Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip

Overview

General Information

Sample URL:https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip
Analysis ID:1668203
Infos:

Detection

Score:52
Range:0 - 100
Confidence:100%

Signatures

Found suspicious ZIP file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Drops PE files
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • cmd.exe (PID: 7068 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 3576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • wget.exe (PID: 5576 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • 7za.exe (PID: 1004 cmdline: 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\te250414.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)
    • conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • notepad.exe (PID: 2888 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\extract\readme.txt MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5044, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, ProcessId: 7068, ProcessName: cmd.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5044, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, ProcessId: 7068, ProcessName: cmd.exe
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5044, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1, ProcessId: 7068, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • Compliance
  • • Networking
  • • Key, Mouse, Clipboard, Microphone and Screen Capturing
  • • System Summary
  • • Data Obfuscation
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion
  • • HIPS / PFW / Operating System Protection Evasion
  • • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme.txtJump to behavior
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme_jp.txtJump to behavior
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme_ko.txtJump to behavior
Source: unknownHTTPS traffic detected: 140.82.112.3:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: Binary string: C:\cpp\TE\Debug\lib\te32.pdb source: te32.dll.3.dr
Source: Binary string: C:\cpp\TE\Debug\lib\te64.pdb source: te64.dll.3.dr
Source: Binary string: C:\cpp\TE\Debug\TE32.pdb source: TE32.exe.3.dr
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: github.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-420f-aab2-644de7b6ef73?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250418%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250418T064447Z&X-Amz-Expires=300&X-Amz-Signature=6d9d7d4782bd7ab4786aa3cf67e4d7c59e3effb62e68b8d2f43088f655331433&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dte250414.zip&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: objects.githubusercontent.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: github.com
Source: global trafficDNS traffic detected: DNS query: objects.githubusercontent.com
Source: ui.js.3.drString found in binary or memory: http://tablacus.github.io/TablacusExplorerAddons/te/
Source: sync.js0.3.drString found in binary or memory: http://tablacus.github.io/TablacusExplorerAddons/te/releases.json
Source: options.html0.3.drString found in binary or memory: http://www.7-zip.org/
Source: options.html.3.drString found in binary or memory: http://www.gnu.org/software/wget/
Source: notepad.exe, 00000005.00000002.2379840814.000002044B43E000.00000004.00000020.00020000.00000000.sdmp, readme_jp.txt.3.dr, readme_ko.txt.3.dr, readme.txt.3.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: sync.js0.3.drString found in binary or memory: https://api.github.com/repos/tablacus/TablacusExplorer/releases/latest
Source: options.html.3.drString found in binary or memory: https://curl.haxx.se/
Source: notepad.exe, 00000005.00000002.2379840814.000002044B43E000.00000004.00000020.00020000.00000000.sdmp, readme_jp.txt.3.dr, readme_ko.txt.3.dr, readme.txt.3.drString found in binary or memory: https://github.com/tablacus/TablacusExplorer
Source: wget.exe, 00000002.00000002.1142555489.0000000000A28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414
Source: wget.exe, 00000002.00000002.1142450646.0000000000160000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1142279217.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.1142685566.0000000002BAD000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip
Source: wget.exe, 00000002.00000002.1142629230.00000000010B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zipData
Source: wget.exe, 00000002.00000002.1142629230.00000000010B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zipSOR
Source: notepad.exe, 00000005.00000002.2379840814.000002044B43E000.00000004.00000020.00020000.00000000.sdmp, readme_jp.txt.3.dr, readme_ko.txt.3.dr, readme.txt.3.drString found in binary or memory: https://github.com/tablacus/TablacusExplorer/wiki
Source: cmdline.out.0.drString found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-
Source: config.xml.3.dr, config.xml6.3.dr, options.js0.3.dr, config.xml10.3.dr, config.xml15.3.dr, config.xml12.3.dr, config.xml9.3.dr, config.xml5.3.dr, config.xml11.3.dr, config.xml2.3.dr, config.xml1.3.dr, config.xml17.3.dr, config.xml14.3.dr, config.xml7.3.dr, config.xml13.3.dr, config.xml8.3.dr, config.xml4.3.dr, config.xml16.3.dr, config.xml0.3.dr, config.xml3.3.drString found in binary or memory: https://tablacus.github.io/TablacusExplorerAddons/
Source: readme_jp.txt.3.drString found in binary or memory: https://tablacus.github.io/explorer.html
Source: notepad.exe, 00000005.00000002.2379840814.000002044B43E000.00000004.00000020.00020000.00000000.sdmp, options.js0.3.dr, readme_ko.txt.3.dr, readme.txt.3.drString found in binary or memory: https://tablacus.github.io/explorer_en.html
Source: sr_lat.xml.3.drString found in binary or memory: https://www.mikroknjiga.rs/pub/rmk/index.php
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownHTTPS traffic detected: 140.82.112.3:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: te32.dll.3.drBinary or memory string: RegisterRawInputDevicesmemstr_bbd193ea-3

System Summary

barindex
Source: te250414.zip.2.drZip Entry: addons/aboutblank/script.js
Source: te250414.zip.2.drZip Entry: addons/aboutblank/sync.js
Source: te250414.zip.2.drZip Entry: addons/addressbar/script.js
Source: te250414.zip.2.drZip Entry: addons/addressbar/sync.js
Source: te250414.zip.2.drZip Entry: addons/back/script.js
Source: te250414.zip.2.drZip Entry: addons/download/script.js
Source: te250414.zip.2.drZip Entry: addons/download/sync.js
Source: te250414.zip.2.drZip Entry: addons/extract/options.js
Source: te250414.zip.2.drZip Entry: addons/extract/script.js
Source: te250414.zip.2.drZip Entry: addons/extract/sync.js
Source: te250414.zip.2.drZip Entry: addons/filterbar/script.js
Source: te250414.zip.2.drZip Entry: addons/forward/script.js
Source: te250414.zip.2.drZip Entry: addons/key/options.js
Source: te250414.zip.2.drZip Entry: addons/key/script.js
Source: te250414.zip.2.drZip Entry: addons/key/sync.js
Source: te250414.zip.2.drZip Entry: addons/mainmenu/script.js
Source: te250414.zip.2.drZip Entry: addons/mainmenu/sync.js
Source: te250414.zip.2.drZip Entry: addons/mouse/options.js
Source: te250414.zip.2.drZip Entry: addons/mouse/script.js
Source: te250414.zip.2.drZip Entry: addons/mouse/sync.js
Source: te250414.zip.2.drZip Entry: addons/multithread/script.js
Source: te250414.zip.2.drZip Entry: addons/multithread/sync.js
Source: te250414.zip.2.drZip Entry: addons/remember/script.js
Source: te250414.zip.2.drZip Entry: addons/remember/sync.js
Source: te250414.zip.2.drZip Entry: addons/segoeicons/script.js
Source: te250414.zip.2.drZip Entry: addons/segoeicons/sync.js
Source: te250414.zip.2.drZip Entry: addons/tabplus/options.js
Source: te250414.zip.2.drZip Entry: addons/tabplus/script.js
Source: te250414.zip.2.drZip Entry: addons/tabplus/sync.js
Source: te250414.zip.2.drZip Entry: addons/titlebar/script.js
Source: te250414.zip.2.drZip Entry: addons/toolbar/options.js
Source: te250414.zip.2.drZip Entry: addons/toolbar/script.js
Source: te250414.zip.2.drZip Entry: addons/toolbar/sync.js
Source: te250414.zip.2.drZip Entry: addons/treeview/script.js
Source: te250414.zip.2.drZip Entry: addons/treeview/sync.js
Source: te250414.zip.2.drZip Entry: addons/undoclosetab/script.js
Source: te250414.zip.2.drZip Entry: addons/undoclosetab/sync.js
Source: te250414.zip.2.drZip Entry: addons/up/script.js
Source: te250414.zip.2.drZip Entry: script/background.js
Source: te250414.zip.2.drZip Entry: script/common.js
Source: te250414.zip.2.drZip Entry: script/consts.js
Source: te250414.zip.2.drZip Entry: script/index.js
Source: te250414.zip.2.drZip Entry: script/options.js
Source: te250414.zip.2.drZip Entry: script/sync.js
Source: te250414.zip.2.drZip Entry: script/sync1.js
Source: te250414.zip.2.drZip Entry: script/syncb.js
Source: te250414.zip.2.drZip Entry: script/threads.js
Source: te250414.zip.2.drZip Entry: script/ui.js
Source: te250414.zip.2.drZip Entry: script/update.js
Source: classification engineClassification label: mal52.win@7/131@2/2
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip"
Source: unknownProcess created: C:\Windows\SysWOW64\7za.exe 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\te250414.zip"
Source: C:\Windows\SysWOW64\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\extract\readme.txt
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Windows\SysWOW64\7za.exeSection loaded: 7z.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Binary string: C:\cpp\TE\Debug\lib\te32.pdb source: te32.dll.3.dr
Source: Binary string: C:\cpp\TE\Debug\lib\te64.pdb source: te64.dll.3.dr
Source: Binary string: C:\cpp\TE\Debug\TE32.pdb source: TE32.exe.3.dr
Source: te64.dll.3.drStatic PE information: section name: .gxfg
Source: te64.dll.3.drStatic PE information: section name: .gehcont
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\lib\tewv64.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\lib\tewv32.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\TE32.exeJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\lib\te32.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\lib\te64.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\TE64.exeJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme.txtJump to behavior
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme_jp.txtJump to behavior
Source: C:\Windows\SysWOW64\7za.exeFile created: C:\Users\user\Desktop\extract\readme_ko.txtJump to behavior
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\lib\tewv64.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\lib\tewv32.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\lib\te32.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\TE32.exeJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\lib\te64.dllJump to dropped file
Source: C:\Windows\SysWOW64\7za.exeDropped PE file which has not been started: C:\Users\user\Desktop\extract\TE64.exeJump to dropped file
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: wget.exe, 00000002.00000002.1142555489.0000000000A28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/tablacus/tablacusexplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/tablacus/tablacusexplorer/releases/download/25.4.14/te250414.zip"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/tablacus/tablacusexplorer/releases/download/25.4.14/te250414.zip" Jump to behavior
Source: C:\Windows\SysWOW64\wget.exeQueries volume information: C:\Users\user\Desktop\download VolumeInformationJump to behavior
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Users\user\Desktop\extract\readme.txt VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1668203 URL: https://github.com/tablacus... Startdate: 18/04/2025 Architecture: WINDOWS Score: 52 33 objects.githubusercontent.com 2->33 35 github.com 2->35 37 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->37 39 Found suspicious ZIP file 2->39 41 Sigma detected: Invoke-Obfuscation VAR+ Launcher 2->41 7 7za.exe 181 2->7         started        10 cmd.exe 2 2->10         started        12 notepad.exe 2->12         started        signatures3 process4 file5 21 C:\Users\user\Desktop\extract\...\tewv64.dll, PE32+ 7->21 dropped 23 C:\Users\user\Desktop\extract\...\tewv32.dll, PE32 7->23 dropped 25 C:\Users\user\Desktop\extract\lib\te64.dll, PE32+ 7->25 dropped 27 3 other files (none is malicious) 7->27 dropped 14 conhost.exe 7->14         started        16 wget.exe 2 10->16         started        19 conhost.exe 10->19         started        process6 dnsIp7 29 github.com 140.82.112.3, 443, 49711 GITHUBUS United States 16->29 31 objects.githubusercontent.com 185.199.109.133, 443, 49712 FASTLYUS Netherlands 16->31

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip0%Avira URL Cloudsafe

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Desktop\extract\TE32.exe0%ReversingLabs
C:\Users\user\Desktop\extract\TE64.exe0%ReversingLabs
C:\Users\user\Desktop\extract\lib\te32.dll0%ReversingLabs
C:\Users\user\Desktop\extract\lib\te64.dll0%ReversingLabs
C:\Users\user\Desktop\extract\lib\tewv32.dll0%ReversingLabs
C:\Users\user\Desktop\extract\lib\tewv64.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://www.mikroknjiga.rs/pub/rmk/index.php0%Avira URL Cloudsafe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
github.com
140.82.112.3
truefalse
    		high
    objects.githubusercontent.com
    		185.199.109.133
    		truefalse
      		high
      NameSourceMaliciousAntivirus DetectionReputation
      http://www.opensource.org/licenses/mit-license.phpnotepad.exe, 00000005.00000002.2379840814.000002044B43E000.00000004.00000020.00020000.00000000.sdmp, readme_jp.txt.3.dr, readme_ko.txt.3.dr, readme.txt.3.drfalse
        		high
        http://www.7-zip.org/options.html0.3.drfalse
          		high
          https://www.mikroknjiga.rs/pub/rmk/index.phpsr_lat.xml.3.drfalse
          • Avira URL Cloud: safe
          		unknown
          https://objects.githubusercontent.com/github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-cmdline.out.0.drfalse
            		high
            http://www.gnu.org/software/wget/options.html.3.drfalse
              		high
              https://curl.haxx.se/options.html.3.drfalse
                		high

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                140.82.112.3
                		github.comUnited States
                		36459GITHUBUSfalse
                185.199.109.133
                		objects.githubusercontent.comNetherlands
                		54113FASTLYUSfalse

                General Information

                Joe Sandbox version:42.0.0 Malachite
                Analysis ID:1668203
                Start date and time:2025-04-18 08:43:54 +02:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 4m 2s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:urldownload.jbs
                Sample URL:https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:16
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal52.win@7/131@2/2
                • Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 184.28.213.193, 4.245.163.56
                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
                • Not all processes where analyzed, report is missing behavior information
                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                • VT rate limit hit for: https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip

                Simulations

                Behavior and APIs

                ⊘No simulations

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Users\user\Desktop\cmdline.out

                Download File
                Process:C:\Windows\SysWOW64\cmd.exe
                File Type:ASCII text, with very long lines (533), with CRLF line terminators
                Category:modified
                Size (bytes):3325
                Entropy (8bit):4.5666265593603015
                Encrypted:false
                SSDEEP:48:g+I4rL9ABrL9AoDtD76Sbtg0yoCO1PSKbx:y3
                MD5:D989661EC17CD03E610C03735816B7F2
                SHA1:1FA4B1A8C76F306F23FDCF9BD4D82E89BF665759
                SHA-256:183EE9A79FF123C9D1991AF0848C1757357623394869E11D8843A874F1DDC963
                SHA-512:292DB4264BDF46741BB13F2F27A000261CA76AD63C4CC4E5F11F85F0E4D58E2AD23A8388FF28E044CAB08E03BDD158F912C256709B6196ADFE2565C80F469816
                Malicious:false
                Reputation:low
                Preview:--2025-04-18 02:44:46-- https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip..Resolving github.com (github.com)... 140.82.112.3..Connecting to github.com (github.com)|140.82.112.3|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-420f-aab2-644de7b6ef73?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250418%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250418T064447Z&X-Amz-Expires=300&X-Amz-Signature=6d9d7d4782bd7ab4786aa3cf67e4d7c59e3effb62e68b8d2f43088f655331433&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dte250414.zip&response-content-type=application%2Foctet-stream [following]..--2025-04-18 02:44:46-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-420f-aab2-644de7b6ef73?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Am

                C:\Users\user\Desktop\download\te250414.zip

                Download File
                Process:C:\Windows\SysWOW64\wget.exe
                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                Category:dropped
                Size (bytes):964974
                Entropy (8bit):7.988548426568693
                Encrypted:false
                SSDEEP:24576:fcEo9GDyUvCsmQAyWHmOK6XjkFyC54TMH7PG:nfDyWNmQpOK6X3C5dHTG
                MD5:FA8877E1DF646EBE3FADF9E42BAEFF24
                SHA1:168B6F925E9D2FB14BBE096EAA3E57FE03D32FA3
                SHA-256:7FB69741364BC5FEF41B056792A6C5FF435463B55681988F17AD42AFEF6D85F0
                SHA-512:05D02AED1E5335CD933E5C82D58402868F74F24893BC07AEC1F20483EC1D37839BE74AE8CC0827A55DB820CC20DDE0CAC6B8B970690404A0561D2D3F2EC4390B
                Malicious:false
                Reputation:low
                Preview:PK........2.{X................addons/PK........`.dW................addons/aboutblank/PK........u.;Tg..#4...E.......addons/aboutblank/config.xmlm.QJ.1........(B..j.(....g.c7v....oZ....o..D.=M).[..4".a.....`,.\.u.sQ.&.....).".b&.IW.P|5....j.=..'..(X..u..z\Y'ma..Y....'...X...a.^..&.s.y.`....$L.yG.k.....a.g.U......4Y......o.....a.kn.)..xo7f.Fp.e.....w.}qF|+.j.J1 .k.f..T...By..+N.7.`..d.L37...S........x.0.}....C.2."_/..........[.....PK...........R8.y.h...t.......addons/aboutblank/script.jsK..+.QpLI...LQ.UPJL./-I.I..V....LS.(..K./..+R..U0.T....T...-./*.N..,(.PJ.....()h...2.bb.+.....4....r..PK..........;T...SW...n.......addons/aboutblank/sync.js.T]..@.}...0..@.........K....1di.......x......E}j3;.g..@.....RL.!..fr.g1.K.......N.N..[.H.?_...<..7."w.x...Z`..C...d..l..7...f.... Y+.X.....:Euf......6.*]u.D.c....4...m...L%E..........).s....@.V(#0..).........*f.>...,....g.?..FM..y..j....#...\....9W.....h...P....K.6,...1..ja......1..-....K.Z.PgB....CL'..y....#.^.....v&

                C:\Users\user\Desktop\extract\TE32.exe

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                Category:dropped
                Size (bytes):10752
                Entropy (8bit):4.2437298333885405
                Encrypted:false
                SSDEEP:96:TNPBQ6GPxrSxNOAGzfAgP++6gtyWgj4oiFiOgtwWsUzwKdHZr4Kywrwv:ZWPxuxNOAGzfd/tyjbifjuw
                MD5:3C1FB1E240E957E47B9ACE114D9F6F6B
                SHA1:2D561631BAC0AB41A1B58692A7E5DCBC3D506D4D
                SHA-256:F7D4D2FAA3A102D077369F64BF4DB097270AA9B882B9BC0114D1CB4AAF5EA156
                SHA-512:4305CA9912A2B90B31F2FCB675E72CC42D0C452771FF3C33BF0FD777B46D53233F636429CE1549945AD6F4B33EDD0D1ABE790187F3499BA4553C700049075661
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6O.eO.eO.et..dN.et..dI.eF.)eJ.eO.e[.e...dH.e..EeN.eO.-eN.e...dN.eRichO.e........PE..L......g.....................$............... ....@..........................p............@..................................#..<....@.......................`..`... !..T...........................x!..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data...$....0......................@....rsrc........@......................@..@.reloc..`....`.......(..............@..B........................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\Desktop\extract\TE64.exe

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):11776
                Entropy (8bit):4.518489184051485
                Encrypted:false
                SSDEEP:96:jsHnX3ubdIj8T04fE5JDxA9SW83M7egP++6gtyWgj4oizygtTsUzwKdHZr4Kywr:jyX34dI34M/DxA9SW83MX/tyjbi2ju
                MD5:98D9BC9CB906420E2AB36DA773A06B9B
                SHA1:E040A093AE91E3E4151FB07E644F5E6BE4ED4992
                SHA-256:06E4802A9A719A76E3A4407302A431AF3AD485A6D5FE0830B3033AF3E441A212
                SHA-512:BA5D4DBA2A0F9983BFF8A9F9750385415CFF0F83E2B1077074B3663603BF6DB39F2AE609FB81B235D3D85017F140000EAC6CD7D4F7E90B2164D2D17EEBA8EE42
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..{...{...{.......{.......{.......{...z...{.......{.......{.......{.Rich..{.........................PE..d....c.g.........."..........$.................@.....................................*....@.................................................("..<....P.......@..l............p....................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data........0......................@....pdata..l....@......................@..@.rsrc........P......................@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................

                C:\Users\user\Desktop\extract\addons\aboutblank\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):581
                Entropy (8bit):5.131764493140162
                Encrypted:false
                SSDEEP:12:beyLJFS/zFynSmnvX6VqfOzWTWLL0o2UOGXq7f8S3eglen:/czwnCVC6hOGaLx6
                MD5:D01F96DA0703463C41A50F4615736DDA
                SHA1:B1707C17D8EA7EB49188536AE5F2AA3E51F60F50
                SHA-256:DD3DE2256F407D97039A2322835712731EA1678FEA9D90BB621A5A7F9D53D1BA
                SHA-512:FA7A26A6B3D7D7335EEAA0DA2AB0A25A557A3C7401506ABBAE8595CFBC0AADD2802EE29A45BB9918DE872473A07833016B6993BBB7F1E38761378CB8DA059295
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.04</Version>.. <MinVersion>2022.1.25</MinVersion>.. <pubDate>Thu, 27 Jan 2022 00:00:00 GMT</pubDate>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Blank page</Name>.. <Description>Blank page</Description>.. </en>.. <fr>.. <Name>Page blanche</Name>.. </fr>.. <ja>.. <Name>.....</Name>.. </ja>.. <zh>.. <Name>....</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\aboutblank\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):116
                Entropy (8bit):4.863224890600287
                Encrypted:false
                SSDEEP:3:9luJiDyMDvLDjF34LJVMbMJo8ickB8L6hWAfLy:yUyMzLDjhGIyk6LdAfe
                MD5:9719414EFDBDE1A45006F226D87818D6
                SHA1:386AC9234C4738A3C58CEB73F91A9C917ABE944B
                SHA-256:88DD76F6A6EED14C8DB95DBB938A8CD441D994C200AB54A6624AA958C3D57505
                SHA-512:F524495C258E7EACFDB9F8CDE1FC5274A15B92ACFFC8D6E99D737B6DDDF4BA65B9E686C5FC9EBE4EABF82FE921F7EA65DC7089301294ED85B43917CBCE76E580
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "aboutblank";..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..}..

                C:\Users\user\Desktop\extract\addons\aboutblank\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2158
                Entropy (8bit):5.41942342474138
                Encrypted:false
                SSDEEP:48:yMn2JS/GB2URB9HD2Vg7bUK8JCYG/2ojl/ZavXWlXWczSgSfsQuA4X4Yw3iv:yMn2JYkT9j2e0T82kl/ZavXCX/2FfZ4L
                MD5:0F251B8104BDCED093720B58E1CE9762
                SHA1:9783586F3A08BAE3D747A959BF12449F570C2505
                SHA-256:FA5089BC5B006C1F30994F5B3DB932CA1C7E7C68BDE190B89814F3212C86172C
                SHA-512:40F4C302C7197A432847B2D86B44F7DBF168DE90E979EC926FFB08A2D462F193C4400E7360AD069578E36DB761F922A743D7772716070BA33F29FBE40A2677B3
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "aboutblank";....Sync.AboutBlank = {...dir: [ssfDRIVES, "shell:downloads", ssfPERSONAL, "shell:my music", "shell:my pictures", "shell:my video"],.....IsHandle: function (Ctrl) {....return SameText("string" === typeof Ctrl ? Ctrl : api.GetDisplayNameOf(Ctrl, SHGDN_FORADDRESSBAR | SHGDN_FORPARSING), "about:blank");...},.....ProcessMenu: function (Ctrl, hMenu, nPos, Selected, item, ContextMenu) {....const FV = GetFolderView(Ctrl);....if (Sync.AboutBlank.IsHandle(FV)) {.....RemoveCommand(hMenu, ContextMenu, "delete;rename");....}....return nPos;...}..}....AddEvent("TranslatePath", function (Ctrl, Path) {...if (Sync.AboutBlank.IsHandle(Path)) {....Ctrl.Enum = function (pid, Ctrl, fncb) {.....const Items = api.CreateObject("FolderItems");.....for (let i = 0; i < Sync.AboutBlank.dir.length; ++i) {......Items.AddItem(Sync.AboutBlank.dir[i]);.....}.....for (const e = api.CreateObject("Enum", fso.Drives); !e.atEnd(); e.moveNext()) {......Items.AddItem(e.item().Path);.....}.....r

                C:\Users\user\Desktop\extract\addons\addressbar\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):828
                Entropy (8bit):5.352098095315068
                Encrypted:false
                SSDEEP:24:M3zxCngVuVC6dAYOwOG5AsHS7CSkWt3/dB:mxOAuc2O7G6mSOlW3j
                MD5:B4326BEE9FE8098D9EC3F7A22B32FCBA
                SHA1:EB967AAE120F23948AE9306A7E60C30794AFEBE3
                SHA-256:60FE3C57F145F692C84077CD6F1E80BA22DB2E940EC4ED0EA94CFDDF5EC8B4DA
                SHA-512:5BE508126DBD2946A17F3AC6CA2F42CCAB2FF7BA236B86D70A18A071AB1E95A6E04933E99900D337D061E563DEDE96DF7B3E5EA55CE2B1C75750448A0F24FAC9
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.75</Version>.. <MinVersion>2024.8.6</MinVersion>.. <pubDate>Mon, 09 Dec 2024 00:00:00 GMT</pubDate>.. <Options>Common:0,6,7,8,9:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Address bar</Name>.. <Description>Breadcrumbs and XP style is available.</Description>.. </en>.. <fr>.. <Name>Barre d'adresse</Name>.. <Description>Les styles "XP" et "Fil d'Ariane" sont disponibles.</Description>.. </fr>.. <ja>.. <Name>......</Name>.. <Description>........XP..........</Description>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\addressbar\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):229
                Entropy (8bit):4.8266091418711525
                Encrypted:false
                SSDEEP:6:+KqGuQcbxKuu5Lo/P72DuY6dq3GWNidqYqLrIALRaJUMvP:SGujxgVSTbo3GQNXKvP
                MD5:23DC2E87BECB1DC36A6855A4A6E3E252
                SHA1:A2AE745659BF0F8AC31B72CFE8484788BE03C5A7
                SHA-256:4820CC115E624E5B6B23BB738648D84EF2331852CD8D6A6735A9FE1F521087F9
                SHA-512:3A53DC33E92DF21448EE00B4990C62D87C6D8A7C299552A0ED0BACACADEE33B2609337FB254D0828236D0A009216660F582D4BBA569B7081A58229041972C1CD
                Malicious:false
                Reputation:low
                Preview:<label><input type="checkbox" id="XP">XP<i> </i>Style</label><br>..<br>..<label>Width</label><br>..<input type="text" name="Width" size="10">..<input type="button" value="Auto" onclick="document.F.Width.value=''"><br>..</table>..

                C:\Users\user\Desktop\extract\addons\addressbar\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (484), with CRLF line terminators
                Category:dropped
                Size (bytes):15269
                Entropy (8bit):5.378414034862963
                Encrypted:false
                SSDEEP:384:2TwTHxDvevGycEiQi/7Tj+jcTWTKTThfytPYTxM5Y1g:0miG/5tvjPTUITtImwT
                MD5:FF5F86FABD9630A734FEA84552A55E03
                SHA1:73CF4E01A6933A540B1DBCE6CE234C389C295BF9
                SHA-256:982861B1BB23001BAC48CAACB39D2D1BA51D7FFD65BB7C518383E65252A15143
                SHA-512:9C16968F616DE4CA587C1CFD847182AB7E5DBBB07659887C961A84662F7E93167CD7D0C2AE98984DD55DB80A845DD732E5E75EB1FB62FC4A04F2051826AD4CEB
                Malicious:false
                Reputation:low
                Preview:.const Addon_Id = "addressbar";..const Default = "ToolBar2Center";..const item = GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("Menu", "Edit");...item.setAttribute("MenuPos", -1);.....item.setAttribute("KeyExec", 1);...item.setAttribute("KeyOn", "All");...item.setAttribute("Key", "Alt+D");..}....if (window.Addon == 1) {...Addons.AddressBar = {....Item: null,....bLoop: false,....nLevel: 0,....bClose: false,....XP: item.getAttribute("XP"),....nPos: 0,....nWidth: 0,......KeyDown: function (ev, o) {.....if (ev.keyCode ? ev.keyCode == VK_RETURN : /^Enter/i.test(ev.key)) {......setTimeout(async function (o, str) {.......let uri = str.trim().replace(/\//g, "\\");.........if (await fso.FileExists(uri)) {........let pos = uri.lastIndexOf("\\");........uri = uri.slice(0, pos).......}.........if (await fso.FolderExists(uri)) {........// If it is a file or folder path, navigate to the folder.........Navigate(uri, SBSP_NEWBROWSER);.......} else if (uri == o.valu

                C:\Users\user\Desktop\extract\addons\addressbar\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2849
                Entropy (8bit):5.36825823133962
                Encrypted:false
                SSDEEP:48:kmJClLXfE4i8C6onGHwhjlHj1BXcOj1BRNfPonPcZ+SIn1pgM1BRNfPonwcZ+41Z:e5fE4IrZlDrHtNfY0s0MtNfYJdkKL
                MD5:0452AF99F631620B07B765A523E9D3CF
                SHA1:7289E72B4EB4647BCA680D904338A71ED2AC617E
                SHA-256:C7ECEA8A2D682A6E9A81CE51E93A1E073C3BBF5361EE284E94A1D84C21C0AA38
                SHA-512:2735275BD0C865262EEDF143A96C9182B446F1361BB9A2C78FBFC7BDC444A73DED32813D34B849B79E60E22BB2E673A941A8037236AEE15116FCE454744933F4
                Malicious:false
                Reputation:low
                Preview:Sync.AddressBar = {...GetPath: function (n) {....let FolderItem = 0;....const FV = te.Ctrl(CTRL_FV);....if (FV) {.....for (FolderItem = FV.FolderItem; n > 0; n--) {......FolderItem = api.ILGetParent(FolderItem);.....}....}....return FolderItem;...},.....SplitPath: function (FolderItem) {....const Items = [];....let n = 0;....do {.....Items.push({......next: n || api.GetAttributesOf(FolderItem, SFGAO_HASSUBFOLDER),......name: GetFolderItemName(FolderItem).....});.....FolderItem = api.ILGetParent(FolderItem);.....n++;....} while (!api.ILIsEmpty(FolderItem) && n < 99);....return JSON.stringify(Items);...}..};....AddEvent("MouseMessage", function (Ctrl, hwnd, msg, mouseData, pt, wHitTestCode, dwExtraInfo) {...if (msg == WM_MOUSEMOVE && Ctrl.Type == CTRL_TE && Common.AddressBar.rcItem) {....const Ctrl2 = te.CtrlFromPoint(pt);....if (Ctrl2 && Ctrl2.Type == CTRL_WB) {.....const ptc = pt.Clone();.....api.ScreenToClient(WebBrowser.hwnd, ptc);.....for (let i = Common.AddressBar.rcItem.length; i-

                C:\Users\user\Desktop\extract\addons\back\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):730
                Entropy (8bit):5.153032297220684
                Encrypted:false
                SSDEEP:12:TMHd32eyLupS/zFH+FSbnv4F1X6VqfOzWTWLL0oJ2qOGXdvPdSgNfk8Henklen:2dVQz1HngGVC6x/OG9FLfkV5
                MD5:0F92D497F1AE2619727957784CA44BF0
                SHA1:BB19D57EB04CFC7534FD039DA0163303E33036B4
                SHA-256:E2941291E852A914E5A4B7FD4790EE176ED14DA4542D8C0774B8086515B851ED
                SHA-512:BDBA9B35B8965CA54606BDCD338654D42ACE0EA4EB1C9E0F1FFDB2FE21712E43888CBBC8C84E58C9F92A40322FB8348B475ED0E7742BF10FD9DAD400F4AAF4AC
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.18</Version>.. <MinVersion>2021.3.26</MinVersion>.. <pubDate>Tue, 17 Aug 2021 00:00:00 GMT</pubDate>.. <Options>Common:5,6:5</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Back</Name>.. <Description>Back</Description>.. </en>.. <fr>.. <Name>Reculer - global</Name>.. <Description>Place le bouton "Reculer" dans la barre d'outils principale</Description>.. </fr>.. <ja>.. <Name>..</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\back\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2017
                Entropy (8bit):5.3926608480735885
                Encrypted:false
                SSDEEP:48:tEfcwTO9YTGCPq8wSF1RjhWf+7T4XAL8Ii6cv+zgCEsL/bhwLLN:mcwTO9YTnq8DLqD2cv+sCTzbSLLN
                MD5:FFAB1894E122E29DDC9570AF0C515CF4
                SHA1:7E55FEAD9B93BF2502FE3A6E151FB3959BC4CF74
                SHA-256:04BF415CB7DE76094693EF5BA68450D13624C898A3C989F32783250B8182F23E
                SHA-512:5BB36F16071565951C37B884A9D45455F6FB7DC8FCC44A6716DF7721FFD6AA7882DEF129C3B18DD5983F1955E8655AE6087304566E9B0753ADC5E96CD951E4C0
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "back";..const Default = "ToolBar2Left";..if (window.Addon == 1) {...Addons.Back = {....Exec: function (Ctrl, pt) {.....Exec(Ctrl, "Back", "Tabs", 0, pt);....},......ExecEx: async function (el) {.....Exec(await GetFolderView(el), "Back", "Tabs", 0);....},......Popup: async function (el) {.....const FV = await te.Ctrl(CTRL_FV);.....if (FV) {......const Log = await FV.History;......const hMenu = await api.CreatePopupMenu();......const mii = await api.Memory("MENUITEMINFO");......mii.fMask = MIIM_ID | MIIM_STRING | MIIM_BITMAP;......const nCount = await Log.Count;......for (let i = await Log.Index + 1; i < nCount; i++) {.......const FolderItem = await Log[i];.......AddMenuIconFolderItem(mii, FolderItem);.......mii.dwTypeData = await FolderItem.Name;.......mii.wID = i;.......await api.InsertMenuItem(hMenu, MAXINT, false, mii);......}......const pt = GetPos(el, 9);......const nVerb = await api.TrackPopupMenuEx(hMenu, TPM_LEFTALIGN | TPM_LEFTBUTTON | TPM_RIGHTBUTTON | TPM_RE

