Edit tour

Windows Analysis Report
teracopy.exe

Overview

General Information

Sample name:	teracopy.exe
Analysis ID:	1525236
MD5:	d704e453e065a23ed414927d9b203086
SHA1:	352e4b98faebc35f5c8cfeaebb7bcb36d7c7fbfc
SHA256:	ac03db52bb68a013d3a8bf4db703ec11976fa1d0aa557eb988e3f926a26656cf
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	35
Range:	0 - 100

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)

Sets debug register (to hijack the execution of another thread)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal ftp login credentials

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Stores files to the Windows start menu directory

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

teracopy.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\teracopy.exe" MD5: D704E453E065A23ED414927D9B203086)

teracopy.exe (PID: 6340 cmdline: "C:\Users\user\Desktop\teracopy.exe" /i "C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\TeraCopy" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs" SECONDSEQUENCE="1" CLIENTPROCESSID="6300" CHAINERUIPROCESSID="6300Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Required,AI64BitFiles,AI32BitFiles,LangFiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,FileTypeAssociations" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\teracopy.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727988756 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\teracopy.exe" TARGETDIR="C:\" AI_INSTALL="1" MD5: D704E453E065A23ED414927D9B203086)

svchost.exe (PID: 6804 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 6740 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7024 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5A47AF99B05C7470AB4A5944CAABC493 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3680 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 8F40C98428DBA722FDF12CC2E7B6A268 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3564 cmdline: "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2300 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\Context.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2184 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\TeraCopy.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6268 cmdline: "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\Context.dll" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6528 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 2EFDDBFE61B0E29FD1CF03EB96A988B5 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

svchost.exe (PID: 6480 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6500 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6548 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6716 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 1656 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6960 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

TeraCopyService.exe (PID: 6260 cmdline: "C:\Program Files\TeraCopy\TeraCopyService.exe" MD5: E90CB56D8C42B86E74CD1C87C4D9958E)

TeraCopy.exe (PID: 1228 cmdline: "C:\Program Files\TeraCopy\TeraCopy.exe" MD5: 0599E55C4EB4729FA508E2A1EF36BA2A)

updater.exe (PID: 1996 cmdline: "C:\Program Files\TeraCopy\updater.exe" /silent MD5: D8B22F90533E53AC0B219133B28AEAB4)

svchost.exe (PID: 7088 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation -p -s wcncsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll", CommandLine: "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll", CommandLine|base64offset|contains: , Image: C:\Windows\System32\msiexec.exe, NewProcessName: C:\Windows\System32\msiexec.exe, OriginalFileName: C:\Windows\System32\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 6740, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll", ProcessId: 3564, ProcessName: msiexec.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6804, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\updater.exe

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe
Source: C:\Users\user\Desktop\teracopy.exe	EXE: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\updater.exe

Uses 32bit PE files

Source: teracopy.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Directory Opus.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\License.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Portable.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Readme.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\share.html
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\sorttable.js
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Total Commander.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Whatsnew.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\XYplorer.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Context.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopy.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopyService.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopy.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\updater.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\Context.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\TeraCopy.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\TeraCopy.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\License.rtf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\DefaultData
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\DefaultData\PowerOff.cmd
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds\Complete.wav
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds\Error.wav
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Blake3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\Blake3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\xxHashAVX2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\xxHashSSE2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\updater.ini

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}

Creates license or readme file

Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.txt
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Readme.txt
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.rtf
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\License.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\Readme.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\License.rtf

PE / OLE file has a valid certificate

Source: teracopy.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.16:63430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.16:63439 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: teracopy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\Desktop\teracopy.exe	File opened: z:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: x:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: v:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: t:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: r:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: p:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: n:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: l:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: j:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: h:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: f:
Source: C:\Windows\System32\svchost.exe	File opened: d:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: b:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: y:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: w:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: u:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: s:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: q:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: o:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: m:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: k:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: i:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: g:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: e:
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: c:
Source: C:\Users\user\Desktop\teracopy.exe	File opened: a:

Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData

Networking

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: codesector.com

Source: unknown	Network traffic detected: HTTP traffic on port 63430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63439
Source: unknown	Network traffic detected: HTTP traffic on port 63439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63430

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.16:63430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.38.21:443 -> 192.168.2.16:63439 version: TLS 1.2

System Summary

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4a89aa.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8B6F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8BCE.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C0D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9B42.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9C0E.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{DF5325DF-1F43-4282-85D5-1CA3353E6B13}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9C7C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\TeraCopySmall.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\ext.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4a89ac.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4a89ac.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIABB0.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAC6C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAC9C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD68.tmp

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI8B6F.tmp

Uses 32bit PE files

Source: teracopy.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal42.spyw.evad.winEXE@33/186@1/26

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\TeraCopy

Source: C:\Users\user\Desktop\teracopy.exe

File created: C:\Users\user\AppData\Roaming\Code Sector

Source: C:\Program Files\TeraCopy\TeraCopy.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeraCopyMutex30728
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4808:120:WilError_03

Source: C:\Users\user\Desktop\teracopy.exe

File created: C:\Users\user\AppData\Local\Temp\upd5ED1.tmp

Source: Yara match

File source: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll, type: DROPPED

Source: teracopy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\teracopy.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\teracopy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\teracopy.exe

File read: C:\Users\user\Desktop\teracopy.exe

Source: unknown	Process created: C:\Users\user\Desktop\teracopy.exe "C:\Users\user\Desktop\teracopy.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5A47AF99B05C7470AB4A5944CAABC493 C
Source: C:\Users\user\Desktop\teracopy.exe	Process created: C:\Users\user\Desktop\teracopy.exe "C:\Users\user\Desktop\teracopy.exe" /i "C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\TeraCopy" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs" SECONDSEQUENCE="1" CLIENTPROCESSID="6300" CHAINERUIPROCESSID="6300Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Required,AI64BitFiles,AI32BitFiles,LangFiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,FileTypeAssociations" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\teracopy.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727988756 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\teracopy.exe" TARGETDIR="C:\" AI_INSTALL="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 8F40C98428DBA722FDF12CC2E7B6A268
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\Context.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\Context.dll"
Source: unknown	Process created: C:\Program Files\TeraCopy\TeraCopyService.exe "C:\Program Files\TeraCopy\TeraCopyService.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5A47AF99B05C7470AB4A5944CAABC493 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2EFDDBFE61B0E29FD1CF03EB96A988B5 E Global\MSI0000
Source: unknown	Process created: C:\Program Files\TeraCopy\TeraCopy.exe "C:\Program Files\TeraCopy\TeraCopy.exe"
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process created: C:\Program Files\TeraCopy\updater.exe "C:\Program Files\TeraCopy\updater.exe" /silent
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\Desktop\teracopy.exe	Process created: C:\Users\user\Desktop\teracopy.exe "C:\Users\user\Desktop\teracopy.exe" /i "C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\TeraCopy" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs" SECONDSEQUENCE="1" CLIENTPROCESSID="6300" CHAINERUIPROCESSID="6300Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Required,AI64BitFiles,AI32BitFiles,LangFiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,FileTypeAssociations" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\teracopy.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727988756 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\teracopy.exe" TARGETDIR="C:\" AI_INSTALL="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 8F40C98428DBA722FDF12CC2E7B6A268
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\Context.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\Context.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2EFDDBFE61B0E29FD1CF03EB96A988B5 E Global\MSI0000
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process created: C:\Program Files\TeraCopy\updater.exe "C:\Program Files\TeraCopy\updater.exe" /silent
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation -p -s wcncsvc

Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: lpk.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msihnd.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: netprofm.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: npmproxy.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msisip.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dcomp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: inputhost.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: uiamanager.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mrmcorer.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: d2d1.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: xmllite.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.ui.xaml.controls.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.globalization.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: bcp47mrm.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: directmanipulation.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: photometadatahandler.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: threadpoolwinrt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ninput.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: taskschd.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: symsrv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: lpk.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msihnd.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: msisip.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\teracopy.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Section loaded: userenv.dll
Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Section loaded: vssapi.dll
Source: C:\Program Files\TeraCopy\TeraCopyService.exe	Section loaded: vsstrace.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: wldp.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: profapi.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: winmm.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: blake3.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: version.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: powrprof.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: umpdc.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: sspicli.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: winsta.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: propsys.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: windows.ui.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: inputhost.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: wintypes.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: wintypes.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Section loaded: windows.ui.immersive.dll

Source: C:\Users\user\Desktop\teracopy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files\TeraCopy\updater.ini

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Directory Opus.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\License.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Portable.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Readme.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\share.html
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\sorttable.js
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Total Commander.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Whatsnew.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\XYplorer.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Context.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopy.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopyService.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\TeraCopy.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\updater.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\Context.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\TeraCopy.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\TeraCopy.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\License.rtf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\DefaultData
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\DefaultData\PowerOff.cmd
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\af\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ar\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bg\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\bn\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\cs\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\da\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\de\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\el\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-AR\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-ES\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fa\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\fr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\he\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hu\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\id\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\it\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ja\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ka\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ko\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\nl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-BR\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\pt-PT\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ro\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ru\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sat\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sl\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sv-SE\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\th\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\tr\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\vi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-CN\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\zh-TW\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds\Complete.wav
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Sounds\Error.wav
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ca\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\es-MX\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\et\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\hi\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\lt\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\ms\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\no\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\sk\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk\default.mo
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\App\Locale\uk\default.po
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\Blake3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\32-bit\Blake3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\xxHashAVX2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\xxHashSSE2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TeraCopy\updater.ini

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}

PE / OLE file has a valid certificate

Source: teracopy.exe

Static PE information: certificate valid

PE file has a big code size

Source: teracopy.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: teracopy.exe

Static file information: File size 12403216 > 1048576

PE file has a big raw section

Source: teracopy.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x27bc00

PE file contains a mix of data directories often seen in goodware

Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: teracopy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: teracopy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: teracopy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

PE file contains a valid data directory to section mapping

Source: teracopy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: teracopy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: teracopy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: teracopy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: teracopy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\Context.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ExternalUICleaner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\MSI69C0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\xxHashSSE2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\xxHashAVX2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Blake3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\shi6923.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Blake3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Local\Temp\MSI6A9E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAC6C.tmp	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\teracopy.exe

File created: C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4D.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAC6C.tmp			Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\teracopy.exe

File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1

Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.txt
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Readme.txt
Source: C:\Users\user\Desktop\teracopy.exe	File created: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.rtf
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\License.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\Readme.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TeraCopy\License.rtf

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeraCopy.lnk

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\teracopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Program Files\TeraCopy\TeraCopy.exe

Special instruction interceptor: First address: 140276BB335 instructions caused by: Self-modifying code

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TeraCopy\Context.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8C4D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ExternalUICleaner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI69C0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\xxHashSSE2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TeraCopy\xxHashAVX2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Blake3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi6923.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Blake3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\teracopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6A9E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAC6C.tmp	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 6952

Thread sleep time: -30000s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13 FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Users\user\Desktop\teracopy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Program Files\TeraCopy\TeraCopy.exe	File opened: C:\Users\user\AppData

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\teracopy.exe

Process queried: DebugPort

HIPS / PFW / Operating System Protection Evasion

Sets debug register (to hijack the execution of another thread)

Source: C:\Program Files\TeraCopy\TeraCopy.exe

Thread register set: 1228 501

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\teracopy.exe	Process created: C:\Users\user\Desktop\teracopy.exe "C:\Users\user\Desktop\teracopy.exe" /i "C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\TeraCopy" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs" SECONDSEQUENCE="1" CLIENTPROCESSID="6300" CHAINERUIPROCESSID="6300Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Required,AI64BitFiles,AI32BitFiles,LangFiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,FileTypeAssociations" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\teracopy.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727988756 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\teracopy.exe" TARGETDIR="C:\" AI_INSTALL="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\Context.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\TeraCopy\32-bit\TeraCopy.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\TeraCopy\Context.dll"
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Process created: C:\Program Files\TeraCopy\updater.exe "C:\Program Files\TeraCopy\updater.exe" /silent

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\teracopy.exe	Process created: C:\Users\user\Desktop\teracopy.exe "c:\users\user\desktop\teracopy.exe" /i "c:\users\user\appdata\roaming\code sector\teracopy 3.17\install\53e6b13\teracopy.x64.msi" ai_euimsi=1 appdir="c:\program files\teracopy" shortcutdir="c:\programdata\microsoft\windows\start menu\programs" secondsequence="1" clientprocessid="6300" chaineruiprocessid="6300chainer" action="install" executeaction="install" clientuilevel="0" addlocal="required,ai64bitfiles,ai32bitfiles,langfiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,filetypeassociations" allusers="1" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\teracopy.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1727988756 " ai_setupexepath_original="c:\users\user\desktop\teracopy.exe" targetdir="c:\" ai_install="1"
Source: C:\Users\user\Desktop\teracopy.exe	Process created: C:\Users\user\Desktop\teracopy.exe "c:\users\user\desktop\teracopy.exe" /i "c:\users\user\appdata\roaming\code sector\teracopy 3.17\install\53e6b13\teracopy.x64.msi" ai_euimsi=1 appdir="c:\program files\teracopy" shortcutdir="c:\programdata\microsoft\windows\start menu\programs" secondsequence="1" clientprocessid="6300" chaineruiprocessid="6300chainer" action="install" executeaction="install" clientuilevel="0" addlocal="required,ai64bitfiles,ai32bitfiles,langfiles,bk3,blake2sp,blake3,exf,hash,md2,xxh64,xxh32,sha3,sha3224,sha3256,sha3384,sha3512,md4,md5,sfv,sha1,sha256,xxh,sha384,sha,xxh3,sha256sum,filetypeassociations" allusers="1" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\teracopy.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1727988756 " ai_setupexepath_original="c:\users\user\desktop\teracopy.exe" targetdir="c:\" ai_install="1"

Language, Device and Operating System Detection

Queries the installation date of Windows

Source: C:\Users\user\Desktop\teracopy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userbril.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Users\user\Desktop\teracopy.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\TeraCopy\TeraCopy.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\teracopy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\teracopy.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct
Source: C:\Program Files\TeraCopy\TeraCopy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter : FirewallProduct

Stealing of Sensitive Information

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\teracopy.exe

File opened: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Directory Opus.txt

Searches for user specific document files

Source: C:\Program Files\TeraCopy\TeraCopy.exe

Directory queried: C:\Users\user\Documents

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	33 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	11 Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	111 Process Injection	4 Virtualization/Sandbox Evasion	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	Security Account Manager	4 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Search Order Hijacking	1 DLL Side-Loading	111 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Search Order Hijacking	1 DLL Side-Loading	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	13 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	133 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
teracopy.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ExternalUICleaner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\lzmaextractor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI69C0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI6A9E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi6923.tmp	0%	ReversingLabs
C:\Program Files\TeraCopy\Context.dll	0%	ReversingLabs
C:\Program Files\TeraCopy\updater.exe	0%	ReversingLabs
C:\Program Files\TeraCopy\xxHashAVX2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Blake3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Blake3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\xxHashSSE2.dll	0%	ReversingLabs
C:\Windows\Installer\MSI8C4D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAC6C.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
codesector.com	216.239.38.21	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.239.38.21	codesector.com	United States	15169	GOOGLEUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525236
Start date and time:	2024-10-03 22:54:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	teracopy.exe
Detection:	MAL
Classification:	mal42.spyw.evad.winEXE@33/186@1/26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: teracopy.exe

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Reputation:	unknown
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LouserzedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\Config.Msi\4a89ab.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1879468
Entropy (8bit):	6.641360744849574
Encrypted:	false
SSDEEP:
MD5:	D5397889FC120BB7D30A07FAB535BBF2
SHA1:	D5A3A7C3E9B53C1F4E904E9803819EFBE962DA3C
SHA-256:	8DDE274C2FA50CDACB7266FE784C54F4D9A38469B9E2CF6D8F05BE32DB39D362
SHA-512:	CBDC7E4DA00D6FEE7E941841F0E9D2097EE42D19ED28D646AF389F65E0CDA69689B6BB445CB4A87603E165B9E161A2AB219620A34A5E2E0F103A4E534190726C
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.CY.@.....@.....@.....@.....@.....@......&.{DF5325DF-1F43-4282-85D5-1CA3353E6B13}..TeraCopy..TeraCopy.x64.msi.@.....@.....@.....@......TeraCopySmall.exe..&.{D2625015-F105-4D7F-9742-61C2BD0660E8}.....@.....@.....@.....@.......@.....@.....@.......@......TeraCopy......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_AiBackupRollbackImpersonate..Rollback backup..Path: [1]L...AI_AiBackupRollbackImpersonate.@.%....`...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.e3..63..63..6...78..6...7...6&..7"..6&..7$..6&..7o..6...7$..6...7 ..63..6...6.$.7g..6.$.72..6.$)62..63.A62..6.$.72..6Rich3..6................PE..L.....Te.........."!...%.p...j.......J..............................................MJ....@..........................5......t9..........................`=.......l...2..p....................2.......e..@....................4..@....................text.