                C:\Users\user\Desktop\extract\addons\download\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):609
                Entropy (8bit):5.115241073381031
                Encrypted:false
                SSDEEP:12:beyLbS/zFMSc+Snv4FX6VqfOzWTWLL0o+qZOGXu1jv8OJZVemlen:4zAbnggVC6tOGeL/G
                MD5:C2FDB3D814B5490416A85AE9DEA00C13
                SHA1:22842DDA390E8800E6094E982C0D203E4F433666
                SHA-256:E686132BF45C14E63A07202D48818A45CBCCE97853D0500ECA8160CF58A86E3E
                SHA-512:847B94DCC9E5D95CBC1EE3344A1556B07E78B9FF37017502625322F91F082EAEFAE8C8E5466D5025F8535CBBC62388D772DE5E5F696EBF9977A4B47B56AFBF1E
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.08</Version>.. <MinVersion>2022.3.7</MinVersion>.. <pubDate>Wed, 09 Mar 2022 00:00:00 GMT</pubDate>.. <Options>Common:0:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Download</Name>.. <Description>Download</Description>.. </en>.. <fr>.. <Name>T.l.charger</Name>.. </fr>.. <ja>.. <Name>......</Name>.. </ja>.. <zh>.. <Name>..</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\download\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1435
                Entropy (8bit):4.984446822124746
                Encrypted:false
                SSDEEP:24:Laq5hqAtMzGOPvi1sxHPvig8iadZF/i18v0qfi1uDd+kmilf:GcqAKPviOHPvilii/iCfieZmilf
                MD5:434BC115B10134695019A551A5BDAF75
                SHA1:E9207A0352A9D6906527ACE9D36BA5B4341A6BEF
                SHA-256:60B074839268B2BD2547611E19D5112612044CEF92E4169947FF2186864D3DAE
                SHA-512:1588277372393A46086F8563E6FCB3866A8D709770CAB8501308DFC13748C3CD8BF8A643FCF29E4E9E346FEC13236BB6339F3ED39DE3FD16D6743C6D5C8D8F4D
                Malicious:false
                Reputation:low
                Preview:<div class="panel" style="display: block;">.. <textarea type="text" id="Path" style="width: 100%; height: 9em"></textarea>.. <table>.. <tr>.. <td>.. <button onclick="RefX('Path', false, this)">Browse...</button>.. </td>.. <td>.. <button onclick="PortableX('Path')">Portable</button>.. </td>.. <td>.. &nbsp;.. </td>.. <td>.. <button title='powershell Invoke-WebRequest -Uri "%url%" -OutFile "%file%"' onclick="SetDL(this)">PowerShell</button>.. </td>.. <td>.. <button title='powershell [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri "%url%" -OutFile "%file%"'.. onclick="SetDL(this)">PowerShell (TLS1.2)</button>.. </td>.. <td>.. <button title='cURL "%url%" -o "%file%" -L' onclick="SetDL(this)">cURL</button>.. </td>.. <td>.. <button title='wget "%url%" -O "%file%"' onclick="SetDL(this)">Wget</button>.. </td>

                C:\Users\user\Desktop\extract\addons\download\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):498
                Entropy (8bit):5.202713040198776
                Encrypted:false
                SSDEEP:12:mTDEKprZyLA2JnE+DRRIMzcCT5i+hiLryqRNQdsyZ9:SEK9MJZRRIMzcMigiLqdV9
                MD5:E3D3F2D2E367D6566B5518006BB1AA39
                SHA1:D1AF5D7C21F571C9C35FB85939E5C5F34663D50A
                SHA-256:4B5001159ECEF745FFE8F68F0F743FCB61D04779E4CA233DEADEE9B67E8C4962
                SHA-512:897BB5B6575D025115089A8126213DE912CA5761C9305F26F2D61C32108B6CB49E0DDE569F74F661B8350EBE825829941ACB36A864EB12C43B6CE177671AA0A5
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = 'download';..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...SetTabContents(0, "", await ReadTextFile("addons\\" + Addon_Id + "\\options.html"));...const el = document.getElementById("_curl");...if (await fso.FileExists(BuildPath(system32, "curl.exe"))) {....el.style.display = "none";...}...SetDL = function (el) {....ConfirmThenExec(el.innerText || GetText("Select"), function () {.....document.F.Path.value = el.title;....});...}..}..

                C:\Users\user\Desktop\extract\addons\download\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1202
                Entropy (8bit):5.3578300963149355
                Encrypted:false
                SSDEEP:24:NYVAhllUAEDt5I9lIKYr1WK2k0+qfZs5DVd/QA8diXWCKfxCACyeC+7V:eKhllUAEDt05kQK2k0eVd9DPQUC+R
                MD5:690BFCB38A178B4EE6431B647F8F36AD
                SHA1:216822F07DCE6D9C3FEBBC5AA0C2AC59368A45E7
                SHA-256:63AC70D1DFA2983B7CB1CC3A3EEBC956B7A9CA12AAE61A5381DBE70934831750
                SHA-512:7F45A228D876DB5F6CEA67B9E81AD38FD79D95502DBBAD33467A08AE13319EFD30461C431A9F11FF569EC5D10F898ABCC5B6FC07E72DB6D245D7E40F2F5ADD0E
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "download";..const item = GetAddonElement(Addon_Id);....Common.Download = {...Path: item.getAttribute("Path"),...Show: GetNum(item.getAttribute("Visible")) ? SW_SHOWNORMAL : SW_HIDE..}..if (Common.Download.Path) {...AddEvent("createHttpRequest", function () {....const o = api.CreateObject("Object");......o.open = function (method, url) {.....o.URL = url;....}......o.send = function () {.....o.fn = GetTempPath(3);.....wsh.Run(ExtractMacro(te, Common.Download.Path.replace(/%url%/ig, o.URL).replace(/%file%/ig, o.fn)), Common.Download.Show, true);.....o.readyState = 4;.....const wfd = api.Memory("WIN32_FIND_DATA");.....const hFind = api.FindFirstFile(o.fn, wfd);.....api.FindClose(hFind);.....o.status = (hFind != INVALID_HANDLE_VALUE) ? wfd.nFileSizeLow ? 200 : 403 : 404;.....if (o.status != 200) {......DeleteItem(o.fn);.....}.....InvokeFunc(o.onload || o.onreadystatechange, [o]);....}......o.get_responseText = function () {.....return ReadTextFile(o.fn);....}......return o

                C:\Users\user\Desktop\extract\addons\extract\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):792
                Entropy (8bit):5.230302086690989
                Encrypted:false
                SSDEEP:12:TMHd32eyLlS/zFHuoS5lSnv4FX6VqfOzWTWLL0oyKMvOGXRJABuVk8jZwhlStoed:2djz1uInggVC6COGqAkgHGjw
                MD5:265B1306065BC9B25D74845DCC0323BE
                SHA1:F394BB994BEF3C8547F4748887625D1BA5F4CF97
                SHA-256:A471FF21ABE2AD66A2C066D4D1E732C5780E3FB69B31295E00FFB73C4CE1EB68
                SHA-512:B7D18308B3E3CA97884DFD347FAD0BADD76F33A9F224C688855B9BF81C6F3D3EC4638AE2F2796764B5F5BCF4920A826B29CE3039D1992DBDB27BA2C64DAC1E56
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.15</Version>.. <MinVersion>2021.3.7</MinVersion>.. <pubDate>Fri, 11 Mar 2022 00:00:00 GMT</pubDate>.. <Options>Common:0:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Extract</Name>.. <Description>Extract the compressed files.</Description>.. </en>.. <fr>.. <Name>Extraire</Name>.. <Description>Extraire le contenu de fichiers compress.s.</Description>.. </fr>.. <ja>.. <Name>..</Name>.. <Description>.........</Description>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\extract\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):570
                Entropy (8bit):4.933168553491683
                Encrypted:false
                SSDEEP:12:okAuc+yfep7egKNTfyfCOySKNTfyfmn9KNTfyfVpkTKNTvlwNwgu:xAtXs8Om5qNwf
                MD5:A09FA46204AEF44003400F911D39CA91
                SHA1:A06FC7C3D9D7626188843C41467CFC88134F068A
                SHA-256:A31B57C56FCE08840388CEF77DB8167240C6CE6640DA4EDD76D87F1EB5BF9B59
                SHA-512:CDD3FA9AACB3C3D5B669D5662BAA530BD0424485378A115DDB21185D2FF992A8B6D31FD9B91A09205B40C00719B05DDC4A2BF3452892BE0DF180B65D49F5C2EF
                Malicious:false
                Reputation:low
                Preview:<input type="text" id="Path" style="width: 100%">..<table>.. <tr>.. <td>.. <button onclick="RefX('Path', false, this)">Browse...</button>.. </td>.. <td>.. <button onclick="SetDefault(document.F.Path, '')">Default</button>.. </td>.. <td>.. <button onclick="PortableX('Path')">Portable</button>.. </td>.. <td>.. <button title="7-Zip\7zG.exe x %src% -o%dest% -aoa" onclick="SetExe(this)">7-Zip</button>.. </td>.. </tr>..</table>..<br>..<button title="http://www.7-zip.org/" onclick="wsh.Run(this.title)">Get 7-Zip...</button>..

                C:\Users\user\Desktop\extract\addons\extract\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):457
                Entropy (8bit):5.239350127775669
                Encrypted:false
                SSDEEP:12:ULA2JQUZP1u5QmNOyX0acDM6MBx6Zye1V:0J7fkY+voM6MBA51V
                MD5:E37A935F935C7BCD4F7BB21795300684
                SHA1:C4495E375E2F0658FBF39E1C129DE43EDE44DE73
                SHA-256:5BD97CF7773DBC6641BA60DE8084DC3A1FC5FCCEA86E7A69BC9FC5B59F4CE4BF
                SHA-512:0F91D71F2A8E1B83D8B2533206F3DCC5E9CEEA635F1B773C123CD6FF22B74FD0ADAC72C4B5FC7904171BE0C3B365246B2E49C515312B78BDB21A1F71BD28A6D6
                Malicious:false
                Reputation:low
                Preview:SetTabContents(0, "", await ReadTextFile("addons\\" + Addon_Id + "\\options.html"));....SetExe = async function (o) {...ConfirmThenExec(o.innerText, async function () {....const ar = o.title.split(" ")....const path = 'C:\\Program Files\\' + ar[0];....const path2 = 'C:\\Program Files (x86)\\' + ar[0];....ar[0] = PathQuoteSpaces(!await fso.FileExists(path) && await fso.FileExists(path2) ? path2 : path);....document.F.Path.value = ar.join(" ");...});..}..

                C:\Users\user\Desktop\extract\addons\extract\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):179
                Entropy (8bit):4.8622249663008
                Encrypted:false
                SSDEEP:3:9wKLDjF34LJVMbMJo8ickB8L6hWAfLFAtko1HbMJo8ickB8L6hVwy:aKLDjhGIyk6LdAfxro1Htyk6LE
                MD5:E37CC3BABB0DCAB277895E14C311E711
                SHA1:AC6640D6DD0DA4124ED44F58D880873CF156BEA3
                SHA-256:A0C5B139580F072D816E04FB713D8274C24C4A8DE84365F75574DF69CFB74ED0
                SHA-512:AC98130F9D72A6C44502824FA8448701727B34E0EC3099398A63356A24A74E579C9D550D4E32DE862296C6BE0213CC6C4FD652CB98C32590EE92684DBB1492C8
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = 'extract';..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...importScript("addons\\" + Addon_Id + "\\options.js");..}..

                C:\Users\user\Desktop\extract\addons\extract\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):611
                Entropy (8bit):5.16895298693708
                Encrypted:false
                SSDEEP:12:aA/VDu/m7l4M4D2j8O/nEkzhsLDvlHph5OtGyEg+mWgGMSwP20m7ZYKfV:jVS84KwYEshsLzlJh5zVgHWgzL2/vfV
                MD5:3D11000A3DFA88ED998B30D000DE82C9
                SHA1:46037F156DC0A23C8A7282F6C594477381C131FE
                SHA-256:030988DD4E1DF247BC62B8C6AB5885C0C91438B9F0E77CA0E23BE75D1B3315B6
                SHA-512:EF616DE808F26E7DD2C0078F8F869679018A1D317C76CFD8C963A88F6D793D244B4C63ADAD2E08C3F95F20BCA4D9940507DD60817D0379B6141A98BF573D5B30
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = 'extract';..const item = GetAddonElement(Addon_Id);....if (Sync.Extract = item.getAttribute("Path")) {...AddEvent("Extract", function (Src, Dest) {....const r = api.CreateProcess(ExtractMacro(te, Sync.Extract.replace(/%src%/i, PathQuoteSpaces(Src)).replace(/%dest%|%dist%/i, PathQuoteSpaces(Dest))), PathUnquoteSpaces(Dest), 0, 0, 0, true);....if ("number" === typeof r) {.....return r;....}....let bWait;....do {.....bWait = false;.....WmiProcess("WHERE ProcessId=" + r.ProcessId, function (item) {......bWait = true;......api.Sleep(500);.....});....} while (bWait);....return S_OK;...});..}..

                C:\Users\user\Desktop\extract\addons\filterbar\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):700
                Entropy (8bit):5.184708377588238
                Encrypted:false
                SSDEEP:12:beyLGOS/zFynSq0nv4/qSybX6VqfOzWTWLL0oduv2OGXJABtR5uF6Rxwk8dIeTFY:83zzngYuVC6VOG5AHxYkgU
                MD5:500AD9EDF5A3B858076CB352FB5FEFE1
                SHA1:E76700130525F47C07FB0D96AEFBBBCB86E62BBF
                SHA-256:C070F606DEB5B049D654202504DBC12AA719620860F97EBF584E529484ED61F5
                SHA-512:45FDFF24059A235F77DDC59E8C50C4367F77D641DCA4BAB0F17427DFBB131A9A76D12F00BB3A54417C24694F3F0DEF4A020D0762EA23C558E5812FCD017252B2
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.39</Version>.. <MinVersion>2022.1.25</MinVersion>.. <pubDate>Sun, 30 Jan 2022 00:00:00 GMT</pubDate>.. <Options>Common:0,5,6,7,8,9:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Filter bar</Name>.. <Description>Filter bar</Description>.. </en>.. <fr>.. <Name>Barre de filtre</Name>.. <Description>Champ d'entr.e de filtre - global.</Description>.. </fr>.. <ja>.. <Name>.......</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\filterbar\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (525), with CRLF line terminators
                Category:dropped
                Size (bytes):6720
                Entropy (8bit):5.359657235080975
                Encrypted:false
                SSDEEP:192:y2rqOceCdrf5HLGUUreeAunnGI0Dz6Dxn1JwXeP4NAe:Fqp5LfvunGI0/60p
                MD5:D4D06AA804241F9A59BAE6F1ACA35FD4
                SHA1:D05C620BADBE135880DEEB168CF10683AAEBE7F8
                SHA-256:BA342163243707FFFB976FAA6F3A5860B4DCB6ADBC44A669A184281F1426EC7F
                SHA-512:AF4896F9BF21ABED7B71452B591B77F0E564E643289513F0D10754E1F7D16ADD97862A41AE6A7A2CAE9E6097568814C16BB9992C502F318A4F6755360B735273
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "filterbar";..const Default = "ToolBar2Right";..let item = GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("MenuPos", -1);.....item.setAttribute("KeyExec", 1);...item.setAttribute("KeyOn", "All");...item.setAttribute("Key", "Ctrl+E");..}....if (window.Addon == 1) {...Addons.FilterBar = {....tid: null,....filter: null,....iCaret: -1,....RE: item.getAttribute("RE"),......KeyDown: function (ev, o) {.....const k = ev.keyCode;.....if (k != VK_PROCESSKEY) {......this.filter = o.value;......clearTimeout(this.tid);......if (k == VK_RETURN) {.......this.Change(ev.ctrlKey);.......return false;......} else {.......this.tid = setTimeout(this.Change, 500);......}.....}....},......KeyUp: function (ev) {.....const k = ev.keyCode;.....if (k == VK_UP || k == VK_DOWN) {......(async function () {.......const FV = await GetFolderView();.......if (FV) {........FV.Focus();.......}......})();......return false;.....}....},......Change: async function (bSearch

                C:\Users\user\Desktop\extract\addons\forward\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):735
                Entropy (8bit):5.148943569724235
                Encrypted:false
                SSDEEP:12:TMHd32eyLupS/zFH+FSbnv4F1X6VqfOzWTWLL0oKSjhOGX7vIywCSgybfk8pXpmf:2dVQz1HngGVC6bjhOGbf0bfki5c5
                MD5:DCECA230B1D940BE4D2649987D2D94C8
                SHA1:8895C02B4F7DDA798DDE4BC09B156C2928E74D83
                SHA-256:A8DA97B1A19B732AC5B68A0313D747E8D4B0DD10F8CBECD218B35EA3D53B6D6D
                SHA-512:3F50BB74A4955232C8A70AED2A365FB90BB6A402994427E8E73935D6E73808B53685DCCC94C2E207424BC48727B1BE683990CA69354BA11BFA76F72AE47DE623
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.18</Version>.. <MinVersion>2021.3.26</MinVersion>.. <pubDate>Tue, 17 Aug 2021 00:00:00 GMT</pubDate>.. <Options>Common:5,6:5</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Forward</Name>.. <Description>Forward</Description>.. </en>.. <fr>.. <Name>Avancer - global</Name>.. <Description>Place le bouton "Avancer" dans la barre d'outil principale</Description>.. </fr>.. <ja>.. <Name>..</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\forward\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1995
                Entropy (8bit):5.388103049898378
                Encrypted:false
                SSDEEP:48:qdPK7wTOX7YTGCPMSF1RPNhWf+FTvCAL8jWNi6cEk+zjXACLsL/bh20:q9K7wTOX7YTnnJ/qVKJcx+vACozbM0
                MD5:7E686080B03BFD30A91ED58879C7F015
                SHA1:444073BD70F770EE4EF412D1A71D2366AB8481D2
                SHA-256:C9EF760922D6283F575F405D3DE3AC7DF5A248BABECABFC7E9883B571E12A9E4
                SHA-512:1B6EFF7086610B50B87821C7C2B2B112F7F6EED056CEB6400AA3938CA6C9E3ED96166AB65B9B7FDAA39EABA7687A25466B0EE4C33EED19150EDDE970BA3E4F60
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "forward";..const Default = "ToolBar2Left";..if (window.Addon == 1) {...Addons.Forward = {....Exec: function (Ctrl, pt) {.....Exec(Ctrl, "Forward", "Tabs", 0, pt);....},......ExecEx: async function (el) {.....Exec(await GetFolderView(el), "Forward", "Tabs", 0);....},......Popup: async function (el) {.....const FV = await te.Ctrl(CTRL_FV);.....if (FV) {......const Log = await FV.History;......const hMenu = await api.CreatePopupMenu();......const mii = await api.Memory("MENUITEMINFO");......mii.fMask = MIIM_ID | MIIM_STRING | MIIM_BITMAP;......for (let i = await Log.Index; i-- > 0;) {.......const FolderItem = await Log[i];.......AddMenuIconFolderItem(mii, FolderItem);.......mii.dwTypeData = await FolderItem.Name;.......mii.wID = i + 1;.......await api.InsertMenuItem(hMenu, MAXINT, false, mii);......}......const pt = GetPos(el, 9);......const nVerb = await api.TrackPopupMenuEx(hMenu, TPM_LEFTALIGN | TPM_LEFTBUTTON | TPM_RIGHTBUTTON | TPM_RETURNCMD, pt.x, pt.y, ui_.hwnd, n

                C:\Users\user\Desktop\extract\addons\key\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):729
                Entropy (8bit):5.129024545453543
                Encrypted:false
                SSDEEP:12:TMHd32eyLrS/zFcSwnv41X6VqfOzWTWLL0osERKJOGXZlYrDtvvk8ZGe6hlen:2dhzEngQVC6KOGplCvvkWmy
                MD5:78DB368804A72B94B725FD92638D84EC
                SHA1:D4C4F6C3653028A1C559B1102134894B40DA8922
                SHA-256:B2A3EFA93EE65FC9C764009DBBBA25637824CB0874C966B9A4CCF1036177C678
                SHA-512:609633CE061D56DDCDB11BCB215C4D99E45BC25C16EA0CD51625038802D786E905E903E267E7E3EE0DBACD88BAFA6687D9A9BE2C7016EEFD335487BD0151AD3B
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.26</Version>.. <MinVersion>2021.11.1</MinVersion>.. <pubDate>Sat, 04 Dec 2021 00:00:00 GMT</pubDate>.. <Options>Common:4:4</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Key</Name>.. <Description>Definition of keyboard shortcuts</Description>.. </en>.. <fr>.. <Name>Raccourci clavier</Name>.. <Description>D.finition de raccourci(s) clavier</Description>.. </fr>.. <ja>.. <Name>..</Name>.. </ja>.. <zh>.. <Name>..</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\key\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):3803
                Entropy (8bit):4.884337488983552
                Encrypted:false
                SSDEEP:96:7s2As3As3gps3Qs30s35wc+ANxwNBThcr:Iy1NlxJ5ens
                MD5:21D4C5EB5A4ECAA54492E6C583947804
                SHA1:A3A3FDB8520F60652A28789F4277607B51C8D51E
                SHA-256:5CD7E57677F5C4E83174C336CC261DC2907607271364D1236A344F241C0265A8
                SHA-512:A27DE22FE7A71C4FA2EC95FD102BF5553278EB17F0561523384285CF65C2D8DFEE126EFF8F69F295FDC582A3FAF1008F9DB40CEADC1BCD452F93C6E15BC24F48
                Malicious:false
                Reputation:low
                Preview:<form name="E">.. <table style="width: 100%; height: calc(100% - 2em)">.. <tr>.. <td width="9em" valign="top">.. <select name="Key" style="width: 9em" onchange="SwitchX('Key', this, document.E)">.. </select>.. <br />.. <select name="KeyAll" size="8" style="width: 9em; height: 33em; height: calc(100% - 2em)" onchange="EditXEx(EditX, 'Key', document.E)" ondblclick="EditX('Key', document.E)" oncontextmenu="CancelX('Key')" multiple>.. </select>.. <select name="KeyList" size="8" style="width: 9em; height: 33em; height: calc(100% - 2em); display: none" onchange="EditXEx(EditX, 'Key', document.E)" ondblclick="EditX('Key', document.E)" oncontextmenu="CancelX('Key')" multiple>.. </select>.. <select name="KeyTree" size="8" style="width: 9em; height: 33em; height: calc(100% - 2em); display: none" onchange="EditXEx(EditX, 'Key', document.E)" ondblclick="EditX('Key', document.E)" oncontextmenu="CancelX('Key')" multiple>.. </s

                C:\Users\user\Desktop\extract\addons\key\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):330
                Entropy (8bit):5.14533045097809
                Encrypted:false
                SSDEEP:6:NYWTbP2gLAKvBXYk6LENBw6hQ/83+/wmX/+OIR6Auov:NYWTbP2gLAaJbBw2BmfAv
                MD5:418C7801AFC18A4C42247A065C52427E
                SHA1:B450EA6B35FF8B897FC761067BB03EF721BF385C
                SHA-256:48ADC5169AD94DAD74B6A5C8F22461E5BE509F1D7CE449407C0015ABF59AC5A0
                SHA-512:133178F6A3F9AE33EB0BADEE51A114F7B930B83E9B0B964518A6999AE38E72B15682BC1162ACED8A75C4AC77E875C030D30D35918761B477BDFF2CEF615F6425
                Malicious:false
                Reputation:low
                Preview:g_Types = { Key: ["All", "List", "Tree", "Edit", "Menus"] };....await SetTabContents(4, "", await ReadTextFile("addons\\" + Addon_Id + "\\options.html"));....SaveLocation = async function () {...SetChanged(null, document.E);...await SaveX("Key", document.E);..}....LoadX("Key", null, document.E);..setTimeout(MakeKeySelect, 99);..

                C:\Users\user\Desktop\extract\addons\key\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):175
                Entropy (8bit):4.822527439463061
                Encrypted:false
                SSDEEP:3:9P5bLDjF34LJVMbMJo8ickB8L6hWAfLFAtko1HbMJo8ickB8L6hVwy:HLDjhGIyk6LdAfxro1Htyk6LE
                MD5:1D5821FA7E71D3E8AC470345803D6252
                SHA1:A5F4D91AC2FB7DBF3B5698CB600B5651987EF206
                SHA-256:A63991477040DCD0492B059A201EF988629220837BA1BC960B51AAA5D63090B1
                SHA-512:3AB51EA5D8F2F043D2F8DA252DBA2B3DA23940A0BD867D185623DDC50A3ED784EB5892D4B88BFA3C56E45C6CF63FE076D5948131BB7A0C7F3654B36FA625D848
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "key";..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...importScript("addons\\" + Addon_Id + "\\options.js");..}..

                C:\Users\user\Desktop\extract\addons\key\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1664
                Entropy (8bit):5.170711397841828
                Encrypted:false
                SSDEEP:48:m0mEZ5jpJdd/twRngHcc4Llq43TxLdRCGou9:me5dERnE0zViGou9
                MD5:38FD3775F08E185B78CBC2A3473A63D2
                SHA1:CAC9E5820977E23184556C70C7E0E0D2E42DA676
                SHA-256:A585F1B106C433772E05BC179CF8A9943A8957D86837C46122B33F38DEA0F404
                SHA-512:BEB71E23DD261F474F21BF6757200B9A9509A3E28B9D2B872055686A605FE23664038874BC974D35FE22AE6694C30E517304663CF83F7344FA798F2B824C82E4
                Malicious:false
                Reputation:low
                Preview:Sync.Key = {...Menus: [],.....OpenMenu: function (Ctrl, pt, nIndex) {....const ar = this.Menus[nIndex];....const items = ar[0];....if (items) {.....const arMenu = ar[1];.....const hMenu = api.CreatePopupMenu();.....MakeMenus(hMenu, null, arMenu, items, Ctrl, pt);.....AdjustMenuBreak(hMenu);.....window.g_menu_click = 2;.....const nVerb = api.TrackPopupMenuEx(hMenu, TPM_RIGHTBUTTON | TPM_RETURNCMD, pt.x, pt.y, te.hwnd, null);.....api.DestroyMenu(hMenu);.....if (nVerb == 0) {......return S_OK;.....}.....const item = items[nVerb - 1];.....const s = item.getAttribute("Type");.....Exec(Ctrl, item.text, window.g_menu_button == 3 && Sametext(s, "Open") ? "Open in new tab" : s, Ctrl.hwnd, pt);....}....return S_OK;...}..}....const xml = OpenXml("key.xml", false, true);..for (let mode in eventTE.Key) {...const items = xml.getElementsByTagName(mode);...for (let i = 0; i < items.length; i++) {....let item = items[i];....const strKey = item.getAttribute("Key");....let strType = item.getAttribute("Ty

                C:\Users\user\Desktop\extract\addons\mainmenu\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):721
                Entropy (8bit):5.189476288054379
                Encrypted:false
                SSDEEP:12:TMHd32eyLyS/zFHnSbnv4/DpX6VqfOzWTWLL0oJdox96OGXXtMLrD7tM7zAk8Qe7:2dkz1CngLUVC6BE96OGNM3tM7zAkA
                MD5:401DDB736832E5B6366D62965E66847F
                SHA1:BD7170C198E1BAC9BABEF03812B16EF6A051DDF3
                SHA-256:EC6122B157996CC6C9B99A4247513B4C03B207BC1522575C1674208F83A1D770
                SHA-512:B55272E0D159FD12296EAE85BBE527994F9C81234DCECFCE6C037E515E99F2F3E2A5D193386175F341A0C97FA9C4DD5236214CABDD33470D08FC53B2DB3FA1B5
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.16</Version>.. <MinVersion>2021.3.25</MinVersion>.. <pubDate>Tue, 17 Aug 2021 00:00:00 GMT</pubDate>.. <Options>Common:6:6</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Main menu</Name>.. <Description>Main menu</Description>.. </en>.. <fr>.. <Name>Menu principal</Name>.. <Description>D.finition du menu principal</Description>.. </fr>.. <ja>.. <Name>.......</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\mainmenu\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2502
                Entropy (8bit):5.159938643590464
                Encrypted:false
                SSDEEP:48:ECPWherIg0bTzDtN68sK0Ex2kelGdbUzv691wUbb6Ldfp+zcObpB5G:DpgnH1wUf6pp+YOZG
                MD5:DF49D912A200FC887D32755DE67E05C3
                SHA1:CBFE92494E5C1970DDC61B2274D51B125CC68FBF
                SHA-256:D4B376EA72D1C7BEFE84C59C679933FB8287ED4F25E205A61EA578BA7321A78F
                SHA-512:807A61153BA9584642D60E1C0A0956D4F13BE1C694A9EA9E30B9CE5EDDD7B684187D8CAB10D3A9D1F5D88ADD2609B68B0F2D807D19E40543E2B72738C8C800C1
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "mainmenu";..const Default = "ToolBar1Left";..if (window.Addon == 1) {...Addons.MainMenu = {....Menu: [],....strMenus: ["&File", "&Edit", "&View", "F&avorites", "&Tools", "&Help"],......Popup: async function (o) {.....if (!await Common.MainMenu.bClose) {......Addons.MainMenu.Item = o;......Common.MainMenu.Item = await GetRect(o, 1);......for (let i = await GetLength(await Common.MainMenu.Menu); i--;) {.......Common.MainMenu.Items[i] = await GetRect(document.getElementById(await Common.MainMenu.Menu[i]), 1);......}......clearTimeout(Addons.MainMenu.tid);......Addons.MainMenu.tid = setTimeout(async function () {.......delete Addons.MainMenu.tid;.......const o = Addons.MainMenu.Item;.......const p = GetPos(o, 9);.......MouseOver(o);.......$.Ctrl = await te;.......Common.MainMenu.bLoop = true;.......await Common.MainMenu.bLoop;.......AddEvent("ExitMenuLoop", async function () {........Common.MainMenu.bLoop = false;........Common.MainMenu.bClose = true;........clearTimeout(

                C:\Users\user\Desktop\extract\addons\mainmenu\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):635
                Entropy (8bit):5.213628646613468
                Encrypted:false
                SSDEEP:12:If9mHpGoYoUWD+5WnZImHo+pOSIMoWejDR4WotzxooRTG/Dru:M4rYo456oBUopjWpxxooRTG/fu
                MD5:B6DB9C5B5879BF54B93EDE41F161B841
                SHA1:B1BB82F5290C2DB62D232F34CAFC4E322E618CBC
                SHA-256:A9B085646ED9D4DBD44A58B557BEF8953BC6693E2B13EA5B16D1353E2F55E53A
                SHA-512:BC3876C4D1746FE7B9828784AED13320331B45D040BBE1F4B921394F37E1746EE59EA0B39309BAFD548B456DA5CD2AE4F9B0367AE253DF1BFD509A915F00FCF4
                Malicious:false
                Reputation:low
                Preview:AddEvent("MouseMessage", function (Ctrl, hwnd, msg, mouseData, pt, wHitTestCode, dwExtraInfo) {...if (msg == WM_MOUSEMOVE) {....if (Common.MainMenu.bLoop && Ctrl.Type == CTRL_TE) {.....const Ctrl2 = te.CtrlFromPoint(pt);.....if (Ctrl2 && Ctrl2.Type == CTRL_WB) {......if (!PtInRect(Common.MainMenu.Item, pt)) {.......for (let i = Common.MainMenu.Items.length; i--;) {........if (PtInRect(Common.MainMenu.Items[i], pt)) {.........Common.MainMenu.bClose = false;.........api.PostMessage(hwnd, WM_KEYDOWN, VK_ESCAPE, 0);.........Common.MainMenu.Popup(Common.MainMenu.Menu[i]);.........break;........}.......}......}.....}.. ..}...}..});..

                C:\Users\user\Desktop\extract\addons\mouse\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):807
                Entropy (8bit):5.222552330675194
                Encrypted:false
                SSDEEP:12:TMHd32eyLY8TS/zFcSq7Znv41X6VqfOzWTWLL0oz0lVlbOGXpElrDjURuW7Mvk8C:2dDzOngQVC6qOG5ElUjQkN78EWo
                MD5:D8999784D1D888F52CF7508DC553D8F0
                SHA1:D041ACEF822A6550AF7B12341141F4DFE84C6FDF
                SHA-256:CF786A8F93C09A167B0FDE45C4715B6E9110241AD1CC5C400108E6A1CF161B00
                SHA-512:DBBA5E06CF6D174A25E27283509F186C37EA6D3C48220C4056427A250AB239D85534570578F6E502F49EC723FF6D197EE78AE446B6E40C15873314A00E5F1EB0
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.33</Version>.. <MinVersion>2021.11.1</MinVersion>.. <pubDate>Mon, 13 Dec 2021 00:00:00 GMT</pubDate>.. <Options>Common:4:4</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Mouse</Name>.. <Description>Mouse button and gestures</Description>.. </en>.. <fr>.. <Name>Souris</Name>.. <Description>D.finition des boutons et manipulations de la souris.</Description>.. </fr>.. <ja>.. <Name>...</Name>.. <Description>.............</Description>.. </ja>.. <zh>.. <Name>..</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\mouse\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):6498
                Entropy (8bit):4.678239225483991
                Encrypted:false
                SSDEEP:96:2EP/PWP3P/PWPHPLygA+F9FLdSKEWmyk0ghEjnwNBKMX3:2q3Q/3QvLyR+SWgnl
                MD5:9B876D974CBB907A91833FAE7F62C530
                SHA1:BC273BEE6E775EEE889C97F93BCF7D774487947A
                SHA-256:6BD549AA4B80EC8DB97596BF608764D651D86EC1D2FDE4C023358A5E7AAD453B
                SHA-512:1C9871566202237E7053D0FD54431277D7E06288629E5015D324A6CC6423FAB2596DDE5D5A14F58D66D8834A8DC5791BE46C86D9DA5C22BC56C2ED704212A756
                Malicious:false
                Reputation:low
                Preview:<form name="E">.. <table style="width: 100%; height: calc(100% - 2em)">.. <tr>.. <td width="9em" valign="top">.. <select name="Mouse" style="width: 9em" onchange="SwitchX('Mouse', this, document.E)" class="translate">.. </select>.. <br>.. <select name="MouseAll" size="9" style="width: 9em; height: 32em; height: calc(100% - 2em)" onchange="EditXEx(EditX, 'Mouse', document.E)" ondblclick="EditX('Mouse', document.E)" oncontextmenu="CancelX('Mouse')" multiple>.. </select>.. <select name="MouseList" size="9" style="width: 9em; height: 32em; height: calc(100% - 2em); display: none" onchange="EditXEx(EditX, 'Mouse', document.E)" ondblclick="EditX('Mouse', document.E)" oncontextmenu="CancelX('Mouse')" multiple>.. </select>.. <select name="MouseList_Background" size="9" style="width: 9em; height: 32em; height: calc(100% - 2em); display: none" onchange="EditXEx(EditX, 'Mouse', document.E)" ondblclick="EditX('Mouse', document.E)" on

                C:\Users\user\Desktop\extract\addons\mouse\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):680
                Entropy (8bit):5.23623260816521
                Encrypted:false
                SSDEEP:12:iWTb85VbREWJqBQ3Nd1dMN38l2tlmrLAl0VYcnX2MMBwY7zmk0:iOWbiWJZdx00VYXMO1zmh
                MD5:80E20A0DE009703D8173BE2CAC896CF6
                SHA1:7429565B6BDC9DA83547122116A819111BE60F73
                SHA-256:182ADFEB227523E391203C62A4142A81A2DAFC718399B9ABEC992339C3696725
                SHA-512:84BDA8405F0F996B0A08BCD5918D7FE51D6E4978A63E0D3BBA3FBA2CA0E75B5E89F8C9D731ECD35C02BA66401D8C099E9040ECD8ED49F2063B778BF2EC60AD7A
                Malicious:false
                Reputation:low
                Preview:g_Types = { Mouse: ["All", "List", "List_Background", "Tree", "Tabs", "Tabs_Background"] };....const src = await ReadTextFile("addons\\" + Addon_Id + "\\options.html");..const ar = [];..const s = "CSA";..for (let i = s.length; i--;) {...ar.unshift('<input type="button" value="', await MainWindow.g_.KeyState[i][0], '" title="', s.charAt(i), '" onclick="AddMouse(this)">');..}..await SetTabContents(4, "", src.replace("%s", ar.join("")));....AddMouse = function (o) {...document.E.MouseMouse.value += o.title;...ChangeX("Mouse");..}....SaveLocation = async function () {...SetChanged(null, document.E);...await SaveX("Mouse", document.E);..}....LoadX("Mouse", null, document.E);..

                C:\Users\user\Desktop\extract\addons\mouse\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):177
                Entropy (8bit):4.8100348071058985
                Encrypted:false
                SSDEEP:3:9zAEzLDjF34LJVMbMJo8ickB8L6hWAfLFAtko1HbMJo8ickB8L6hVwy:VAEzLDjhGIyk6LdAfxro1Htyk6LE
                MD5:84EF6019A6508DB00BD60F4E5E1CE2E9
                SHA1:B5C06A241F1D6AE9F0176665DEBA890CD2951B53
                SHA-256:9CE9A2F7EEB261CB58665F14A3C6600B8FCFAC2574DDC70A53114F358A0CF9D5
                SHA-512:8DE8838CEA8A71F488C99DD3597DE396B52E7A281CF8D752B5C0F38116CBF57AA34BFBD65A957EACBF2F50A572074ECA3AACF82B55F072D3C163F694E9D1B86A
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "mouse";..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...importScript("addons\\" + Addon_Id + "\\options.js");..}..

                C:\Users\user\Desktop\extract\addons\mouse\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1761
                Entropy (8bit):5.137121246814836
                Encrypted:false
                SSDEEP:48:S0LMCqlcj1F0dttwVnngHcc4Llq43TxLdRMbyH9:SqySJRVnnE0zVGyH9
                MD5:53AFAE0F6D0A5C7885EF6029D6E5831A
                SHA1:332737948863AB1DEC3C82BBA45EC7E1AAAA14F9
                SHA-256:AACFC9C3E128317912EDABE8CE366E6AE63D1F59EEFAEEA8C94E02EA02B491D6
                SHA-512:4FAA079E715CE9FE5BFA4F3787280C89BB2DC9A7A3A142A3C0F708DCAE1909963AE05E7E76A1F4F784A1E54F0EB334CED0693D56F0AFEA3810FE615C8A833F80
                Malicious:false
                Reputation:low
                Preview:Sync.Mouse = {...Menus: [],.....OpenMenu: function (Ctrl, pt, nIndex) {....const ar = this.Menus[nIndex];....const items = ar[0];....if (items) {.....setTimeout(function () {......const arMenu = ar[1];......const hMenu = api.CreatePopupMenu();......MakeMenus(hMenu, null, arMenu, items, Ctrl, pt);......AdjustMenuBreak(hMenu);......window.g_menu_click = 2;......const nVerb = api.TrackPopupMenuEx(hMenu, TPM_RIGHTBUTTON | TPM_RETURNCMD, pt.x, pt.y, te.hwnd, null);......api.DestroyMenu(hMenu);......if (nVerb == 0) {.......return;......}......const item = items[nVerb - 1];......const s = item.getAttribute("Type");......Exec(Ctrl, item.text, window.g_menu_button == 3 && s == "Open" ? "Open in New Tab" : s, Ctrl.hwnd, pt);.....}, 99);....}....return S_OK;...}..}....const xml = OpenXml("mouse.xml", false, true);..for (let mode in eventTE.Mouse) {...const items = xml.getElementsByTagName(mode);...for (let i = 0; i < items.length; ++i) {....let item = items[i];....const strMouse = item.getAttribu

                C:\Users\user\Desktop\extract\addons\multithread\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):817
                Entropy (8bit):5.380168140698069
                Encrypted:false
                SSDEEP:12:beyLpXiS/zFy4FS54nv4FX6VqfOzWTWLL0oV2QqtOGXPqzk8Ze2gneGoeRClelen:Tzx5nggVC6dctOGyzkke9neGTClj
                MD5:A67A5AD65336F326C30D175D2108584A
                SHA1:820BEA029B4B0DC35885F6AD982D6C979F6399CE
                SHA-256:4D2E7F5D0F33899C56425716E1AE6022ADEB136195B6AC298CE9FA928DB917BE
                SHA-512:173037FC46CA4D5A79565C64CA4FF23266F948E2BA46EB10E17D1517D118F9FCC301FF602DA0878E0752CF015F255D0BDF1B09E662075BEA9FC2622AF66E5DC8
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.29</Version>.. <MinVersion>2022.1.24</MinVersion>.. <pubDate>Mon, 24 Jan 2022 00:00:00 GMT</pubDate>.. <Options>Common:0:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Multi thread</Name>.. <Description>Multi-threaded file operation.</Description>.. </en>.. <fr>.. <Name>Multi-fils</Name>.. <Description>Op.rations sur fichier parall.lis.es.</Description>.. </fr>.. <ja>.. <Name>.......</Name>.. <Description>....................</Description>.. </ja>.. <zh>.. <Name>.......</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\multithread\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):601
                Entropy (8bit):5.293210089426903
                Encrypted:false
                SSDEEP:12:P/VDXCQaMtfnDEKprZyLAvUGuVRebGutEbGu+B9bGuIMmzb:XVmQaMtrEK9V2veBtEB+HBr2
                MD5:0D9611D338A5189D430C074AE9BCCE14
                SHA1:41574F13278C320E4B2D80E4C9170440D4548E27
                SHA-256:9BAD8B4176DFE27AE887B2C2356AB7FC572E3BC4E3DF223D5B15D6A3BE0E82D6
                SHA-512:7402F1C0D72700A338897A30DFAD7A83E4E0DCB65B10ADD64FB200E435236501133C9559E537F8560B4DBF4BC66EF026FA8A3EE5549A99425FB8CF83BACB1388
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "multithread";..const item = GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("Copy", 1);...item.setAttribute("Move", 1);...item.setAttribute("Delete", 1);..}..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...SetTabContents(0, "", '<label><input type="checkbox" id="Copy">Copy</label><br><label><input type="checkbox" id="Move">Move</label><br><label><input type="checkbox" id="Delete">Delete</label><br><label><input type="checkbox" id="!NoTemp">@shell32.dll,-21815[Temporary Burn Folder]</label><br>');..}..

                C:\Users\user\Desktop\extract\addons\multithread\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):4692
                Entropy (8bit):5.260387925795628
                Encrypted:false
                SSDEEP:96:DX9mIV/VvZtn9vbCuo3tPa9aQD2c4je4fi+4OhP4dJP:DX9meZtJbVePYdh
                MD5:8346F91B2B7CD033B18C944A03F53FD1
                SHA1:F4767259E931EE9C3361C1BECFC6A9046AA1641E
                SHA-256:2703ACCF794A4575E0D45FF2E999DB9E9134389E84C825A8A01CCD2D10CF0F3F
                SHA-512:6488AFA2A0A61FEFD4D754E03F298A952D3001C63EAFE134E57DC39B768B0464E71B5C24E0991EC7ECC389FA4320DA0EA56EAF424DCF89C50A0D6D1B81F10C9B
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "multithread";..const item = GetAddonElement(Addon_Id);....Sync.MultiThread = {...Copy: GetNum(item.getAttribute("Copy")),...Move: GetNum(item.getAttribute("Move")),...Delete: GetNum(item.getAttribute("Delete")),...NoTemp: item.getAttribute("NoTemp"),.....FO: function (Ctrl, Items, Dest, grfKeyState, pt, pdwEffect, bOver, bDelete) {....let path;....if (!(grfKeyState & MK_LBUTTON) || Items.Count == 0) {.....return false;....}....try {.....path = Dest.ExtendedProperty("linktarget") || Dest.Path || Dest;....} catch (e) {.....path = Dest.Path || Dest;....}....const wfd = api.Memory("WIN32_FIND_DATA");....if (bDelete || (path && fso.FolderExists(path))) {.....const arFrom = [];.....const strTemp = GetTempPath(4);.....if (Items.Count == 1 && api.PathMatchSpec(Items.Item(0).Path, strTemp + "*.bmp")) {......return false;.....}.....let strTemp2;.....for (let i = 0; i < Items.Count; ++i) {......let path1 = Items.Item(i).Path;......const hFind = api.FindFirstFile(path1, wfd);....

                C:\Users\user\Desktop\extract\addons\remember\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):978
                Entropy (8bit):5.521198402251415
                Encrypted:false
                SSDEEP:24:2dvz5nggVC68aQKaROGkh72lGSkgyS8G1:crpDcT8vGW7YuS
                MD5:6EE6FFEB647125545308BA93A07C0B54
                SHA1:81721A83E84FBF54B3D53E52CC20DE7627DBF5C6
                SHA-256:3E435A53D81303A5F95AD72FBBB0127CC178C620A9674A0B55F83C8C65095634
                SHA-512:AC59A8EB71D0E73EF7E721223B869E1A5ECDC857B64AFA5EBAD86C84794D601B432F35B7269EB5DE03ABECB15E335A9CADD436EE112399982B0D1DDD0941AF6C
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.42</Version>.. <MinVersion>2021.12.18</MinVersion>.. <pubDate>Thu, 23 Dec 2021 00:00:00 GMT</pubDate>.. <Options>Common:0:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Remember folder view settings</Name>.. <Description>Automatically remember folder view settings.</Description>.. </en>.. <fr>.. <Name>M.moriser la configuration d'affichage de dossier</Name>.. <Description>Enregistre automatiquement les param.tres d'affichage des dossiers.</Description>.. </fr>.. <ja>.. <Name>.............</Name>.. <Description>...................</Description>.. </ja>.. <zh>.. <Name>.........</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\remember\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):658
                Entropy (8bit):4.864119029086559
                Encrypted:false
                SSDEEP:12:RoyAuaWjCv3nvHfzJOAurhY3ScvHfUAurhY32+oe9f2rPeK2aPaK2ZPRCv:61vHNyhwHHghw22oTCRs
                MD5:5013EE8EFEB2F84D278433BBF55CCB6E
                SHA1:486A664613A93B9F5A9C743BC663A93BB0018EA8
                SHA-256:B655F807B81B4FE3E7EB10DDA610A947D85343450FCAFD969110AB466BFC151E
                SHA-512:CD921A9A76A2384823A02781F73AD4D03E7DAF12B11E2D5F05E89D54016790640D90EB93626043ADDFB3D6DE7A7E7543BBDF986C44B6AFD085B0F2E599544EE0
                Malicious:false
                Reputation:low
                Preview:<label>Number of items</label><br>..<input type="text" id="Save" style="width: 100%" placeholder="1000"><br>..<label>Filter</label><br>..<textarea rows="6" name="Filter" style="width: 100%"></textarea><br>..<label>Disable</label><br>..<textarea rows="6" name="Disable" style="width: 100%"></textarea><br>..<label>Advanced</label><br>..<input type="hidden" name="Format">..<label><input type="radio" id="Format=0" name="_Format" onclick="SetRadio(this)">Normal</label>..<label><input type="radio" id="Format=1" name="_Format" onclick="SetRadio(this)">Path</label>..<label><input type="radio" id="Format=2" name="_Format" onclick="SetRadio(this)">Key</label>..

                C:\Users\user\Desktop\extract\addons\remember\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):331
                Entropy (8bit):5.030843227475796
                Encrypted:false
                SSDEEP:6:tgO5FB/Doo1wX+Nh0Mb1wtr0rzLDjhGIyk6LdAfxrocCdLAOvBXYk6LEe:J5bDXm6nDEKprZyLA2JE
                MD5:66FC25301DF18EEEE59B995CB4CDFAA8
                SHA1:21BFE734025A22C10ED156E114D2B1E7849F6D00
                SHA-256:C41F87F1A5E83A86FB88311E7636C77BF40B44690992F91D20C4530A64011DA5
                SHA-512:E9D7D7887CF696283CE22CFD60BD004ED0D3D11AF644C99C180A17C72BCC4379BAE21028508D4E161370AA4F46A904DD87225DE8900758F347E00794FC901EF5
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "remember";..const item = await GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("Format", "1");..}..if (window.Addon == 1) {...$.importScript("addons\\" + Addon_Id + "\\sync.js");..} else {...SetTabContents(0, "", await ReadTextFile("addons\\" + Addon_Id + "\\options.html"));..}..

                C:\Users\user\Desktop\extract\addons\remember\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):5535
                Entropy (8bit):5.389002430561659
                Encrypted:false
                SSDEEP:96:JY6LQL8w/pAW3JPEyuebjsvkFodCIM84fFZIibkyaEP2Qq8NyZdLn:JY6LQL8oWW3JEy1dYYzon
                MD5:75B76C8AC4C882485BC7054620A831C4
                SHA1:18DFD3A68107184A2F4BE982D0F300DE19BA5E93
                SHA-256:76FAE75FB9E2A7DA759457FC022D2277DB2A360EF2B4F6D23CA46FA1EA8B6DF4
                SHA-512:E80A86FBACB239707815642B57043C4E7F9BD4D1334C6C3DC7332A06C25E83E127EB6848C996BB51CE629120D833053F048791672042B8C7A2DED9A9D0F2D0CA
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "remember";..let item = GetAddonElement(Addon_Id);....Common.Remember = api.CreateObject("Object");..Common.Remember.db = api.CreateObject("Object");....Sync.Remember = {...ID: ["Time", "ViewMode", "IconSize", "Columns", "SortColumn", "Group", "SortColumns", "Path"],...nFormat: api.LowPart(GetAddonOption(Addon_Id, "Format")),...Filter: ExtractFilter(GetAddonOption(Addon_Id, "Filter") || "*"),...Disable: ExtractFilter(GetAddonOption(Addon_Id, "Disable") || "-"),...nIcon: api.GetSystemMetrics(SM_CYICON) * 96 / screen.deviceYDPI,...nSM: api.GetSystemMetrics(SM_CYSMICON) * 96 / screen.deviceYDPI,...nSave: item.getAttribute("Save") || 1000,.....RememberFolder: function (FV) {....if (FV && FV.FolderItem && !FV.FolderItem.Unavailable && FV.Data && FV.Data.Remember) {.....const path = Sync.Remember.GetPath(FV);.....if (path == FV.Data.Remember && PathMatchEx(path, Sync.Remember.Filter) && !PathMatchEx(path, Sync.Remember.Disable)) {......const col = FV.Columns(Sync.Remember.nF

                C:\Users\user\Desktop\extract\addons\segoeicons\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):1008
                Entropy (8bit):5.297087352356874
                Encrypted:false
                SSDEEP:24:/czqnCVC6FFFQNbYOG9FFn6oBdvbkeFF3AbRILSoNGOcD+:amCccMHG7IOAcpAbRIWqX
                MD5:6DA99882A5406B720FB90FBA2E6A7BDB
                SHA1:1C200E84B59EB538C0379FC9A0421C996AFDB30D
                SHA-256:E49C57B2241F0F8B96FD70B8ED7A7F2A553DACB18121848B2BC4EF0C550A1E57
                SHA-512:9A7D8767E54689CF3B75CB27E7256AC4A41A9BC79C4BDDEAC5896E0B41431351E6C1052106B4A66611BF101C7F13BDB1AF32920CB4CB6AF11780B625E18081C1
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.04</Version>.. <MinVersion>2022.2.9</MinVersion>.. <pubDate>Wed, 09 Feb 2022 00:00:00 GMT</pubDate>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Segoe Fluent Icons</Name>.. <Description>Replace the standard icon with Segoe Fluent Icons or Segoe UI MDL2 Assets. *Windows 10 or higher is required</Description>.. </en>.. <fr>.. <Name>Segoe Fluent Icons</Name>.. <Description>Remplace les ic.nes standards par les ic.nes fluides Segoe ou les disponibilit.s Segoe UI MDL2. *Windows 10 ou plus requis !!</Description>.. </fr>.. <en>.. <Name>Segoe Fluent Icons</Name>.. <Description>.......Segoe Fluent Icons / Segoe UI MDL2 Assets .........Windows 10 .....</Description>.. </en>.. <zh>.. <Name>Segoe ...</Name>.. </zh>..</TablacusExp

                C:\Users\user\Desktop\extract\addons\segoeicons\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):117
                Entropy (8bit):4.782453940824892
                Encrypted:false
                SSDEEP:3:C3/LDjF3/KbnCbjHfsuIVMbMJo8ickB8L6hWAfLy:C3/LDjh/KebjHfsuNyk6LdAfe
                MD5:E65DBAEAF2954AC9E91830B026937EDA
                SHA1:1E86442181CD95418FE31D0FDEA1DBDC8B620942
                SHA-256:51280E5B6E235E36AEEB23923E7F53A48EBBF1301CF5C2EE09D423A97AF58050
                SHA-512:B9488DDACF115564B65267DF0698D7100428CA7B6286783B273509F78CE686C9F9BB76970811EC53114A23ED5D2D71DCA106ED74A8759A31695ACDDC5725228F
                Malicious:false
                Reputation:low
                Preview:if (window.Addon == 1) {...const Addon_Id = "segoeicons";...$.importScript("addons\\" + Addon_Id + "\\sync.js");..}..

                C:\Users\user\Desktop\extract\addons\segoeicons\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2589
                Entropy (8bit):5.307712547020652
                Encrypted:false
                SSDEEP:48:g2ikn/WRFCm+TjpHqaiknFe7uWeDNDoy/YO4ORuT7D4OP:zR/WHYT9ZRFe7kNDoy/YO45
                MD5:682A09117BB10CD1224F4DAB1A3AACC9
                SHA1:B6419A4F7157372DD10366C79796C013A1B9CE26
                SHA-256:9933708E2BCD2AEA1BAB9F893751CB1BF41C5DEEC79277E7AA2BF5B617A74720
                SHA-512:777DCDCC9959A8FA63C90B11FF6BD06C940ED313F83B3499F381D35BFBD4C423E7F6F0149CAFEA87F245EC283BFD0475F2101266E62BF08026FDC4E31CD1E431
                Malicious:false
                Reputation:low
                Preview:Sync.SegoeIcons = {...general: {....0: "0xe72b",....1: "0xe72a",....2: "0xe728",....3: "0xe734",....4: "0xe90c",....5: "0xe8c6",....6: "0xe8c8",....7: "0xe77f",....8: "0xe7a7",....9: "0xe7a6",....10: "0xe74d",....11: "0xed0e",....12: "0xe8dA",....13: "0xe74e",....14: "0xe7c5",....15: "0xe771",....16: "0xe897",....17: "0xe721",....19: "0xe749",....20: "0xf0e2",....21: "0xea37",....22: "0xe71d",....23: "0xe8fd",....24: "0xe8cb",....25: "0xe8cb",....26: "0xe8cb",....27: "0xe8cb",....28: "0xe74a",....29: "0xe8ce",....30: "0xe8cd",....31: "0xe8f4",....32: "0xe71d",....35: "0xe780",....36: "0xec75",....37: "0xf0e2",....38: "0xea37",....39: "0xe71d",....40: "0xe8fd",....43: "0xed43",....44: "0xe8de",....45: "0xf413"...},...browser: {....0: "0xe72b",....1: "0xe72a",....2: "0xe711",....3: "0xe72c",....4: "0xe80f",....5: "0xe721",....6: "0xe728",....7: "0xe749",....8: "0xe8d2",....9: "0xe929",....10: "0xec7a",....11: "0xe8d6",....12: "0xe81c",....13: "0xe8c3",....14: "0xe8a7",....15: "0xef6b",..

                C:\Users\user\Desktop\extract\addons\tabplus\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):604
                Entropy (8bit):5.125872745867432
                Encrypted:false
                SSDEEP:12:beyLKZ8S/zFfFS5WF5nv4FX6VqfOzWTWLL0ou7oOGXuR8ZR70epXvIlen:A3z1F5nggVC6pOGyWVPfN
                MD5:C6A1C823DF232FF9AAB71CA39C2C621E
                SHA1:61648D9A76FE78EF62D2DE16B17B83847098DAC9
                SHA-256:C2299F22211AA3EEBC1A8D6749E31BA3C4D24AB6E260B642DF0B4DD4F24A4E71
                SHA-512:965BB3AFB8D3C092AD2B9A626CE83C1591CB143DD63417D75FBBE8EF040CFE94A4842EE297FD6655E75AA91BCCB421B23DB2094E13F0A9E4D41572F6359AC769
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer>.. <General>.. <Version>1.97</Version>.. <MinVersion>2024.2.16</MinVersion>.. <pubDate>Fri, 16 Feb 2024 00:00:00 GMT</pubDate>.. <Options>Common:0:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Tab plus</Name>.. <Description>Tab plus</Description>.. </en>.. <fr>.. <Name>Tab+</Name>.. </fr>.. <ja>.. <Name>.....</Name>.. </ja>.. <zh>.. <Name>....</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\tabplus\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):3256
                Entropy (8bit):4.932781711089403
                Encrypted:false
                SSDEEP:48:yNwrKzjP7Y3NwKwuguoO+9Qs8pfuoxWaP1kletImGxVJJleOImG0V9vbEle/ImG3:2cwruboQbfuwyljJl5El7d
                MD5:D639548928505D41AF06A0530D52E39E
                SHA1:45BBFCFA12D88C10FF9D937BEC40A67271E5955E
                SHA-256:B93AC9AAACCD57085453A3C3DE050F9E854332B1ECD576ABFF5A0A8AA0936028
                SHA-512:0F91AA50B22F544A44170979908FED0C5F320BF74CB9DE5ED07FFCEE3E8BAC1F57835333429586734FFC112FB30A6A47B2F7D316D05AC1A758233DFFD5202AA2
                Malicious:false
                Reputation:low
                Preview:<div class="panel" style="display: block;">.. <label>View</label>.. <br>.. <label><input type="checkbox" id="Icon">Icon</label><br>.. <input type="checkbox" id="Drive"><label for="Drive" id="_Drive">Drive</label><br>.. <label><input type="checkbox" id="Close">Close Tab</label><br>.. <label><input type="checkbox" id="!NoLock">Lock</label><br>.. <label><input type="checkbox" id="Protected">@wmploc.dll,-1714[Protected]</label><br>.. <label><input type="checkbox" id="New">New Tab</label><br>.. <label><input type="checkbox" id="Active">Background</label><br>.. <label><input type="checkbox" id="Tooltips">Tooltips</label><br>.. <label><input type="checkbox" id="Fix">Fixed width</label><br>.. <label>Width</label>.. <input type="text" name="Width" style="width: 5em">.. <label>@mspaint.exe,-50047[px]</label>.. <br>.. <label>Align</label>&nbsp;.. <select name="Align" class="translate">.. <option value="">Top.. <option value="1">Bottom.. <option value="2">Left.. <optio

                C:\Users\user\Desktop\extract\addons\tabplus\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):406
                Entropy (8bit):5.351161889322932
                Encrypted:false
                SSDEEP:12:Nr/vsqUrLA2JdDRRhBZWhQDRRCv/W50sNOi:N7RaJ9RRhBZWhURRyW50Fi
                MD5:DD4288A0F7E6C59158D75EF136BB8442
                SHA1:35595F7F94C542FF9D8D0B5AC0289149096AFED5
                SHA-256:A3625B038D87534DF5E6B45E31CFC733E83D2A4F33437297CFAAD66A4EEEA0B8
                SHA-512:A927B466D1D68136F75095145FDE07146D0A25DFD8E8FBB5B8F8A1818067A9EB98EE3982379EF9609A26883E49DACB9C68071B0624CA56F2B11D189487D892C0
                Malicious:false
                Reputation:low
                Preview:const Icon = document.F.Icon;..if (Icon) {...Icon.name = "Icon_0";..}..await SetTabContents(0, "", await ReadTextFile("addons\\" + Addon_Id + "\\options.html"));..document.getElementById("_Drive").innerHTML = (await api.LoadString(hShell32, 4122)).replace(/ %c:?/, "");..document.getElementById("_DropTo").innerHTML = (await GetTextR("@SRH.dll,-8110[Drop to %1]")).replace(/%1/, await GetText("Folder"));..