C:\Config.Msi\4a89ad.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.272939453098405
Encrypted:	false
SSDEEP:
MD5:	47E0E5451579327491E7742B954A3B34
SHA1:	85DEDEB028396433965991D4CDDB83E072A1E95B
SHA-256:	2BF5666E023158C99EFCAE7241A1247106FFE43F0653736FD3704A466B9ABCF5
SHA-512:	7331B4678E044C8FD9CFF259DB1B5EED53ADCDFEC828CE2BDA569F06D84C22AF36C1990472B8EA7F0A2BD654FC05E6DC2BEF72D35513A4E46B8D35E7C2FF4B88
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.CY.@.....@.....@.....@.....@.....@......&.{DF5325DF-1F43-4282-85D5-1CA3353E6B13}..TeraCopy..TeraCopy.x64.msi.@.....@.....@.....@......TeraCopySmall.exe..&.{D2625015-F105-4D7F-9742-61C2BD0660E8}.....@.....@.....@.....@.......@.....@.....@.......@......TeraCopy......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_AiRestoreDeferredImpersonate..Executing restore operation..Path: [1]....AI_AiRestoreDeferred..Executing restore operation..Path: [1]...@.....@.....@....

C:\Program Files\TeraCopy\App\DefaultData\PowerOff.cmd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.083767071515677
Encrypted:	false
SSDEEP:
MD5:	F95082B2D55F940FFD919C87C3432C38
SHA1:	1ADACA6FC0A241AA405C67EEAC4513AB204E98DE
SHA-256:	50C0BC8A1097A40A940133FDA83E77D109E1C30FE385E142C646CCFAEC9BD4BD
SHA-512:	BFF12129C00419A030E1379CA2497B725FEB78F6DFF6EF7A801AF887C405871932310BD62C7F02E2355FAF50B83924FB4AA3E3E1027A69E5835F851033B95089
Malicious:	false
Reputation:	unknown
Preview:	@ECHO OFF..ECHO System will be turned off automatically in 5 minutes. Press N to cancel...ECHO...CHOICE /M "Shutdown" /C YN /T 300 /D Y..IF ERRORLEVEL 1 IF NOT ERRORLEVEL 2 SHUTDOWN -s -t 60..IF ERRORLEVEL 2 ECHO Shutdown cancelled....REM Wait 2 sec..CHOICE /C AB /T 2 /D A > NUL

C:\Program Files\TeraCopy\App\Locale\af\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13256
Entropy (8bit):	4.6819349542497894
Encrypted:	false
SSDEEP:
MD5:	4012217E3EEE49EE1610DBE87E46651D
SHA1:	B803F7EC967B416C99D64A0463A902DE551F65CF
SHA-256:	5D11BCE4BF2E61976E84F9A98D5848BBF0A20DA32614DB5CA7DD2DA4EAC1E6EF
SHA-512:	DED5E566B2F8DB5C25620379DBED9982D3BC8EC5F59802573884A776D438BFC59D38B62F4BC562D74262152A8EF91CFBEFAC8F5E201551A3859A02A5D19B59A4
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: af\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Afrikaans\n"."Language: af_ZA\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "Verified".msgstr ""..msg

C:\Program Files\TeraCopy\App\Locale\ar\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 269 messages, Project-Id-Version: teracopy '%s \331\205\331\204\331\201 \330\255\331\201\330\270 hash'
Category:	dropped
Size (bytes):	19904
Entropy (8bit):	5.251159395479645
Encrypted:	false
SSDEEP:
MD5:	4327F54846724DD55A393A41095D23AB
SHA1:	574538EA6BF1A79F6F2491F1563D9AFD8F9C6E5F
SHA-256:	D49D4CE4DFF401441C28CAFAC7DD77BACAE3CCCB4AF1077CCC318FFFDF6B4E10
SHA-512:	05D439F31AA5895444671ADB879DCB19490D9A6402C7706D646D5120E65FEAB222291495DD5FB4F402872CEAA89B576789B098B281C54BAC8AF41ECF0708B2FA
Malicious:	false
Reputation:	unknown
Preview:	....................g.......................#...............#.......................#...........#.......-.......B.......N.......k.......\|...................F.......................................+...........K.......i.......t.......z...............................................................................................................-.......=.......O.......U.......f.......p.......................................................................................................'.......0.......=..."...]............................................................................................... .......4.......H.......\.......e.......s.......}...........................................................&...................".......5.......C.......P.......V.......f.......m.......t...........................................b...........;.......@.......P.......Z.......a.......i.......s................................... ......."............... .......,.../.......\..."...q...............

C:\Program Files\TeraCopy\App\Locale\bg\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 140 messages, Project-Id-Version: teracopy '\320\227\320\260 \320\277\321\200\320\276\320\263\321\200\320\260\320\274\320\260\321\202\320\260'
Category:	dropped
Size (bytes):	11248
Entropy (8bit):	5.23171823034504
Encrypted:	false
SSDEEP:
MD5:	2428F8768437D27FB7D541E33E0D9A0A
SHA1:	1927F852AD91EB25E39A31BC6A62ED446900D1F6
SHA-256:	4790696B3AA3D8D85FDAF89286E003D6D23687466E6BAC35F12C29D7BCCA21B2
SHA-512:	45E8007754545AB67456014CFE4458E0F37A084D851792C6C78A6AB1081F517205B2D714B52524638ECC3EACDC943AB92E92277AC63E62BE8A00E16027948C64
Malicious:	false
Reputation:	unknown
Preview:	................\|...................................................F...........Y.......c.......q...+...........................................................................,.......>.......D.......U......._.......u.......z..........................................."...................2.......M.......W.......].......k.......u...........................................&...................................................-.......=...b...Z.......................................................................................F.......J.......O.......T...%...Y...................................................<...............!...&.......H.......N.......k.......u...........................................................................<...........3.......I.......Y.......q...........#...................................................................%.......B.......Q.......X.......a.......p.......u.......~.......................................................................................

C:\Program Files\TeraCopy\App\Locale\ca\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 268 messages, Project-Id-Version: teracopy '%d element\011'
Category:	dropped
Size (bytes):	17981
Entropy (8bit):	4.983468289293194
Encrypted:	false
SSDEEP:
MD5:	1D0070555FD812DCC7297B33689FCF92
SHA1:	4CC089583B843C634E9263A5862F675E92144E81
SHA-256:	695905FB66F9A4F78509617AEE494F2A5BA45C03B722E40B6B5E348B66D967F1
SHA-512:	C75AAC0AA10ABDEA26E8F15B6A6536D7A92921E5C9FFDF11CCBFF9329CF5202FA39488E905719955042FCB330B5EE8F17FDB90689557FF78E833EE44951EA20F
Malicious:	false
Reputation:	unknown
Preview:	................\|...g...........x.......y...........#...............#.......................#...........$...............C.......O.......l.......}...................F.......................................+... .......L.......j.......u.......{.......................................................................................................................>.......P.......V.......g.......q...................................................................4...................'.......D.......U.......].......f.......s..."...........................................................................$.......*.......A.......V.......j.......~...........................................................................................&...'.......N.......X.......k.......y...................................................................................b...........q........................................................................... ......."...........5... ...?...,...`..........."...........

C:\Program Files\TeraCopy\App\Locale\cs\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13515
Entropy (8bit):	4.798021937784084
Encrypted:	false
SSDEEP:
MD5:	A1218D62F97693E064FC2C5F67B756A7
SHA1:	0F14E1D04734B20CCA6BD643682BC22F2B99F4BD
SHA-256:	C180E556A17D7DA2081B45010B5D485B31A0F1FB2D91BCDA2E853C9F185551F4
SHA-512:	7E747E62049DEFA9D06FE3BCBD1DC3312CE39AE97E570F20DF58586DB0372082C4C82E8AEBE83DF8BE154D0659EAB0D8483DC01D598DDE96006CE5D30C64C53D
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 3;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: cs\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Czech\n"."Language: cs_CZ\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "V

C:\Program Files\TeraCopy\App\Locale\da\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Category:	dropped
Size (bytes):	16763
Entropy (8bit):	4.997526165866252
Encrypted:	false
SSDEEP:
MD5:	0FFDDF329932960917DF7AC4B571C275
SHA1:	542F70D20452972FCDCF232FAE6928EC0A87134D
SHA-256:	E25F81D8FC19F225ACF8989ACE87F38BFBBD36B1AD662F95FF005D9802312CF0
SHA-512:	FE8D1B9480602B7ACF0E3815BD72A674B3E38FDF73FCF21F237F6BC77B12B0B2CF6FE2FF02CD6FB5F222C9B6F1DB9E5135D339F4D53631B804872A6462B3A112
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\de\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d Element'
Category:	dropped
Size (bytes):	17249
Entropy (8bit):	5.019368586779337
Encrypted:	false
SSDEEP:
MD5:	712F9230174FEE9928DA66E315E46004
SHA1:	8022B5D1C606434202F473F0D30426E940DEF600
SHA-256:	D0261DFDE3804779EA64F34CBFADE54CE3846955A8D8BFC4F1C9E459AFFAC07E
SHA-512:	A5CACBA2C3ADE100C93AAEE269FFEDE0CB88C70A4CC9FD2571368BA05ED9E46593F4435E395355D35F40B91B3E82329A32AA5EED98DF175DC916921F96A3C7DE
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\el\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \316\243\317\204\316\277\316\271\317\207\316\265\316\257\316\277'
Category:	dropped
Size (bytes):	23985
Entropy (8bit):	5.25970435117162
Encrypted:	false
SSDEEP:
MD5:	E3631843066AEAD4FE641898F042BC76
SHA1:	174A793D12BD3FC9B73009CBFABBD2292FD120F6
SHA-256:	AC6983E589B49085A5FF0AC4271A6E2653B62BE460974081509E82594553F1F1
SHA-512:	8CB02381AC0CC534F9554CC0D80DCDB3A00A0FC3D79F265EB3C34E8EE7E660E1DC4EE891F8BD243ECBAEE49B7793DBC19D3CD5606F6389371A0BC0CB340435AB
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\es-ES\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	4.971273169554418
Encrypted:	false
SSDEEP:
MD5:	9D26F7FB0D6C08D1C07D2E88B81DD909
SHA1:	08C47B367BBDC9DDCB44DC6895DFFA5AF3E3350C
SHA-256:	B2B37936C0A4379EC35223EFF47BCF5FF136F01FD0E7EE30CCA0166AB177A662
SHA-512:	E777421F583AE144AF3D5D3D006DC2D1CC7677FF07C1C2D1508A2337DAC4461401BAFAE00DD87B1051AF531E282F187712A991212F06D71B3A07861ECEB0ABDC
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\es-ES\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18932
Entropy (8bit):	4.7838580978435985
Encrypted:	false
SSDEEP:
MD5:	96861DBBE20762BA494DCA7DA1015AD3
SHA1:	D96CFDBABCE0B6A67965F2EF37146433C5E9CC90
SHA-256:	8D7D7CC7DDCFC19142EA04C53F631B3C5901D7E2F941157F605F755CDB987FB0
SHA-512:	FF6541767BC1B2DBEE9363CFAEA6BC0AE3FAA35523ACD782860B26C4D0C1A6DF0A22E88AF910315E7EE88B4063AF112C64004C09C5DF825902037F2A350516C1
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: es-ES\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Spanish\n"."Language: es_ES\n"..#. mode..msgid "Copying".msgstr "Copiando"..msgid "Moving".msgstr "Moviendo"..msgid "Testing".msgstr "Probando"..msgid "Verifying".msgstr "Verificando"..msgid "Deleting".msgstr "Borrando"..#. results..msgid "Added".msgstr "A.adido"..m

C:\Program Files\TeraCopy\App\Locale\es-MX\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Category:	dropped
Size (bytes):	17894
Entropy (8bit):	4.967260060709588
Encrypted:	false
SSDEEP:
MD5:	519872BCB9ADF9574A8A4DE4FACD99CB
SHA1:	CD47725A799D99BF6508F4B1D96028958934FD82
SHA-256:	1A862583E9C881C6600A7511198596F77B2A25997890EC39E7F93E3E55226F98
SHA-512:	B1F5BEC2986FC7350BA9E215EC5D2CCE5364F017C1C7287A7D8940E2971B6FFF616B4A8A79596038F8F4B765BE4B0811581997F25C9C4745FE07EF990ED5CD27
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\es-MX\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18930
Entropy (8bit):	4.777490833450184
Encrypted:	false
SSDEEP:
MD5:	B8B90910DFF01CE71D9E4F0EA8D07F76
SHA1:	5E3EAC3B4376959ABF0B3E140B204670E688619A
SHA-256:	A684A5362717A05A5C80B0BACFBB24A593D1E417B7BCE520F492B41F4B215B37
SHA-512:	C9F8CC13E92AB03D4BFCD8955AAC97BF7CBC4587C8DA6186B972320F79F738C0CACD84C8FA5B380F5AF3C619E6D736CE67FD5F13301E3D144B12888CA95E10B4
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: es-MX\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Spanish, Mexico\n"."Language: es_MX\n"..#. mode..msgid "Copying".msgstr "Copiando"..msgid "Moving".msgstr "Moviendo"..msgid "Testing".msgstr "Probando"..msgid "Verifying".msgstr "Verificando"..msgid "Deleting".msgstr "Eliminando"..#. results..msgid "Added".msgstr "Ag