                C:\Users\user\Desktop\extract\addons\tabplus\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):20753
                Entropy (8bit):5.378372220139905
                Encrypted:false
                SSDEEP:384:tkuY4Ojgek2QR+1pVKbEUrPfIdkTgS9mq+VQokFcnEAEF4w/in2DT:GucrAEDGryAjcJMdV/in2DT
                MD5:CFBC891641E0031B9CFDC28570D12AE3
                SHA1:66CEF0671D187FACC7350EF816205A8C1976F9A0
                SHA-256:92F27A03B890C3CE167073E29ECF798A2D88407CCD770506873D9D592203E9F8
                SHA-512:C3BBEB40EA9265E1D6DEBF05EA43AD57C5F54190812FD160E5B7381D4D0563A054B1DB1476F4D9F8ABCFC491378EAFD28C17CFD26C196071A0F8A4F28150563A
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "tabplus";..let item = GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("Icon", 1);...item.setAttribute("Drive", 1);...item.setAttribute("New", 1);..}..if (window.Addon == 1) {...te.Tab = false;.....Addons.TabPlus = {....Click: [],....Button: [],....Drag: [],....Drop: [],....pt: await api.Memory("POINT"),....nCount: [],....nIndex: [],....bFlag: [],....nFocused: -1,....opt: {},....str: {},....tids: [],....nSelected: [],......Arrange: async function (Id, bWait) {.....delete Addons.TabPlus.tids[Id];.....const o = document.getElementById("tabplus_" + Id);.....if (o) {......const wait = [];......const TC = await te.Ctrl(CTRL_TC, Id);......if (TC && await TC.Visible) {.......const nCount = await TC.Count;.......Addons.TabPlus.nIndex[Id] = await TC.SelectedIndex;.......Addons.TabPlus.nCount[Id] = nCount;.......if (o.lastChild && Addons.TabPlus.opt.New) {........o.removeChild(o.lastChild);.......}.......let nDisp = o.getElementsByTagName("li").l

                C:\Users\user\Desktop\extract\addons\tabplus\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):5507
                Entropy (8bit):5.363339545903153
                Encrypted:false
                SSDEEP:96:bRzfYiYSfYdX242/czFpNjeudGbmyiyxtaDpRHFEnVz9aB7LZfLMPMFEaoLLjDwd:lc24HjljyifpBOMBfgUF4DpkNv
                MD5:C76BDE649C2C0D9AC2288B64FBEE9033
                SHA1:DE4D92B3BA5DBD28521EE4CE6C585DEECD16CB2A
                SHA-256:7450AAF5215D3B2DCCB4B5D77FF2B24FC9566AEA30F9BC03BC012618C06AD0C7
                SHA-512:6095209C874618CE3D2E1B85D69D13FF6DAA8092435A6A7CDAFD23C59621D546B08D33F44A7222CC6AAC0D2C348B1BD430E5F80AF1698160571A22E46147F32A
                Malicious:false
                Reputation:low
                Preview:Common.TabPlus.rc = api.CreateObject("Object");..Common.TabPlus.rcItem = api.CreateObject("Object");....Sync.TabPlus = {...DropTo: !GetAddonOption("tabplus", "NoDropTo"),.....FromPt: function (Id, pt) {....const ptc = pt.Clone();....api.ScreenToClient(WebBrowser.hwnd, ptc);....const Items = Common.TabPlus.rcItem[Id];....const TC = te.Ctrl(CTRL_TC, Id);....if (TC) {.....for (let i = Math.min(Items.length, TC.Count); i-- > 0;) {......if (PtInRect(Items[i], ptc)) {.......return i;......}.....}....}....return -1;...},.....TCFromPt: function (pt) {....const ptc = pt.Clone();....api.ScreenToClient(WebBrowser.hwnd, ptc);....for (let Id in Common.TabPlus.rc) {.....const TC = te.Ctrl(CTRL_TC, Id);.....if (TC.Visible && PtInRect(Common.TabPlus.rc[Id], ptc)) {......return TC;.....}....}...},.....DropTab: function (FV, hwnd, pt) {....const sw = sha.Windows();....for (let i = 0; i < sw.Count; ++i) {.....const x = sw.item(i);.....if (x) {......const w = x.Document.parentWindow;......if (w && w.te &&

                C:\Users\user\Desktop\extract\addons\titlebar\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):684
                Entropy (8bit):5.146591302491771
                Encrypted:false
                SSDEEP:12:TMHd32eyL/iS/zFHlSbnvX6VqfOzWTWLL0oucIvMOGXJAB75rPog5uk8Z1ue+aFY:2dqrz14nCVC6JOG5AnIkW1KD
                MD5:C5671C66F4E4B469EA457A3801212523
                SHA1:6B163EA04C4706C18DBD651B1DE42C6EC3A9C87B
                SHA-256:79A4E725FA271AA3A77115BCF258504453088A28A93C3FF67832882544C73FC8
                SHA-512:035C4B2430A9CCC684D94A7308DBC50792FAA439A94754BF0EE6831AE025AD027B2938103741E1F70E0A7621FCE0A2BB67DF50D8FE79C5DCD51B9741679C45D6
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.09</Version>.. <MinVersion>2021.3.27</MinVersion>.. <pubDate>Tue, 17 Aug 2021 00:00:00 GMT</pubDate>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Title bar</Name>.. <Description>Title bar</Description>.. </en>.. <fr>.. <Name>Barre de titre</Name>.. <Description>Affichage de la barre de titre</Description>.. </fr>.. <ja>.. <Name>......</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\titlebar\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):139
                Entropy (8bit):5.0096553083975275
                Encrypted:false
                SSDEEP:3:C3/LDjF3BRFoeL/c5yXNeovsPGIRls7EQ6LKoqGPgxcYov:C3/LDjhFo28LovsPGIjJ2obPLYy
                MD5:3EA13FD52120169BC6F481BE755C1A4A
                SHA1:1FF8CF34A47B00854601E1F94E31F95DFFDC6B64
                SHA-256:A57CD733BF09D6DD0793D8EFF77627108010E0C31B58E75E7919017D13BB1C2E
                SHA-512:7B5E60E568A192BEE67D7A84EB4BC70732236974BABC59F65BF40887A8FB9D9017ACD5FF4616475A96738CD7C2C9EC0D4BEF1B49028CC1CEB54DB69095972E4C
                Malicious:false
                Reputation:low
                Preview:if (window.Addon == 1) {...AddEvent("ChangeView1", async function (Ctrl) {....document.title = await Ctrl.Title + ' - ' + TITLE;...});..}..

                C:\Users\user\Desktop\extract\addons\toolbar\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):718
                Entropy (8bit):5.1787628786593105
                Encrypted:false
                SSDEEP:12:TMHd32eyLDS/zFqSRSnv4zDX6VqfOzWTWLL0ouRv9gOGXJABVrD1ogIk8GMbeqle:2d1zangzmVC6OgOG5AekDn
                MD5:7BB7D3A0CB695E7A3FA0F3A47466791C
                SHA1:33C8BD36B64994A03EAA1685F7C0014556E9E67F
                SHA-256:CFB883535C799D73F73DF0BEFAD4B5BE497756D34BD0283629162E2792C52676
                SHA-512:3FEE797D09006DB9AEAA6A6AFD37BB15E9F4666B08392CF83972C6ED55C120319F1BD446431FFBFEE308F24734922CCA6E9A6A33A51778FBE2DAB9CA7D50D2B6
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.44</Version>.. <MinVersion>2022.3.27</MinVersion>.. <pubDate>Thu, 31 Mar 2022 00:00:00 GMT</pubDate>.. <Options>Common:4,6:4</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Tool bar</Name>.. <Description>Tool bar</Description>.. </en>.. <fr>.. <Name>Barre d'outils</Name>.. <Description>D.finition de la barre d'outils</Description>.. </fr>.. <ja>.. <Name>.....</Name>.. </ja>.. <zh>.. <Name>...</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\toolbar\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):3245
                Entropy (8bit):4.696112848988621
                Encrypted:false
                SSDEEP:96:VQSmCPMC9uZ2NUQxAflV40fEbmcRvAX6v:VQTCE/T5M0MbmcRoqv
                MD5:D550A2622CAB5B08BEB5095F9E718438
                SHA1:ADB666B46462072F6B24A4DCA2D178039A95F4FF
                SHA-256:230E77076531770A03B51600DCE991E0A000138919D1CDD1BE4A2926932669C6
                SHA-512:E4E28D28ECC1B858D676FD393D91730EBA0C9C3E17DD5629293D81A4FAC4032855E66A86962C54947F413B232309BC4CC6D5C0D5EEFD214F9F55B7C85A489460
                Malicious:false
                Reputation:low
                Preview:<label><input type="checkbox" id="!NoDD" value="2">Buttons</label><br>.. panel-->..<form name="E" style="display: inline;">.. <table width="100%">.. <tr>.. <td width="12.5em" valign="top">.. <select name="List" size="19".. style="width: 12.5em; height: 34em; height: calc(100vh - 9em); min-height: 17em".. onchange="EditXEx(EditTB)" ondblclick="EditTB()" oncontextmenu="CancelX('List')" multiple>.. </select>.. </td>.. <td valign="top">.. <label>Name</label>.. <br>.. <input type="text" name="Name" style="width: 100%" onchange="ChangeX('List')">.. <label>Type</label>.. <br>.. <select name="Type" onchange="ChangeX('List')">.. </select>.. <table class="layout">.. <tr>.. <td style="width: 100%; vertical-align: bottom">.. <label>Options</label>.. </td>.. <td class="buttons">.. <input type="button" value="Portable" oncli

                C:\Users\user\Desktop\extract\addons\toolbar\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:exported SGML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2164
                Entropy (8bit):5.286664595687199
                Encrypted:false
                SSDEEP:48:250f9Do+6WLdP+YFSPy4HLDbSZ/qyx2IYZllN1m6f:250f9Do+6WLdGYFSPy4nmdqyx29rlN1L
                MD5:201C17560D572F6197142F6FD4FDADE6
                SHA1:79F967CB227FE4E490AD432B0F934DB547BDA48D
                SHA-256:1C32590404977B6663370F381382C2264946D6AEC191E206C7253B82E23EEDD5
                SHA-512:7A01391D790FE1A5006A9F6913528EBBFA4D6ECE61A30E1C2B823A24A66447ECA17FD4CFB56ABB0571990C9A09FD19E59227E810796CAC544B61EF738B7D201E
                Malicious:false
                Reputation:low
                Preview:const ar = (await ReadTextFile("addons\\" + Addon_Id + "\\options.html")).split(" panel-->");..SetTabContents(0, "View", ar[0]);..SetTabContents(4, "General", ar[1]);....SaveLocation = async function () {...if (g_bChanged && document.E.Name.value) {....await ReplaceTB('List');...}...if (g_Chg["List"]) {....const xml = await CreateXml();....const root = await xml.createElement("TablacusExplorer");....const o = document.E.List;....for (let i = 0; i < o.length; i++) {.....const item = await xml.createElement("Item");.....const a = o[i].value.split(g_sep);.....item.text = a[1];.....await Promise.all([item.setAttribute("Name", a[0]), item.setAttribute("Type", a[2]), item.setAttribute("Icon", a[3]), item.setAttribute("Height", a[4])]);.....await root.appendChild(item);....}....await xml.appendChild(root);....await SaveXmlEx(Addon_Id + ".xml", xml);....te.Data["xml" + AddonName] = xml;...}..}....EditTB = async function () {...if (g_x.List.selectedIndex < 0) {....return;...}...ClearX("List"

                C:\Users\user\Desktop\extract\addons\toolbar\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):5868
                Entropy (8bit):5.307269766989454
                Encrypted:false
                SSDEEP:96:tIWLFJ+uSl31wTKLmmCXv05srTlORm/0DNL/qi8pSU/vRJSOKa19:Co+um35mmCfgs14m/0DN8dv/nH
                MD5:CEE70DA2F17598FBDA82C7B819A2391E
                SHA1:9C823CE8288281AA16C453CBDA3C82AAD28E6143
                SHA-256:739C58E54AAF31D51C2CFCC28055D4F7BB7B1502C08BD0E009F81F8E90796FBC
                SHA-512:95352D39DE33DD183F19FCB26BB273A22BCF62E0A3FC9B7E1C60A22E425B00D5722BBEF64B563614F347DE100ED300EC9060E686A5566008B236D831B796531E
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "toolbar";..const Default = "ToolBar2Left";..if (window.Addon == 1) {...Addons.ToolBar = {....Click: async function (i, bNew) {.....const items = await GetXmlItems(await te.Data.xmlToolBar.getElementsByTagName("Item"));.....const item = items[i];.....if (item) {......Exec(te, item.text, (bNew && /^Open$|^Open in background$/i.test(item.type)) ? "Open in new tab" : item.Type, ui_.hwnd, null);.....}.....return false;....},......Down: function (ev, i) {.....if ((ev.buttons != null ? ev.buttons : ev.button) == 4) {......return this.Click(i, true);.....}....},......Open: async function (ev, i) {.....if (Addons.ToolBar.bClose) {......return S_OK;.....}.....if ((ev.buttons != null ? ev.buttons : ev.button) == 1) {......const items = await te.Data.xmlToolBar.getElementsByTagName("Item");......let item = await items[i];......const hMenu = await api.CreatePopupMenu();......const arMenu = await api.CreateObject("Array");......for (let j = await GetLength(items); --j > i;) {......

                C:\Users\user\Desktop\extract\addons\toolbar\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2739
                Entropy (8bit):5.358421639432561
                Encrypted:false
                SSDEEP:48:9qj2g68QTAJFtUzQ7LmEsddRj1BhcOj1BbfPonUKwoYmsM1abfPonUKweYPwWzDY:ImEsddJ1HvfYUNSsM+fYUNhwWzDKjv
                MD5:33F8243D348F3477DDAD503E64121E2B
                SHA1:174609B6458ABCBB9705165DE2CDC48545D1B335
                SHA-256:54122D04CC33D096BF0CD78C5F3F6808414A36454829BC99B1C332E81191D84D
                SHA-512:A0AC18B36D14939B2C6E155EF36DA4F11D81618E723093DFB17A2B9B7DDA9CA870F9B4D1B5D7A024A66F853860C6C1E02D44D68550F37A7AF95A3572D7977BBB
                Malicious:false
                Reputation:low
                Preview:Common.ToolBar = api.CreateObject("Object");..Common.ToolBar.Items = api.CreateObject("Array");....Sync.ToolBar = {...FromPt: function (ptc) {....for (let i = Common.ToolBar.Count; --i >= 0;) {.....if (PtInRect(Common.ToolBar.Items[i], ptc)) {......return i;.....}....}....return -1;...},.....Append: function (dataObj) {....const xml = te.Data.xmlToolBar;....let root = xml.documentElement;....if (!root) {.....xml.appendChild(xml.createProcessingInstruction("xml", 'version="1.0" encoding="UTF-8"'));.....root = xml.createElement("TablacusExplorer");.....xml.appendChild(root);....}....if (root) {.....for (let i = 0; i < dataObj.Count; i++) {......const FolderItem = dataObj.Item(i);......const item = xml.createElement("Item");......item.setAttribute("Name", api.GetDisplayNameOf(FolderItem, SHGDN_INFOLDER));......item.text = api.GetDisplayNameOf(FolderItem, SHGDN_FORPARSINGEX | SHGDN_FORPARSING);......if (fso.FileExists(item.text)) {.......item.text = PathQuoteSpaces(item.text);.......item.s

                C:\Users\user\Desktop\extract\addons\treeview\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):726
                Entropy (8bit):5.194021899418081
                Encrypted:false
                SSDEEP:12:TMHd32eyLRFS/zFcAS5YAnv4/qSybX6VqfOzWTWLL0ouvR+OGX+grDh4k8GjeUle:2dJzongYuVC6uIOGOi4kD2
                MD5:CB66AA9F0617E324817EADFD8C4423D1
                SHA1:4D40F2079B119528FD4CE5DB1D2CA86B18A2E9D2
                SHA-256:52BA3DFD3088C82BC83DCC6A1A05E0742DC0930744AFDB3509C1422EFD6A09D7
                SHA-512:2B3D277472C43F0AA963A0D05CFC74103915992BEF31E0F412191221BD0880ED5643809B2C5053D241304F0060C81558E2B80EC5C91A2B8CCF8963D4EBCA83FE
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.48</Version>.. <MinVersion>2024.10.11</MinVersion>.. <pubDate>Fri, 22 Nov 2024 00:00:00 GMT</pubDate>.. <Options>Common:0,5,6,7,8,9:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Tree view</Name>.. <Description>Tree view</Description>.. </en>.. <fr>.. <Name>Arborescence</Name>.. <Description>D.finition de la vue arborescente</Description>.. </fr>.. <ja>.. <Name>...</Name>.. </ja>.. <zh>.. <Name>....</Name>.. </zh>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\treeview\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):374
                Entropy (8bit):4.985445016499596
                Encrypted:false
                SSDEEP:6:+KqGuQ2EJQAqEMS+Bm/f9TKHOu3P3qGuQC6AqEiWZwDu3P3qGuQ3qEMS+BmdcHpW:SGukQlC+m/feJ3iGualpWb3iGuVC+mYM
                MD5:475E2DC3C3560F543A844CD349EE4DFA
                SHA1:8BAA1E1524D0DEEAB913AE7DF4FEF849D3A305AA
                SHA-256:00C41C3ECF78AACB8A41797B210F0F6AE5F8B57148812B81B6BBA677558091BF
                SHA-512:5A4C73A8A8916F4EF7554F8C30E09FCF52CA0FCDFE4B89D137979CA8F23964D1ED271ABBDEE1E4C2854AD8AD88A9904F0E7DEA0956A9230D948E3CF0C8F0587B
                Malicious:false
                Reputation:low
                Preview:<label><input type="checkbox" id="Depth" value="1">@shell32.dll,-32788[Expanded]</label><br>..<label><input type="checkbox" id="List" value="1">List</label><br>..<label><input type="checkbox" id="Collapse" value="1">@shell32.dll,-32789[Collapse Folders]<span> (</span>Auto<span>)</span></label><br>..<label><input type="checkbox" id="Refresh" value="1">Refresh</label><br>..

                C:\Users\user\Desktop\extract\addons\treeview\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1223
                Entropy (8bit):5.2741012610162095
                Encrypted:false
                SSDEEP:24:hOos+frQtRWdLf5645WRTUwvjUdIu1AwRBmwoN2qx9XnJE:wATgRILf5645WdwW4tzAN2o9ZE
                MD5:039232BD4662684F2A888911CF1BCB81
                SHA1:61E95E3813717150A0E3FA05B19BAB2985DD2327
                SHA-256:A68CEF3F402F97B56FC0297FE7B013E0C058B63E65176FED15D0639F89EE2689
                SHA-512:84ABE0D9E45C5EDC1DFCF88FD83EB26DBA37BA82C143C39FBE0FDED509F9D78BE68C9F254EFA806AFC36CF60B4FDF2870B91D417A823DDE74031C97838F4D717
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "treeview";..const Default = "ToolBar2Left";..const item = await GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("MenuPos", -1);...item.setAttribute("List", 1);..}..if (window.Addon == 1) {...Addons.TreeView = {....Popup: async function (o) {.....const FV = await GetFolderView(o);.....if (FV) {......FV.Focus();......const TV = await FV.TreeView;......if (TV) {.......InputDialog(await GetText("Width"), await TV.Width, function (n) {........if (n) {.........TV.Width = n;.........TV.Align = true;........}.......});......}.....}.....return false;....}...};.....AddEvent("Layout", async function () {....const h = GetIconSizeEx(item);....SetAddon(Addon_Id, Default, ['<span class="button" onclick="SyncExec(Sync.TreeView.Exec, this)" oncontextmenu="return Addons.TreeView.Popup(this)" onmouseover="MouseOver(this)" onmouseout="MouseOut()">', await GetImgTag({.....title: await GetText("Tree"),.....src: item.getAttribute("Icon") || "bitmap:ieframe.d

                C:\Users\user\Desktop\extract\addons\treeview\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (354), with CRLF line terminators
                Category:dropped
                Size (bytes):5249
                Entropy (8bit):5.453123745256295
                Encrypted:false
                SSDEEP:96:yWgVVkYaw9vyYigQ9z1xzlX7IC2l3xMx2eqkH8gk2qf5K1qIj/PtC4PnJQ46dyMd:yWFwgZ7v2l3xMx2eq3TxdIj/P04PO42d
                MD5:F6FD56E64F65B8C62C452181DD463305
                SHA1:0BF85B9489534FA478F3D0428FF7E2BAF8F630D6
                SHA-256:5375BD8DFDD7FF95541EE822D32F18110C8269F6940F97B117E4B7BDA98A72CF
                SHA-512:09B41E2790EA2D098002ECC4338B0DE4D7C7129C44082D40A7740C20D2A1E0818E738F0EF86265E379F40B0BFBA0FCF5F7C301EC13F955F0588AC98C9F05049C
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "treeview";..const item = GetAddonElement(Addon_Id);....Sync.TreeView = {...strName: "Tree",...List: item.getAttribute("List"),...nPos: 0,...Depth: GetNum(item.getAttribute("Depth")),...Collapse: GetNum(item.getAttribute("Collapse")),.....Exec: function (Ctrl, pt) {....const FV = GetFolderView(Ctrl, pt);....if (FV) {.....FV.Focus();.....const TV = FV.TreeView;.....if (TV) {......TV.Visible = !TV.Visible;......if (TV.Visible) {.......if (!TV.Width) {........TV.Width = 200;.......}.......Sync.TreeView.Expand(FV);......}.....}....}....return S_OK;...},.....Expand: function (Ctrl) {....if (Sync.TreeView.List && Ctrl.FolderItem && IsWitness(Ctrl.FolderItem)) {.....const TV = Ctrl.TreeView;.....if (TV) {......if (Sync.TreeView.Collapse) {.......const hwnd = TV.hwndTree;.......let hItem = api.SendMessage(hwnd, TVM_GETNEXTITEM, 9, null);.......let Now = TV.SelectedItem;.......let New = Ctrl.FolderItem;.......let nUp = Sync.TreeView.Depth ? 0 : 1;.......while (api.ILGetCount(Ne

                C:\Users\user\Desktop\extract\addons\undoclosetab\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):857
                Entropy (8bit):5.479766588983144
                Encrypted:false
                SSDEEP:12:TMHd32eyLupS/zFYFS83nv4/qSybX6VqfOzWTWLL0oo24YBhOGX+yovT6cak8L1L:2dVQzo3ngYuVC6g2bBhOGxVNkc1zOg
                MD5:58F0C14139D0D98E65C1A39B71CC3D9A
                SHA1:65778751AC078BC6083618250D8D6D756CCB8810
                SHA-256:029FC6D672A8CC98987FE8547A56228F1EF3DCD322DBBF2242A88A7D2D51FA76
                SHA-512:863C2181EDB11537B4CB22AE4E5279264B547076EF2B29DAC7728869F4A499E14A88C441D020B0F41759CF06F2D0EC1383BFECD7F2031C66609A0DF8BBFFCD7D
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.18</Version>.. <MinVersion>2024.8.6</MinVersion>.. <pubDate>Mon, 23 Sep 2024 00:00:00 GMT</pubDate>.. <Options>Common:0,5,6,7,8,9:0</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Undo close tab</Name>.. <Description>Undo close tab.</Description>.. </en>.. <fr>.. <Name>D.faire la fermeture d'onglet</Name>.. <Description>Annule la derni.re fermeture d'onglet.</Description>.. </fr>.. <ja>.. <Name>..........</Name>.. </ja>.. <zh>.. <Name>.......</Name>.. </zh>.. <zh_cn>.. <Name>.........</Name>.. </zh_cn>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\undoclosetab\lang\ja.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                Category:dropped
                Size (bytes):148
                Entropy (8bit):5.529220366889474
                Encrypted:false
                SSDEEP:3:JLWMNHU8LdgCfgLWCccsdwTAQojk7a1GwgtxezyhVAKAiuzLWCn:JiMVBd/gLWC1syJojz1DXzYaKCz6Cn
                MD5:A5C171863A3821DF4755448B12D468C2
                SHA1:3F00DE57C28BABC68ECFFE898EDCE878639EC476
                SHA-256:7D852173D56F747CBA5B003E4FB3C25087BD069CE2B191DE1D6FEC86A57B1D14
                SHA-512:F44CE4C159497F3E886D4E1E253CD69DBBB0906EAC7A7112582F6FBC95B4F9B51F944C088D9ED100F90CD9169EB8D6BC6CF55D3C569198681DE73E9738F848C1
                Malicious:false
                Reputation:low
                Preview:.<?xml version="1.0" encoding="UTF-8"?>..<resources>...<text s="&amp;Undo close tab">..........(&amp;U)</text>..</resources>..

                C:\Users\user\Desktop\extract\addons\undoclosetab\lang\zh.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):97
                Entropy (8bit):5.254084621115127
                Encrypted:false
                SSDEEP:3:YCccsdwTAQo+nkXgzEZ2uzLWCn:YC1syJoDXgEdz6Cn
                MD5:1D5612806CC7A6C0E46D96A9C4858E41
                SHA1:0BEA06E92CE42EEEB889B8268C35817536142A39
                SHA-256:8C4408CF4F744BC8F26DF876C7559AE507875434401BC1476261804E3A2ACC6D
                SHA-512:80E2650BECE1FCF1E48601770591101EA6BD517C46537EE29E3C8712BB41BDF3C33AB45952EB6C194ECA1BF5C6CF21D0859BA18E1311BCDCC5BE5F0BAAF5866D
                Malicious:false
                Reputation:low
                Preview:<resources>...<text s="&amp;Undo close tab">..........</text>..</resources>..

                C:\Users\user\Desktop\extract\addons\undoclosetab\lang\zh_cn.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):100
                Entropy (8bit):5.189436845812487
                Encrypted:false
                SSDEEP:3:YCXYYdwTAQo+nkXgzEZ2uzLWCn:YCXYYyJoDXgEdz6Cn
                MD5:2DC4F1B8DDA7E048C8D467C0BBAD0449
                SHA1:6AED123AECE1E9C2C76E55A6BE8C589588073EA9
                SHA-256:F4DAE33E4E59A6C3A90110126E62F5AF206336479D93FBC142CFD00EB829AD65
                SHA-512:C81E7B4AEB8274D8015BA56814D42467961EE88B54A7735D6EF2875E0A421949567F31DBDD6550053BAADBA951498593E0C21DDC05A29C2A62E820EE875813D4
                Malicious:false
                Reputation:low
                Preview:<resources>.. <text s="&amp;Undo close tab">..........</text>..</resources>..

                C:\Users\user\Desktop\extract\addons\undoclosetab\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1722
                Entropy (8bit):5.27286461675719
                Encrypted:false
                SSDEEP:24:DK+zgQNAsAt/7iaunctJLPEeDESyswSmrKU41O/nRBKRzwukKbqQ9X0z:HzgQSht/2/n8Jzj/4rVqkzKRhkKbd9q
                MD5:B2C8CDD5A3E5914D366132EFE4A12185
                SHA1:991E9CB4B35394E7A6C037A3A13ABEFB75728C22
                SHA-256:064A1CDEA0E312E534A2AA11E3FBA091BA1C2EF16E36BEC12BABA895C06E3734
                SHA-512:C2DA91C141473190A87BF697BB622E9D1CFD02C49B21CA8C3284F90C10779CF09A8E641EAD66B5C505098177F57879CD37D58F4DE96526D94837F71EC13889EA
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "undoclosetab";..const Default = "None";..const item = await GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("MenuExec", 1);...item.setAttribute("Menu", "Tabs");...item.setAttribute("MenuPos", 0);.....item.setAttribute("KeyExec", 1);...item.setAttribute("Key", "Shift+Ctrl+T");...item.setAttribute("KeyOn", "All");.....item.setAttribute("MouseExec", 1);...item.setAttribute("Mouse", "3");...item.setAttribute("MouseOn", "Tabs_Background");..}..if (window.Addon == 1) {...Addons.UndoCloseTab = {....Popup: async function (Ctrl, pt) {.....if (Addons.RecentlyClosedTabs) {......Addons.RecentlyClosedTabs.Exec(Ctrl, pt);.....}....},......KillTimer: function () {.....if (Addons.UndoCloseTab.tid) {......clearTimeout(Addons.UndoCloseTab.tid);......delete Addons.UndoCloseTab.tid;.....}....},......Save: function () {.....Addons.UndoCloseTab.KillTimer();.....Common.UndoCloseTab.bSave = true;.....Addons.UndoCloseTab.tid = setTimeout(function () {......Syn

                C:\Users\user\Desktop\extract\addons\undoclosetab\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):4053
                Entropy (8bit):5.36662582802152
                Encrypted:false
                SSDEEP:96:0ddYSKHDrvMRWXs6q/pQBFEQPzdZ7psdLMdkFltEa45q3BfQ/PoJ:8OSKHDrvC0PEQipg4lQ/PoJ
                MD5:B843544DE49CBD31DE911414D8122633
                SHA1:30FFBB11CB2371A7651697EAFFC5630F0D773C45
                SHA-256:2F6E5A83D8592C380E8EA25FDA29A11101B7E7952DAEBDE53B560F97E922364A
                SHA-512:1EE4723024F417BCF03359319004CBE4E8B08CBD8788AABD9E880F103392FCFB31FBA98813138719D7E9C795BDD8B93042BDFC5EBEB74CB0DAC0EF75CADCF034
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "undoclosetab";..const item = GetAddonElement(Addon_Id);....Common.UndoCloseTab = api.CreateObject("Object");..Sync.UndoCloseTab = {...Items: item.getAttribute("Save") || 30,...strName: item.getAttribute("MenuName") || GetAddonInfo(Addon_Id).Name,...nPos: GetNum(item.getAttribute("MenuPos")),...CONFIG: fso.BuildPath(te.Data.DataFolder, "config\\closedtabs.xml"),.....Exec: function (Ctrl, pt) {....const FV = GetFolderView(Ctrl, pt);....if (FV) {.....Sync.UndoCloseTab.bLock = true;.....const db = (Common.UndoCloseTab.db || []);.....while (db.length) {......Sync.UndoCloseTab.bFail = false;......Sync.UndoCloseTab.Open(FV, 0);......if (!Sync.UndoCloseTab.bFail) {.......break;......}.....}.....Sync.UndoCloseTab.bLock = false;....}....return S_OK;...},.....Open: function (FV, i) {....if (FV) {.....const Items = Sync.UndoCloseTab.Get(i);.....const db = (Common.UndoCloseTab.db || []);.....db.splice(i, 1);.....FV.Navigate(Items, SBSP_NEWBROWSER);.....InvokeUI("Addons.UndoCloseTa

                C:\Users\user\Desktop\extract\addons\up\config.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):677
                Entropy (8bit):5.104295785637424
                Encrypted:false
                SSDEEP:12:TMHd32eyLjFS/zFDioSbnv4/BX6VqfOzWTWLL0oKatOGXd3lt+Sgybfk8IEen:2dzzCng/8VC6LtOGTM0bfkR
                MD5:FAE9ECCBDC90E1229D9C43BF3BA66C3E
                SHA1:A656263433E6503200F1A673AEEBC94D5AE35F6E
                SHA-256:B913A0D53FEE0BD62E8B004F477497C79896F81F955FFFA8228E92E3D22709C3
                SHA-512:A5D64783370518E4EB21F2809D098929A2F83B5F3020E20840654122605E59CC742FAFC1BFA05AD4F770C6ADF7DA9CE082E042B85C278A683E0AF0E64EEF83EF
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>.. <General>.. <Version>1.20</Version>.. <MinVersion>2021.7.23</MinVersion>.. <pubDate>Tue, 17 Aug 2021 00:00:00 GMT</pubDate>.. <Options>Common:5,6,7,8,9:5</Options>.. <Level>2</Level>.. <Creator>Gaku</Creator>.. <URL>https://tablacus.github.io/TablacusExplorerAddons/</URL>.. <License>MIT License</License>.. </General>.. <en>.. <Name>Up</Name>.. <Description>Up</Description>.. </en>.. <fr>.. <Name>Remonter - global</Name>.. <Description>Place ce bouton dans la barre d'outil principale</Description>.. </fr>.. <ja>.. <Name>..</Name>.. </ja>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\addons\up\script.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2714
                Entropy (8bit):5.307486712336948
                Encrypted:false
                SSDEEP:48:F7A28tU3YbjtnYTBMEN52oIgS0NL67j9c64UywIZ53igxPD35rL/rMstiL/rlX1f:FE28tUKjtnYTBMo2oIKL+JP4pwIjiePM
                MD5:43FB41548F497B600DC26A6A675BDA33
                SHA1:9276A1E0B196833FFA61275F11D44F4838803ABA
                SHA-256:C83E090A69DBA440FE2985334866070B57EDD4E94E81E0BCAE36645A09E5A6C3
                SHA-512:9B2A01E40386B86AAA4B3D41D2A5840F9D51056F685BCB8FF5D185AE0FB1F066D8A7E0FB51ACEC743CDE7F2E7666177C4CAACD5B795EC0FFA3F4584F39D675DF
                Malicious:false
                Reputation:low
                Preview:const Addon_Id = "up";..const Default = "ToolBar2Left";..let item = await GetAddonElement(Addon_Id);..if (!item.getAttribute("Set")) {...item.setAttribute("Menu", "View");...item.setAttribute("MenuPos", -1);.....item.setAttribute("KeyOn", "List");...item.setAttribute("Key", "$e");.....item.setAttribute("MouseOn", "List");...item.setAttribute("Mouse", "2U");..}..if (window.Addon == 1) {...Addons.Up = {....Exec: async function (Ctrl, pt) {.....const FV = await GetFolderView(Ctrl, pt);.....FV.Focus();.....Exec(FV, "Up", "Tabs", 0, pt);....},......Popup: async function (el) {.....const FV = await GetFolderView(el);.....if (FV) {......FV.Focus();......await FolderMenu.Clear();......const hMenu = await api.CreatePopupMenu();......let FolderItem = await FV.FolderItem;......if (await api.ILIsEmpty(FolderItem)) {.......FolderItem = ssfDRIVES;......}......while (!await api.ILIsEmpty(FolderItem)) {.......FolderItem = await api.ILRemoveLastID(FolderItem);.......FolderMenu.AddMenuItem(hMenu, Folder

                C:\Users\user\Desktop\extract\init\addons.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (591), with CRLF line terminators
                Category:dropped
                Size (bytes):593
                Entropy (8bit):4.507798308661272
                Encrypted:false
                SSDEEP:6:WlY16KDku9WRK5OS5v5FMOm8KFSLaSIb2QWFS7uK14YMgfQlpQyu8/FSnY1en:b6KDkLgxv4S6CucgfcpjZFen
                MD5:D05109328CF2697A88370B9F6ABE31FE
                SHA1:754BF73A3FC7A48E4ED0C2B727F0A33C4FB8D5D1
                SHA-256:94404EFC5FB101D4BCEAE92921AADD83170F77A7165781435F3984E84D342121
                SHA-512:B273CA924A95631134AEAC1DC765D1B90CBAE170EDD057B793B0A9AED1ADF92D606BCCF1B579DB1E2435998DAF1C4AF97A1CFC3942D8275DD148D4EBB4398DD6
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer><mouse Enabled="1" Level="2"/><key Enabled="1" Level="2"/><addressbar Enabled="1" Level="2"/><filterbar Enabled="1" Level="2"/><back Enabled="1" Level="2"/><forward Enabled="1" Level="2"/><up Enabled="1" Level="2"/><treeview Enabled="1" Level="2"/><toolbar Enabled="1" Level="2"/><mainmenu Enabled="1" Level="2"/><titlebar Enabled="1" Level="2"/><tabplus Enabled="1" Level="2"/><multithread Enabled="1" Level="2"/><remember Enabled="1" Level="2"/><undoclosetab Enabled="3" Level="2"/><aboutblank Enabled="1" Level="2"/><segoeicons Enabled="1" Level="2"/></TablacusExplorer>..