C:\Program Files\TeraCopy\App\Locale\et\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	16242
Entropy (8bit):	4.796034246202111
Encrypted:	false
SSDEEP:
MD5:	A70C05E90C653673EC6352D1256BE459
SHA1:	11DF5BA9C6B0D95EB7C8A624DF59E360902A0186
SHA-256:	5190408D2BC313DF0D4EFC03F293DE3A5DEAFFF4CA786FE13B8B72FC3EFFB90D
SHA-512:	3F61D8DEC2B08BF7C270EED6923F027901ED9D09362F28A53E02CF212695D847FF53AFA733690DC0F0DA23A47B2555B6AB68E727C6C8C776987447FA910FB6D5
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: et\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Estonian\n"."Language: et_EE\n"..#. mode..msgid "Copying".msgstr "Kopeeritakse"..msgid "Moving".msgstr "Teisaldatakse"..msgid "Testing".msgstr "Testimine"..msgid "Verifying".msgstr "Kontrollitakse"..msgid "Deleting".msgstr "Kustutatakse"..#. results..msgid "Added".msgst

C:\Program Files\TeraCopy\App\Locale\he\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 44 messages, Project-Id-Version: teracopy '\327\224\327\225\327\241\327\243 \327\234\327\252\327\244\327\250\327\231\327\230 \327\241\327\231\327\231\327\250 \327\224\327\227\327\234\327\225\327\240\327\225\327\252'
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	5.234560893988042
Encrypted:	false
SSDEEP:
MD5:	1E40015C62BD91CD832549FC3AA7A81E
SHA1:	419FBCB1B425B152E6BD555971B8C7F4F6A317A6
SHA-256:	8125454F29F04FA3BA0F936374A8FB969DDDB6AB9C7A0F7E33FAEB3F094FCF9B
SHA-512:	D29F615BD518401521A088D889D182B4BAE65793AE314EE79F9240F106567E44AF4CEB889849F421666925D6748298042E8947F5BCC526B85647EA4D65F37E78
Malicious:	false
Reputation:	unknown
Preview:	........,.......\|...;.......................F...........-.......;.......R.......Y.......`.......q.......w.......\|...................................................b...........'...............3.......8.......=.......B...!...I.......k...........................<...................................................................%.......,.......6.......=.......B...$...Z...................-.......@...................$.......A.......J.......Q.......l.......u.......~................................... ....... ...................v...........................................%.......$...............................Z....... ...y...................................................................................).......8...5.......n...............+...(.......................$...................................................".......#.......................................)... .......................&...,...%...................*...'.......................!............Add to Explorer context menu.Ad

C:\Program Files\TeraCopy\App\Locale\he\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13585
Entropy (8bit):	4.905880063811039
Encrypted:	false
SSDEEP:
MD5:	1C9B5CA6CB3104D80BB8D620DD1FF02F
SHA1:	BA3CF30B10FD8A8F6EE6F0D9EE232AF8F360176D
SHA-256:	0847DC42DBBB03E3864A8FC1D325647E6FE314447BA0F1B3FF73E5ABAA945B88
SHA-512:	29A6F895CF89385A2F3A6AF69338BCE82CF9568ADD272C3405CA5DDC8BA2DA78AD95582763C55F790A20A1E52E3D4CB255EFB0A8B03817A84B862A863646AD3D
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-03 12:18\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=n%100==1 ? 0 : n%100==2 ? 1 : n%100==3 \|\| n%100==4 ? 2 : 3;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: he\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Hebrew\n"."Language: he_IL\n"..#. mode..msgid "Copying".msgstr "....."..msgid "Moving".msgstr "....."..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Adde

C:\Program Files\TeraCopy\App\Locale\hr\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	15788
Entropy (8bit):	4.848233278494292
Encrypted:	false
SSDEEP:
MD5:	AEE9A8E056EA30404C5CBE22DA03DA26
SHA1:	B790856B242FCE0F3A80CE69E35836D59A8412E5
SHA-256:	CC8FEDC38DD6E722CDF1AE61F1BB40994E0923413D2AEF26BD1A7639488F70F3
SHA-512:	F989966FDC4EA0030CD9BF126426A859AE1B9285E68C445EE668FA8D6B49E2BE559E8D54CD4D8991A3D6DCD6CE5B82EFA7805CEDF52671719582E3C954DF0C9F
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 \|\| n%100>=20) ? 1 : 2);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: hr\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Croatian\n"."Language: hr_HR\n"..#. mode..msgid "Copying".msgstr "Kopiranje"..msgid "Moving".msgstr "Premje.tanje"..msgid "Testing".msgstr "Testiranje"..msgid "Verifying".msgstr "Provjera"..msgid

C:\Program Files\TeraCopy\App\Locale\id\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 188 messages, Project-Id-Version: teracopy '(Membutuhkan akses administrator yang lebih tinggi)'
Category:	dropped
Size (bytes):	11855
Entropy (8bit):	4.955871097360089
Encrypted:	false
SSDEEP:
MD5:	D612B6D7C08A9695FBA816C9B00F9B38
SHA1:	3EC32B63F275977377D0BA1A7FF743F2FCA3AF58
SHA-256:	FBF4044D25603F122EC1196B1C37939A700D23256794BF3FA9D12F252C3D54CF
SHA-512:	B9BE6C3925B6CDFDB2537FD95EC3E54D937F5A1CCDA0C9BCBD2B306FD3691D3BCB7CB0C758A8A162987AC8F0F96F3BE18A4F1CAE578D4AEC2625FF59B3035ED3
Malicious:	false
Reputation:	unknown
Preview:	....................................#...................................................%.......B...F...H...........................+...................................................$.......*.......H.......O.......Y.......b.......s.......................................................................................................7.......H.......P.......Y.......f..."...................................................................................2.......7.......A...&...]...........................................................................b...........].......m.......w.......~..................................................."............... .......,...+.......X..."...m................................... ......."...&.......I.......M.......P.......U...%...Z...................................................................<...........%.......4.......>...!...M.......o.......r.......x...............................................................................................

C:\Program Files\TeraCopy\App\Locale\it\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18507
Entropy (8bit):	4.738289909252582
Encrypted:	false
SSDEEP:
MD5:	678E6FFA95116917E148B25D51920D49
SHA1:	97BB92BD5CF5F9D66C919D57E5C2E3FD20ED8F9A
SHA-256:	10A1BD2262254D46211F927791591510C817BA17A739EBAB61C09D84E205E2AE
SHA-512:	2EBFDFE03BE1AACEE2EA11FDD1544DFF5B31B79ADE8AF003C4539D31B4DF4ADE3B476711234816CA695E6E4BF9348E6F1D81C6FAFA1F1A76C64B184EDB69A41B
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: it\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Italian\n"."Language: it_IT\n"..#. mode..msgid "Copying".msgstr "Copio"..msgid "Moving".msgstr "Sposto"..msgid "Testing".msgstr "Analizzo"..msgid "Verifying".msgstr "Verifico"..msgid "Deleting".msgstr "Elimino"..#. results..msgid "Added".msgstr "Aggiunta"..msgid "OK".ms

C:\Program Files\TeraCopy\App\Locale\ja\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	20525
Entropy (8bit):	5.696209850624636
Encrypted:	false
SSDEEP:
MD5:	E8544BC1236C3A70926BB46CEA88614D
SHA1:	144C14A8B3A7B585BACDBEEBEC465088672B00A5
SHA-256:	39566C9BCACA20EEEBA8CDF66C003DE4DCC216D1AB3E8932C173BF70CC69EB96
SHA-512:	A6DA50DB13721322A995CBCC474AAC29DD60FEB2CDB77C1D37DC3621165B300E7712A28260E8EFF125AC3FC6DFE9675B11D9B43B354E25F14B62966D8CDBB7DA
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid ""..msgstr "".."Project-Id-Version: teracopy\n".."POT-Creation-Date: 2022-01-02 17:46\n".."PO-Revision-Date: 2022-12-28 05:44\n".."Last-Translator: Somebody <your.email@address.com>\n".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n".."X-Generator: dxgettext 1.3.1\n".."Plural-Forms: nplurals=1; plural=0;\n".."X-Crowdin-Project: teracopy\n".."X-Crowdin-Project-ID: 490081\n".."X-Crowdin-Language: ja\n".."X-Crowdin-File: default.po\n".."X-Crowdin-File-ID: 5\n".."Language-Team: Japanese\n".."Language: ja_JP\n"....#. mode..msgid "Copying"..msgstr "...."....msgid "Moving"..msgstr "..."....msgid "Testing"..msgstr "....."....msgid "Verifying"..msgstr "..."....msgid "Deleting"..msgstr "..."....#. results

C:\Program Files\TeraCopy\App\Locale\ko\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18703
Entropy (8bit):	5.649116224415241
Encrypted:	false
SSDEEP:
MD5:	A25DDB3525E43CE566927C54510A5B72
SHA1:	1EB3E1392AB5918B28D32884184CFF6BA59FD366
SHA-256:	91E0C813E087BF4ADD2263E77DD8673DB3DBBA6DCF77BEA9F2CE401173EF75C9
SHA-512:	8152D262A8A77EB0AEF28BD7626DB4DA96F572B51D406C118BDCAF900F1D09636DE4DE0492BFEDB3DE7E4C6DE12688E5994C576D4AC01948327BAC29EEA02B3C
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ko\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Korean\n"."Language: ko_KR\n"..#. mode..msgid "Copying".msgstr ".. ."..msgid "Moving".msgstr ".."..msgid "Testing".msgstr "... ."..msgid "Verifying".msgstr ".. ."..msgid "Deleting".msgstr ".. ."..#. results..msgid "Added".msgstr ".."..msgid "O

C:\Program Files\TeraCopy\App\Locale\lt\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: teracopy
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.452949188493464
Encrypted:	false
SSDEEP:
MD5:	B5C1B401057C13D8DA0BF3B75C416A1F
SHA1:	A66C5E1B4589FFA6C0EF1573CBCF74FC70B05875
SHA-256:	ED19A35A542FEFF6538664FF6B5B26327E5DD6579CE54B01B1EA3F23573D5DB3
SHA-512:	865058D0C39F5DFE3663D3FE66B307CD2D325BDB11F0F628971F768D67297249FAD74A8AF3639A3143D21FD5AA3E2023DD892A0397B48AD46EACD27E11DA3EF7
Malicious:	false
Reputation:	unknown
Preview:	................$.......,.......8...G...9................Project-Id-Version: teracopy.POT-Creation-Date: 2022-01-02 17:46.PO-Revision-Date: 2022-01-02 14:49.Last-Translator: Somebody <your.email@address.com>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.3.1.Plural-Forms: nplurals=4; plural=(n%10==1 && (n%100>19 \|\| n%100<11) ? 0 : (n%10>=2 && n%10<=9) && (n%100>19 \|\| n%100<11) ? 1 : n%1!=0 ? 2: 3);.X-Crowdin-Project: teracopy.X-Crowdin-Project-ID: 490081.X-Crowdin-Language: lt.X-Crowdin-File: default.po.X-Crowdin-File-ID: 5.Language-Team: Lithuanian.Language: lt_LT..

C:\Program Files\TeraCopy\App\Locale\lt\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	12693
Entropy (8bit):	4.685094910671641
Encrypted:	false
SSDEEP:
MD5:	94307F770260256FAB33922CD25097A2
SHA1:	D78CC393FD4F12D5DB1A657D4A667E8082F46F68
SHA-256:	A57136F4C8A52029397C9230B1762794093A16746BF411C962AEA2637CC78FD4
SHA-512:	9C7FCC05EF8F30408EFC8620ABAB87913EB842FDF2920A504EAC81A9D5843DBBC71309A07AD0F134CCC831878E395590623B2BD07F7974A96D07788298C86325
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=(n%10==1 && (n%100>19 \|\| n%100<11) ? 0 : (n%10>=2 && n%10<=9) && (n%100>19 \|\| n%100<11) ? 1 : n%1!=0 ? 2: 3);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: lt\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Lithuanian\n"."Language: lt_LT\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".

C:\Program Files\TeraCopy\App\Locale\no\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Category:	dropped
Size (bytes):	16629
Entropy (8bit):	4.970533133068623
Encrypted:	false
SSDEEP:
MD5:	006D6E0D25DC7B0DA9CCBCDAAB160667
SHA1:	3CB7F68B3CE705CB555D5D4F6B213E4498892B4F
SHA-256:	1D906079414392C51D0182A0BA5B1CA7409CFE94269EFABB86F9D7522B2B3606
SHA-512:	917DECA2E882B5BE0377239D45FD0E9B6E93B4A5CB16F03901F8F1C623498BA87FA242D41B2E6F3C8D362AE9DB79988C05B3796139BAD0EF840D484A133FBB9B
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\pt-BR\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18726
Entropy (8bit):	4.815341710812011
Encrypted:	false
SSDEEP:
MD5:	ECD7D4EFEF5739A8EFCD1886D0FB23C2
SHA1:	E2A98065919A2E300AF9AA67D3803CCDF6E86456
SHA-256:	8A7D37AC8D59A9BF571EF35E263D5254476BBD1AC335DF859E3610F55DD1A955
SHA-512:	BAF8A2F5A7E8C89CDF90810E6F8C3322BEA804BACFDC7D0E409091622AD97605675767631EA670C8AF68D8E1AEA2CBB6671729AB74A510AC3F2F85CE52171F0C
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: pt-BR\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Portuguese, Brazilian\n"."Language: pt_BR\n"..#. mode..msgid "Copying".msgstr "Copiando"..msgid "Moving".msgstr "Movendo"..msgid "Testing".msgstr "Testando"..msgid "Verifying".msgstr "Verificando"..msgid "Deleting".msgstr "Excluindo"..#. results..msgid "Added".msgstr

C:\Program Files\TeraCopy\App\Locale\pt-PT\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Category:	dropped
Size (bytes):	17607
Entropy (8bit):	4.9864927814469455
Encrypted:	false
SSDEEP:
MD5:	9399F2FCA85C842B2786BEA367377502
SHA1:	32F1919A7781E660B854F1F79515EEA4568A40DC
SHA-256:	24FFD07EA703344C681CCC553BC8851772E176598A0C041665F121435245421C
SHA-512:	0DEEEDB0858845D2638CE522B9E5D485EFF539778462AF6214A795EA61B73761CD955D0F24793C637F1348630AA27ABDD7B09E772D7787F5225E5E0E667CE4B1
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\pt-PT\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	19482
Entropy (8bit):	4.8244527116320155
Encrypted:	false
SSDEEP:
MD5:	A2598C33E22199CE1DFC9D0A67D4B96D
SHA1:	C7717E9D0869EB64D52C3A0B2E23781E8FCC5740
SHA-256:	88235FF2847D33087131BA8F5FF69690BD9CD9D990D94381C23C4C29F3822F7D
SHA-512:	691E5652F10A9AA729CD7ECE298C530191949105CE5C3BD0018CBE932B59C239F40327DD5C02E34D4BC92647EA7A763B4DFFA757AD9F2A69F1C17DF421897DC7
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid ""..msgstr "".."Project-Id-Version: teracopy\n".."POT-Creation-Date: 2022-01-02 17:46\n".."PO-Revision-Date: 2022-01-03 12:18\n".."Last-Translator: Somebody <your.email@address.com>\n".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n".."X-Generator: dxgettext 1.3.1\n".."Plural-Forms: nplurals=2; plural=(n != 1);\n".."X-Crowdin-Project: teracopy\n".."X-Crowdin-Project-ID: 490081\n".."X-Crowdin-Language: pt-PT\n".."X-Crowdin-File: default.po\n".."X-Crowdin-File-ID: 5\n".."Language-Team: Portuguese\n".."Language: pt_PT\n"....#. mode..msgid "Copying"..msgstr "Copiando"....msgid "Moving"..msgstr "Movendo"....msgid "Testing"..msgstr "Testando"....msgid "Verifying"..msgstr "Verificando"....msgid "Deleting"..msgstr "Eliminando"....#. resul

C:\Program Files\TeraCopy\App\Locale\ru\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	22595
Entropy (8bit):	5.299439552979892
Encrypted:	false
SSDEEP:
MD5:	EBF7AC061C95116E68C6EF335EB1A2A8
SHA1:	646F4E7AA201CFA574987CF953A42C4D18409297
SHA-256:	0DAD884EDB969AD318F626887A3BB2E5ECAF10532BEF6870E8642FDC7607615B
SHA-512:	BF9C32AF628949372523705A02B104BAAAF673FB27D07F6727717DA51F0128E94A93E1CF927E86EEC6D893030FE4D3F65428793E0C201C1A1551BED9344C25D7
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=((n%10==1 && n%100!=11) ? 0 : ((n%10 >= 2 && n%10 <=4 && (n%100 < 12 \|\| n%100 > 14)) ? 1 : ((n%10 == 0 \|\| (n%10 >= 5 && n%10 <=9)) \|\| (n%100 >= 11 && n%100 <= 14)) ? 2 : 3));\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ru\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Russian\n"."Language: ru_RU\n"..#. mode..msgid "Copying".msgstr "..........."..msgid "Moving".

C:\Program Files\TeraCopy\App\Locale\sat\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 26 messages, Project-Id-Version: teracopy '\341\261\252\341\261\256\341\261\233\341\261\237\341\261\261 \341\261\250\341\261\256 \341\261\233\341\261\237\341\261\246\341\261\256\341\261\270 \341\261\242\341\261\237'
Category:	dropped
Size (bytes):	1810
Entropy (8bit):	5.1261565866361485
Encrypted:	false
SSDEEP:
MD5:	078D120A736F5482960C7FA215EDDD15
SHA1:	C6D9F1BBFADFB423BB95463F7874CB2061C65BEE
SHA-256:	5594A2514008E226E6C0CCEC4F1EC3EC079193757928982DF588BA88619C3884
SHA-512:	55CA32FC857C7088575311089F9A57ABDD7BDDE962E5046F4F7949FFF3F56E25F0B35B079567AB6C520A459AD304A6E3268553E4D64E6ED56FEF2EB07CC0F0FF
Malicious:	false
Reputation:	unknown
Preview:	....................%...........P.......Q......._.......f.......l.......q.......x.......~...........................................................................................................................................................-.................../.......<.......L.......\.......i...<...v...............................................................2.......?.......O......._.../...l...........)....................................................................................................................................................................................Always On Top.Cancel.Close.Copy.Delete.Error.File.Get Pro version.Ignore.Menu.More.Move.Overwrite.Pause.Paused.Resume.Select.Shutdown.Skip.Skipped.Source.Start Now.Target.Test.Verify.Project-Id-Version: teracopy.POT-Creation-Date: 2022-01-02 17:46.PO-Revision-Date: 2022-01-02 14:49.Last-Translator: Somebody <your.email@address.com>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfe

C:\Program Files\TeraCopy\App\Locale\sat\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13066
Entropy (8bit):	4.823397614765023
Encrypted:	false
SSDEEP:
MD5:	126A4970128732468B67BC0112F311BB
SHA1:	48941D06F461940064C32145073884CDD350C733
SHA-256:	0C2425B8825900BD44E5AC8464DB3B987703BE568E05F7948066F2E75E18C810
SHA-512:	FAE02208A34C32813F9F1A9C7BE9EB21BA6550F8D9A61C679BBEA394DE3BE0AEFE78D719923FA3180038A5B20337E9873513263925A45566F56782D45FB49049
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: sat\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Santali\n"."Language: sat_IN\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "Verified".msgstr ""..msg

C:\Program Files\TeraCopy\App\Locale\sl\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18347
Entropy (8bit):	4.870975996099702
Encrypted:	false
SSDEEP:
MD5:	CA5CFCDCC9E474E2908F5164D6F4BCA9
SHA1:	B888F4EEB292738D255D6618C856255D131BA196
SHA-256:	4CFE6856BD84D01CBA46E5148925F5109D21B37499AB50765FC58F6BDE911215
SHA-512:	852FA789CC943C4E314327B92CA434AF98D109ABD6B9A0B2D3F3383167C84497084314D235D91DC6C8680D2DA20D4F22910E6B8348EBBCA7DA3F1332CDE83461
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=(n%100==1 ? 1 : n%100==2 ? 2 : n%100==3 \|\| n%100==4 ? 3 : 0);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: sl\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Slovenian\n"."Language: sl_SI\n"..#. mode..msgid "Copying".msgstr "Kopiranje"..msgid "Moving".msgstr "Premikanje"..msgid "Testing".msgstr "Testiranje"..msgid "Verifying".msgstr "Preverjanje"..msgid "Deleting".msgstr "B

C:\Program Files\TeraCopy\App\Locale\sr\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy '\320\224\320\276\320\264\320\260\321\230 \321\203 \320\272\320\276\320\275\321\202\320\265\320\272\321\201\321\202\321\203\320\260\320\273\320\275\320\276\320\274 \320\274\320\265\320\275\320\270\321\230\321\203 Explorer-\320\260'
Category:	dropped
Size (bytes):	3673
Entropy (8bit):	5.411303950054313
Encrypted:	false
SSDEEP:
MD5:	633A32C206D6C230574D8A2063D00578
SHA1:	6434BC23D3D80404A03DD68800A2A98C2B3C3687
SHA-256:	00E04C8797D1FCD28BAB958DF6DB196A9B4155524DE29166F8A4FECAA0F1C9BD
SHA-512:	250154D2126786C99194C7B998AEF9659BA36137788B3E24030A1145A339BEAAAD728DF55B9AF9662DF4D5C81A924FA38AF3A05D5630E926B5A9F705AD39D928
Malicious:	false
Reputation:	unknown
Preview:	........+.......t...;.......................F...................+.......B.......I.......P.......a.......g.......l.......s.......}...........................b................................... .......%...!..........L.......i.......s.......y...........<...................................................................................#............../...$...G.......l...5...s...C.......b...........P...1...g...............................................................).......6...5...G...$...}...............W.......l.......u...................P.......7...........%.......4.......E.......X...o...m...)...........................'...'...2.......Z.......k...................................:.......S...........@...............*...'...............&.......#...................................................!.......".......................................(...............................+...$...........%.......)........................... ............Add to Explorer context menu.Adds Copy and Move

C:\Program Files\TeraCopy\App\Locale\sr\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	14063
Entropy (8bit):	5.02636217019597
Encrypted:	false
SSDEEP:
MD5:	87AA0128264F8E08C7A306C68512DB83
SHA1:	A7968AD3716B24A7E3898D5561873D27555503FF
SHA-256:	F6EA3E788AE091032358E6C13F09E024FC779AF640363987C64E3E3F50DD69DE
SHA-512:	7C884AA0C38EB48C9ED73FF7BE272B13AF137F15923DFBE6D69A01CEE3D1B388EAD40904D93A263DFF25BB2EF3B20480F5D367BE42181F5B538A0BF4E7FE1CC3
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 \|\| n%100>=20) ? 1 : 2);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: sr\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Serbian (Cyrillic)\n"."Language: sr_SP\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. resu

C:\Program Files\TeraCopy\App\Locale\th\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	20341
Entropy (8bit):	5.170869348505211
Encrypted:	false
SSDEEP:
MD5:	C5F5B2435A92C36A98A13AFA2DA56170
SHA1:	74A20B16F8760701F6C4006CB1E9C203510C9614
SHA-256:	EB6EBD77EACCCEE1DC3E9B3E3BF601311DC88E6D61D988B4F890DE022AB03759
SHA-512:	11F7545C38B31D710E50598A6985C07D77D78959EFA10FDDEB0BCC2032EA81063CADB9A6866F0C79BFD24F3AB07AC64CF01A0FE27F7010E84402B6FA871F02D6
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: th\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Thai\n"."Language: th_TH\n"..#. mode..msgid "Copying".msgstr "..........."..msgid "Moving".msgstr "........."..msgid "Testing".msgstr ".........."..msgid "Verifying".msgstr "..........."..msgid "

C:\Program Files\TeraCopy\App\Locale\tr\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \303\266\304\237e'
Category:	dropped
Size (bytes):	17380
Entropy (8bit):	5.13944510194327
Encrypted:	false
SSDEEP:
MD5:	ADE1E179CC313497B674D791D509FAA9
SHA1:	2F4CA5A28649D2D0CE82E8808C123CABC32B0791
SHA-256:	CE3EB87B80E780A0318A80E707018BAD0E0153409C7AD10679CAA03AEDC0D906
SHA-512:	80C15C5FAE89062F103639EF353C31F24CAA6694DF8AEEF1E7C023FEBD484FF80E4E1EB82DFAEDD77AF68ADB047E67A3AD7D4995DC01B8396B4108E673422EF7
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Locale\tr\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18416
Entropy (8bit):	4.974121431771883
Encrypted:	false
SSDEEP:
MD5:	E6A1680E263D913BDD2C65FBFC87B573
SHA1:	D60A249D46C23DA166BFCF599E980740CDFF9C31
SHA-256:	C117CB070EEFBBCEC3278FBF21AB42923BF72D296D3921CD8E623ACA16604639
SHA-512:	335A10B77898182B5262A8CC84078EB2F4F9A9A3E1D6CCAE3820A0F176AB606A2970ACECCF65B011309DFF7BCEDFF5CB234BE7E2CD83A0796592120E6FA2BB91
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: tr\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Turkish\n"."Language: tr_TR\n"..#. mode..msgid "Copying".msgstr "Kopyalan.yor"..msgid "Moving".msgstr "Ta..n.yor"..msgid "Testing".msgstr "Test ediliyor"..msgid "Verifying".msgstr "Do.rulan.yor"..msgid "Deleting".msgstr "Siliniyor"..#. results..msgid "Added".msgst

C:\Program Files\TeraCopy\App\Locale\zh-CN\default.po

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17334
Entropy (8bit):	5.7536227911828375
Encrypted:	false
SSDEEP:
MD5:	C04FF6792B038B0C64D59FCA1FCBD1BA
SHA1:	C1635563236D2B6D31728B01B26B7CF0DA220D68
SHA-256:	19309CE1632C56979D0686549F250312430664003155EE73374E12ECC1B9632B
SHA-512:	3AD45A1046E18407B4506325C71256A610E6B953B05CF47538A3FF95BA024D7A307D0F96D454BCA42082E3152BE8D4EA646C6BA7BED67A111624DB52830EB19D
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-07-13 08:18\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: zh-CN\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Chinese Simplified\n"."Language: zh_CN\n"..#. mode..msgid "Copying".msgstr "..."..msgid "Moving".msgstr "..."..msgid "Testing".msgstr "..."..msgid "Verifying".msgstr "..."..msgid "Deleting".msgstr "..."..#. results..msgid "Added".msgstr "..

C:\Program Files\TeraCopy\App\Locale\zh-TW\default.mo

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \345\200\213\351\240\205\347\233\256'
Category:	dropped
Size (bytes):	16403
Entropy (8bit):	5.767331036551763
Encrypted:	false
SSDEEP:
MD5:	ED7FA20D5D61AB01061A9E8318821072
SHA1:	FC18AE9043295EEAAFCF1A77768CD1F0184690F4
SHA-256:	8B0953547338C38F892096E73F01485195AC0B7B616F05429CE97A99F07824F2
SHA-512:	2AF8F9F16EAD6B70E03F2E0CE549F8E6214E236FE17D0B89A71508C171D19606E507DDC751B599D7920489660600DEF39F01E563CECDE8E8F184D74C2AE6D2B2
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Program Files\TeraCopy\App\Sounds\Complete.wav

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	501804
Entropy (8bit):	5.137175821839779
Encrypted:	false
SSDEEP:
MD5:	B163AA40A5983E7AA0FB7C075AF6BAAB
SHA1:	19199CFB4F8EC69113693A8A661645C233FDA045
SHA-256:	406C008842A8C413CFC97585C5679F09DCFECCA59DC30988F994E19C70E4ECFA
SHA-512:	397C157EA65C663B2F85243A33AC238654242DECBC03F36875907C3573CCC4414C01941D503F2FA5BA6806611B85350461F1FAEE3D38715358A42BAC498951FA
Malicious:	false
Reputation:	unknown
Preview:	RIFF$...WAVEfmt ........D...........data................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeraCopy\Context.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1755872
Entropy (8bit):	5.975108869882995
Encrypted:	false
SSDEEP:
MD5:	F25893561856E49FEA312FE0660309B7
SHA1:	CEDB00AB9052101C6BA37127853A37BE3A68FFAE
SHA-256:	805E41FB941140234C29AE25A0BE1542DC72C6957132588E68D79DAC7687DAA8
SHA-512:	15BBF583B253BBD87E68A759F9D9A3FF09928317CD29A3046B98FD555773083122497AB18E092C4469021AD8AAAF75E8FB4A88647343772CC51C31CE82A2E699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......d.........." .....P...J................@.....................................+)....`.......................... .......................`.......@..........LR.......,......."..................................................8f...............................text...0N.......P.................. ..`.data...P-...`.......T..............@....bss....x................................idata.......`......................@....didata.............................@....edata..............................@..@.rdata..E...........................@..@.reloc...".......$..................@..B.pdata..LR.......T..................@..@.rsrc........@......................@..@....................................@..@........................................