                C:\Users\user\Desktop\extract\init\key.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1611), with CRLF line terminators
                Category:dropped
                Size (bytes):2197
                Entropy (8bit):5.280617871685869
                Encrypted:false
                SSDEEP:24:vq1xXJH80s4Xhs4ZIBorVvK4Z946ge7bsLyQPVqyQEVwBgBBl2Ruio+RHS:S1xXns4Xhs42T4ZC63ULPNqPMs4QfBJS
                MD5:347ECF2C11B802FA1BE637155AD64D48
                SHA1:E7596DB8196ABF32FF270F6C23E35ED814D35BAA
                SHA-256:6DF5EF41B703E30B6A768F840D507077BC760DCC834F5CC8F1E9A8FFE393DA3E
                SHA-512:EC5543C437B914EADD91CC0B19B1483DC71D16BF696DC5B1702E75A4860D9D4E23523EBB6A01631DF49E7847845298A1C3AE7FA8CAAB047AAD7C42F45C70D17B
                Malicious:false
                Reputation:low
                Preview:.<TablacusExplorer><All Key="$3f,Ctrl+R" Type="Tabs">Refresh</All><All Key="$57" Type="JavaScript">ToggleFullscreen();</All><All Key="$200f" Type="Tabs">Next Tab</All><All Key="$300f" Type="Tabs">Previous Tab</All><All Key="$214b" Type="JScript">var TC = te.Ctrl(CTRL_TC);..if (TC) {.. if (TC.Selected.CurrentViewMode == FVM_DETAILS) {.. ChangeTab(TC, -1);.. return S_OK;.. }..}..return S_FALSE;</All><All Key="$214d" Type="JScript">var TC = te.Ctrl(CTRL_TC);..if (TC) {.. if (TC.Selected.CurrentViewMode == FVM_DETAILS) {.. ChangeTab(TC, 1);.. return S_OK;.. }..}..return S_FALSE;</All><All Key="Ctrl+1" Type="Tabs">0</All><All Key="Ctrl+2" Type="Tabs">1</All><All Key="Ctrl+3" Type="Tabs">2</All><All Key="Ctrl+4" Type="Tabs">3</All><All Key="Ctrl+5" Type="Tabs">4</All><All Key="Ctrl+6" Type="Tabs">5</All><All Key="Ctrl+7" Type="Tabs">6</All><All Key="Ctrl+8" Type="Tabs">7</All><All Key="Ctrl+9" Type="Tabs">-1</All><All Key="Ctrl+F" Type="Tools">Search</All><All Key="$414b"

                C:\Users\user\Desktop\extract\init\menus.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (2873), with CRLF line terminators
                Category:dropped
                Size (bytes):2875
                Entropy (8bit):4.948596709254717
                Encrypted:false
                SSDEEP:48:xbPCQhCsrZhSOh68L2sNEFSDbJ20svnHsd9OF:x+g1rjSuvwvHsdcF
                MD5:6C92BCD9B7B7DA2B34EC11A04E7C265E
                SHA1:BCEE8B7562877BDF49040362BC7EDB5855DB6BCD
                SHA-256:D260DAAC3202568AB3C97736685A27CB9ACBFE5B8042D1C250E8E0D41EBD0ADE
                SHA-512:EF634816F2BDB4CD1459B400A165F79324F4258129574A04CED7C3F1034E415B69DD3E2ED2BF27A06A0C2E5834C596D3399E92128308FA4FA86A0A5F7F1D6B3C
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer><Default Base="1" Pos="-1"><Item Name="Folder" Filter="*.folder" Type="Selected Items" Icon="">Open</Item></Default><Context Base="2" Pos="1"><Item Name="Open in New Tab" Filter="*.folder" Type="Selected Items" Icon="">Open in New Tab</Item><Item Name="Open in Background" Filter="*.folder" Type="Selected Items" Icon="">Open in Background</Item></Context><Background Base="3" Pos="0"/><Tabs Base="0" Pos="0"><Item Name="&amp;Close Tab\t$2011" Filter="*" Type="Tabs" Icon="">Close Tab</Item><Item Name="Cl&amp;ose Other Tabs" Filter="" Type="Tabs" Icon="">Close Other Tabs</Item><Item Name="Close Tabs on Left" Filter="*" Type="Tabs" Icon="">Close Tabs on Left</Item><Item Name="Close Tabs on Right" Filter="*" Type="Tabs" Icon="">Close Tabs on Right</Item><Item Name="" Filter="" Type="Menus" Icon="">Separator</Item><Item Name="&amp;Refresh\t$3f" Filter="*" Type="Tabs" Icon="">Refresh</Item><Item Name="&amp;New Tab\t$2014" Filter="" Type="Tabs" Icon="">New Tab</Item><Item Name=

                C:\Users\user\Desktop\extract\init\mouse.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (1225), with CRLF line terminators
                Category:dropped
                Size (bytes):1227
                Entropy (8bit):4.924868304817954
                Encrypted:false
                SSDEEP:24:il8JH75DilWsuIKneGsKHZt7Hco5DUTUZ3fn87m187W4:P1DilWsuIKneGsKHRDU45n8t
                MD5:02094635B233528D977C5991613CCA12
                SHA1:7D79524F05EF15924013C0C75C9172412E24ACD3
                SHA-256:FF33A73831AC91F4C9BDF895A0DD73D62FF3A38BB851E47E40B8BA44664D1A61
                SHA-512:402937ED7FDCBB2A6E186A295E9E7CE0DAF2154A78FC881A812F5CA8A08739447AAB91B0C9FDE365948591DFB8528216CFE8CF978E21461998EFD4794A35CC1C
                Malicious:false
                Reputation:low
                Preview:<TablacusExplorer><All Name="Previous Tab" Mouse="28" Type="Tabs">Previous Tab</All><All Name="Next Tab" Mouse="29" Type="Tabs">Next Tab</All><List Name="Back" Mouse="2L" Type="Tabs">Back</List><List Name="Forward" Mouse="2R" Type="Tabs">Forward</List><List Name="Up" Mouse="2U" Type="Tabs">Up</List><List Name="Refresh" Mouse="2UD" Type="Tabs">Refresh</List><List Name="New Tab" Mouse="2D" Type="Tabs">New Tab</List><List Name="Close Tab" Mouse="2DR" Type="Tabs">Close Tab</List><List Name="Forward" Mouse="12" Type="Tabs">Forward</List><List Name="Back" Mouse="21,4" Type="Tabs">Back</List><List Name="Open in Background" Mouse="3" Type="Selected Items">Open in Background</List><List Name="Forward" Mouse="5" Type="Tabs">Forward</List><List_Background Name="Up" Mouse="11" Type="Tabs">Up</List_Background><List_Background Name="New Tab" Mouse="3" Type="Tabs">New Tab</List_Background><Tabs Name="Lock" Mouse="11" Type="Tabs">Lock</Tabs><Tabs Name="Close Tab" Mouse="3" Type="Tabs">Close Tab</Tabs>

                C:\Users\user\Desktop\extract\lang\cs.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8891
                Entropy (8bit):5.15403099598643
                Encrypted:false
                SSDEEP:192:ECSP4yysHCKAYHppg/Sc58BjsXdggfq4T:prsZ1zXBjstggfqA
                MD5:664A218BA77C551C349782352E719F51
                SHA1:A37D9BAB61E90D1F4238657791E4589E939B86AA
                SHA-256:2A63CEE480819C609847282B7734D56D5717403E58B69BB80C6ECE0E07888E4C
                SHA-512:756C324094211CB12D55A7A2B0242DD158E063979297BA9C8710694D9D415534FCC166BB5CB7C4F9C082368D5AFD36BC9F46A82E6083D0E01ADADAA5E85A5504
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="OUBRECHT.com" en="Czech">.esky</lang>...<text s="&amp;File">&amp;Soubor</text>...<text s="&amp;Edit">&amp;Upravit</text>...<text s="&amp;View">&amp;Zobrazit</text>...<text s="F&amp;avorites">O&amp;bl.ben.</text>...<text s="&amp;Tools">&amp;N.stroje</text>...<text s="&amp;Help">&amp;Pomoc</text>...<text s="Back">Zp.t</text>...<text s="Forward">Vp.ed</text>...<text s="Up">Nahoru</text>...<text s="Down">Dol.</text>...<text s="Go">jdi</text>...<text s="&amp;Close application">&amp;Zav..t aplikaci</text>...<text s="&amp;Up one level">&amp;O .rove. v..</text>...<text s="&amp;Refresh">&amp;Obnovit</text>...<text s="&amp;Reload customize">&amp;Znovu na..st p.izp.soben.</text>...<text s="&amp;Load layout...">&amp;Na..st rozlo.en....</text>...<text s="&amp;Save layout...">&amp;Ulo.it rozlo.en....</text>...<text s="&amp;Options...">&amp;Mo.nosti...</text>...<text s="&amp;Close tab">&amp;Zav..t panel</text>...<text s="Cl&amp;ose other tabs">Z

                C:\Users\user\Desktop\extract\lang\de.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8756
                Entropy (8bit):4.96809512620748
                Encrypted:false
                SSDEEP:192:nKY8KUsAv/vnYGCPAfowDoS9u0D3VnAkyolBYOhXCgoTUaoL:SNXoS9BikrBYFjoL
                MD5:FC0A9236DA2E865DB36AC269BC7E53D0
                SHA1:79157839A73D1076D838972B3AF8D97B497E43ED
                SHA-256:C36262E81C0FDB4F739D1D8CFEDD03030556581351FB2F6982C465CAA0F0F9B7
                SHA-512:23476B5142C3D56C79AE605C4092282559676C4C856500B859BAF7F875425A144542B0FF7D6606A64C97E50D2E777402E84EC6E7AE7E46416911B4A6E6C322CA
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="LightTempler" en="German">Deutsch</lang>...<text s="&amp;File">&amp;Datei</text>...<text s="&amp;Edit">&amp;Bearbeiten</text>...<text s="&amp;View">&amp;Ansicht</text>...<text s="F&amp;avorites">&amp;Favoriten</text>...<text s="&amp;Tools">&amp;Tools</text>...<text s="&amp;Help">&amp;Hilfe</text>...<text s="Back">Zur.ck</text>...<text s="Forward">Vorw.rts</text>...<text s="Up">Hoch</text>...<text s="Down">Runter</text>...<text s="Go">Los</text>...<text s="&amp;Close application">&amp;Beenden</text>...<text s="&amp;Up one level">&amp;Eine Ebene h.her</text>...<text s="&amp;Refresh">&amp;Aktualisieren</text>...<text s="&amp;Reload customize">&amp;Einstellungen erneut laden</text>...<text s="&amp;Load layout...">&amp;Lade Layout...</text>...<text s="&amp;Save layout...">&amp;Sichere Layout...</text>...<text s="&amp;Options...">&amp;Optionen...</text>...<text s="&amp;Close tab">&amp;Tab schlie.en</text>...<text s="Cl&amp;ose other tabs">&amp;Andere Tabs schl

                C:\Users\user\Desktop\extract\lang\el.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                Category:dropped
                Size (bytes):11565
                Entropy (8bit):5.326643451721098
                Encrypted:false
                SSDEEP:192:SUxGSJovnovkMhmgku9RJr2takS9rfvZH0CF856Q4akTX:SAGSJovMJr9R92t0NvZVFaH47
                MD5:7E54C51AEEADF0AD061AC055E9C175E4
                SHA1:26F2A2D0733C8BB038CAD722962010AE15184F9C
                SHA-256:0242158EE61EABC47F6FFF7D6E6A015C8450893C63A14AB2F0612FE771EB4B9D
                SHA-512:11840FFCC15F3BA716C1991CC852D2C68F53239DA321D5D74488995782EA02D881CE80C53800C5A74E3679E7607066CD7B9067950D05A9A36D5A2EB7A4A12365
                Malicious:false
                Reputation:low
                Preview:.<resources>...<lang author="geogeo.gr" en="Greek">........</lang>...<text s="&amp;File">&amp;......</text>...<text s="&amp;Edit">&amp;...........</text>...<text s="&amp;View">.&amp;......</text>...<text s="F&amp;avorites">.&amp;........</text>...<text s="&amp;Tools">....&amp;....</text>...<text s="&amp;Help">&amp;.......</text>...<text s="Back">....</text>...<text s="Forward">.......</text>...<text s="Up">....</text>...<text s="Down">....</text>...<text s="Go">........&#160;</text>...<text s="&amp;Close Application">&amp;........ .........</text>...<text s="&amp;Up One Level">... ....... &amp;....</text>...<text s="&amp;Refresh">.&amp;.......</text>...<text s="&amp;Reload Customize">&amp;............ ...........</text>...<text s="&amp;Load Layout...">&amp;....... ...........</text>...<text s="&amp;Save Layout...">&amp;....

                C:\Users\user\Desktop\extract\lang\en.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                Category:dropped
                Size (bytes):8287
                Entropy (8bit):4.879262745287795
                Encrypted:false
                SSDEEP:96:xEqXtJsimVWBEYA2Xy8wTDltLhJrcseUej1EjRPkkk+iM/V8VybdDfyR8R:WqXtJsiCYy8wTDlHb+qjRPkkk+ivrq
                MD5:5BA7A66EC5B05CDBB6AD62D7ADEC1771
                SHA1:29E4DEE85CDBCCE1796FB80DE43E5489730BEE60
                SHA-256:D1310B098D1E39C5233A70B723CD38E11C1CA113DD099203A546AC842C68EF9C
                SHA-512:86E4404A02D3D9A9504A3EDC57C588FBA15550A9C40F56FDEA061438E996F24732BF2A1827879E8C32A73A78D150BA9D4EA22D00273798C76CBE54EE4F1E18C0
                Malicious:false
                Reputation:low
                Preview:.<resources>...<lang author="Gaku" en="English">English</lang>...<text s="&amp;File">&amp;File</text>...<text s="&amp;Edit">&amp;Edit</text>...<text s="&amp;View">&amp;View</text>...<text s="F&amp;avorites">F&amp;avorites</text>...<text s="&amp;Tools">&amp;Tools</text>...<text s="&amp;Help">&amp;Help</text>...<text s="Back">Back</text>...<text s="Forward">Forward</text>...<text s="Up">Up</text>...<text s="Down">Down</text>...<text s="Go">Go</text>...<text s="&amp;Close application">&amp;Close application</text>...<text s="&amp;Up one level">&amp;Up one level</text>...<text s="&amp;Refresh">&amp;Refresh</text>...<text s="&amp;Reload customize">&amp;Reload customize</text>...<text s="&amp;Load layout...">&amp;Load layout...</text>...<text s="&amp;Save layout...">&amp;Save layout...</text>...<text s="&amp;Options...">&amp;Options...</text>...<text s="&amp;Close tab">&amp;Close tab</text>...<text s="Cl&amp;ose other tabs">Cl&amp;ose other tabs</text>...<text s="Close all tabs">Close all

                C:\Users\user\Desktop\extract\lang\es.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8976
                Entropy (8bit):4.983925990774959
                Encrypted:false
                SSDEEP:192:nb4O66Y1m10Pd3e01bWMZpzPk/NsBNyGo1s:2seBeobW2Zk/NsKY
                MD5:8D0677A230FD8C962AA85C146EF29609
                SHA1:43BE79396363E90F26DAF36EDFC0A8F115AE1599
                SHA-256:001FDA9196A33C352444CAF255EE0D4B2915AA73A80A71A16159013AE1067A63
                SHA-512:7855861AD43F58692E88A908EE4ACE1467E072E1E064C9036A51B20AEB0BCDA00D05DC6CF1B2049FDA9F719001046E391C9B4905240DE62D396A81BB50988DED
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Patricio M. Ros" en="Spanish">Espa.ol</lang>...<text s="&amp;File">&amp;Archivo</text>...<text s="&amp;Edit">&amp;Editar</text>...<text s="&amp;View">&amp;Ver</text>...<text s="F&amp;avorites">&amp;Favoritos</text>...<text s="&amp;Tools">&amp;Herramientas</text>...<text s="&amp;Help">A&amp;yuda</text>...<text s="Back">Atr.s</text>...<text s="Forward">Adelante</text>...<text s="Up">Arriba&#160;</text>...<text s="Down">Abajo&#160;</text>...<text s="Go">Ir</text>...<text s="&amp;Close application">&amp;Cerrar Aplicaci.n</text>...<text s="&amp;Up one level">&amp;Ir a la Carpeta Superior</text>...<text s="&amp;Refresh">&amp;Refrescar</text>...<text s="&amp;Reload customize">&amp;Volver a cargar Configuraci.n</text>...<text s="&amp;Load layout...">&amp;Cargar Dise.o</text>...<text s="&amp;Save layout...">&amp;Guardar Dise.o...</text>...<text s="&amp;Options...">&amp;Opciones...</text>...<text s="&amp;Close tab">&amp;Cerrar Pesta.a</text>...<text s="Cl&amp;o

                C:\Users\user\Desktop\extract\lang\es_la.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):9060
                Entropy (8bit):4.962320866517366
                Encrypted:false
                SSDEEP:192:y24O6szYDOZzRucd0e0gxow7IzhNsByFzuxs:OOZFJqexijhNscj
                MD5:7C21C06B69D51B5D77384542EEE36ED8
                SHA1:6298EBFB7C9065452AF0EC666380CF9BE49EA541
                SHA-256:CAE423D9B7B2F4B2E30FBCBAD566E755018591BC3309067DEF7D276E6103371F
                SHA-512:558332B16633B8E462BCE4794FA3CA52F3F3D957D092405AAFFDF99FD1381455F6DE8B50D3B3382D85A18B1BD80C15231413AF5D5B0B7D125FEE1781F94056D4
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="DasinFlameS" en="Spanish la">Espa.ol latino</lang>...<text s="&amp;File">&amp;Archivo</text>...<text s="&amp;Edit">&amp;Editar</text>...<text s="&amp;View">&amp;Ver</text>...<text s="F&amp;avorites">&amp;Favoritos</text>...<text s="&amp;Tools">&amp;Herramientas</text>...<text s="&amp;Help">A&amp;yuda</text>...<text s="Back">Atr.s</text>...<text s="Forward">Adelante</text>...<text s="Up">Arriba&#160;</text>...<text s="Down">Abajo&#160;</text>...<text s="Go">Ir</text>...<text s="&amp;Close application">&amp;Cerrar aplicaci.n</text>...<text s="&amp;Up one level">&amp;Ir a carpeta superior</text>...<text s="&amp;Refresh">&amp;Recargar</text>...<text s="&amp;Reload customize">&amp;Recargar personalizaci.n</text>...<text s="&amp;Load layout...">&amp;Cargar plantilla</text>...<text s="&amp;Save layout...">&amp;Guardar plantilla...</text>...<text s="&amp;Options...">&amp;Opciones...</text>...<text s="&amp;Close tab">&amp;Cerrar pesta.a</text>...<text s="Cl&amp;

                C:\Users\user\Desktop\extract\lang\fr.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):9124
                Entropy (8bit):4.954494944300351
                Encrypted:false
                SSDEEP:192:XWLx2ScnfwtKzLFpOf5Bl4RErRr9k1wP6rdD6Fg9:jxnfwszZpORBlcw+86rJ6I
                MD5:7B721136331C27A1B681A225BD800972
                SHA1:260FDF5A809A3BA2EE78E75FCA1023E44156CE34
                SHA-256:926A0D0254C86ACF3AE68622BB64AB2AF25D043CE51995AB58D2910E682FBA8E
                SHA-512:6008D77B203BF0F00D3173BEC6B058B1D01BD3374B316511A1CC2E2228078F04BF12134E93E785A80AD95A0463CA5B6DFDBE4E5BEF339F7926E401656487D923
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Olivier Wuillemin/bufferUnderrun/Lidgeu" en="French">Fran.ais</lang>...<text s="&amp;File">&amp;Fichier</text>...<text s="&amp;Edit">&amp;Edition</text>...<text s="&amp;View">Aff&amp;ichage</text>...<text s="F&amp;avorites">F&amp;avoris</text>...<text s="&amp;Tools">&amp;Outils</text>...<text s="&amp;Help">&amp;Aide</text>...<text s="Back">Reculer</text>...<text s="Forward">Avancer</text>...<text s="Up">Monter</text>...<text s="Down">Descendre</text>...<text s="Go">Go</text>...<text s="&amp;Close application">&amp;Fermer l'application</text>...<text s="&amp;Up one level">&amp;Remonter d'un niveau</text>...<text s="&amp;Refresh">&amp;Actualiser</text>...<text s="&amp;Reload customize">&amp;Recharger la personnalisation</text>...<text s="&amp;Load layout...">&amp;Charger la disposition...</text>...<text s="&amp;Save layout...">&amp;Enregistrer la disposition...</text>...<text s="&amp;Options...">&amp;Pr.f.rences...</text>...<text s="&amp;Close tab">&amp;Fer

                C:\Users\user\Desktop\extract\lang\it.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8795
                Entropy (8bit):4.885860303914034
                Encrypted:false
                SSDEEP:96:EI6KVWz3FMqw6/l9ld12hrRxYTaUi/uzY8eols4gEwt+B0MK4zsdsX7ChAC2:D6KVWjw6zldUh/YuU6uc8Rls4xhO8XFb
                MD5:D6761DFB9B866A837E7B4E65503FE1D6
                SHA1:E6C6578AFBF048824B9450C451ACA7E7D83D8E1B
                SHA-256:B5DD9F0AABDB0EBEBB1B483FCE459B6F39CA2020EE0801E3CBA72BB22C27449A
                SHA-512:283E5EC2FC2EF164B7D168008CF224D275FC7DDB8A0121F59FA8873C724C605A9BBE1DC74D192939846E7D29845A2C11B1682CBC0E8D133DA844816CB05240DA
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Michele Pezza" en="Italian">Italiano</lang>...<text s="&amp;File">&amp;File</text>...<text s="&amp;Edit">&amp;Modifica</text>...<text s="&amp;View">&amp;Visualizza</text>...<text s="F&amp;avorites">&amp;Preferiti</text>...<text s="&amp;Tools">&amp;Strumenti</text>...<text s="&amp;Help">&amp;Aiuto</text>...<text s="Back">Indietro</text>...<text s="Forward">Avanti</text>...<text s="Up">Su</text>...<text s="Down">Gi.</text>...<text s="Go">Vai</text>...<text s="&amp;Close application">&amp;Chiudi applicazione</text>...<text s="&amp;Up one level">&amp;Su di un livello</text>...<text s="&amp;Refresh">&amp;Aggiorna</text>...<text s="&amp;Reload customize">&amp;Ricarica configurazione</text>...<text s="&amp;Load layout...">&amp;Carica struttura grafica...</text>...<text s="&amp;Save layout...">&amp;Salva struttura grafica...</text>...<text s="&amp;Options...">&amp;Opzioni...</text>...<text s="&amp;Close tab">&amp;Chiudi scheda</text>...<text s="Cl&amp;ose other tab

                C:\Users\user\Desktop\extract\lang\ja.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):9467
                Entropy (8bit):5.676879559756575
                Encrypted:false
                SSDEEP:192:0ilr/8s4EcEvwoGq/1De/LRSMTdX2QRnxhWLluL:NIHE5R/1De/08EQkuL
                MD5:5F1EE3A336F58E7677CEC5D0A75C0530
                SHA1:B6CF9DA32D607D5C353DF9486172ABA8241C67F2
                SHA-256:3E5A2F1F27306532228A997F1914A483331A54B0086E540BD98F3BAA4B059E49
                SHA-512:73B9EA7DCE4F3143B84C59083B79CCE03789109E915C30846B94E3A3D82DFC08807B56AA340F08F2BB3F6D96AAAFD2FA726BF605952D051AA525018EF74D7B96
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Gaku" en="Japanese">...</lang>...<text s="&amp;File">....(&amp;F)</text>...<text s="&amp;Edit">..(&amp;E)</text>...<text s="&amp;View">..(&amp;V)</text>...<text s="F&amp;avorites">.....(&amp;A)</text>...<text s="&amp;Tools">...(&amp;T)</text>...<text s="&amp;Help">...(&amp;H)</text>...<text s="Back">..</text>...<text s="Forward">..</text>...<text s="Up">..</text>...<text s="Down">..</text>...<text s="Go">..</text>...<text s="&amp;Close application">...........(&amp;C)</text>...<text s="&amp;Up one level">.......(&amp;U)</text>...<text s="&amp;Refresh">..(&amp;R)</text>...<text s="&amp;Reload customize">..........(&amp;R)</text>...<text s="&amp;Load layout...">..........(&amp;L)...</text>...<text s="&amp;Save layout...">........(&amp;S)...</text>...<text s="&amp;Options...">.....(&amp;O)...</

                C:\Users\user\Desktop\extract\lang\ko.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):9000
                Entropy (8bit):5.66130775407854
                Encrypted:false
                SSDEEP:96:6Vid3ZZKnW3PFu5lSIHSDYdlUCyxJP9sMODe6shbSQfTRr30er435H3vsyW2eOIg:sE6W3PYlSIAmyOXzshbrfTRr3I35kUVZ
                MD5:0AE96D5A92E0AFB6D9212B57835EDDDD
                SHA1:8332B70718F99CB3AB36BA53196D89C33A65BC87
                SHA-256:796AEC005211FB1D87CB91126941D4CB444C4BBA60BDAE76F088A2CFB7A67CFC
                SHA-512:C50FD34463F7DF711B7FD376F8FD21F16D33B4EF3C5ACFFFB9B377BFCF913D6F1C096A93E3FC1B2A6FC345AC1B70CFE08970C9D8986B0C0E14DD85C0C39EFE76
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="......V...sG..." en="Korean">...</lang>...<text s="&amp;File">..(&amp;F)</text>...<text s="&amp;Edit">..(&amp;E)</text>...<text s="&amp;View">..(&amp;V)</text>...<text s="F&amp;avorites">....(&amp;A)</text>...<text s="&amp;Tools">..(&amp;T)</text>...<text s="&amp;Help">...(&amp;H)</text>...<text s="Back">..</text>...<text s="Forward">...</text>...<text s="Up">..</text>...<text s="Down">...</text>...<text s="Go">..</text>...<text s="&amp;Close application">.. .... ..(&amp;C)</text>...<text s="&amp;Up one level">. .. ..(&amp;U)</text>...<text s="&amp;Refresh">.. ..(&amp;R)</text>...<text s="&amp;Reload customize">... .. .. ..(&amp;R)</text>...<text s="&amp;Load layout...">.... ..(&amp;L)...</text>...<text s="&amp;Save layout...">.... ..(&amp;S)...</text>...<text s="&amp;Options...">..(&amp;O)...</text>...

                C:\Users\user\Desktop\extract\lang\nl.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):8623
                Entropy (8bit):4.88675805347654
                Encrypted:false
                SSDEEP:96:B03Xsq04RV/TtkCDmQFdbnJsSi/eoC5GckoLp71I/kGdJ8Q36iEZQB/:BC8q045n6QFdTovC5Gckm12WtG5
                MD5:D6C4D9573717AD99CB921F7B4FCAE13A
                SHA1:6519C957B9530FBFB0D6691F34538121D4849F7A
                SHA-256:735EF6F9D7FC92B9CA6A43122D9F9EFE3D922D28C53D08760D251B1470617E26
                SHA-512:D28A2EEC1C0B74B48083218E0881BFCC4BAF637244A231BD9F02B65D6E09B687FC43ABC755EA2E8F15E2D69A9895E396E98F8AE38E9AAB9D89CD6991C439C4E6
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="mlohnen" en="Nederlands">Nederlands</lang>...<text s="&amp;File">&amp;Bestand</text>...<text s="&amp;Edit">&amp;Wijzigen</text>...<text s="&amp;View">&amp;Beeld</text>...<text s="F&amp;avorites">F&amp;avorieten</text>...<text s="&amp;Tools">&amp;Gereedschap</text>...<text s="&amp;Help">&amp;Help</text>...<text s="Back">Terug</text>...<text s="Forward">Vooruit</text>...<text s="Up">Omhoog</text>...<text s="Down">Naar beneden</text>...<text s="Go">Ga</text>...<text s="&amp;Close application">&amp;Programma afsluiten</text>...<text s="&amp;Up one level">&amp;Een niveau omhoog</text>...<text s="&amp;Refresh">&amp;Vernieuwen</text>...<text s="&amp;Reload customize">&amp;Herladen aangepast</text>...<text s="&amp;Load layout...">&amp;Layout laden...</text>...<text s="&amp;Save layout...">&amp;Layout opslaan...</text>...<text s="&amp;Options...">&amp;Opties...</text>...<text s="&amp;Close tab">&amp;Sluit tab</text>...<text s="Cl&amp;ose other tabs">Sl&amp;uit andere

                C:\Users\user\Desktop\extract\lang\pl.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8888
                Entropy (8bit):5.143485607780671
                Encrypted:false
                SSDEEP:192:jhZX7tNkDo7rLHuNIYFdmvEtlp3jM6GHPQ7H4pS0nA6ukk:3R24raNz+YlqHPQ7YpS0nA6uh
                MD5:E901B2E9BE9B7FB98C7D632F1CF3A41F
                SHA1:44ABFB1EBF9AF5BC29292B188ED172615884AADF
                SHA-256:5BE0E9E0F019C15A14ADD0E75B821DAAB681603374E9EB65F3DCBA85EBB164BE
                SHA-512:44F57FFA94563D16BF518246F76ABCE946C836B896C0918A2580D269A101FB0F16C9F43A02C03EA64117F454AEC0DEA18AA37513DF3A3C9E8CC2095494CE0F68
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Matthaiks,Piotr Kostrzewski" en="Polish">Polski</lang>...<text s="&amp;File">&amp;Plik</text>...<text s="&amp;Edit">&amp;Edycja</text>...<text s="&amp;View">&amp;Widok</text>...<text s="F&amp;avorites">U&amp;lubione</text>...<text s="&amp;Tools">&amp;Narz.dzia</text>...<text s="&amp;Help">&amp;Pomoc</text>...<text s="Back">Wstecz</text>...<text s="Forward">Do przodu</text>...<text s="Up">W g.r.</text>...<text s="Down">W d..&#160;</text>...<text s="Go">Przejd.</text>...<text s="&amp;Close application">&amp;Zamknij aplikacj.</text>...<text s="&amp;Up one level">&amp;Jeden poziom w g.r.</text>...<text s="&amp;Refresh">&amp;Od.wie.</text>...<text s="&amp;Reload customize">&amp;Prze.aduj ustawienia</text>...<text s="&amp;Load layout...">&amp;Za.aduj uk.ad...</text>...<text s="&amp;Save layout...">&amp;Zapisz uk.ad...</text>...<text s="&amp;Options...">&amp;Opcje...</text>...<text s="&amp;Close tab">&amp;Zamknij kart.</text>...<text s="Cl&amp;ose o

                C:\Users\user\Desktop\extract\lang\pt.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8793
                Entropy (8bit):4.96323214815517
                Encrypted:false
                SSDEEP:96:ghXUnf/3K65psQyMWPg+u+AZmsWqirenQDvjXuaRUjY1HxSKoRzaEgX:mUnf/3K65sm+AZm1rkQDvjXuQUjwx8w
                MD5:105EE0F51A10859CF850D4964E8C89BA
                SHA1:EBCAE1C59EE0EB7C5F64B41349BDFBF39578857C
                SHA-256:862B9B76F691D7EF0AE8D6ABE3CA4A92D77473F9CE767C40C0CC9F74A7D3004B
                SHA-512:B7C6F67DDE392E924402D932A775B7D35622FF0EE555971F0FE0D0504D1E3A2E5216F5C5C1B1BA61D50354CBC1E80E67549BE4CD915C3BEA1E17CE9775682620
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="S.rgio Nova" en="Portuguese">Portugu.s</lang>...<text s="&amp;File">&amp;Arquivo</text>...<text s="&amp;Edit">&amp;Editar</text>...<text s="&amp;View">&amp;Visualizar</text>...<text s="F&amp;avorites">&amp;Favoritos</text>...<text s="&amp;Tools">Fe&amp;rramentas</text>...<text s="&amp;Help">A&amp;juda</text>...<text s="Back">Voltar</text>...<text s="Forward">Avan&amp;.ar</text>...<text s="Up">Acima</text>...<text s="Down">Abaixo</text>...<text s="Go">Ir</text>...<text s="&amp;Close application">Fechar a&amp;plicativo</text>...<text s="&amp;Up one level">&amp;Um n.vel acima</text>...<text s="&amp;Refresh">A&amp;tualizar</text>...<text s="&amp;Reload customize">Recarre&amp;gar personaliza..o</text>...<text s="&amp;Load layout...">Carregar le&amp;iaute...</text>...<text s="&amp;Save layout...">&amp;Salvar leiaute...</text>...<text s="&amp;Options...">&amp;Op..es...</text>...<text s="&amp;Close tab">Fec&amp;har aba</text>...<text s="Cl&amp;ose other tabs

                C:\Users\user\Desktop\extract\lang\ru.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):10979
                Entropy (8bit):5.325067770195591
                Encrypted:false
                SSDEEP:192:DSghkKaXFsAqoH5VL5thwvTcXzqPjFcU/OWESR/kPQgU:Pys4DThAc27z2WnR/Z
                MD5:264BB301EC5442226CC3A742AE5E9E14
                SHA1:8102CBB5FAB7D2AF33A7E3C9CA25A28A66C16309
                SHA-256:CC5A92080E66CF75BA064F06E11E8F60DAF782DE146DA28DA4B769D356B5F4BC
                SHA-512:3BFEF0AFC6AB36961D6D7E8F3A4CAB3105B26888A03FFD544B8ACE9018C8F36C1117A07A22ED234ED1E5832E1CC4AEBE3BF78DEAFD316969D8E4A8C8FA30CC41
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Hunter User" en="Russian">.......</lang>...<text s="&amp;File">&amp;....</text>...<text s="&amp;Edit">&amp;......</text>...<text s="&amp;View">&amp;...</text>...<text s="F&amp;avorites">.&amp;........</text>...<text s="&amp;Tools">&amp;...........</text>...<text s="&amp;Help">&amp;....... ......</text>...<text s="Back">.....</text>...<text s="Forward">......</text>...<text s="Up">.....&#160;</text>...<text s="Down">....&#160;</text>...<text s="Go">.........</text>...<text s="&amp;Close application">&amp;....... .........</text>...<text s="&amp;Up one level">&amp;..... .. .... .......</text>...<text s="&amp;Refresh">&amp;........</text>...<text s="&amp;Reload customize">&amp;........ .........</text>...<text s="&amp;Load layout...">&amp;......... ..........</text>...<text s="&amp;Save layout...">&amp;..