C:\Program Files\TeraCopy\License.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	4.697765435237592
Encrypted:	false
SSDEEP:
MD5:	E8A8EF422A7B69C7FE5E4040230CBCE4
SHA1:	E6435981001B98D3E5ABFA7C163AA90B2BF76008
SHA-256:	0CF0973D9BB6DF2F0EFFEF874404A7D19CF30B53DE88ECDF326FA29477B904DA
SHA-512:	A3A6688F5C56868FBF53C848BD5B6228E65C0C613FDE11000F22F41855B8ADFAB08089A3E380FD0FE240CC2783F192FECA611FFD7999101B9CD48AD816038192
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\*\generator Riched20 10.0.21359}\viewkind4\uc1 ..\pard\f0\fs18\lang1033 Please read the following terms and conditions carefully before using this software. Use of this software indicates you accept the terms of this license agreement and warranty.\par..\par..1. Disclaimer of Warranty\par..\par..TeraCopy (this software) is provided "as-is" and without warranty of any kind, express, implied or otherwise, including without limitation, any warranty of merchantability or fitness for a particular purpose. \par..\par..In no event shall the author of this software be held liable for data loss, damages, loss of profits or any other kind of loss while using or misusing this software.\par..\par..2. License\par..\par..TeraCopy is provided as FREEWARE for private (non-commercial) or educational (including non-profit organization) use. In these cases, you are granted the right to use and to make an unlimited number of copies of

C:\Program Files\TeraCopy\Readme.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.8248967588728355
Encrypted:	false
SSDEEP:
MD5:	77A28C6396845A0622A7BFF3AE011BF1
SHA1:	0727E94064D93C26887BB906BE7F1B1642EFF106
SHA-256:	253DD55E4186C616F13F73603077C3F644E0B6F5DA5D2DC36E7FFD90569035D9
SHA-512:	E229626A40453ADFD16F311E48FF868E836BE123C13D57BF290D89AA3B5D4A7444EBBFE0532BBDA923E75E2BD3B247D146941A4DC502B9E83527880EC4851F75
Malicious:	false
Reputation:	unknown
Preview:	TeraCopy..(c) 2007-2023 Code Sector..All Rights Reserved....CONTENTS....1. GENERAL NOTES..2. SYSTEM REQUIREMENTS..3. CONTACTING US....1. GENERAL NOTES....TeraCopy is a compact program designed to copy and move files at the maximum..possible speed, also providing you with a lot of features. ....* Copy files faster. TeraCopy uses dynamically adjusted buffers to reduce .. seek times. Asynchronous copy speeds up file transfer between two physical .. hard drives.....* Pause and resume transfers. Pause copy process at any time to free up system.. resources and continue with a single click.....* Error recovery. In case of copy error, TeraCopy will try several times and .. in the worse case just skips the file, not terminating the entire transfer... ..* Interactive file list. TeraCopy shows failed file transfers and lets you fix.. the problem and recopy only problem files. ....* Shell integration. TeraCopy can completely replace Explorer copy and move .. functions, allowing you work wit

C:\Program Files\TeraCopy\sorttable.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17213
Entropy (8bit):	4.901143064880864
Encrypted:	false
SSDEEP:
MD5:	C465D96C2035408602F71B29B06D722C
SHA1:	80862EE118C9F5833D69483F2C682092735FBDE8
SHA-256:	72FA6DDC5DFDB54DD35935FEAAAD9B2A68CA1E872CAA4EDF03C1A26F1C3E4931
SHA-512:	6B09DB7E545C57C78B38C74966948D1E681101059025FACB5B233AE957C5F54C589C347B8FF54BEA67D31C69541ED736447E4E223B663F5491196EDEA2E07635
Malicious:	false
Reputation:	unknown
Preview:	/.. SortTable.. version 2.. 7th April 2007.. Stuart Langridge, http://www.kryogenix.org/code/browser/sorttable/.. .. Thanks to many, many people for contributions and suggestions... Licenced as X11: http://www.kryogenix.org/code/browser/licence.html.. This basically means: do what you want with it.../.... ..var stIsIE = /@cc_on!@/false;....sorttable = {.. init: function() {.. // quit if this function has already been called.. if (arguments.callee.done) return;.. // flag this function so we don't do the same thing twice.. arguments.callee.done = true;.. // kill the timer.. if (_timer) clearInterval(_timer);.. .. if (!document.createElement \|\| !document.getElementsByTagName) return;.. .. sorttable.DATE_RE = /^(\d\d?)[\/\.-](\d\d?)[\/\.-]((\d\d)?\d\d)$/;.. .. forEach(document.getElementsByTagName('table'), function(table) {.. if (table.className.search(/\bsortable\b/) != -1) {.. sorttable.makeSortable(table);.. }.. });..

C:\Program Files\TeraCopy\updater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1213664
Entropy (8bit):	6.442073850064254
Encrypted:	false
SSDEEP:
MD5:	D8B22F90533E53AC0B219133B28AEAB4
SHA1:	3204E11F5CCFBE5BB5441A6F7F43F8CDC16983EA
SHA-256:	DC9D76355354FC0B3D5D7176F97DBEDF72526D81E4B93AD8231E4F48F0020708
SHA-512:	F606A91E811A3DCF2EB5FDE0DDA4280ADF641B19087F6C491A4F817A45EEA88A8650C9F1DAA2B1AF12ECCF59D19A0AA8E83CAD0B028DF94DF16B4D5BE428925A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5..5..5....;....... ..&.. ..-.. ..j.........4...."..5......v.....v$.4...v.4..Rich5..................PE..L...j.Te.........."....%.P..........ho.......`....@.......................................@..................................S.......................X...,.............p...............................@............`.......I.. ....................text..._N.......P.................. ..`.rdata..P....`.......T..............@..@.data...<4...p.......d..............@....rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\TeraCopy\updater.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.331139663722829
Encrypted:	false
SSDEEP:
MD5:	8E70FD29D0458F4F3073E50FA83F2D27
SHA1:	70CEF6902FF3F14BBFAD8C6EB0DB3E36C3285F71
SHA-256:	FB45DEDF3CC06EE62A5475424A08FBB6C5A164914242DE04F35B9796B42E50AC
SHA-512:	0692AB0B4ED85A2EA6A57565D66C11B07B284407ADC10F5B02A61A51028ADBD89B4A1CD1E13E5D7B066516F8DF475A701999470BF082DC90AE0C9E6A1241F983
Malicious:	false
Reputation:	unknown
Preview:	[General]..AppId=com.codesector.teracopy..ApplicationName=TeraCopy..AppDir=C:\Program Files\TeraCopy\..CompanyName=Code Sector..ApplicationVersion=3.17..DefaultCommandLine=/checknow..CheckFrequency=3..DownloadsFolder=C:\ProgramData\Code Sector\TeraCopy\updates\..Flags=PerMachine\|ShowConfigOptionsButton..ID={591EBD44-A7B6-491E-BE02-6A863257EFE1}..URL=https://codesector.com/updates/teracopy.txt..

C:\Program Files\TeraCopy\xxHashAVX2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287456
Entropy (8bit):	6.182673321088226
Encrypted:	false
SSDEEP:
MD5:	11D0F3D7776C7D6D1B7BF5433C4AA31B
SHA1:	B6A2C78F8549A0496005CFA60BAE91ACE8D5D6E9
SHA-256:	6BA89DBDF71F4DCE480C206BE45F47FAAC467D185845A9BCC093AE9FACD6ADA1
SHA-512:	2A5D95DA95E0FB087E4181ED0BEF0344B16E2A3D75D8E30F6F8FAC56CFF6093B2924FE976DC9E5CC7AF320FF18EA197419312764AF237981279A51B46664C596
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......d.........." .....Z...........-........@..............................P.......}....`.......................... ..........................~....0..........`$...6...,......L!..................................................(...........`....................text....Y.......Z.................. ..`.data....e...p...f...^..............@....bss....................................idata..~...........................@....didata.`...........................@....edata..............................@..@.rdata..E...........................@..@.reloc..L!......."..................@..B.pdata..`$.......&..................@..@.rsrc........0....... ..............@..@.............P.......6..............@..@........................................

C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12403216
Entropy (8bit):	7.764291052511955
Encrypted:	false
SSDEEP:
MD5:	D704E453E065A23ED414927D9B203086
SHA1:	352E4B98FAEBC35F5C8CFEAEBB7BCB36D7C7FBFC
SHA-256:	AC03DB52BB68A013D3A8BF4DB703EC11976FA1D0AA557EB988E3F926A26656CF
SHA-512:	0EC2C8CD14A7F4DFD704B19729239EE78E54FC1FB87BA1A2A80DA4B7D595FD573861271CA220C3A7B264209CEED1CA96DA12D6BDF2B34C35771790CD6337CF49
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E...................................................l..............................8=.....8=@.......(.....8=......Rich....................PE..L.....Te.........."....%..'..n................'...@...........................:......1....@...................................2.<.....3.............0....,...`7.......,.p...................@.,......).@.............'. ....Y2.`....................text...F.'.......'................. ..`.rdata........'.......'.............@..@.data.........2..<....2.............@....rsrc.........3.......2.............@..@.reloc.......`7.......6.............@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeraCopy.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Dec 3 10:00:40 2023, mtime=Thu Oct 3 19:54:52 2024, atime=Sun Dec 3 10:00:40 2023, length=4825824, window=hide
Category:	dropped
Size (bytes):	976
Entropy (8bit):	4.634472664314333
Encrypted:	false
SSDEEP:
MD5:	5A4B4AF57C53D166FAB5E127621B9A09
SHA1:	2F152AD96822586D8148EE358119C3F6B21FCEA6
SHA-256:	74CC04CD7F366537F9611298E3DFFCEA3E22791485DB0E6236F5ABB120E5084A
SHA-512:	FA4EE6E02B86BC5C72249B233CADC504A31D60DAD0BD1FC275BEC0EB469D808B40014D4A3427D81198CA12D60CA416CB9A5620281A97FFEF9767D9969DFE38AB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... .......%.....~........%...I.....................{....P.O. .:i.....+00.../C:\.....................1.....CY...PROGRA~1..t......O.ICY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....CY...TeraCopy..B......CY.CY.....C.......................G.T.e.r.a.C.o.p.y.....f.2..I..W.X .TeraCopy.exe..J......W.XCY.....T.........................T.e.r.a.C.o.p.y...e.x.e.......U...............-.......T............:.a.....C:\Program Files\TeraCopy\TeraCopy.exe..2.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.e.r.a.C.o.p.y.\.T.e.r.a.C.o.p.y...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.e.r.a.C.o.p.y.\.........&................c^...NI..e.2.......`.......X.......965543...........hT..CrF.f4... ...............%..hT..CrF.f4... ...............%.........A...1SPS.XF.L8C....&.m.%................S.-.1.-.5.-.1.8.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ExternalUICleaner.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295776
Entropy (8bit):	6.878784462375495
Encrypted:	false
SSDEEP:
MD5:	FE7A1C4D2CDD6DFE104516E4CC892D26
SHA1:	11366A5701858C9B75EC6B4BF63A6D02D11119FE
SHA-256:	FF0A3A058558052580EEEFEB9794B8F0D6A46DF6CD98D7053E0569E6091B990D
SHA-512:	113D431C2FD8DE9A5DF9CDD159C626952954D097491D39A7CD66E2682E60424B3EB93B2D1CF1B353B2952BC9737874286AE155107263EA8BF44FF34CD7E8EC89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{F..?'.X?'.X?'.X.U.Y4'.X.U.Y.'.X.U.Y)'.XX.Y.'.XX.Y('.XX.Yl'.X.U.Y.'.X?'.X.'.X...Y'.X...Y>'.X..TX>'.X?'<X>'.X...Y>'.XRich?'.X........PE..L...v.Te.........."!...%............u................................................m....@..........................#.......$..x....P...............F..`=...`...... ...p...........................`...@............................................text..._........................... ..`.rdata...n.......p..................@..@.data...4....0......................@....rsrc........P.......&..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\GSBT.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	849
Entropy (8bit):	5.071410438146583
Encrypted:	false
SSDEEP:
MD5:	C49F277F3BE2A6DC8DF1229228502C60
SHA1:	BC2A3EE9DE3BFE547E504E8DD3DAB7D3ADBE667F
SHA-256:	B2007692FE156C90385B48451FECFEEEF7F8C5CC74FA6CC617AC28F0206B5EFE
SHA-512:	8121AEA5DFA07ED69D97C1A53F41B5120778778342917C08117DFC23A6FD54EEB24F71AA167EA8B4B3F15C17307FAE2D6C2A9C72AAD0499F2E5F64A714AED9D9
Malicious:	false
Reputation:	unknown
Preview:	<SplitButton xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:d="http://schemas.microsoft.com/expression/blend/2008".. xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006".. Content="Split" BorderThickness = "0,0,0,0">...<SplitButton.Resources>....<SolidColorBrush x:Key="SplitButtonForeground"........ Color="#FFFFFF"/>....<SolidColorBrush x:Key="SplitButtonForegroundPointerOver"........ Color="#FFFFFF"/>....<SolidColorBrush x:Key="SplitButtonBackground".... Color="{ThemeResource SystemAccentColorLight1}"/>....<SolidColorBrush x:Key="SplitButtonBackgroundPointerOver".... Color="{ThemeResource SystemAccentColorLight2}"/>...</SplitButton.Resources>..</SplitButton>

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ImageCheckBox.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.861580373550762
Encrypted:	false
SSDEEP:
MD5:	D8183F12C5CAF9008EB9424C49F99F5A
SHA1:	66B70B93DF0E01F14F243CAEE63E648DC7D0AD1D
SHA-256:	4C1E97804F92610C2EA98A2DD6E5D8E2E0F205415B779A3B8051542B0AAC3072
SHA-512:	675F92FC03834599DD13113BF8A4F8099CAB8BB34EF1C12F36886AB82D69E6B5EC564D6A5EC1F134B8589328F786F2B4633B90FDAF2704B03BC0357B94E2BFB8
Malicious:	false
Reputation:	unknown
Preview:	<CheckBox.. xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:d="http://schemas.microsoft.com/expression/blend/2008".. xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006">....</CheckBox>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ProgressImage.png

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 172 x 2, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.813402326168254
Encrypted:	false
SSDEEP:
MD5:	8C903C7A534CD12C8EEA9582068FB39D
SHA1:	ED049DCEBC99857FA90043861C5619C776F8E937
SHA-256:	EFDF35F6BE917E4CBB41482226F2B475537F1D3DE9D415933ED499A89342EAE1
SHA-512:	BAF4487948277BB04392B81F2AC211B96F6ADC37545A3DDF60DF50721329B6D967BFD85EB9048C1C343094D37350F90F988FCA3BA587F31B3E96734B9FF05A4C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............'7F....sRGB.........gAMA......a.....pHYs...%...%.IR$.....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:DC74BB36F13411E7B9DAF69239A47EE0" xmpMM:DocumentID="xmp.did:177E35F1F47511E7851197F734C157FA" xmpMM:InstanceID="xmp.iid:64d94472-a5cf-3e42-a150-242af63002d7" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2018-01-08T14:03:54+02:00" xmp:ModifyDate="2018-02-26T12:22:17+0

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\TeraCopy.png

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	44375
Entropy (8bit):	7.842972942954408
Encrypted:	false
SSDEEP:
MD5:	F3E10DAD17928BC47031A2205A26C17A
SHA1:	8716244BC1AE996025246E1306DB6F9A3BFE08A7
SHA-256:	9C7F720C1367E6EA08E4C8A93E7F1EA54F72328E85E1C04B58667383464DBF80
SHA-512:	180469A611CD9CDB73A74259125F334330915BC6EE6FEE22851ED1FA7CE35AD61B501232BE87A2FEF8A0C887C3AABEF913235DEF82C140CBF0C8FE285B406AE8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...UU.-.PTA.E(.......Q0 A$.(........("..[.nm..vn;MO.tO\|..'...3.f...=......[..k.....Ea.}..~..s..g.........Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z;t[w...........K.7.....,.\+X$.B.../8Kp....Z..C..........T}}..:w..w...c.;..v666..O._....O.v..G.~....>z.....5x...O..[.f.#...v.)..z......;......C..E.}..1.........{...g-.Z^mjj.M>..`..^Pk.Vk...L.l.......C.....ty_........}....Q....^...d.e.%W]~yEh..s..g.....&..y..-.$k.O._.".....$....F&......CDb......r........Vk.VE;]pC.N..!.e..%b....C.1#F$S&LH...%3...+..<.xp../.1....../%....j...+o.9.s......O..s..{..w.....-.t...\`..Z.....%z.i...vv....c.9f.y#G&..N.....eo.h.d......s..'...k.;.<p.r.`...?......{...H..>.\|....#wHJ..q/.---.kF.p....j.w.M."<...$:...N.>~.\.^..QX...W...>..s.{.......%......) .X..d...........w...."cr....N.....@vE......(..Wg.r..r..$/..W^.?k/.:..,...S&N.T.....>.l}.A..^P...g.ybQJ..C.1kVr.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtn

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 144 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1632
Entropy (8bit):	7.065194573254018
Encrypted:	false
SSDEEP:
MD5:	B51B54B77E9CBFDB1063F7487C1C07EC
SHA1:	8A8A7036CFBC86A537447BF71B9F6795923DB8B9
SHA-256:	9D7243C688264329A8CB9E22DA00B651E0A9407741D722E03DD67CC8B3EE1335
SHA-512:	04CEF1AA3A530E7F03054369450EB42F36BF45C13C7445ADF450EC4635A8601447C5BB6E978B3ADABE9021019644681BF1609539EB548DD50ADA973AAC0C6555
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............t.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.da4a7e5ef, 2022/11/22-13:50:07 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d1e63b55-9116-0245-817e-e9b4ed3c6432" xmpMM:DocumentID="xmp.did:485C39C1C94F11ED83288002166ECD5D" xmpMM:InstanceID="xmp.iid:485C39C0C94F11ED83288002166ECD5D" xmp:CreatorTool="Adobe Photoshop 24.1 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:aedb8564-e1ec-6e45-936a-37a934478847" stRef:documentID="adobe:docid:photoshop:eaad788d-11ce-b144-80d2-31699d954fc0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.~.l...rIDATx...KTQ..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtn.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.226686182904195
Encrypted:	false
SSDEEP:
MD5:	EA680496AD3D80DC404138CB24187D8B
SHA1:	782913444374E5A2844165E5F6B47BD67EBAFC3C
SHA-256:	E95D463716EFA3B37FBF909E6B87B8F6CCE2B5E38839B5405A817E97FB48E15D
SHA-512:	4414279D39FA1A59FBF088C8C65DB7A048F1245BD9A7EB68EA585341A009B65B652FF81C66166B2F56FED3369D60070800964F532C658B88CD4A93B817C188CC
Malicious:	false
Reputation:	unknown
Preview:	<Button.. xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:d="http://schemas.microsoft.com/expression/blend/2008".. xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006".. mc:Ignorable="d" Foreground="#4f76b7" Background="#f3f3f3" Padding="0.5" BorderThickness="0">.. <Button.Resources>.. <SolidColorBrush x:Key="ButtonForegroundPressed" Color="#4f76b7"/>....<SolidColorBrush x:Key="ButtonBackgroundPressed" Color="#ededed"/>....... <SolidColorBrush x:Key="ButtonForegroundPointerOver" Color="#4f76b7"/>....<SolidColorBrush x:Key="ButtonBackgroundPointerOver" Color="#eaeaea"/>.. </Button.Resources>.. <FontIcon FontSize="22" Glyph="" />..</Button>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtndark.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.238552257328604
Encrypted:	false
SSDEEP:
MD5:	70A671452ED9D4BFFCD83E0B486338B9
SHA1:	5224BC067A1882D913A18DEAD1AF1BAE2BEDB1E8
SHA-256:	742B0F642B590F60B41F764673462CD4D9637E1BDE5CCDE41B380F1009D99175
SHA-512:	D5B9E4573A8202BCF293B10F734E98CB3A44B7C9B276F1DC54B187C12C10CB4204213AB41ADFFB3FD575C9AF8EB201342B4490F9AF085B99D24BD9C74E0E0E16
Malicious:	false
Reputation:	unknown
Preview:	<Button.. xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:d="http://schemas.microsoft.com/expression/blend/2008".. xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006".. mc:Ignorable="d" Foreground="#4f76b7" Background="#202020" Padding="0.5" BorderThickness="0">.. <Button.Resources>.. <SolidColorBrush x:Key="ButtonForegroundPressed" Color="#4f76b7"/>....<SolidColorBrush x:Key="ButtonBackgroundPressed" Color="#292929"/>....... <SolidColorBrush x:Key="ButtonForegroundPointerOver" Color="#4f76b7"/>....<SolidColorBrush x:Key="ButtonBackgroundPointerOver" Color="#2d2d2d"/>.. </Button.Resources>.. <FontIcon FontSize="22" Glyph="" />..</Button>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\applogoicon.ico

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	432254
Entropy (8bit):	2.7060227375504753
Encrypted:	false
SSDEEP:
MD5:	CC6E080CA4FE743C56FDFF3E57202CE4
SHA1:	BCD1A9EF23A06B0BE46E205C9AD06D5363784777
SHA-256:	8D1734CD9C81E2C7DAC3F3ABE93CE2DA300B48896159B3A58CA11B1405C3AE73
SHA-512:	631BD2F05CC806D32E14FBEF2CDF1A1C5E379762831EA3BDA0FAEBCADEF4D3502D16AA173D5B20CD6C675B189778D139349B5DB6F743BDE5E032C3021F6B221E
Malicious:	false
Reputation:	unknown
Preview:	............ .( ............ .(.... ..``.... ......(..HH.... ..T......@@.... .(B......00.... ..%..>T.. .... ......y........ ............... .h.......(............. ...... ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\applogoicondark.ico

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	432254
Entropy (8bit):	2.255419263558884
Encrypted:	false
SSDEEP:
MD5:	C29BCB924EA0ACD4EA8BEFD2CE735C73
SHA1:	B3A006219458C8D8D8CA2561F6CCAC3BE3C06C56
SHA-256:	894E369E4AFE02C3474F4C0E9877D5CAB28B2753F56A7B0C09D867DB7C2FD3F9
SHA-512:	15D1AD65253E4716932C68AA75280224BA8348AED9E289E41778B34EAA789390A9DC99C7248BF5B1EAC302A53136DD2FBBA79111F331B21DA274D17EA4CE0498
Malicious:	false
Reputation:	unknown
Preview:	............ .( ............ .(.... ..``.... ......(..HH.... ..T......@@.... .(B......00.... ..%..>T.. .... ......y........ ............... .h.......(............. ...... ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\background

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 400x300, components 3
Category:	dropped
Size (bytes):	2589
Entropy (8bit):	3.901038883532958
Encrypted:	false
SSDEEP:
MD5:	9E23DA7C3CD3FB8113E698A12A3D3047
SHA1:	6D021109495D77A53AFE101F2B03A4DA847E6D99
SHA-256:	B671008E5D4A15409051D7B3D2AA40F7C028E1DAB5876C2882976793ABB9356C
SHA-512:	65E885984681CEE190764515F61BB8DA3C29463B87F4371FFF27AE4C4089AF46C9B98910A847EC29D7368160D6AAF841FB93F1347C9ABC47BCE5CF997C8B4EF2
Malicious:	false
Reputation:	unknown
Preview:	......JFIF............."Exif..MM...........................Ducky.......d.....C....................................................................C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\backgrounddark

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 400x300, components 3
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	3.874486375788142
Encrypted:	false
SSDEEP:
MD5:	1E7CFADA2AC8493B5AC718CA95EE7550
SHA1:	2663F0F414D123AB262F79806648DE38E2D4D7BD
SHA-256:	99FEB7FE7C24ED7ECE21F280E5FBC190003BEBCBE15DA489C479CEC27FC81D61
SHA-512:	E2504F3DAF7EB42B3B553BF05497AC2D34BB41B703FBFE8BDC2955292D98DD313FB9947485603B96F88A869825E9FB7366EBF7014E83492AE8121A6AC3946F2B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF............."Exif..MM...........................Ducky.......d.....C....................................................................C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgs

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 624 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1290
Entropy (8bit):	6.266336392363215
Encrypted:	false
SSDEEP:
MD5:	7633F00EA029A3B988C354441F0F4722
SHA1:	A72A74AF68D006A35EFCF9BE6FE3424FF31FB84C
SHA-256:	ED127A86F01D767643AF667C1D52525A3CB7632713B981896AF72628DA7EE7FA
SHA-512:	52C70CBD6FA3CC292A1D5B505B272D88B6F950EAC4D24DF750B7C8CE5BCACDFF9FC9FDD0CCFF8F081D05852559AE187F50D4E6B4F5F95E8C648A658D4B9A03B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...p...%.............sRGB.........gAMA......a.....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<...{iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ED41AEE1F13311E7A25BA8297387DFAC" xmpMM:DocumentID="xmp.did:9954F2F025D411E890AAB73BC1CEB2D4" xmpMM:InstanceID="xmp.iid:9954F2EF25D411E890AAB73BC1CEB2D4" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00ef4e7a-8894-f642-abf2-85f0decca204" stRef:documentID="adobe:docid:photoshop:15b8003b-4ad4-ad44-9857-56569a2f319c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgs.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	4.950526840686042
Encrypted:	false
SSDEEP:
MD5:	118F4C63590056978AC5065ECD4337B7
SHA1:	3C8B555894DEB0E0F3872AB6BADB75D73A837FF5
SHA-256:	18573B641FD232CE9506DFBB4A15F7871B73BF3499F6A6B5734C2BC152852C94
SHA-512:	3A6CA3BD174B88DD0BB1B2B160A78E46A2FFE3E52228D48683493E74881419F63BF9C7FBD4A8A754583FB77EF97D77D04136BB9C7C6EECD76A143AC5016FC982
Malicious:	false
Reputation:	unknown
Preview:	<Button.. xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:d="http://schemas.microsoft.com/expression/blend/2008".. xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006".. mc:Ignorable="d" Style="{StaticResource AccentButtonStyle}">....</Button>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgsdark

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 624 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1289
Entropy (8bit):	6.279089479302763
Encrypted:	false
SSDEEP:
MD5:	D2CEE1442309FE99E978F0316395D970
SHA1:	957524B71A6A2228487F77748D50FF3ADFE1E65E
SHA-256:	75FEA1443A0AF73756270C1840ED88B22301530AE5B9418A6BD1F45B62F8F1CD
SHA-512:	3972BAF2F0FACC70225B96019ACC83C32C21A525B31FBA81C537638FACE5DFDA33DEAE2C9B082E33CF94F2E9DB6B5F5EE79E904E331E8C88FE60DD2EA5752BEF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...p...%.............sRGB.........gAMA......a.....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<...{iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ED41AEE1F13311E7A25BA8297387DFAC" xmpMM:DocumentID="xmp.did:9954F2F025D411E890AAB73BC1CEB2D4" xmpMM:InstanceID="xmp.iid:9954F2EF25D411E890AAB73BC1CEB2D4" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00ef4e7a-8894-f642-abf2-85f0decca204" stRef:documentID="adobe:docid:photoshop:15b8003b-4ad4-ad44-9857-56569a2f319c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\checkboximgs

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 192 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	6.819982547985948
Encrypted:	false
SSDEEP:
MD5:	BF7AC146EB80DE9D4D3E6B5A7998EBBF
SHA1:	532B1BAE084AF1BB3A8880C47A509CE1BB804DF3
SHA-256:	73616E9E679089CD5C580D5EF9CC96859F13509AF8150FE081D67A1935CE4885
SHA-512:	EA5ED62DE728D88CF598B0B9BB1DA953B2EE7675CB71D04F022CE41B2697E0F02BEF269181C09EDE6C28C6946DD8944ABBB487AB4BE8B190FC9B72423CA4A905
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...~iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.da4a7e5ef, 2022/11/22-13:50:07 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:911915E74D5EE31181168862711AAC09" xmpMM:DocumentID="xmp.did:E4714AB5A38911EDAB52D3250028D710" xmpMM:InstanceID="xmp.iid:E4714AB4A38911EDAB52D3250028D710" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b5304969-ec11-804a-a26e-25a25ad6a304" stRef:documentID="adobe:docid:photoshop:ddafb4bc-724c-3942-8494-a85d8f539ed4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>C'.m....IDATx.b..;.0...FK...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\checkboximgsdark

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 192 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	7.0616862220997065
Encrypted:	false
SSDEEP:
MD5:	DA526C0CAA0495A9C96ECC574CC5FF20
SHA1:	F570C7CDA9594F68950EBFAD4497863EDDF55097
SHA-256:	205A20E410235B12B18CF6B48E69EDF1D8DC28E6EA9F4896BAF3ADEFF33260BA
SHA-512:	600EA6951973B3F3EFCB8649030DDEDF223927B9CCED03E8CE99B818F6A26B0D3F0F0075AF0C696593DB9086F422147FFA35DC4BA8FC10061FB4922024AD0C10
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...~iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.da4a7e5ef, 2022/11/22-13:50:07 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:911915E74D5EE31181168862711AAC09" xmpMM:DocumentID="xmp.did:77997BDAA61A11EDB020C02E961397D4" xmpMM:InstanceID="xmp.iid:77997BD9A61A11EDB020C02E961397D4" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:34fae08a-d4e9-8d42-a5ab-a7362e90adca" stRef:documentID="adobe:docid:photoshop:36aa3829-6c87-0648-ace5-b5ed8633d605"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8}....bIDATx.bL..0.@K....