                C:\Users\user\Desktop\extract\lang\sr_lat.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):9082
                Entropy (8bit):5.02819147449998
                Encrypted:false
                SSDEEP:192:bpSx9JMkIzs4zvF26ue5dbo2M12Osm94yNz:FqCNMeMR94o
                MD5:93847174E2D3AFC9C4B68390B483824A
                SHA1:CC0623D0ACCC16BD1163E77CEC60610889B69B56
                SHA-256:71F0EA098D20E1748E48F92A7E3687846B80A188EF8571551FF811C8130824AD
                SHA-512:C4310096364C0C28AA9D171C897EE292EB3F4712FDFFC7854B8E14EDA00630650ACB1CF70332C7750F09BA8A137C0A09BE71B156B27734424D0F5380C1AA9082
                Malicious:false
                Reputation:low
                Preview: Ra.unarski re.nik Mikro knjige https://www.mikroknjiga.rs/pub/rmk/index.php English-Serbian Computer Dictionary | Englesko-srpski / srpsko-engleski re.nik ra.unarskih (kompjuterskih) termina --><resources>...<lang author="Ognjen Nini." en="Serbian">Srpski</lang>...<text s="&amp;File">&amp;Datoteka</text>...<text s="&amp;Edit">&amp;Izmena</text>...<text s="&amp;View">&amp;Prikaz</text>...<text s="F&amp;avorites">O&amp;miljene lokacije</text>...<text s="&amp;Tools">&amp;Alati</text>...<text s="&amp;Help">&amp;Pomo.</text>...<text s="Back">Nazad</text>...<text s="Forward">Napred</text>...<text s="Up">Gore</text>...<text s="Down">Dole</text>...<text s="Go">Uradi</text>...<text s="&amp;Close application">&amp;Zatvori aplikaciju</text>...<text s="&amp;Up one level">&amp;Nivo iznad</text>...<text s="&amp;Refresh">&amp;Osve.i</text>...<text s="&amp;Reload customize">&amp;U.itaj prilago.eno</text>...<text s="&amp;Load layout...">&amp;U.itaj izgled...</text>...<text s="&amp;Save la

                C:\Users\user\Desktop\extract\lang\tr.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8774
                Entropy (8bit):5.086608641414861
                Encrypted:false
                SSDEEP:192:4j547t3aQaaseQa5du9+Xl930U2CFURr7QSfns:ZDwUPFURrLfs
                MD5:C91E01728E6175CB48EB404B684D09DB
                SHA1:B70A4348D616DBA7C8D76A225C8A74FF16BEAE71
                SHA-256:9F34C8EF9D68B15CE31A12B53781F985800015555D588C2CA027C8D709BBDD0B
                SHA-512:789109D1987E29F84A6F90B8EEEEEE0F93DDA5028EF11972022438E4F315187BE0C42D35DBDABDFB621E2691E95A1C9152467514D394B0FF6153A29ECB604859
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Ferhat Aydin" en="Turkish">T.rk.e</lang>...<text s="&amp;File">&amp;Dosya</text>...<text s="&amp;Edit">D.&amp;zen</text>...<text s="&amp;View">&amp;G.r.n.m</text>...<text s="F&amp;avorites">F&amp;avoriler</text>...<text s="&amp;Tools">&amp;Ara.lar</text>...<text s="&amp;Help">&amp;Yard.m</text>...<text s="Back">Geri</text>...<text s="Forward">.leri</text>...<text s="Up">.st</text>...<text s="Down">Alt&#160;</text>...<text s="Go">Git</text>...<text s="&amp;Close application">&amp;Uygulamay. Kapat</text>...<text s="&amp;Up one level">&amp;Bir .ste ..k</text>...<text s="&amp;Refresh">&amp;Yenile</text>...<text s="&amp;Reload customize">&amp;Ayarlar. tekrar y.kle</text>...<text s="&amp;Load layout...">&amp;G.r.n.m. y.kle...</text>...<text s="&amp;Save layout...">&amp;G.r.n.m. kaydet...</text>...<text s="&amp;Options...">&amp;Se.enekler...</text>...<text s="&amp;Close tab">&amp;Sekmeyi kapat</text>...<text s="Cl&amp;ose other tabs">D&amp

                C:\Users\user\Desktop\extract\lang\uk.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):10918
                Entropy (8bit):5.295609097183902
                Encrypted:false
                SSDEEP:192:K265+oUY9xJReWcFKF7FARuhxvk5959ve2V90FcgRAuCfj2BURodJ:QNRgixAPn5Feee3qfjAL
                MD5:93B89B496DF9CD0354AC4D721E28FE40
                SHA1:96E8356932C34767972F18DEF167E540CC4DE055
                SHA-256:34423C32F936AF6FB6B69BB71D3E1263F3523CC0FBEADE3C8B758B62A2B6845C
                SHA-512:D75E618E24F63DF27D5C0F5BD5B62C7D1ADAC52FF03963CA379862EAFDE38D23E7BDC20AD179D4D71DE43041E1798281BD2616409114850CC2DE163C52838F85
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="Henaro aka Ironwool" en="Ukrainian">..........</lang>...<text s="&amp;File">&amp;....</text>...<text s="&amp;Edit">&amp;......</text>...<text s="&amp;View">&amp;...</text>...<text s="F&amp;avorites">.&amp;.....</text>...<text s="&amp;Tools">&amp;...........</text>...<text s="&amp;Help">&amp;....... ......</text>...<text s="Back">.....</text>...<text s="Forward">......</text>...<text s="Up">.....</text>...<text s="Down">....</text>...<text s="Go">........</text>...<text s="&amp;Close application">&amp;....... .......</text>...<text s="&amp;Up one level">&amp;..... .. .... ......</text>...<text s="&amp;Refresh">&amp;.......</text>...<text s="&amp;Reload customize">&amp;....... ............</text>...<text s="&amp;Load layout...">&amp;........... ..........</text>...<text s="&amp;Save layout...">&amp;....

                C:\Users\user\Desktop\extract\lang\zh.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8596
                Entropy (8bit):5.730382823215028
                Encrypted:false
                SSDEEP:192:dhglswzqSeSmve3PMym4s0gt7P8Fh7Mwvz39fqDt:dhe/MMmrVCXvz9m
                MD5:4663B153E911C63B10BAB14A485CAB95
                SHA1:266B306C82CD48048E20FBD174C1FC2C7B8D97B4
                SHA-256:982355C588C1A1BC7672E22FFB4C46F1BCA5FA2AB381DE0D6760383977DCDA76
                SHA-512:63556BFA9A0100F946D49A902959229FAEBF16A601838C301B7BFC1AD6D75B0FDB3A5E3BE88B07D671CEF3C0F0810EA5DE7E6CA7D39F091030CB33B2142EB9E3
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author="..." en="Traditional Chinese">....</lang>...<text s="&amp;File">..(&amp;F)</text>...<text s="&amp;Edit">..(&amp;E)</text>...<text s="&amp;View">..(&amp;V)</text>...<text s="F&amp;avorites">....(&amp;A)</text>...<text s="&amp;Tools">..(&amp;T)</text>...<text s="&amp;Help">..(&amp;H)</text>...<text s="Back">...</text>...<text s="Forward">...</text>...<text s="Up">..</text>...<text s="Down">..</text>...<text s="Go">..</text>...<text s="&amp;Close application">......(&amp;C)</text>...<text s="&amp;Up one level">....(&amp;U)</text>...<text s="&amp;Refresh">....(&amp;R)</text>...<text s="&amp;Reload customize">........(&amp;R)</text>...<text s="&amp;Load layout...">....(&amp;L)...</text>...<text s="&amp;Save layout...">....(&amp;S)...</text>...<text s="&amp;Options...">..(&amp;O)...</text>...<text s="&amp;Close tab">....(&amp;C)

                C:\Users\user\Desktop\extract\lang\zh_cn.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):8538
                Entropy (8bit):5.723911411026256
                Encrypted:false
                SSDEEP:96:5PhnJI1Tj09Ng4LJ17UL+lhBeyHAez5PwopMimqO4bt0KpYuoQfWYScEq:xhnJI1TvYJBUAh8mwopMimh8+Kp0YJ9
                MD5:AE8E0066BE1FB0A23B66B44DAEEC177E
                SHA1:ED5BA8D5DC128ECD516C3966FB1DA82EEFE5C6AC
                SHA-256:F08195A9D12B58EF750225BE984219D866FBCE8D0EF3D65A71D1E29D98241031
                SHA-512:14AAEB7D941EC60FA1552C2F311F4B43F528EF3E96872F2450107824FAA8F1E2CC144D871DF968E636E21266FD1B3A95DE5AF8536532CEF5A68FD1AA6EA2AC5B
                Malicious:false
                Reputation:low
                Preview:<resources>...<lang author=".." en="Simplified Chinese">....</lang>...<text s="&amp;File">..(&amp;F)</text>...<text s="&amp;Edit">..(&amp;E)</text>...<text s="&amp;View">..(&amp;V)</text>...<text s="F&amp;avorites">..(&amp;A)</text>...<text s="&amp;Tools">..(&amp;T)</text>...<text s="&amp;Help">..(&amp;H)</text>...<text s="Back">..</text>...<text s="Forward">..</text>...<text s="Up">...</text>...<text s="Down">...</text>...<text s="Go">..</text>...<text s="&amp;Close application">....(&amp;C)</text>...<text s="&amp;Up one level">....(&amp;U)</text>...<text s="&amp;Refresh">..(&amp;R)</text>...<text s="&amp;Reload customize">.......(&amp;R)</text>...<text s="&amp;Load layout...">.......(&amp;L)</text>...<text s="&amp;Save layout...">.......(&amp;S)</text>...<text s="&amp;Options...">.....(&amp;O)</text>...<text s="&amp;Close tab">.....(&amp;C)</text>...<text s="Cl&

                C:\Users\user\Desktop\extract\layout\1tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):428
                Entropy (8bit):5.241558444802742
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrEN+STQiKoKCA4DrjFRkKYjen:2du0nrENGpotjFm6
                MD5:3878C81DFB2C3C6DDF3337D2111AE5EC
                SHA1:8DC11AF2E4718334F0CA78363BB8876B3CE22585
                SHA-256:8EF3600953F3528B2B0D218F67FA05316CA4807AA77DD3B6311E20F24B8A3CAC
                SHA-512:8DF26B2F3D33BDD60001D24192CAD52573680694C4BA20FE88C686B112C082A3BCFBC8EAF3B9AE7743C69B0AEADD4E932A25D0E80E82F69B7E15FB658FD5E18B
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\4tabs.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1469
                Entropy (8bit):5.170455841545163
                Encrypted:false
                SSDEEP:24:2du0nrqGpotjFm70WGpotjFm70nrCpGpotjFm70OpGpotjFm6:c7nW0o1TW0o1Tnm0o1Tm0o11
                MD5:6521E156E3A7ED636B59AE68B18B3C2E
                SHA1:F5E1DA495583F784DF19DD82D8F8C919749434DD
                SHA-256:C66EBE04BAD09097BFC1224802A794A813478A4763C629199320826DC23AD6E9
                SHA-512:0998B1AE961FA7E7533B65F0E4B1CEB887A96A6472EB694FFAA97D790990E42314A36248DACB42336454F78CADFB3051A26DD336B492F3C461620AD2E913A62C
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="50%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..<Ctrl Type="196608" Left="50%" Top="0" Width="50%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..<Ctrl Type="196608" Left="0" Top="50%" Width="50%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags=

                C:\Users\user\Desktop\extract\layout\bottom_tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):428
                Entropy (8bit):5.242693845061012
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrENtKQiKoKCA4DrjFRkKYjen:2du0nrENdpotjFm6
                MD5:8F07B8C61826EEBEC36F12BBAFF4267B
                SHA1:21FAC427266209F521C4104A862E0EA3B5F89166
                SHA-256:50034129EFDB4AD6FBCD46496C20A76791F7D5421C3ABEC85A722670B64928BA
                SHA-512:2345DEB89F5641059A3FA64DC35C420EBEBC5AFDFC6BDB45DBCB71AB549AD90606FF2AE77BE848DEF9CF519E62DE2EF0895B719CA8548B211FFCC114BB06C69B
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409337923" Align="3" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\h2tabs.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):775
                Entropy (8bit):5.2024914722505615
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrE0e+STQiKoKCA4DrjFRkKY7Y9nrC70e+STQiKoKCA4DrjFRkKYje:2du0nrEdGpotjFm70nrC7dGpotjFm6
                MD5:1027EC6D98AA114E7B107B7F1E7A4D5D
                SHA1:90F5A6DCDEE85AB9D48FF4488362578BC88130EA
                SHA-256:2991B86FF4E794AB7A5E74701BF21A75563639EA7193DEB0E873B9A7301B372B
                SHA-512:F2F9418269FC49A075E21B0E8AC40966324C6A14A27F438190E96EFF9AB0F5B9FBC4CA1F62F893CB609C553249C4E0F4045872F077DFBF344C3375B5D5261CCE
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..<Ctrl Type="196608" Left="0" Top="50%" Width="100%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\left_tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):429
                Entropy (8bit):5.230959250994488
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrEy7EoIQiKoKCA4DrjFRkKYjen:2du0nrEuEoNpotjFm6
                MD5:8BA2C0721E92D29CF219960ADD76848D
                SHA1:C2E52FDE726E8817A3CDC629FF0C86FEDD4709F2
                SHA-256:B11609892E4392611EABCF6F2B214B6A54B444E215C22EF52C37C77DB19D47F5
                SHA-512:97A9DFC7BEC2E95FF54DA1F6DB6371AC86DDE33B98DF4C9F867C20A73946EDDD42BC08C77752A85276E2AF29AD16B2F556C5B252B4E5F221052E40D46962F8D4
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409339200" Align="4" TabWidth="120" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\right_tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):429
                Entropy (8bit):5.242508943914181
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrE2CBoIQiKoKCA4DrjFRkKYjen:2du0nrED6NpotjFm6
                MD5:8E6D1B28A31B0FF9E286BE34D4C3E4DC
                SHA1:F62B46F4827858078D0528924358832B3C4C2EB2
                SHA-256:8BC8BD22E6FC2ECEE66D6E86BB2B464581DA68CB2EAC3BD954521013AB5EF10B
                SHA-512:0183940829DCD95DC3F9BF2B2E12807129FE8838537E60DCA9620AF521F4E429A10327138696E588C7F208943CD6EF66DCFCB2814AF0F6902FE96654AE6F3F70
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409322816" Align="5" TabWidth="120" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\tree_1tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):429
                Entropy (8bit):5.232574070122833
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrENnTS3QiKoKCA4DreQFRkKYjen:2du0nrENnRpotVFm6
                MD5:2FBF06F2971683721E8C0AD6EEB2CEC5
                SHA1:DF826DF10ADFB90C70E6619EE397C2AF5608E407
                SHA-256:99195797CDCAB5F474AB3EE97A62D3E495A4E211A836715EE7CFE8531F72AB45
                SHA-512:80A7CFB6D9AF5D4131A2271C9C1A561B349E06F72030D8A44026152316F79B33A6E1178E5BB132B5BC44A9AA23BE2F3700249A733D0A3358B2AA192B73413FE7
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409337920" Align="2" TabWidth="100" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="3" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\tree_2tabs.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
                Category:dropped
                Size (bytes):761
                Entropy (8bit):5.166285086274804
                Encrypted:false
                SSDEEP:12:TMHd32N9nrE0e+SToKoKCA4DreQFRkK/eW9nrC70e+SToKoKCA4DreQFRkK/Aen:2d0nrEdBotVFmynrC7dBotVFm0
                MD5:444F782DDEEEBFF97D15E70031AED71B
                SHA1:9EBF256D0A0C2B7A01BC5125DAEBA0F118D2DEE9
                SHA-256:976D6A69A2816B414B7A3152DA98BAC854360A528E52552BC34756A08B529022
                SHA-512:28F046493ACD34739AA8F1FA1CA065ED6F5B15CC46D7638B357EAE6E96478C90D9C7244E009C387AE48B0E5340702365ACED9F44115421359547C5937E4F84C1
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer><Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1"><Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="3" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/></Ctrl><Ctrl Type="196608" Left="0" Top="50%" Width="100%" Height="50%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1"><Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="3" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/></Ctrl></TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\v2tabs.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):775
                Entropy (8bit):5.2024914722505615
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrY+STQiKoKCA4DrjFRkKY7Y9U+STQiKoKCA4DrjFRkKYjen:2du0nrYGpotjFm70UGpotjFm6
                MD5:3D836E188657C612D58DF2FBF49BA8A0
                SHA1:C9BD09C542164F71A450F7D46C57507819204315
                SHA-256:637E9D7E3B3CE011D378D3585C03E1728A32DE2163C5E524C775C3C3D2AF834D
                SHA-512:D502CBB260170CE42C7F043A6CCB436373D05A9421BD09EAC848ABCC6C5F6B8A5504D355AC00780B10BC4E5A4C8B8857E7955967DE38093675BEE71A39F83B3E
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="50%" Height="100%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..<Ctrl Type="196608" Left="50%" Top="0" Width="50%" Height="100%" Style="1409337921" Align="2" TabWidth="96" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\layout\vertical_tab.xml

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):429
                Entropy (8bit):5.22495588810852
                Encrypted:false
                SSDEEP:12:TMHd32eGY9nrEN+jIQiKoKCA4DrjFRkKYjen:2du0nrENSNpotjFm6
                MD5:03FE152295957E548916FEC444A7B5B5
                SHA1:199F04D63C08A09A6ADF00F429BFD94227407A3A
                SHA-256:4ACC8ADCC9AF12BE675CACF484A67F4EB7011DC1DFB11FA983FC7CE60727248F
                SHA-512:82309603456C4A8F3E6DAED2925792481C098EAB44B9AFA9F87D5EDE79126D94DD586B20C6A955A3606283A2452507C07AD12F4BD08F1A4A069BC3E932891983
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<TablacusExplorer>..<Ctrl Type="196608" Left="0" Top="0" Width="100%" Height="100%" Style="1409336002" Align="1" TabWidth="120" TabHeight="0" SelectedIndex="0" Visible="1">..<Ctrl Type="1" Path="C:\" FolderFlags="73728" ViewMode="4" IconSize="16" Options="6" ViewFlags="0" Lock="0" Align="1" Width="200" Flags="32931" EnumFlags="32" RootStyle="2" Root="0"/>..</Ctrl>..</TablacusExplorer>..

                C:\Users\user\Desktop\extract\lib\te32.dll

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                Category:dropped
                Size (bytes):489984
                Entropy (8bit):6.566989551812453
                Encrypted:false
                SSDEEP:12288:96rNALK87pnjivRminNmbzdLVEyvlZSktm9:t5njiwMm3jEytZS2m9
                MD5:C672A0C23EFBF60CFA7F3F884BE29112
                SHA1:3064A6E49A02FA64156438DD5C4A4FD30A00EB9A
                SHA-256:E68F8204EE6ECE713BA12021C8C54037A3D1C685D29DEC648BDA68D251B4BE08
                SHA-512:A3243333137731E631DB9C56C2885B9806D75B0B23E51617699D3E46ECE34EE6873CA6D8AED010AAC7F3E4DCE138634E6D73C93384AAD33CE9D35947F5574AF9
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......1.#3u.M`u.M`u.M`...`|.M`...`..M`...`l.M`N.Naa.M`N.Iae.M`N.HaT.M`|..`t.M`|..`z.M`|..`T.M`u.L`s.M`..Har.M`..Mat.M`..`t.M`u..`t.M`..Oat.M`Richu.M`........................PE..L......g...........!.....v...&............................................................@.........................0...V.......T....P.......................p...`...Q..T............................R..@...............(............................text....t.......v.................. ..`.rdata..HG.......H...z..............@..@.data....b.......>..................@....rsrc........P......................@..@.reloc...`...p...b..................@..B................................................................................................................................................................................................................................................................

                C:\Users\user\Desktop\extract\lib\te64.dll

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):603648
                Entropy (8bit):6.186459092501574
                Encrypted:false
                SSDEEP:12288:4unfQTKjxE52H6ky4jksJLx/rVTmew1Wme5ABuOKm3sH:4AfQTO652HFnnlTmeKWme5ABuJH
                MD5:60BF5894199B1852581A4C388A3276A5
                SHA1:02CB149D2B39A17F3248672EDA3992CDE8EB24CC
                SHA-256:96EB6DC7039D78E97219849396E61404A242659E4AFF8A2AE295980D8CFF4E5B
                SHA-512:B1C80E83CDFEEBC59458926125C46EB7D80E3BBB5DE73FBA1A48822B0FD0BC94324ADB4CD46392BC9A53E42A03BAF0DCCE1929B43C4B14F8950375B85AB79905
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................]..............................................b.....b.....b.S.....;....b.....Rich...........PE..d...K..g.........." .........V......4U....................................................`.............................................X.......h....`...........[..................0@..T............................@............... ...............................text............................... ..`.rdata....... ......................@..@.data...l....0...l...$..............@....pdata...[.......\..................@..@.gxfg...p....0......................@..@.gehcont.....P......................@..@.rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................

                C:\Users\user\Desktop\extract\lib\tewv32.dll

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                Category:dropped
                Size (bytes):168448
                Entropy (8bit):6.486420572652127
                Encrypted:false
                SSDEEP:3072:zEhviLbSPRikkzxwYKGqdow1mn+R2KmxTYbnWw6KFtr6HSjT+rBFkqiGAEi8Vbi2:zE9iLcfYn4ow4+NWT9wzFtrGmEi8Vbi2
                MD5:93C582D5E120F197C147F13E7DDD051D
                SHA1:11064EBBA02644F9D58BDB77DC9B0B554F896253
                SHA-256:E9EEB08541DB61B993BC518A68C38CA090E092EB3336315D6E98AD8D85694484
                SHA-512:3E6969C1120C74C6679AB71F2911F976787B869A31A47D5995BB0FAE5A51DAF3D644B69BE013423A8B0B585309BB30AE5E5BA29D12029FAB908678DE3798C032
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..^.........i......i......^......^......^...*..i......i......i..................................{..................Rich...........PE..L......g...........!................i.....................................................@..........................Y......dZ......................................p1..8...................H2.......1..@............................................text............................... ..`.rdata.............................@..@.data...(#...p.......R..............@....rsrc................l..............@..@.reloc........... ...r..............@..B................................................................................................................................................................................................................................................................................

                C:\Users\user\Desktop\extract\lib\tewv64.dll

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):201728
                Entropy (8bit):6.073219900621779
                Encrypted:false
                SSDEEP:6144:3xlqK+Nfe1lD7ZmbubbSEmPAQmw+Fw+n+HnO+b1oJtkF:hsKvlDMbubbSEmPAQmw+Fw+n+HnO+b1q
                MD5:B0FC249A55D7D27BB4010EB49A5753F7
                SHA1:8DC0842AF6561B187CC9CAB909B2896731CA6868
                SHA-256:26D3B4EC7A7FDB551008B6DCF81CB49E26452FE4D4637ADDC13B88E451D5EEC8
                SHA-512:D5F4ACB62AF6B226CA63FB3320E8217E32088D1102D998DA5B5330F9A9F92AEB8548A2B1DD1A630A5ECD792E7DB81F3E3D79B5680EC790D428FFED6529EFE63B
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..w2..$2..$2..$W..%7..$W..%...$`..%=..$`..%:..$`..%...$W..%>..$W..%3..$W..%#..$2..$...$2..$4..$...%3..$...%3..$..#$3..$2.K$3..$...%3..$Rich2..$........PE..d......g.........." .........^......@........................................P............`.................................................D........0.......................@..t... .......................@...(...@...................8............................text...P........................... ..`.rdata..............................@..@.data..../..........................@....pdata..............................@..@.rsrc........0......................@..@.reloc..t....@......................@..B........................................................................................................................................................................................................................

                C:\Users\user\Desktop\extract\readme.txt

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):1734
                Entropy (8bit):5.260469563186709
                Encrypted:false
                SSDEEP:48:+VjYRyVQKKegYJgO4Xt5X515mhymAhcO2Lp+AYBeNd/B:crhKDA+Dp15mh/8+LVx
                MD5:5D7FAEE46B09D3D8A11255FB8CFBFC4B
                SHA1:C3D50FE7F1A1CE783B06DBA77E6014EEF87AE9AC
                SHA-256:B57E21F7DE253E66279395CA61340891AA6356FDDD8C17227FB572E531CE0335
                SHA-512:94316465329A441E60B817D2B8DB318A9432688F47C6509DD78931803A342B09B630380B70AC2C64F63BFC0645FBC2A55C909026D292AFC9C64330A2FACA99CA
                Malicious:false
                Reputation:low
                Preview:A tabbed file manager with Add-on support...Tablacus Explorer....Author: Gaku......Features in Tablacus Explorer:....* Tabbed interface..* Add-on support..* Completely Portable, No installation required..* Multiple language and Unicode support..* Customizable association, menus, keys, mouse gestures, alias..* Open source..* 64-bit(TE64.exe/x64 Edition) and 32-bit(TE32.exe/x86 Edition) versions are available......Set up:....* Extract the ZIP file to any folder..* Run Tablacus Explorer (te64.exe/te32.exe)....- In case you installed Tablacus Explorer to the Program Files directory:....* Settings are saved in "%AppData%\tablacus\explorer\config"...* Open Options..* Press "Initialize config folder"......Uninstall:....* Delete the tablacus folder.....- In case you installed Tablacus Explorer to the Program Files directory:....* Delete the folder "%AppData%\tablacus" too.......Multilingual:....* Espa.ol / Spanish..Translator : Patricio M. Ros....* .... / Traditional Chinese..Translat

                C:\Users\user\Desktop\extract\readme_jp.txt

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                Category:dropped
                Size (bytes):2522
                Entropy (8bit):5.766264784274812
                Encrypted:false
                SSDEEP:48:a2OwIpQbB56lnt3a8OczUETH79HNqw+reQdTHOi+due0h1BNZqek9d22eNhgB:s7Qd56YHczTqzreQdjMduLfBNZXk9d2G
                MD5:2AC68A33C6824B896234F71F203ABC0E
                SHA1:E097CC712A91518991159EDAF1C7C41750F111F7
                SHA-256:D87045E34AB51C81BE61988862BE50208BD90521305A3D9EE6490CC175D16321
                SHA-512:EDD5EC7772438C9D3E0793BEEE628771F0F90E2629A5A70483FA96B39984974693D901D26A1CB8A9B7C7C579D05B3E47E7A2F1A189BD54BF186CB4322CF4D98C
                Malicious:false
                Reputation:low
                Preview:..............................Tablacus Explorer......: Gaku......Tablacus Explorer.......* ..........* ...........* ..............................* .............* .....................................* .........* 64....TE64.exe/x64 Edition....32....TE32.exe/x86 Edition.............* Visial Basic.Visual C++..NET Framework.............................................* USB..........................................................................* ZIP........

                C:\Users\user\Desktop\extract\readme_ko.txt

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                Category:dropped
                Size (bytes):1987
                Entropy (8bit):6.023741656452478
                Encrypted:false
                SSDEEP:48:BgwIBZYNHC/O209DdO0RJy5mNFK01ONnpK9HAJaL6B:u1la455mNMbK9o
                MD5:429BC928D295C8B01079CFAE4A6E0FAC
                SHA1:68B280E623CD533B90599A7C0BAD00FA572E42EB
                SHA-256:BBECBF04F0912187D236E97301C26928F662C45268204187253018E3DFB8202B
                SHA-512:6470658AD9AD160CF59D688F1E3AEF6E5F6607B7D2F0E6EBF14023253A21F326FA29943BAB226B544AF1DA63FDE31F5FE0217A27E4C6969B3ED12332AFDDD0A9
                Malicious:false
                Reputation:low
                Preview:.. ... .... . ... .. .........Tablacus Explorer......: Gaku......Tablacus Explorer. ..:....* . .......* .. ....* ... .. .... .. .. ....* .. .. . .... ....* ... .. ... .., .., ., ... ..., ....* ......* 64.. (TE64.exe/x64 Edition) . 32.. (TE32.exe/x86 Edition) .. .. ..........:....* ZIP ... ... ... .. ....* Tablacus Explorer (te64.exe/te32.exe)....- Program Files ..... Tablacus Explorer. ... ..:....* ... "%AppData%\tablacus\explorer\config". ........* .. ....* ".. .. ...". ............:....* tablacus ... ..........- Program Files ..... Tablacus Explorer. ... ..:....* "%AppData%\tablacus" ... ...............:....* ... / Korean.