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\cmdlinkarrow

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Reputation:	unknown
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\custominstallbtn

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 144 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	914
Entropy (8bit):	7.605863623195678
Encrypted:	false
SSDEEP:
MD5:	FB33DCAD5260941FC9261B1F378D5775
SHA1:	5BFBEFC05E1D1F41B10974B1CA43495053AD95F3
SHA-256:	9CCBC0BABA2EFE3424610A0F282626E2364473C5AFC5CD6D485E6673BFF3A862
SHA-512:	7CC5481FBCB4E4F0420DA5196A209124F615C0B42E2F1FF5DA444AC13C0D8698B5F20472EE1743C126D0BBDC6241E2CCBB58F6AC0970DBA6AFF74189D600F0EB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............46.....sRGB.........gAMA......a.....pHYs...%...%.IR$....'IDATx^.MOSA..O.o1...(...B....S0...7j......!(....\A.HLL..]ia....(..D..r.m..):.enB.s;..F..I.{..i{....G&p...?.#gN...?...?L'.2..32.....C...`..#X ....1..b.`..#X ....1..b.`..#..=.y..F..H.r.o..#}.;..i.#Gj..\.tD.P.]r..9.....V....r..{]...G.W...J....A.....`O;=x..g..O....."0...z%.Y..Qw.0...z.S"G.:B..a.9.....Y..V...A.W.....hO..k..+..2.r..yJe..5.y.L.xV..H....j...4.......=^.S..1.&....FZ...R(.Rn.j.b..T(..5.y..E...9.(.Z.B.2V..$-.91^.#..XJ.r...S.%..~'.k.A..Y.17.....R ..HW..Z.P-B.x....$......t....J"]y...w...IT..m49..P.~[.>!..:........E45........n..H.y....6...."./.........8......B..:..7....<.D.?.A!.v..~ X...I;....U<....{:...jFb.Z....@..t./.Xl,.'....d.Y..J......j..t.....]'D........~._.g<...s....n.^@.x..r+..{......4]y..a2.%.*.+....D. n.m...X..........1F.@..,.c......1F.@..,.c....@.......R6.....IEND.B`.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\custominstallbtndark

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 144 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.642489263867849
Encrypted:	false
SSDEEP:
MD5:	9644532F7C320BF54DFE912D016B7B6B
SHA1:	5867E7E4FBBAE2CB922D76926E425ED846C44BCC
SHA-256:	D51BEB033D366F295E3C342767DCE17DE6CB6395FB9086FF3063325F6DF22F62
SHA-512:	717234ED347AB6F92C951085BFC0F91BA251F8BC65A00E00F67ACF8FF31DB452E09600CC5199FBC3B27E708494BB74C419E09CEA37E648B1249AE96EF5726397
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............46.....sRGB.........gAMA......a.....pHYs...%...%.IR$....+IDATx^..N.A.......b.($....pa\.n..Q7hFq...0.` ../ .....@.4.....:.n.......T'..z.-:.8_2.SUg.S.oz...+.?.P...V.(...v.(...O.(.FfBm...."...O.@..,.c......1F.@..,.c......1F.@..J..u....%9R...X...s.m/..#5.AnP.7VS..9R.....t.A.;P.}.AnPb'.i...A..+.z..;.^j.....:[..Q9...x.b.5....r............k.AnP.9t...W".!..Ay>....M%.....e.._~.......I.......G....es.r..'...d'...b.."2ZK2.D..[.W;.W...`..DZ..S[....g.i6...2.^...\)..38..y'+g.q...L-.e.\A...j<y..-Q...-fN.A..N.....z......k.....D......j.....@@%..<@%.PI.+.P..T......@. .,u.o.WB....W.n!.S.x....Q...h.v7.?`.5._<...@"..I..b...\|N..._..'..4..(.....!.UB..'..4....G.'.....>...o]>..]w.i..t.....=D.....V.@.<..:..........S..z*.7x.2.%..=....^l...Q.=../...........I.t......%...v.A.0v:ON&.-O. ..\|..l.)O...1+%^.M..>.X.>....#.1..b.`..#X ....1..b.`..#X ....1../......{....IEND.B`.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	177504
Entropy (8bit):	6.617535318433651
Encrypted:	false
SSDEEP:
MD5:	D43AEAE5B7B5831A99B5D74140133D1A
SHA1:	79A88C0BE5865DB188BD3DB39A53C9F0066CC064
SHA-256:	557E29270D0B009CDD844137D61B5E9952AECB62867CD52A8BA84870B02B5C15
SHA-512:	01DB3FAACC75CB7C61FE798563E28B1BE5F0161A0CD25F44642EA62825C6BCCAF8719E0EF9808B1CAB964861356DD814805EE45E0F6A96D4DD8D35AC1015DDB5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T.l...l...l..q....l..q....l.......l.......l.......l..q....l..q....l...l..+l......l......l....H..l...l ..l......l..Rich.l..................PE..L...M.Te.........."!...%.............................................................C....@..........................O.......P.......................x..`=......h...p...p..................../.......-..@............................................text...g........................... ..`.rdata..............................@..@.data........`.......L..............@....rsrc................X..............@..@.reloc..h............^..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	218464
Entropy (8bit):	6.4017712810613245
Encrypted:	false
SSDEEP:
MD5:	EFE6624DD51199CCBBFC3496D893EF7C
SHA1:	46E15CDBDDF614AB0D9B8A0AEFBA65CCEFFDD525
SHA-256:	0FBD4D3B6057F10097755257DEF4E872E3B0D4DDEDE6F9D52139CA1A8AD0DE09
SHA-512:	530B6FD898651A25D633419DCC7109CF22F075BE95B55738A455D9A850DA7BBC37AA9F71A52646A6AE68C2967F3A5E16BFD3E2332EF97A6C0056B5F23BF0C944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}b%}9.K.9.K.9.K..qH/<.K..qN/..K.,\|O/6.K.,\|H/3.K.,\|N/h.K..qO/(.K..qJ/(.K.9.J...K...B/3.K...K/8.K.....8.K.9...8.K...I/8.K.Rich9.K.........PE..d...P.Te.........." ...%.....4......h................................................ ....`.........................................0................`.......0..........`=...p.........p.......................(.......@............................................text...p........................... ..`.rdata..r...........................@..@.data...d$..........................@....pdata.......0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\dictionarywinui.xaml

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	exported SGML document, ASCII text, with very long lines (702), with CRLF line terminators
Category:	dropped
Size (bytes):	17676
Entropy (8bit):	5.031022408941319
Encrypted:	false
SSDEEP:
MD5:	C834F825115F45E689B82C73728C00A4
SHA1:	E58AC4BFC9E563C7E5DBFBD01BAA1A18CFF23480
SHA-256:	81333FD2442942B0CAC5EF6E69191AE6074CC17B20F35D77D21817FFAC13E60B
SHA-512:	E092F8CE70BF9169B5FE55E4B6D42936A9C7ADE45D187604B2A034565656DE4B0AE2667B9E78542403DD6A76B1885A8AEA4D516956BC4D1117B3C5144E61C356
Malicious:	false
Reputation:	unknown
Preview:	Free Public License 1.0.0 Permission to use, copy, modify, and/or distribute this code for any purpose with or without fee is hereby granted. -->..<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation".. xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml".. xmlns:Windows10version1809="http://schemas.microsoft.com/winfx/2006/xaml/presentation?IsApiContractPresent(Windows.Foundation.UniversalApiContract, 7)".. xmlns:BelowWindows10version1809="http://schemas.microsoft.com/winfx/2006/xaml/presentation?IsApiContractNotPresent(Windows.Foundation.UniversalApiContract, 7)">.. <ResourceDictionary.ThemeDictionaries>.. <ResourceDictionary x:Key="Default">.. <ResourceDictionary.MergedDictionaries>.. <Windows10version1809:ColorPaletteResources Accent="#FF4F76B7" AltHigh="#FF000000" AltLow="#FF000000" AltMedium="#FF7999ce" AltMediumHigh="#FF000000" AltMediumLow="#FF3f66

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\exclamic

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 50 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.1338258836706085
Encrypted:	false
SSDEEP:
MD5:	8BC1FB1AF551315AC15BB51933CBBCAD
SHA1:	3BAA47215FCCC6128E7FA43674A527A7F132F2CB
SHA-256:	74E1343C539D2DEBC30C73C32B91016EA30C48486619DC47324C9E46C81CB2BA
SHA-512:	B6CA3F6FCBC74C598D020C27E14145955256966E3BE77607777A33DE4A91C67094A921E279C0755C7AEFF04BF34411EDD8C8FAED074BC0609984FBB8DF11B55E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...E.............tEXtSoftware.Adobe ImageReadyq.e<...liTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.da4a7e5ef, 2022/11/22-13:50:07 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:76B3B35C4DAAE11191B485BA280938C5" xmpMM:DocumentID="xmp.did:54F7F23CA12911ED83E6B38D59A0AA05" xmpMM:InstanceID="xmp.iid:54F7F23BA12911ED83E6B38D59A0AA05" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1932698b-7046-9c42-bfd7-15aee268cd76" stRef:documentID="xmp.did:76B3B35C4DAAE11191B485BA280938C5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..;.....IDATx..]H.Q.......he-]...Z..m...$].t#

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\info

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PNG image data, 50 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	7.371782426816929
Encrypted:	false
SSDEEP:
MD5:	90BC43D1785A9598A85F3A736CBD62E8
SHA1:	BFAE814CD7A28439B7DC016D30BABBA010CCB7C1
SHA-256:	B6840929BA2276D7F9BB09379E15933D42BD4047C582C0E82718D892EE1F87B7
SHA-512:	2FC94064B40FC1B90A3AD311A7538F0527F3AF205CA0FAA195C0F753590156A24E3DAAFD082B1DE2948A1D3861EFD477643C41565881A1B67BFEA536C32B3EC7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...E.............tEXtSoftware.Adobe ImageReadyq.e<...liTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.da4a7e5ef, 2022/11/22-13:50:07 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:76B3B35C4DAAE11191B485BA280938C5" xmpMM:DocumentID="xmp.did:5DBFE84AA12911EDAA90FB99E76C401E" xmpMM:InstanceID="xmp.iid:5DBFE849A12911EDAA90FB99E76C401E" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5786eaf1-81a5-0849-a2ff-c48da1635061" stRef:documentID="xmp.did:76B3B35C4DAAE11191B485BA280938C5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.4QL...%IDATx..[HTA........j..].-+.4.R.n..KA.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\infoIconMsi

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.347251063198798
Encrypted:	false
SSDEEP:
MD5:	8595D2A2D58310B448729E28649443D6
SHA1:	08C1DF6FBF692F21157B2276EB1988AC732FF93C
SHA-256:	27F13C4829994B214BB1A26EEF474DA67C521FD429536CB8421BA2F7C3E02B5F
SHA-512:	AE409B8F210067AC194875E8EBF6A04797DF64FA92874646957B2213FB4A4F7DA2427EF1ED8D35CD2832B2A065E050298BAC0FC99C2A81DE4A569A417C2A1037
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.....................................................................................................................{...............................................................................................................................................................................................rqr............................................................................................................................................................................................rqr............................................................................................................................................................................................tst............................................................................................................................................................................}................yxy...................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\lzmaextractor.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22880
Entropy (8bit):	6.878300492350629
Encrypted:	false
SSDEEP:
MD5:	A706F8C897A73F32F728101D33018162
SHA1:	0F31C13246DF88C372EB25DAB2CC8817EF76E00F
SHA-256:	0161061CF5128659925643594D6667897974AB78DF83F720397AF0F59221B7FF
SHA-512:	FC7ED0BE53FB89B5743AB9B0537BF74FF05CBC8F41BE4BE243790A9993E2C45D9EF0AD1C4C336E32BA981C4C6B3B2E4F58D853BECBD37ECD899DE81680B0805A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.u9...j...j...j...k...j...j(..j!=.k...j!=.k...j!=.j...j...j...j!=.k...jRich...j........................PE..L.....Te.........."!...%............@........ ...............................`............@.........................P".......$.......@..h...............`=...P..\....!..p............................................ ..X............................text...)........................... ..`.rdata..X.... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..\....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AiFilesBackNoImpers_DF5325DF_1F43_4282_85D5_1CA3353E6B13.bak

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	3.4605948032799687
Encrypted:	false
SSDEEP:
MD5:	715F3614CB1F90F54BD4B7445958D0F9
SHA1:	3D221D8C75C1C79EC2855B7E1B04D2327D7091E8
SHA-256:	40F34AE2656029A839FCBC712D73C10BF0FD246AEF826B62897CD271AA0A0D99
SHA-512:	93934A27356F355082ADA0FA59EE6A25C2594AF504507D0F57DC10DD1E3057D7FE3318BA8AC5FB6DD5E6491BD2D9CF2D0A134269D896A302AC96CD71602C4EB2
Malicious:	false
Reputation:	unknown
Preview:	........C.:.\...........%...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.e.r.a.C.o.p.y.\.A.p.p.\.S.o.u.n.d.s.\.....9...C.:.\.A.I._.R.e.c.y.c.l.e.B.i.n.\.{.5.8.C.5.2.0.8.B.-.4.6.0.A.-.4.1.8.C.-.A.F.2.A.-.A.7.A.E.8.E.2.1.2.6.4.9.}.\.2.......C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.T.e.r.a.C.o.p.y.\.I.g.n.o.r.e.\.....9...C.:.\.A.I._.R.e.c.y.c.l.e.B.i.n.\.{.5.8.C.5.2.0.8.B.-.4.6.0.A.-.4.1.8.C.-.A.F.2.A.-.A.7.A.E.8.E.2.1.2.6.4.9.}.\.1.../...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.T.e.r.a.C.o.p.y.\.S.c.r.i.p.t.s.\.....9...C.:.\.A.I._.R.e.c.y.c.l.e.B.i.n.\.{.5.8.C.5.2.0.8.B.-.4.6.0.A.-.4.1.8.C.-.A.F.2.A.-.A.7.A.E.8.E.2.1.2.6.4.9.}.\.0.......9...C.:.\.A.I._.R.e.c.y.c.l.e.B.i.n.\.{.5.8.C.5.2.0.8.B.-.4.6.0.A.-.4.1.8.C.-.A.F.2.A.-.A.7.A.E.8.E.2.1.2.6.4.9.}.\.0...../...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.T.e.r.a.C.o.p.y.\.S.c.r.i.p.t.s.\...9...C.:.\.A.I._.R.e.c.y.c.l.e.B.i.n.\.{.5.8.C.5.2.0.8.B.-.4.6.0.A.-.4.1.8.C.-.A.F.2.A.-.A.7.A.E.8.E.2.1.2.