                C:\Users\user\Desktop\extract\script\background.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2413
                Entropy (8bit):5.392637595415315
                Encrypted:false
                SSDEEP:48:nMFtTEuHrz4sFStBUydMyj4LCODWeYguUFgCOjmCSqD4rJPjed1K:OtPrbFSizvKeYgj8hCJPjedU
                MD5:BB4AA131E67978EFE6A959B8D31A5BCA
                SHA1:F9D77759D85FBD42C46CC491057190889D9BEC0A
                SHA-256:6549006DE16C4526E8F94F29EA1E41447115A824E0B521D0B03724F6E1E9DFAC
                SHA-512:EBE7A5622CE10069A48BC41F1CFB330773AE7B8CD86B2A3EAD8BA9D8C742DC9B16F9F1D5D901CA29711496A49A63C6D84A6AC7CA76D81A24D226CE504B072A9F
                Malicious:false
                Reputation:low
                Preview://Tablacus Explorer....function _s() {...try {....window.te = external;....api = te.WindowsAPI;....fso = api.CreateObject("fso");....sha = api.CreateObject("sha");....wsh = api.CreateObject("wsh");....arg = api.CommandLineToArgv(api.GetCommandLine());....if (/rundll32\.?(exe)?"?$/i.test(arg[0])) {.....arg.shift();....}....location = { href: arg[2], hash: '' };....var parent = fso.GetParentFolderName(api.GetModuleFileName(null));....if (!/^[A-Z]:\\|^\\\\/i.test(location.href)) {.....location.href = fso.BuildPath(parent, location.href);....}....var sw = sha.Windows();....for (var i = 0; i < sw.Count; ++i) {.....var x = sw.item(i);.....if (x && x.Document) {......var w = x.Document.parentWindow;......if (w && w.Exchange && w.Exchange[arg[3]]) {.......window.MainWindow = w;.......var rc = api.Memory('RECT');.......api.GetWindowRect(w.te.hwnd, rc);.......api.MoveWindow(te.hwnd, (rc.Left + rc.Right) / 2, (rc.Top + rc.Bottom) / 2, 0, 0, false);......}.....}....}....api.AllowSetForegroundWindo

                C:\Users\user\Desktop\extract\script\common.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):12243
                Entropy (8bit):5.496413457759763
                Encrypted:false
                SSDEEP:192:WIT+T5jB/ffEuEoaRivV8MMsItno244joBAKLjD5bsaMjlYtNwOuwrw:PT+T5jJffEuELXMM1noion1MRYtFrw
                MD5:C974EA55BAD8AD71B4F5D7A0CCB198E1
                SHA1:B13CE7EAA36E8D1BECAC1C4532D9C229586B6A5E
                SHA-256:FF2616C9736759B8ED29AE657A50C59DEC6F94C6D52C698F98204513DBCFC966
                SHA-512:F1DEF2D080C0B6485F0E1E67D48C484B9CBBA2B0A965D526F01259B62E0403AD3BD4A885DBB56E6503F9D167B17D897B31CFA39B1A7B91C56D3B4482AE346B40
                Malicious:false
                Reputation:low
                Preview:// Tablacus Explorer....g_sep = "` ~";....if ("async ") {...AsyncFunction = Object.getPrototypeOf(async function () { }).constructor;..} else {...AsyncFunction = function (s) {....return Function(FixScript(s));...};..}....importScript = async function (fn) {...let hr = E_FAIL, s;...if (window.ReadTextFile) {....s = await ReadTextFile(fn);...} else {....if (!/^[A-Z]:\\|^\\\\\w/i.test(fn)) {.....fn = BuildPath(GetParentFolderName(await api.GetModuleFileName(null)), fn);....}....let ado = await api.CreateObject("ads");....ado.CharSet = "utf-8";....await ado.Open();....await ado.LoadFromFile(fn);....s = await ado.ReadText();....ado.Close();...}...if (s) {....if (/\.vbs$/i.test(fn)) {.....hr = ExecScriptEx(window.Ctrl, s, "VBScript", await $.pt, await $.dataObj, await $.grfKeyState, await $.pdwEffect, await $.bDrop);....} else {.....await new AsyncFunction(s)();.....hr = S_OK;....}...}...return hr;..}....if (!window.InitUI && !window.chrome) {...if (window.alert) {....importScript("script\\

                C:\Users\user\Desktop\extract\script\consts.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):45350
                Entropy (8bit):5.306595899178274
                Encrypted:false
                SSDEEP:768:ApfFX4h8XeVWrM3se9b3+loBLVCqYMA5KQgxqriIRIWfv2izXSqU:1khrbo1l8v2izXi
                MD5:BA7679E5EB1243BD47896C12D2C60D0D
                SHA1:B4071F32AAD444D144CB6E94F47AA5458F99E5B7
                SHA-256:4E7C971B0DAEE60D124430DB1E9F3A3DA2E61147D2896AB8D13E3EA549181EF6
                SHA-512:A96592B2BE47E04F8B5B520E058AA16C1E16A3444B3387551A68D2641C8AE2C4CA30D18142985AB6731B2A9F844402325DD7A84FD3D70CFF49FB7114A5A53261
                Malicious:false
                Reputation:low
                Preview://Tablacus Explorer....if ("undefined" === typeof Promise) {...Promise = function (fn) {....this.promise = fn;...}...Promise.all = function (ar) {....ar.then = function (fn) {.....for (var i = 0; i < ar.length; ++i) {......if ("function" === typeof ar[i] && ar[i].promise) {.......(function (ar, i) {........ar[i].promise(function (data) {.........ar[i] = data;........});.......})(ar, i);......}.....}.....fn(ar);.....return ar;....}....return ar;...}..}....try {...if ("undefined" === typeof console) {....console = {.....log: function () {......const args = Array.apply(null, arguments);......api.OutputDebugString(args.join("\n") + "\n");.....}....}...}..} catch (e) { }....FixScript = RemoveAsync = function (s, a) {...if (a) {....return "(async () => {" + s + "\n})();";...}...s = s.replace(/([^\.\w])(async |await )/g, "$1");...if ("undefined" === typeof ScriptEngineMajorVersion) {....return s;...}...var v = ScriptEngineMajorVersion();...s = s.replace(/(\([^\(\)]*\))\s*=>\s*\{/g, "function

                C:\Users\user\Desktop\extract\script\dialog.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1744
                Entropy (8bit):4.831018821880081
                Encrypted:false
                SSDEEP:24:hPaPPE2sVIX9UyVMZEPa4Kcl/hLc1RRHiOgB9vFpJfGVM9vFQBAueA+DpGwLigv7:t1lStMZ6adcxNc1DiLfYAOBAjHigzQ3S
                MD5:4E0A4415A06D21ED1600B1779782E88A
                SHA1:EC504141D63FA6ACC1EDBE20528D5D5EC72746E5
                SHA-256:AC8BE2436FB5FC789751462683677B3747D0317969EE08069BB5F413FAB48CB2
                SHA-512:1354007DA8C8605332E4B9221584BCF4CFA11AD920289711D2ECF11C47DA856BD78442B7CFDAC69BA7ADC582567173515738D8C79E2A4C5EBEDDF02DAAF09DBE
                Malicious:false
                Reputation:low
                Preview:<!DOCTYPE html>..<html>.. <head>.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta http-equiv="MSThemeCompatible" content="Yes">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Tablacus Explorer</title>.. <link rel="stylesheet" type="text/css" href="./index.css">.. <script type="text/javascript" charset="utf-8" src="./consts.js"></script>.. </head>.. <body>.. <form name="F" onsubmit="return false">.. <div class="panel" id="panel0" style="overflow-y: auto;">.. <div id="Content" style="height: 100%"><label>Please wait.</label></div>.. - - - - - - - - - - -->.. </div>.. panel_end-->.. <table id="buttons" class="footer">.. <tr>.. <td style="padding: 0 2px;">.. <button id="ButtonSearch" class="hide" onclick="SearchIcon(document.getElementById('Content'))" disabled="true">Search</button>.. </td>.. <td id="footnote" class="nowrap"></td>..

                C:\Users\user\Desktop\extract\script\index.css

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):5646
                Entropy (8bit):5.007959119740393
                Encrypted:false
                SSDEEP:96:xBP2Y4nOfyBYozNCE80GfTTp1Q1bwIIdzA4KB/b+cTqsqc:xBPKg4zw9Hp1Qp9k8PBKcTP
                MD5:F1BEBCDDADE286B54711DF3AB28D9DB0
                SHA1:71F4B8F73DE7A6BEA44208B39E2A3C8658BAC79D
                SHA-256:5ED605FC9DD9B425BABB95D0A91ED27BEA277AD52F673CD50A172F38275B60F2
                SHA-512:91910C2398B477E4BBDC2C162E18B7F949B2C9EAEB00AA7FBA6750F8EAF29CDA31A1DDA303C47C67FD117A681A50B35435C5450219E3B9B1504F3A15B6381DE0
                Malicious:false
                Reputation:low
                Preview:* {...box-sizing: border-box;...font-size: 12px;...font-size: inherit;...font: inherit;..}....html {...height: 100%;..}....body {...overflow: hidden;...margin: 0;...padding: 0;...border: none;...color: #000;...background-color: #f0f0f0;...height: 100%;..}....table {...border-collapse: collapse;...border-spacing: 0;...border: none;...padding: 0;...margin: 0;..}....td, tr {...vertical-align: top;...border: none;...padding: 0;...margin: 0;..}....img {...vertical-align: middle;...border: none;..}....img.button, img.button1, img.hoverbutton, img.activebutton {...box-sizing: content-box;..}....svg {.. fill: currentColor;..}....form {...display: inline;...margin: 0;..}....button {...white-space: nowrap;..}.....button, .button1 {...display: inline-block; *display: inline; *zoom: 1;...padding: 1px 1px;...text-decoration: none;...cursor: default;...outline: 0;...white-space: nowrap;...vertical-align: middle;..}.....hoverbutton, .activebutton {...display: inline-block; *display: inline; *zoom: 1

                C:\Users\user\Desktop\extract\script\index.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):4660
                Entropy (8bit):4.5126838970907714
                Encrypted:false
                SSDEEP:48:t1lStMZcKnqpKmoobR3Ed8ea8pWuSoDEa3e3l0QlIS:rcjXo8U+ehZA3//
                MD5:F39248F0FB5CB7A0FDAFEBE81E57B381
                SHA1:4BCE9A8BDD20A5413F58481D33F8D22809B42774
                SHA-256:87434DF5323DA2998B71B3BD999CFAF2536D5EDAAF7795691A404D63977836E1
                SHA-512:C152A448B69E73C5CB94631A2345E921F4EB413648DB1095DB9D4739DF5331D228D1D17C692197701C5C3580C039F59406628217AA055725E4AE64D6B161BABF
                Malicious:false
                Reputation:low
                Preview:<!DOCTYPE html>..<html>.. <head>.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta http-equiv="MSThemeCompatible" content="Yes">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Tablacus Explorer</title>.. <link rel="stylesheet" type="text/css" href="./index.css">.. <script type="text/javascript" charset="utf-8" src="./consts.js"></script>.. </head>.. <body>.. <noscript>.. <label>This page uses JavaScript.</label><br>.. </noscript>.. <form name="F" onsubmit="return false">.. <div id="toolbar">.. <table class="layout" onresize="Resize()">.. <tr>.. <td id="ToolBar1Left" class="toolbar1"></td>.. <td id="ToolBar1Center" class="toolbar2"></td>.. <td id="ToolBar1Right" class="toolbar3"></td>.. </tr>.. </table>.. <table class="layout" onresize="Resize()">.. <tr>.. <td id="ToolBar2Left" class="toolbar1"></td>..

                C:\Users\user\Desktop\extract\script\index.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (394), with CRLF line terminators
                Category:dropped
                Size (bytes):16400
                Entropy (8bit):5.417423775088834
                Encrypted:false
                SSDEEP:384:mbMTXi8Wikuna2FHFCi7YV1ZpL8viwizvXS7zu0ioi3Ek8BDXDyk2:ga8WXe7NEupFB5
                MD5:9D01044045AEB4C211ED6C3CA3D42F4F
                SHA1:D554B9E683671289FE7E28761A55D60FE5272F8C
                SHA-256:AC9188C0AA4DB5E51A30C4DBC3D10B7259FEA2B9E453A5773EE15FEB5E2A48DC
                SHA-512:978AF67A5E316DE362DF44747C2CCC7364A35FCF3BD9B7A2EE6880DFA19BC70E25985804234FBD3229D2FEAE4022EA58C394397FF656075BF522416FAF296C6E
                Malicious:false
                Reputation:low
                Preview:// Tablacus Explorer....Resize = async function () {...ResetScroll();...let o = document.getElementById("toolbar");...const offsetTop = o ? o.offsetHeight : 0;...let h = 0;...o = document.getElementById("bottombar");...const offsetBottom = o.offsetHeight;...o = document.getElementById("client");...const ode = document.documentElement || document.body;...if (o) {....h = Math.max(ode.offsetHeight - offsetBottom - offsetTop, 0);....o.style.height = h + "px";...}...await Promise.all([ResizeSideBar("Left", h), ResizeSideBar("Right", h)]);...o = document.getElementById("Background");...pt = GetPos(o);...te.offsetLeft = pt.x;...te.offsetRight = ode.offsetWidth - o.offsetWidth - pt.x;...te.offsetTop = pt.y;...pt = GetPos(document.getElementById("bottombar"));...te.offsetBottom = ode.offsetHeight - pt.y;...if (ui_.Show) {....await RunEventUI1("Resize");...}...api.PostMessage(ui_.hwnd, WM_SIZE, 0, 0);..}....ResizeSideBar = async function (z, h) {...let o = g_.Locations;...const r = await Promise

                C:\Users\user\Desktop\extract\script\location.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):16006
                Entropy (8bit):4.457850743507173
                Encrypted:false
                SSDEEP:192:Qi56n5a5jELd4ELSELZfM5fGfjsvasesdtG7tKtbAr3UlVRXqT6A5l5p35F5UEL0:4t1fKipHQl5BL2wWiB
                MD5:D0E7C792B71400C2FBD9D29D3BA7B53A
                SHA1:AEE0666E64BF66247FE74415B4C9EDD7B16FE3EC
                SHA-256:678182E314F205B3FF02B12286179D3D9806321056B4079EA549F1A89554934B
                SHA-512:7CCD031EF7042135A202780599C5E21DA339A90B8BF54069DC31BD9CD78E977E71D5CBBD7D8893B16761AD394ADDFEF6D18E5C0E40FB7AE66C41019B85B093CD
                Malicious:false
                Reputation:low
                Preview:<!DOCTYPE html>..<html>.. <head>.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta http-equiv="MSThemeCompatible" content="Yes">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Tablacus Explorer</title>.. <link rel="stylesheet" type="text/css" href="./options.css">.. <script type="text/javascript" charset="utf-8" src="./consts.js"></script>.. </head>.. <body><div id="P">.. <ul id="tabs" class="tab0 hide"> .. --><li id="tab0"></li> .. --><li id="tab1"></li> .. --><li id="tab2"></li> .. --><li id="tab3"></li> .. --><li id="tab4"></li> .. --><li id="tab5">Icon</li> .. --><li id="tab6">Position</li> .. --><li id="tab7">Menus</li> .. --><li id="tab8">Key</li> .. --><li id="tab9">Mouse</li> .. --></ul>.... <div class="panel hide" id="panel6">.. <form name="L" onsubmit="return false">.. <table class="window" id="tewin" border="1" style="width: 1

                C:\Users\user\Desktop\extract\script\options.css

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:assembler source, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):694
                Entropy (8bit):5.07552684657998
                Encrypted:false
                SSDEEP:12:x6YbhUAYblSBwb9qmbnyqHbQEa9lfPNoZXJ+nCKFXfIrf8XfIrfNWREWtmgXfIDt:hSMCJyq7Y9lXGZgtFz1zv8eYNM6
                MD5:BE1414C00E97250B4957DE8CB7F03BF5
                SHA1:4B158560B9C9A3781C98AF4D51CB9964EDA32060
                SHA-256:8F997A548564CE2169B61256FD96A32E53AED25CC668FAFF130EFA0712A2C50B
                SHA-512:F0C3F82FA83B673E721B16ABA51C35A68AE78FDFBEC897EC37B3503842D292009B471AB5D8FF8DC37C7ED5FBF5A2F085DE3CECCDD88BF4545B75C3DDB95B7104
                Malicious:false
                Reputation:low
                Preview:@import url("index.css");....select {...min-height: 1.7em;..}....input[type="text"], input[type="number"], input[type="search"] {...min-height: 1.4em;..}....input[type="button"], button {...vertical-align: top;..}....textarea {.. min-height: 2em..}.....oddline {...color: #000;...background-color: #ffffe1;..}.....box {.. border-top: 1px solid #888;..}.....color {...border-radius: 2px;..}.....window {...border: 1px solid #a0a0a0;..}.....window td {...border: 1px solid #a0a0a0;..}.....footer {.. width: 100%;.. line-height: 1.5em..}.....text1 {...color: #000;...background-color: #fff;...border: 1px solid #a0a0a0;...white-space: nowrap;..}.....location {...width: calc(100vh / 3);..}....

                C:\Users\user\Desktop\extract\script\options.html

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):39479
                Entropy (8bit):4.6468904663029535
                Encrypted:false
                SSDEEP:384:GNsrlrw5rIpjFGo3FizLwEtWPhmVaxzDZYglTfyznoyp0papTpGpspYcveVYLZgQ:re6wwEtWJmV2VWZgVBw
                MD5:93FBEDA2E02414BF287AB8F26D1CB73D
                SHA1:911FB8D759E6FCDF18000162725406CD7A614D21
                SHA-256:2C3DE4654DE791BC8510795A3CCB3475EB9EF6BFC3D3E937B347B21B0E4EA507
                SHA-512:375D5D3E9CC98123837ADDBBC247198C9E8361CF133CF309AAB881D42A74A2C0F63C1D3FCCF04BD8FE06C01DAEC19CDECE18BB8231EC1392B35FE5757B0CA91D
                Malicious:false
                Reputation:low
                Preview:<!DOCTYPE html>..<html>.. <head>.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta http-equiv="MSThemeCompatible" content="Yes">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Options</title>.. <link rel="stylesheet" type="text/css" href="./options.css">.. <script type="text/javascript" charset="utf-8" src="./consts.js"></script>.. </head>.. <body>.. <form name="F" onsubmit="return false">.. <table class="layout" class="full">.. <tr>.. <td class="top">.. <div id="tab_" class="pane nowrap" style="width: 12em; overflow-x: hidden; overflow-y: auto;">.. <a id="tabbtn0" class="treebutton" onclick="ClickButton(0);"></a>.. <label id="tab0" class="button" style="width: 91%" onmousedown="ClickTree(this);">General</label>.. <br>.. <div id="tab0_" style="margin-left: 1.667em; display: none">.. <label id="tab0_1" class="button" sty

                C:\Users\user\Desktop\extract\script\options.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (368), with CRLF, CR line terminators
                Category:dropped
                Size (bytes):99585
                Entropy (8bit):5.41335580398562
                Encrypted:false
                SSDEEP:3072:2EPnlgTh0oRu+9h+1wdbPUIKW+MJEvMavYLrIApoG268hvm:2EAh0o8+9hFbU7zcEvMavYLsApoG2xvm
                MD5:0766D5706962676FCE7C06C11A909A38
                SHA1:4509DE45AC17CFE9CDE076802E05E6973CF3EE0C
                SHA-256:A0361154692887F9F6EF36B6323E7D47E25139BEECDC5FE116EAB7C0DDFFF7D4
                SHA-512:A524D21270729AEA14F2C9ABE6C1D62D9BDF94190A9F51A3154997BC8196D9FBF2B898861222C9CA20EDA6D0696415109F629E65E692B62E8830DF9543E582BE
                Malicious:false
                Reputation:low
                Preview://Tablacus Explorer....RunEventUI("BrowserCreatedEx");....nTabMax = 0;..TabIndex = -1;..g_x = { Menu: null, Addons: null };..g_Chg = { Menus: false, Addons: false, Tab: false, Tree: false, View: false, Data: null };..g_arMenuTypes = ["Default", "Context", "Background", "Tabs", "Tree", "File", "Edit", "View", "Favorites", "Tools", "Help", "Systray", "System", "Alias"];..g_MenuType = "";..g_Id = "";..g_dlgAddons = null;..g_bDrag = false;..g_pt = { x: 0, y: 0 };..g_Gesture = null;..g_drag5 = false;..g_nResult = 0;..g_bChanged = true;..g_bClosed = false;..g_nSort = {..."1_1" : 1,..."1_3" : 1..};..g_ovPanel = null;..g_.ShowError = true;..ui_.elAddons = {};....urlAddons = "https://tablacus.github.io/TablacusExplorerAddons/";..urlIcons = urlAddons + "te/iconpacks/";..urlLang = urlAddons + "te/lang/";..xhr = null;..xmlAddons = null;..arLangs = ["General"];....Promise.all([GetLangId(), MainWindow.IconSize]).then(function (r) {...ui_.IconSize = r[1];...if (!/^en/.test(r[0])) {....arLangs.unshift

                C:\Users\user\Desktop\extract\script\sync.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with very long lines (409), with CRLF line terminators
                Category:dropped
                Size (bytes):115354
                Entropy (8bit):5.5006497845226585
                Encrypted:false
                SSDEEP:3072:Qj8DbSYoiqxYMD+KMC8LLnEn/+ayeRIxzvXitqN8pX+WxTgv:QDiqxYMDwC8fnQmayeRIxbXitqN8TxTq
                MD5:D89C18D420E8FA9F6FBCB93202BEA6AF
                SHA1:2CA5533AE39172E38F0A8EF10C099D9BB4426AAF
                SHA-256:8096A9DEF13CED7509BF4C6AF0BEA4359526EFA5264A89BBC51A3C83138AC43E
                SHA-512:B8F25D2C9302C659F1BB84DBEC04494A27DB00343B356BB45558ED616876CBE4B392C25FA293C51F518721D83F0812F1367F8C9133AB043637DC88C04991AF4B
                Malicious:false
                Reputation:low
                Preview://Tablacus Explorer....Ctrl = null;..g_temp = null;..Handled = null;..hwnd = null;..pt = api.Memory("POINT");..dataObj = null;..grfKeyState = null;..pdwEffect = [0];..bDrop = null;..Input = null;..eventTE = api.CreateObject("Object");..eventTE.Environment = api.CreateObject("Object");..eventTA = api.CreateObject("Object");....g_ptDrag = api.Memory("POINT");..window.Common = api.CreateObject("Object");..Common["_stack"] = api.CreateObject("Array");..window.Sync = api.CreateObject("Object");....g_ = api.CreateObject("Object");..g_.Colors = api.CreateObject("Object")..g_.KeyCode = api.CreateObject("Object");..g_.KeyState = api.CreateObject("Array");..const ar = [...[0x1d0000, 0x2000],...[0x2a0000, 0x1000],...[0x380000, 0x4000],...["Win", 0x8000],...["Ctrl", 0x2000],...["Shift", 0x1000],...["Alt", 0x4000]..];..for (let i in ar) {...const a2 = api.CreateObject("Array");...a2.push(ar[i][0], ar[i][1]);...g_.KeyState.push(a2);..}..g_.stack_TC = api.CreateObject("Array");..g_.dlgs = api.CreateO

                C:\Users\user\Desktop\extract\script\sync1.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):114582
                Entropy (8bit):5.469551482228482
                Encrypted:false
                SSDEEP:1536:IbiPkie1xZOHR0FNmtRBRxNapJpKOQCJo7zSER1NORzOWqDDIPAIQQaIk0vf1VHV:IunHXRj7Oe5tWqDIPAICovHuXc3T
                MD5:F1DA577FC76AF16581206FB3EF3A78EA
                SHA1:830FCEACD5C45E687AE8F0D66A29663A3AD72937
                SHA-256:3F5647311D7E38ACD5A190794C524908713FAE1BD6294B7A1EE726F055B2C902
                SHA-512:F5A7AAFD1C342618E74BCA0B412255FBCA6EC2A00B9ACEE8821C2FA64D2219D086AA99B0E4E4896B970D746C46AFCCC0CA314CB94DC3E4DEF89ACA634DCDA6C4
                Malicious:false
                Reputation:low
                Preview://Tablacus Explorer....te.ClearEvents();..te.About = AboutTE(2);..Init = false;..g_arBM = [];....GetAddress = null;..ShowContextMenu = null;....Addon_Id = "";..g_pidlCP = api.ILRemoveLastID(ssfCONTROLS);..if (api.ILIsEmpty(g_pidlCP) || api.ILIsEqual(g_pidlCP, ssfDRIVES)) {...g_pidlCP = ssfCONTROLS;..}....Refresh = function (Ctrl, pt) {...return RunEvent4("Refresh", Ctrl, pt);..}....g_.mouse = {...str: "",...CancelContextMenu: false,...ptGesture: api.Memory("POINT"),...ptDown: api.Memory("POINT"),...hwndGesture: null,...tidGesture: null,...bCapture: false,...RButton: -1,...bTrail: false,...bDblClk: false,.....StartGestureTimer: function () {....InvokeUI("StartGestureTimer");...},.....EndGesture: function (button) {....clearTimeout(this.tidGesture);....if (this.bCapture) {.....api.ReleaseCapture();.....this.bCapture = false;....}....if (this.RButton >= 0) {.....this.RButtonDown(false)....}....this.str = "";....g_bRButton = false;....SetGestureText(Ctrl, "");....if (this.bTrail) {.....api

                C:\Users\user\Desktop\extract\script\syncb.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):2204
                Entropy (8bit):5.297609246032042
                Encrypted:false
                SSDEEP:24:lXQmZQU6AEMWl4I1JOc683vLNU/SIXnyIBjXo2Suq+eYuNiz9kIwHM4PBXK:l9s4Mt68ZU/SIXj4Iq48izGHM4PBXK
                MD5:EAA9F631F470279312D61B169A96525C
                SHA1:68A7E0D0D41613CD8629CDB8FDC815D93F8C4F10
                SHA-256:ED3BECEF0CD75318FC8B3D647A7297789EC34FCFAB3DF2062096A56501D8FC53
                SHA-512:5F44F3F79E652BDAC10948944AB083C5CAE53A50394408CBD4D9FD144C662F36A032EA225E3A252828127A9B3C4BEC091F6772244A50BCB1393564C93903E1A9
                Malicious:false
                Reputation:low
                Preview:// Tablacus Explorer....InvokeUI = function () {...if (arguments.length == 2 && arguments[1].unshift) {....const args = Array.apply(null, arguments[1]);....args.unshift(arguments[0]);....InvokeFunc(UI.Invoke, args);....return S_OK;...}...InvokeFunc(UI.Invoke, Array.apply(null, arguments));...return S_OK;..}....BlurId = function () {...InvokeUI("BlurId", Array.apply(null, arguments));..}....clearTimeout = function () {...InvokeUI("clearTimeout", Array.apply(null, arguments));..}....clipboardData = {...setData: function (format, data) {....api.SetClipboardData(data);....return true;...},...getData: api.GetClipboardData..}....CloseWindow = function () {...InvokeUI("CloseWindow");..}....ExitFullscreen = function () {...FullscreenChanged(false);...InvokeUI("ExitFullscreen");..}....FocusFV = function () {...InvokeUI("FocusFV");..}....GetFolderView = function (Ctrl, pt, bStrict) {...if (!Ctrl) {....return te.Ctrl(CTRL_FV);...}...const nType = Ctrl.Type;...if (nType <= CTRL_EB) {....return Ctr

                C:\Users\user\Desktop\extract\script\threads.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1245
                Entropy (8bit):5.238268926901653
                Encrypted:false
                SSDEEP:24:c/oPBSNDZAoXw703xe83tlmJPnv7PXshhU2CXH/K4CuAiFfDs3bgoF43:c/oPINdAoF3rtYrPEU2CSbiFfDs3bgJ3
                MD5:4A21AFFCAA4DDBD6198B1A601BEF4D5E
                SHA1:AC6464331CB3C33CA1AB70148E4B4DFF0BB1B97A
                SHA-256:6047342B14F2237203AE2AB6981C5B9E0D07364CAEAB5F1F07FFCF9AFDE7ADBD
                SHA-512:C688828F410751D831A94DF1AA89826AE4270DA4194A2BEDF9C0714191535A80B1B766A734948CEDB8E19CA312DFEC92ABD7AD18F06BB835473543C15D992B03
                Malicious:false
                Reputation:low
                Preview:try {...while (Threads.Images.length) {....var o = Threads.Images.pop();....var image = api.CreateObject("WICBitmap");....image.OnGetAlt = o.OnGetAlt;....if (image.FromFile(o.path, o.cx)) {.....if (o.cx) {......if (!o.anime || image.GetFrameCount() < 2) {.......image = GetThumbnail(image, o.cx, o.f);......}.....}.....if (o.mix) {......image.AlphaBlend(o.rc, o.mix, o.max || 100);.....}.....if ("string" === typeof o.type) {......o.out = image.DataURI(o.type, o.anime && o.quality != -2 && image.GetFrameCount() > 1 ? -2 : o.quality);.....} else if ("number" === typeof o.type) {......o.out = image.GetHBITMAP(o.type);.....} else if (MainWindow.WINVER > 0x601) {......o.out = MainWindow.api.CreateObject("WICBitmap").FromStream(image.GetStream("", -2));.....} else {......o.out = MainWindow.api.CreateObject("WICBitmap").FromFile(image.DataURI());.....}.....api.Invoke(o.onload || o.callback, o);....} else if (o.onerror) {.....api.Invoke(o.onerror, o);....}...}..} catch (e) { }..try {...Threads.En

                C:\Users\user\Desktop\extract\script\ui.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):42334
                Entropy (8bit):5.380004033812086
                Encrypted:false
                SSDEEP:768:IxgJCAf/BrpN9dcFMsLeUl/vAAgEftJq+7R9tKdEvQeea:IiwAf/BrpN9dEMsLeaAAgEftJq+7RXKu
                MD5:19E4FA23E7EF73F865B0A10CF2BF901E
                SHA1:DDFCBDC8EF73149C1D53CA1881E4C6258E3342F9
                SHA-256:49FED8D28DE4F336E70333E8A7A5C99660C3502E176E5F0483F0CA817D527AD4
                SHA-512:66CC042873687FD7BEE404DA456062854B4C76CA33C2392311FD2EF584BC787F2487B4FA76E0AB7D062C354D2D6CAA208267DB78CA05033A3B238E5CD502E226
                Malicious:false
                Reputation:low
                Preview:// Tablacus Explorer....if (!window.addEventListener && window.attachEvent) {...window.addEventListener = function (n, fn) {....window.attachEvent("on" + n, fn);...}...document.addEventListener = function (n, fn) {....document.attachEvent("on" + n, fn);...}...document.body.addEventListener = function (n, fn) {....document.body.attachEvent("on" + n, fn);...}..}....if (!window.devicePixelRatio) {...window.devicePixelRatio = 1;..}....ui_ = {...IEVer: window.chrome ? 12 : ScriptEngineMajorVersion() > 8 ? ScriptEngineMajorVersion() : ScriptEngineMinorVersion(),...Zoom: 1,...tmDown: 0,...eventTE: {},...MiscIcon: {}..};....InitUI = async function () {...if (window.chrome) {....te = await parent.chrome.webview.hostObjects.te;....parent.chrome.webview.hostObjects.options.shouldSerializeDates = true;....api = await te.WindowsAPI0.CreateObject("api");....fso = api.CreateObject("fso");....sha = api.CreateObject("sha");....wsh = api.CreateObject("wsh");....$ = await api.CreateObject("Object");....$

                C:\Users\user\Desktop\extract\script\update.js

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1738
                Entropy (8bit):5.407025416554453
                Encrypted:false
                SSDEEP:48:pvo/2RfjL37fjp0lEqGwhIAduSZohjuSRyhjuSgeTuSrKU:JG2hbTJqnhDQXhSYyhSUiQKU
                MD5:6FEA5DCF7168D3C3753AED11F9BD829E
                SHA1:5DAC39221AE65FB1AB365C5D02920CB06C612AEC
                SHA-256:A00A922F79ED8C94951579206D7819380EB145B3ABFF1AA17EE315B22E29DAE0
                SHA-512:E1CDC6970324E41EDF60BE7B4A2212A636BA08A6C5DF54216A469E111710FDA25A7B79B99ED72745D1333172162D7C86B24F9963E64F67DB1225A2E48F114FB0
                Malicious:false
                Reputation:low
                Preview:TITLE = "Tablacus Explorer";..fso = new ActiveXObject("Scripting.FileSystemObject");..sha = new ActiveXObject('Shell.Application');..wsh = new ActiveXObject('WScript.Shell');..args = WScript.Arguments;....var server = GetObject("winmgmts:\\\\.\\root\\cimv2");..var t = new Date().getTime();..if (server) {...for (;;) {....var df = new Date().getTime() - t;....var cols = server.ExecQuery('SELECT * FROM Win32_Process WHERE ExecutablePath="' + (args(0).split("\\").join("\\\\")) + '"');....if (!cols.Count) {.....break;....}....if (df > 30000) {.....for (var list = new Enumerator(cols); !list.atEnd(); list.moveNext()) {......if (list.item().Terminate() == 0) {.......continue;......}.....}....}....if (df < 6000) {.....WScript.Sleep(500);....} else if (wsh.Popup(args(2), 5, TITLE, 1) == 2) {.....WScript.Quit();....}...}..} else {...wsh.Popup(args(2), 9, TITLE, 0);..}..if (args.length > 5 && args(5)) {...var f = args.length > 6 ? parseInt(args(6)) : 0x0210;...if (/^Move$/i.test(args(5))) {....sh

                \Device\ConDrv

                Download File
                Process:C:\Windows\SysWOW64\7za.exe
                File Type:ASCII text, with CRLF, CR line terminators
                Category:dropped
                Size (bytes):569
                Entropy (8bit):4.84669104508676
                Encrypted:false
                SSDEEP:12:pMd1DiIiRwsh3lUyTAhiQFyYhiW5L/ROAIhwitN7N:piWI4wsh3SyTAhJThb5DMAIhbtr
                MD5:7E2C69064F81D05C8FBD1FDE08EBBEBF
                SHA1:E6BBD85258B316AAA0CCF5D52C2928512D84EF09
                SHA-256:5713F629708BFD79A7F0B08080F774F22C4B382B23AF65FB7C50E931C4AB0FE5
                SHA-512:4474FC4D798573D18A1FCCE0C0B518B31B0F3039BC05E0F4661DC3BACE77D58A77E380348B652D2186DCF189EC10B3DE89F52C9E16FA192B4EAF1BAE463B5E69
                Malicious:false
                Reputation:low
                Preview:..7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30....Scanning the drive for archives:.. 0M Scan C:\Users\user\Desktop\download\. .1 file, 964974 bytes (943 KiB)....Extracting archive: C:\Users\user\Desktop\download\te250414.zip..--..Path = C:\Users\user\Desktop\download\te250414.zip..Type = zip..Physical Size = 964974.... 0%. . 4% 70. . 5% 77. . 5% 78. . 12% 112. . 79% 139. .Everything is Ok....Folders: 26..Files: 128..Size: 2345723..Compressed: 964974..

                Static File Info

                ⊘No static file info

                Network Behavior

                Download Network PCAP: filtered – full

                Network Port Distribution

                • Total Packets: 155
                • • 443 (HTTPS)
                • • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Apr 18, 2025 08:44:47.364872932 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.364906073 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.364964962 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.367036104 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.367055893 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.606728077 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.606797934 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.608597040 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.608601093 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.608828068 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.609747887 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.656272888 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.882298946 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.882472038 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.882499933 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:47.882524967 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.882572889 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.891987085 CEST49711443192.168.2.4140.82.112.3
                Apr 18, 2025 08:44:47.891995907 CEST44349711140.82.112.3192.168.2.4
                Apr 18, 2025 08:44:48.007424116 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.007508039 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.007608891 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.008886099 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.008924961 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.221389055 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.221468925 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.223226070 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.223273039 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.223499060 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.224489927 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.272295952 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.517662048 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.519809961 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.519845963 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.519870043 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.519905090 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.519957066 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.523135900 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.526487112 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.526505947 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.526546955 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.526561975 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.526607990 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.529879093 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.533293962 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.533313990 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.533360958 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.533376932 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.533447027 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.536654949 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.540050983 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.540076017 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.540102005 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.540118933 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.540175915 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.543431044 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.546792984 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.546809912 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.546844006 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.546859980 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.546912909 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.550199032 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.553546906 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.553565979 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.553591967 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.553606033 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.553653002 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.556938887 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.560367107 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.560384989 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.560412884 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.560429096 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.560477972 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.621043921 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.622652054 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.622669935 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.622705936 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.622725964 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.622773886 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.625811100 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.628757954 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.628781080 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.628804922 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.628820896 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.628865957 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.631776094 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.634569883 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.634584904 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.634615898 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.634629965 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.634674072 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.637290955 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.639852047 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.639868975 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.639916897 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.639933109 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.639982939 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.642313957 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.644773006 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.644790888 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.644824982 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.644840956 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.644885063 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.658775091 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.658782005 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.658827066 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.658859968 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.658873081 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.658901930 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.658917904 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.669998884 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.670015097 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.670089006 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.670104027 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.670150995 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.727601051 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.727617025 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.727703094 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.727720022 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.727770090 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.736897945 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.736911058 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.736978054 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.736993074 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.737040997 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.746196032 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.746210098 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.746277094 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.746290922 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.746350050 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.753829002 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.753843069 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.753926039 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.753938913 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.753983974 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.761497974 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.761513948 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.761588097 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.761600018 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.761651993 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.768265009 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.768280029 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.768342018 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.768361092 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.768404961 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.773926020 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.773940086 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.774019003 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.774038076 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.774084091 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.780231953 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.780246019 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.780319929 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.780333996 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.780381918 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.823611975 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.823637962 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.823728085 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.823741913 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.823798895 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.828840017 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.828854084 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.828922033 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.828936100 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.828991890 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.834151030 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.834165096 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.834235907 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.834249973 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.834296942 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.839143991 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.839158058 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.839227915 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.839241028 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.839293003 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.843934059 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.843947887 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.844017029 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.844029903 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.844090939 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.848417997 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.848432064 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.848500013 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.848512888 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.848567009 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.852705956 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.852719069 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.852786064 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.852799892 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.852847099 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.856781960 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.856796026 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.856861115 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.856874943 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.856929064 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.860724926 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.860738993 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.860805988 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.860819101 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.860867023 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.864531040 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.864543915 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.864613056 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.864624977 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.864671946 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.868752003 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.868766069 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.868849993 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.868863106 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.868911982 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.872329950 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.872343063 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.872422934 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.872436047 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.872486115 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.875689983 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.875703096 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.875767946 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.875781059 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.875832081 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.878914118 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.878927946 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.879002094 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.879014969 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.879062891 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.882045031 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.882059097 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.882122993 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.882137060 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.882189035 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.885075092 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.885087967 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.885147095 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.885159969 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.885207891 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.888022900 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.888036013 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.888088942 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.888102055 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.888144970 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.918943882 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.918957949 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.919028044 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.919040918 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.919094086 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.926418066 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.926431894 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.926496029 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.926508904 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.926558018 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.929222107 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.929234028 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.929291010 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.929303885 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.929351091 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.931926012 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.931946993 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.932001114 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.932015896 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.932059050 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.934612989 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.934627056 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.934704065 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.934716940 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.934761047 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.937262058 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.937275887 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.937334061 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.937346935 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.937396049 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.939764023 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.939779043 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.939838886 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.939851999 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.939893961 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.942044973 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.942059040 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.942116022 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.942127943 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.942178011 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.944425106 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.944438934 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.944483042 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.944513083 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.944555044 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.946768999 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.946783066 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.946841002 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.946854115 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.946896076 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.949089050 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.949110031 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.949157000 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.949170113 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.949218035 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.951186895 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.951200008 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.951270103 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.951283932 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.951333046 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.953576088 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.953589916 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.953651905 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.953665018 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.953713894 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.955437899 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.955451012 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.955509901 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.955522060 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.955569983 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.957665920 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.957679033 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.957737923 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.957751989 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.957793951 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.959378958 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.959393024 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.959448099 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.959460974 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.959506035 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.961827040 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.961843014 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.961908102 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.961920977 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.961963892 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.963219881 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.963239908 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.963274002 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.963285923 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.963315010 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.963335991 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.965120077 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.965142012 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.965200901 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.965231895 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.965277910 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.967037916 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.967051983 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.967108965 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.967122078 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.967168093 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.969729900 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.969744921 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.969799042 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.969813108 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.969851971 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.970985889 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.970999002 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.971052885 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.971065998 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.971107006 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.972805977 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.972821951 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.972870111 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.972887039 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.972932100 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.974486113 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.974502087 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.974550962 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.974565029 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.974603891 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.976135015 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.976147890 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.976192951 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.976207018 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.976250887 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.978617907 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.978631973 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.978683949 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.978698015 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.978734970 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.979677916 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.979691029 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.979737043 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.979749918 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.979790926 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.981513023 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.981528044 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.981592894 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.981605053 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.981625080 CEST44349712185.199.109.133192.168.2.4
                Apr 18, 2025 08:44:48.981647015 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.981673002 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.982736111 CEST49712443192.168.2.4185.199.109.133
                Apr 18, 2025 08:44:48.982760906 CEST44349712185.199.109.133192.168.2.4
                TimestampSource PortDest PortSource IPDest IP
                Apr 18, 2025 08:44:47.258193970 CEST5549653192.168.2.41.1.1.1
                Apr 18, 2025 08:44:47.360625029 CEST53554961.1.1.1192.168.2.4
                Apr 18, 2025 08:44:47.902730942 CEST6410753192.168.2.41.1.1.1
                Apr 18, 2025 08:44:48.005203009 CEST53641071.1.1.1192.168.2.4

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Apr 18, 2025 08:44:47.258193970 CEST192.168.2.41.1.1.10x185Standard query (0)github.comA (IP address)IN (0x0001)false
                Apr 18, 2025 08:44:47.902730942 CEST192.168.2.41.1.1.10xdf78Standard query (0)objects.githubusercontent.comA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Apr 18, 2025 08:44:47.360625029 CEST1.1.1.1192.168.2.40x185No error (0)github.com140.82.112.3A (IP address)IN (0x0001)false
                Apr 18, 2025 08:44:48.005203009 CEST1.1.1.1192.168.2.40xdf78No error (0)objects.githubusercontent.com185.199.109.133A (IP address)IN (0x0001)false
                Apr 18, 2025 08:44:48.005203009 CEST1.1.1.1192.168.2.40xdf78No error (0)objects.githubusercontent.com185.199.110.133A (IP address)IN (0x0001)false
                Apr 18, 2025 08:44:48.005203009 CEST1.1.1.1192.168.2.40xdf78No error (0)objects.githubusercontent.com185.199.111.133A (IP address)IN (0x0001)false
                Apr 18, 2025 08:44:48.005203009 CEST1.1.1.1192.168.2.40xdf78No error (0)objects.githubusercontent.com185.199.108.133A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • github.com
                • objects.githubusercontent.com

                HTTPS Proxied Packets

                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                0192.168.2.449711140.82.112.34435576C:\Windows\SysWOW64\wget.exe
                TimestampBytes transferredDirectionData
                2025-04-18 06:44:47 UTC250OUTGET /tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip HTTP/1.1
                User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
                Accept: */*
                Accept-Encoding: identity
                Host: github.com
                Connection: Keep-Alive
                2025-04-18 06:44:47 UTC956INHTTP/1.1 302 Found
                Date: Fri, 18 Apr 2025 06:44:47 GMT
                Content-Type: text/html; charset=utf-8
                Content-Length: 0
                Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame,Accept-Encoding, Accept, X-Requested-With
                Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-420f-aab2-644de7b6ef73?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250418%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250418T064447Z&X-Amz-Expires=300&X-Amz-Signature=6d9d7d4782bd7ab4786aa3cf67e4d7c59e3effb62e68b8d2f43088f655331433&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dte250414.zip&response-content-type=application%2Foctet-stream
                Cache-Control: no-cache
                Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
                X-Frame-Options: deny
                X-Content-Type-Options: nosniff
                X-XSS-Protection: 0
                Referrer-Policy: no-referrer-when-downgrade
                2025-04-18 06:44:47 UTC3472INData Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75
                Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.githu


                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                1192.168.2.449712185.199.109.1334435576C:\Windows\SysWOW64\wget.exe
                TimestampBytes transferredDirectionData
                2025-04-18 06:44:48 UTC675OUTGET /github-production-release-asset-2e65be/11879182/eb38d59c-ec0f-420f-aab2-644de7b6ef73?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250418%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250418T064447Z&X-Amz-Expires=300&X-Amz-Signature=6d9d7d4782bd7ab4786aa3cf67e4d7c59e3effb62e68b8d2f43088f655331433&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dte250414.zip&response-content-type=application%2Foctet-stream HTTP/1.1
                User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
                Accept: */*
                Accept-Encoding: identity
                Host: objects.githubusercontent.com
                Connection: Keep-Alive
                2025-04-18 06:44:48 UTC846INHTTP/1.1 200 OK
                Connection: close
                Content-Length: 964974
                Content-Type: application/octet-stream
                Last-Modified: Mon, 14 Apr 2025 13:37:03 GMT
                ETag: "0x8DD7B5970FFDC6B"
                Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
                x-ms-request-id: 84f5ba89-701e-006d-3942-ad551e000000
                x-ms-version: 2025-01-05
                x-ms-creation-time: Mon, 14 Apr 2025 13:37:03 GMT
                x-ms-blob-content-md5: +oh34d9kbr4/rfnkK67/JA==
                x-ms-lease-status: unlocked
                x-ms-lease-state: available
                x-ms-blob-type: BlockBlob
                Content-Disposition: attachment; filename=te250414.zip
                x-ms-server-encrypted: true
                Via: 1.1 varnish, 1.1 varnish
                Fastly-Restarts: 1
                Accept-Ranges: bytes
                Age: 1508
                Date: Fri, 18 Apr 2025 06:44:48 GMT
                X-Served-By: cache-iad-kiad7000077-IAD, cache-pdk-kfty8610033-PDK
                X-Cache: HIT, HIT
                X-Cache-Hits: 13, 0
                X-Timer: S1744958688.370243,VS0,VE15
                2025-04-18 06:44:48 UTC1378INData Raw: 50 4b 03 04 14 00 00 00 00 00 32 b1 7b 58 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 61 64 64 6f 6e 73 2f 50 4b 03 04 14 00 00 00 00 00 60 9b 64 57 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 61 64 64 6f 6e 73 2f 61 62 6f 75 74 62 6c 61 6e 6b 2f 50 4b 03 04 14 00 00 00 08 00 75 b0 3b 54 67 8e b3 23 34 01 00 00 45 02 00 00 1c 00 00 00 61 64 64 6f 6e 73 2f 61 62 6f 75 74 62 6c 61 6e 6b 2f 63 6f 6e 66 69 67 2e 78 6d 6c 6d 92 51 4a 03 31 10 86 df 05 ef 90 03 c8 ce ba 28 42 19 02 6a a5 28 ad 88 ac be 67 b7 63 37 76 cd 2e d9 ac 88 6f 5a 10 c1 13 e8 93 6f e2 01 44 11 3d 4d 29 d5 5b d8 86 ac 34 22 e4 61 fe 7f be 7f c2 84 60 2c 92 5c a4 75 b5 73 51 e6 85 26 cd 97 97 18 c3 0e 29 d2 22 b7 62 26 8f 49 57 b2 50 7c 35 08 d7 10 9c 6a 9a 3d a9 1a 27 0a a3 28 58
                Data Ascii: PK2{Xaddons/PK`dWaddons/aboutblank/PKu;Tg#4Eaddons/aboutblank/config.xmlmQJ1(Bj(gc7v.oZoD=M)[4"a`,\usQ&)"b&IWP|5j='(X
                2025-04-18 06:44:48 UTC1378INData Raw: 56 f3 ca f0 1a de 3d 46 51 54 33 f9 0a c4 5d 77 ea 7a 3d 6f ec c1 5b 78 5f c4 94 e7 7c 3a f8 72 32 c4 fb 3f 0e 45 57 6c e4 12 af 11 71 76 e1 a2 07 a6 96 07 5a 26 98 ce 6c c8 c0 a1 c6 54 d9 e0 f2 14 03 2d d3 9d 0d c2 5f c8 ad 0d e1 f6 5e ea 2f 48 86 85 19 ba 92 36 13 7c a3 93 93 db 7d 02 c2 29 8f f8 f1 7c 93 cf eb d7 70 f3 88 5f 70 73 9b 95 16 ce b9 e8 b1 19 c6 5e c8 f5 95 f9 30 6b 7c 6d 14 3e fe a7 e4 25 c2 f7 67 f0 72 60 bf 00 50 4b 03 04 14 00 00 00 00 00 60 9b 64 57 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 61 64 64 6f 6e 73 2f 61 64 64 72 65 73 73 62 61 72 2f 50 4b 03 04 14 00 00 00 08 00 d1 b2 89 59 94 ee aa 49 c7 01 00 00 3c 03 00 00 1c 00 00 00 61 64 64 6f 6e 73 2f 61 64 64 72 65 73 73 62 61 72 2f 63 6f 6e 66 69 67 2e 78 6d 6c 75 53 4d 8b d3
                Data Ascii: V=FQT3]wz=o[x_|:r2?EWlqvZ&lT-_^/H6|})|p_ps^0k|m>%gr`PK`dWaddons/addressbar/PKYI<addons/addressbar/config.xmluSM
                2025-04-18 06:44:48 UTC1378INData Raw: 4d 8b ea 5b 3f 6f 6d cd 40 f1 3f ff cc b5 8e 28 b1 9c e6 b5 e9 30 32 8d 7c e3 c8 71 69 f7 c6 89 58 a4 03 1d 29 83 24 1d f8 11 69 23 03 c3 35 23 d6 f3 6c 7a d3 9f ea 82 a0 84 83 d1 18 26 72 1d e0 ba 5d 47 b4 5a 3c 7c 57 c5 d7 77 6d 1a 96 73 de da 22 bd 29 01 40 27 22 26 99 82 84 c4 0f c9 94 63 90 c0 64 f3 3a f1 cc 2b 67 66 32 4a 98 4f d8 9c c6 83 86 a4 70 16 0f 23 e5 3a 19 1e 0c cf c7 67 dd cb 83 41 ff 72 d8 1d 24 a2 df 11 0a 86 41 40 30 84 c3 45 f2 8d 2b d3 5d d2 94 2c c2 5b 03 f4 65 2e 3c 7a 2c 18 49 f7 06 97 e2 3b a5 85 2f 8c 9e 17 2c 99 d0 04 f6 e6 e6 8c 8e 84 5e 17 37 19 35 3a 2c 74 f5 ce 68 70 32 be 3c a8 71 f7 70 4c f4 c8 80 d5 c9 6e 8d 6c b4 c9 70 dc ff 49 89 a2 66 75 74 51 46 e5 e8 02 a8 e0 7c 95 a0 09 82 6b ce 22 1d 86 59 b8 a4 4a e6 3b b5 46 fc
                Data Ascii: M[?om@?(02|qiX)$i#5#lz&r]GZ<|Wwms")@'"&cd:+gf2JOp#:gAr$A@0E+],[e.<z,I;/,^75:,thp2<qpLnlpIfutQF|k"YJ;F
                2025-04-18 06:44:48 UTC1378INData Raw: ac 93 d3 fd d7 bd b3 11 fc 3d 1a 1f bc 39 ef 0f 7b a3 5e ff 8c 7c c4 f6 70 34 e8 9d 1d c3 cd 68 3d 45 fd c4 37 ed 21 0b 1d 6f a6 cf 87 73 ea ba 7b bb 75 b2 b7 f7 f5 37 3b b5 47 33 da 4d dd eb 8c 20 35 d1 b5 8e 1f dc 82 59 b8 2e bf 13 d3 1e c1 a2 7b be 3f d8 1f f5 07 75 b8 ec e4 b7 ab 8f 96 76 af 20 6d 3f a0 1e 71 3c 6e 13 4f 99 39 d1 1e af 92 e7 95 4c 26 a6 f5 61 16 fa 4b cf fe b4 d4 f2 75 41 e2 a7 78 4f 8f 42 3e ce 91 bc 0b c8 31 33 96 3e 0a 41 07 89 a1 77 6f a4 94 a3 f3 d3 f1 49 f7 68 b4 7f d2 3b 46 e9 64 9b 67 78 b2 63 d0 3b fe 21 db 23 ee ae 3b a7 87 78 41 69 dc f0 ff 6f eb 64 e9 8c 8d f9 b5 67 0b fd 14 b5 74 48 23 16 fa b7 4a 4d 72 30 ba 76 98 35 27 3a 17 5c 05 5c cb 8c 28 d9 69 42 ab 70 2d 53 74 e3 fe e4 3d 26 02 9a ba b3 8b 52 a7 2a 6c 73 4d e2 0f
                Data Ascii: =9{^|p4h=E7!os{u7;G3M 5Y.{?uv m?q<nO9L&aKuAxOB>13>AwoIh;Fdgxc;!#;xAiodgtH#JMr0v5':\\(iBp-St=&R*lsM
                2025-04-18 06:44:48 UTC1378INData Raw: 63 48 d1 52 72 f1 bc ae 5a 32 3e 9c 97 ed 98 46 b0 c8 bc bb 12 47 48 58 35 7a 6f 19 73 56 7c 62 de 42 90 2f ee f7 22 78 47 e5 a6 c3 13 1c 41 8f 4f 33 4a ef 59 78 41 b3 5c 60 5f 1b ec 5c 9d 16 c9 66 3b 5b 0a 92 ab 4e 40 5e da ce f6 f6 97 9a 0a 23 c2 8c 7f 85 11 71 8d 65 d8 f4 ca b1 e8 9b c3 f3 1e d9 22 df 7d 03 90 02 f1 ed b3 17 b6 73 25 6b 78 02 3f 72 70 2e 4d 12 52 d7 64 ce 15 6d 11 2c c4 99 ba fe 75 93 cc 1d db a6 1e d4 da d4 11 5b 20 3a 76 bb 58 04 90 94 08 a9 11 4d b2 00 6a cc b1 4c b7 61 ba ce 0c 18 2d 80 a8 0b 6c 14 6b 73 12 f9 ee 92 41 df c2 0c 67 8e d7 60 7e d0 dc 09 6e 92 f6 c4 07 2e 0b d1 95 8c c5 9d 84 37 b0 4e 27 fe 19 80 d3 3b de ac 21 ba 9e c1 d9 f4 1b f2 15 68 66 13 5e e6 d6 56 26 89 ea 02 51 46 b8 a6 54 51 55 32 49 f8 7c c5 a2 ac 5d 82 bc
                Data Ascii: cHRrZ2>FGHX5zosV|bB/"xGAO3JYxA\`_\f;[N@^#qe"}s%kx?rp.MRdm,u[ :vXMjLa-lksAg`~n.7N';!hf^V&QFTQU2I|]
                2025-04-18 06:44:48 UTC1378INData Raw: a5 5f 26 57 a5 a4 49 33 26 c7 3c 97 e6 f8 b0 b6 a5 c6 7d e2 7f e8 06 17 23 07 9d 9f 4c fd d0 eb 8c 7d 07 3d 37 5e e1 56 b0 6b fe 89 9e f5 71 1d 44 60 06 55 2d 6f 49 58 0c 3c b0 02 60 48 76 29 33 41 c9 27 f3 65 5b b9 d2 86 a9 c6 2d a8 ba 82 c4 3e 93 54 dc 43 d4 02 08 0a 66 1f 1d 14 8b e8 84 6e 42 49 24 2d 89 ca 00 a2 28 82 19 58 82 54 ca bd c7 77 b8 8b 90 4a 35 cb bc be 77 2d c2 69 70 d2 3a e0 38 b8 fe 3b 86 15 88 a6 88 eb f1 82 c9 87 60 ef 0a 9e e9 52 07 d8 fc 25 34 0f 92 69 35 ef 27 f3 30 98 36 fb 0e 98 c6 fc 84 88 98 4a 90 bd f5 af e6 9a ff 33 0c 78 59 fe ed 8f dc e7 82 a4 f8 66 5e 8a 7c dc 7c d1 70 4c 39 23 62 55 94 83 9d 92 aa 61 17 b0 49 d1 2a 46 c6 ee da 42 35 fd 1b a8 4e 1f d7 49 69 73 46 44 1d 3d 43 09 bc ea d3 fa ae 82 21 a9 22 ea de 80 83 7f 8c
                Data Ascii: _&WI3&<}#L}=7^VkqD`U-oIX<`Hv)3A'e[->TCfnBI$-(XTwJ5w-ip:8;`R%4i5'06J3xYf^||pL9#bUaI*FB5NIisFD=C!"
                2025-04-18 06:44:48 UTC1378INData Raw: 25 5d f8 9b 3d 4b 3d 60 65 96 99 d5 7a a6 bc 18 92 42 e4 fc a8 4c 1b 07 8c d0 f4 b5 76 ba a9 df 13 ce 61 3f ca f0 ba b0 81 a8 80 27 f8 89 ae b1 20 5a e0 54 ef c2 32 54 f0 37 30 ef cf a7 8b 49 f0 b5 3f bb fb 3a 0f 66 0d e9 85 7c 1f 96 c2 69 da 41 9b 7e f4 2a 7b 35 e7 09 88 ac 42 a3 dc b4 5e cf a4 b8 6b 25 cd b3 83 9e 62 ac 19 ea da 99 d5 2c 27 29 36 43 2d 78 22 4c 38 68 8c 8f bc 14 c8 7b 31 20 b4 e7 b6 aa 54 77 71 93 0b 3d 14 83 8c 6c 15 87 9d b8 da 79 fb ea 4d 93 a8 de 9e d3 9f c4 51 04 fe 5a 2a 0a 91 d3 65 29 53 80 ac 0c b9 46 71 5e d1 d6 7c 9e 9d d8 1e 7c bf fc 5c ec 30 83 24 c3 45 d1 43 92 40 70 86 80 b3 24 a3 c9 8f 1e 3a 1b d2 be 99 a7 8e d8 d0 c2 d5 10 ce 04 39 08 e9 6a d9 06 ea 9e 34 b8 2e e4 44 94 39 33 cd df 55 6a 5b 5e 16 84 3f 91 bc 87 22 b5 bd
                Data Ascii: %]=K=`ezBLva?' ZT2T70I?:f|iA~*{5B^k%b,')6C-x"L8h{1 Twq=lyMQZ*e)SFq^||\0$EC@p$:9j4.D93Uj[^?"
                2025-04-18 06:44:48 UTC1378INData Raw: 1e 9c 93 ae c9 21 b3 23 ae eb 9a 2d 55 c5 b4 59 06 56 2f b0 e6 06 02 bf c1 57 75 f1 ab fb b7 cb 6f 50 4b 03 04 14 00 00 00 08 00 10 b2 69 54 45 00 88 44 41 01 00 00 f2 01 00 00 19 00 00 00 61 64 64 6f 6e 73 2f 64 6f 77 6e 6c 6f 61 64 2f 73 63 72 69 70 74 2e 6a 73 7d 90 cb 6a c3 30 10 45 d7 2e e4 1f 84 28 44 a6 41 f4 b1 0c 59 34 6d 52 02 5d 94 26 4b 43 50 a5 71 a3 22 4b c6 1a 37 36 4d fe bd a3 38 84 ae 0a 5a 0c f3 38 f7 5e e9 e0 23 b2 47 63 82 df ae 0c 9b b1 b1 09 7b ef 82 32 e3 e9 e8 ca 96 4c ec ad a7 96 3c ad b0 d9 8c dd e5 ec 67 74 95 5d 4b 5b d5 a1 c1 b5 6e 6c 8d 82 ab 34 8f 45 c1 d9 cd 05 47 25 2f 8a d8 7b 2d bf 22 cf 09 78 64 e0 22 9c 00 6b c0 8d fa 78 0a 1e c1 63 14 b7 13 c6 f9 84 a9 bd b2 c8 de 41 99 0d 74 b8 b4 0e fe 43 87 1a 2d 8d e4 0e 2b c7 f3
                Data Ascii: !#-UYV/WuoPKiTEDAaddons/download/script.js}j0E.(DAY4mR]&KCPq"K76M8Z8^#Gc{2L<gt]K[nl4EG%/{-"xd"kxcAtC-+
                2025-04-18 06:44:48 UTC1378INData Raw: 5c b1 0e df 2d 81 ba ce 0f 37 d6 57 58 62 4c a1 db 94 1a 17 40 b0 2d 4c 52 f6 03 91 d3 ef 99 cc c5 b1 e5 51 a0 76 6f 44 15 11 4a 8d ac bb dc 23 ae 06 ea c5 3a 43 fa 39 44 c0 51 10 ab 3c 43 b6 38 30 8a 47 06 68 dd b9 c9 02 ea 48 89 fa ef bc 81 98 04 49 94 67 85 42 ad 31 26 5b 22 45 1d 00 fd 64 75 34 74 c5 96 fa 09 12 0a ff 26 79 07 49 df 48 d2 a0 2c 49 8c 96 14 25 02 95 1e d1 1f 6f 7e 07 3b 20 ec f0 2f e0 e1 fd e9 cb d9 f1 df d8 e1 f9 f5 d3 c3 5d 75 74 5a 1d 5e 54 87 57 d5 d1 6d 75 70 e7 97 7e 52 dc 75 d8 4f be 50 9e af 2f 87 97 27 f6 90 07 d5 e6 da 04 f4 97 b7 fd 0a 50 4b 03 04 14 00 00 00 08 00 11 b0 68 54 e7 dd c1 81 0c 01 00 00 3a 02 00 00 1b 00 00 00 61 64 64 6f 6e 73 2f 65 78 74 72 61 63 74 2f 6f 70 74 69 6f 6e 73 2e 68 74 6d 6c 9d 91 4d 4b c4 30 10
                Data Ascii: \-7WXbL@-LRQvoDJ#:C9DQ<C80GhHIgB1&["Edu4t&yIH,I%o~; /]utZ^TWmup~RuOP/'PKhT:addons/extract/options.htmlMK0
                2025-04-18 06:44:48 UTC1378INData Raw: ad 8d 9c 78 c8 ae 3a af 11 bb f0 72 b5 62 1e 3c 31 1f 10 3e 0e a2 46 08 9d cd 63 c3 04 f9 ee f1 de d4 5e 69 06 f9 01 50 4b 03 04 14 00 00 00 00 00 60 9b 64 57 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 61 64 64 6f 6e 73 2f 66 69 6c 74 65 72 62 61 72 2f 50 4b 03 04 14 00 00 00 08 00 79 a9 3e 54 45 bc f8 dc 6c 01 00 00 bc 02 00 00 1b 00 00 00 61 64 64 6f 6e 73 2f 66 69 6c 74 65 72 62 61 72 2f 63 6f 6e 66 69 67 2e 78 6d 6c 75 92 c1 4a c3 40 10 86 ef 82 ef b0 37 2f 31 9b a6 54 6d 59 16 b4 d5 a2 b4 0a 5a bd 6f 9a 69 13 4d 36 61 b3 11 f1 66 73 f1 e8 45 7c 00 4f c5 83 57 0f 82 07 1f 25 88 f8 16 a6 cb 2e 34 52 21 84 99 7f fe 6f 7e 32 84 8c 98 17 b1 71 9e ed df a4 51 22 40 d0 f5 35 84 48 1f 38 08 16 a9 a6 6a 2f 40 64 61 c2 69 c3 6e b6 09 d6 9d 19 0e 43 6e 14
                Data Ascii: x:rb<1>Fc^iPK`dWaddons/filterbar/PKy>TEladdons/filterbar/config.xmluJ@7/1TmYZoiM6afsE|OW%.4R!o~2qQ"@5H8j/@dainCn


                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                • • File
                • • Registry
                • • Network

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:02:44:45
                Start date:18/04/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip" > cmdline.out 2>&1
                Imagebase:0xc70000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Process Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                General

                Target ID:1
                Start time:02:44:45
                Start date:18/04/2025
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff62fc20000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Mutex Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Thread Activities

                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Windows UI Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                General

                Target ID:2
                Start time:02:44:46
                Start date:18/04/2025
                Path:C:\Windows\SysWOW64\wget.exe
                Wow64 process (32bit):true
                Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/tablacus/TablacusExplorer/releases/download/25.4.14/te250414.zip"
                Imagebase:0x400000
                File size:3'895'184 bytes
                MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Process Activities

                Show Windows behavior

                Thread Activities

                Show Windows behavior

                Memory Activities

                Show Windows behavior

                System Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                Network Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                General

                Target ID:3
                Start time:02:44:47
                Start date:18/04/2025
                Path:C:\Windows\SysWOW64\7za.exe
                Wow64 process (32bit):true
                Commandline:7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\te250414.zip"
                Imagebase:0x730000
                File size:289'792 bytes
                MD5 hash:77E556CDFDC5C592F5C46DB4127C6F4C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Thread Activities

                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                Process Token Activities


                General

                Target ID:4
                Start time:02:44:47
                Start date:18/04/2025
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff62fc20000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Mutex Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Thread Activities

                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Windows UI Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                General

                Target ID:5
                Start time:02:44:50
                Start date:18/04/2025
                Path:C:\Windows\System32\notepad.exe
                Wow64 process (32bit):false
                Commandline:"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\extract\readme.txt
                Imagebase:0x7ff7d6920000
                File size:201'216 bytes
                MD5 hash:27F71B12CB585541885A31BE22F61C83
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:false
                Show Windows behavior

                File Activities

                Show Windows behavior

                Section Activities

                Show Windows behavior

                Registry Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Mutex Activities

                Show Windows behavior

                Process Activities

                Show Windows behavior

                Thread Activities

                Show Windows behavior

                Memory Activities

                Show Windows behavior

                System Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Windows UI Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                Disassembly

                ⊘No disassembly