C:\Users\user\AppData\Local\Temp\MSI69C0.tmp

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	738656
Entropy (8bit):	6.613404997696155
Encrypted:	false
SSDEEP:
MD5:	5A1F2196056C0A06B79A77AE981C7761
SHA1:	A880AE54395658F129E24732800E207ECD0B5603
SHA-256:	52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
SHA-512:	9AFC180EBC10C0EE0D7306F4B7085608A4E69321044D474691587BF7E63F945888781A9FC5E69568D351AC690B0335214BD04BDF5C75FD8A3BD1EC4BE5D3475A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h/YQ,N7.,N7.,N7..<4.'N7..<2..N7.913.=N7.914.;N7.912.bN7..<3.5N7..<1.-N7..<6..N7.,N6..O7...>.@N7...7.-N7.....-N7.,N..-N7...5.-N7.Rich,N7.................PE..L... .Te.........."!...%.....z...............................................@............@..........................d.......n..,.......................`=...... m.....p...........................0...@...............x............................text............................... ..`.rdata..............................@..@.data...@%..........................@....rsrc...............................@..@.reloc.. m.......n..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI6A9E.tmp

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1104736
Entropy (8bit):	6.471248400056245
Encrypted:	false
SSDEEP:
MD5:	25E52C5776A81E0C5CCB9BDD4C808C90
SHA1:	E42104EF61AE4760A41552292091EB6A5089CED4
SHA-256:	0831DBCB3799C9E36EA586582E8EF907DCEFEB2045351D6774C7AD0EF02A9AF2
SHA-512:	746570C011E501505EC9D09077519BCA1A485B0CAC66229BE6F4715A91EE52D5CC857DE26AD8D7A33806DDFA580D2BA9F77759E3764EA761D327FE2F1E881292
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..e&f.6&f.6&f.6...7-f.6...7.f.63..77f.63..71f.63..7rf.6...7>f.6...79f.6&f.6.g.6...7.f.6...7'f.6...6'f.6&fn6'f.6...7'f.6Rich&f.6................PE..L... .Te.........."!...%.Z...X.......k.......p............................................@..........................y..t...$z..........................`=.......?......p...........................0...@............p..8............................text...>Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................\|..............@....rsrc................X..............@..@.reloc...?.......@...^..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi6923.tmp

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\upd5ED1.tmp (copy)

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E750AA90012457A9C718BA564CC7C59D
SHA1:	F2DE0AEBED40AB99AE10830A536B50282122102F
SHA-256:	9D48EA41DA43018DA9D980FFC26DE5CB7601C5B8985985753BF0EA3A1E050E55
SHA-512:	FDDADBFCC366AF3AAA481D87BB5A1521F41090624048B39E4F77BA584EB161D6B19F32E22EC596E17B0F5792BBB353585A70B2B6455B5A4E59C3B810F515D818
Malicious:	false
Reputation:	unknown
Preview:	;aiu;....[Update]..Name = TeraCopy 3.17..ProductVersion = 3.17..URL = https://codesector.com/files/teracopy3.17.exe..Size = 12403216..ReleaseDate = 03/12/2023..SHA256 = AC03DB52BB68A013D3A8BF4DB703EC11976FA1D0AA557EB988E3F926A26656CF..MD5 = d704e453e065a23ed414927d9b203086..ServerFileName = teracopy3.17.exe..Flags = Critical\|Sys64..RegistryKey = HKUD\Software\Code Sector\TeraCopy\Version..Version = 3.17..Feature = Clone & Rescan feature...Enhancement = xxHash support for SSE2 processors...Enhancement1 = Upgraded reporting and checksum export features...Enhancement2 = Implemented network recovery wait function during testing and verification...Enhancement3 = Expanded maximum buffer capacity to 256 MB...BugFix = Resolved minor bugs and improved user interface design...AutoCloseApplication = [APPDIR]TeraCopy.exe..

C:\Users\user\AppData\Local\Temp\upd5ED1.tmp.part

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	822
Entropy (8bit):	5.339674299124217
Encrypted:	false
SSDEEP:
MD5:	E750AA90012457A9C718BA564CC7C59D
SHA1:	F2DE0AEBED40AB99AE10830A536B50282122102F
SHA-256:	9D48EA41DA43018DA9D980FFC26DE5CB7601C5B8985985753BF0EA3A1E050E55
SHA-512:	FDDADBFCC366AF3AAA481D87BB5A1521F41090624048B39E4F77BA584EB161D6B19F32E22EC596E17B0F5792BBB353585A70B2B6455B5A4E59C3B810F515D818
Malicious:	false
Reputation:	unknown
Preview:	;aiu;....[Update]..Name = TeraCopy 3.17..ProductVersion = 3.17..URL = https://codesector.com/files/teracopy3.17.exe..Size = 12403216..ReleaseDate = 03/12/2023..SHA256 = AC03DB52BB68A013D3A8BF4DB703EC11976FA1D0AA557EB988E3F926A26656CF..MD5 = d704e453e065a23ed414927d9b203086..ServerFileName = teracopy3.17.exe..Flags = Critical\|Sys64..RegistryKey = HKUD\Software\Code Sector\TeraCopy\Version..Version = 3.17..Feature = Clone & Rescan feature...Enhancement = xxHash support for SSE2 processors...Enhancement1 = Upgraded reporting and checksum export features...Enhancement2 = Implemented network recovery wait function during testing and verification...Enhancement3 = Expanded maximum buffer capacity to 256 MB...BugFix = Resolved minor bugs and improved user interface design...AutoCloseApplication = [APPDIR]TeraCopy.exe..

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Blake3.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	6.417003393811551
Encrypted:	false
SSDEEP:
MD5:	E0BAB8DB4AE8A9B8445AF952947CA6BF
SHA1:	634824A4EF961C0D7B2AEEC1943445D370730F35
SHA-256:	EEA8E41310FDA36F6665290FB2C0A63BA6A53E0AC3D518D25AEA8D62C1B41884
SHA-512:	855AF64A8553A04980599DBF02ED77258AA2304CCC79C388E6F31BFB4B43332850BE002C69256FA83E679399EFA30DFF715C1B1B04BFEDD23B9AD87385F04EB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r..!..!..!... ..!... ..!... ..!6.. ..!6.. ..!6.. ..!... ..!..!..!... ..!... ..!... ..!Rich..!........PE..L...'C.d...........!...$.............Z....................................................@..........................V......dW..(....................................O..8............................N..@............................................text...H........................... ..`.rdata..D].......^..................@..@.data........`.......J..............@....reloc...............T..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1291984
Entropy (8bit):	6.622116538963222
Encrypted:	false
SSDEEP:
MD5:	B3C193EA7D8AA574C736A4720D71DC93
SHA1:	FB56BB48DD4C73FE97CB5424BD1BA7903185611A
SHA-256:	F9F1D46E0105AD3A0EBF8584AE9F5B88C2C33ED5E79B41E7CB40CD598B3E3EB0
SHA-512:	ABEE0986043C191D343E577B2B148830E897B295277DCD8E1A445DA874B4513B4019440745F78F9486CE433084C7E87FB296FEC07AF94B0EEDFA82A9F0B0AFB5
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....k.`.....................~......,+.......0....@..........................`........................................................................... ...0..(....................................................................................text............................... ..`.itext..D.... ...................... ..`.data...x=...0...>..................@....bss.....h...p...........................idata...............V..............@....didata..............j..............@....edata...............n..............@..@.rdata..E.... .......p..............@..@.reloc..(....0.......r..............@..B.rsrc...............................@..@.............`......................@..@........................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1171176
Entropy (8bit):	6.628736457473184
Encrypted:	false
SSDEEP:
MD5:	91DBC4D3933F7572E93758583CAC490D
SHA1:	27EAC8058768E8E8B7B67F34B2229B78FB3BEE45
SHA-256:	7B520EAD82236B6692449318076A9BDA561CC73E0055AB19D8E12FBD138E0152
SHA-512:	E0939519B469528E7D164D5342FC28F29B94EB3EEC9C9D75F7DEA5670CC814A5457E82DFFBAED4A43E768C8DBA27E3C0EBCC23B9488A94F2273FB6ABBB60896C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....Pe...........!.....F...h.......T.......`....@.......................................@..........................P....... ...........................,...p...{...................................................#..X....@..z....................text...8/.......0.................. ..`.itext..,....@.......4.............. ..`.data....B...`...D...J..............@....bss.....k...............................idata....... ......................@....didata.z....@......................@....edata.......P......................@..@.rdata..E....`......................@..@.reloc...{...p...\|..................@..B.rsrc................*..............@..@....................................@..@........................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3486088
Entropy (8bit):	7.21108362550264
Encrypted:	false
SSDEEP:
MD5:	69FEC14702D245028F9CC04E1E9A1F96
SHA1:	0447B0A3D761C8BB24A694E3982A11271590E894
SHA-256:	89653B3A79E8B17DFC5DE1206D859DDB3B60EF95468A0E4B51E964C200FE6D1B
SHA-512:	A3772A7AC406DF67B461D63680A6EE8A4F5EFAE8E4BA080F6AF42474C9B8630AB55178D15F9953C655532E8BD4595053077A20D9F153E643FF1C07E6A513684E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ..}...4n...]..{.l....3oK.)v...8Z.h..'..:L,....FJh-.........Q..............................................................................................................................................................................................PE..L....]le..................K..........@.......0K...@..................................<5...@......@....................n.t.....n.\.... n...............5..,...0...............................0................................................................m............................@..............n.....................@..@..............n.....................@....rsrc........ n..V..................@..@.............0.......`..............@................@.......b..............@......................................................................................................................................................................................................................................;.j..,..3;..}.cy0....8.@,.$..

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	215264
Entropy (8bit):	6.556293785062301
Encrypted:	false
SSDEEP:
MD5:	2464598E94F31AE78FFB0C9B0CAC4BCD
SHA1:	B46137FCAEFB8B0DCAFA3B0ED5F9217A6CA9B923
SHA-256:	FA4240E6202A9E91973464838E2FDE3452E5B9EDD344C84478A84F4F9E2ABB04
SHA-512:	0F6B90E30485CAF008159CA329335CED2D6B357DFBC966A234DA6B5E99D38C6B68FD6C7698D004C00A60B27A79B1DAD4B06095754997116DA82C9C02A30A9F71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....d............................4.............@.......................................@......@...................`..x....@...........................,.......:...................................................B.. ....P.......................text............................... ..`.itext.............................. ..`.data...............................@....bss.....c...............................idata.......@......................@....didata......P......................@....edata..x....`......................@..@.tls.........p...........................rdata..]...........................@..@.reloc...:.......<..................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Ignore\Temp files.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.623807081313914
Encrypted:	false
SSDEEP:
MD5:	3D62C0183F83DA72EC3107BEC5446F52
SHA1:	F891C548E98680CCA44E8534A327BC6500F56D16
SHA-256:	F18018D786FFC21F2CF1C6F475E5EA8D03BDE907F21026E3CB79E6B3B303CACB
SHA-512:	9D51191ED27AB48F40A633972E97D34E755644768D6CB32ABE2FAEEAD967AAF3CA25688F1577C4749D3622424D8142E4C5B9B045E09F12F62AF3FD6F9A3A938C
Malicious:	false
Reputation:	unknown
Preview:	# Windows....*.tmp..ehthumbs.db..ehthumbs_vista.db..Thumbs.db....# macOS.....AppleDB...AppleDesktop...AppleDouble...DS_Store...LSOverride....

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Ignore\Video files.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	3.807371823591203
Encrypted:	false
SSDEEP:
MD5:	995F3F5C23A3C5F239A5192A9548EEEA
SHA1:	4D3E96AAD16D657D44A9C97EB7B3761285E63E33
SHA-256:	32DE3B6E121896C34E1285A8972822AAC4E2FD23A72637490FAF95EF206B1087
SHA-512:	9FD1B9CBB11ABEA7BBC4AF55DFAE913204C7255A4507568302C89C1026A20F19D220459F9999E5EFB14604544171D7146F7B870C6205019CCC72975E55E52C78
Malicious:	false
Reputation:	unknown
Preview:	.avchd...avi...flv...m4p...m4v...mkv...mov...mp2...mp4...mpe...mpeg...mpg...mpv...ogg...qt...swf...webm...wmv

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Eject drives.ps1

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	745
Entropy (8bit):	5.145494180427928
Encrypted:	false
SSDEEP:
MD5:	51E4E6F58E11B0589A3A4A6BD81F68F3
SHA1:	804511278232B75697F310FD449B1E8900225C50
SHA-256:	83E0537579B7E1877E4BA59EE57D2BD97B8688E9F4FE2D47212111BBA0FF5D25
SHA-512:	545627A718FF059D555EAEFEF9A86298EE6450CCBF7ECFC143DF6EF45E3D8C632B22DF8AAFA3D538234B3798E321231740D81EE14B42E5BE0BD1614860810B02
Malicious:	false
Reputation:	unknown
Preview:	param ($source, $target, [int64] $size, $time, [int64] $failed, [int64] $skipped)....write-host "Transfer completed:"..write-host " Source: $source"..write-host " Target: $target"..write-host " Failed: $failed, skipped: $skipped"....$fsize = "{0:N0}" -f $size..write-host " Size: $fsize"..write-host " Time: $time"..write-host ""....# get removable drives..$drives = gwmi win32_volume \| ...where{$_.DriveType -eq '2'} \|....select -ExpandProperty DriveLetter....# eject drives..foreach ($drive in $drives) {...if ($target.StartsWith($drive) -or $source.StartsWith($drive) ) {....write-host "Ejecting drive $drive..."......$shell = New-Object -comObject Shell.Application....$shell.Namespace(17).ParseName($drive).InvokeVerb("Eject")...}..}..

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Notify via IFTTT.ps1

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.196545168465599
Encrypted:	false
SSDEEP:
MD5:	97269C790CA19E8BAFDBB4EE12B86773
SHA1:	458B9EF86A0AA662567E8D9E8674B6889B3885DE
SHA-256:	C03043C2F78AA69470EE6DF3E50176C0CD05D4629343AC9B2CC26031B01FFC4D
SHA-512:	DEF8BE33114B8800646614D036DCCB17AC04083E8C4855FEACC90D0B6D5A283716D1E86DD14ABF6398B62D8ABA4B3082AB44931642F7F0C47D16C373B939E7B5
Malicious:	false
Reputation:	unknown
Preview:	param ($source, $target, [int64] $size, $time, [int64] $failed, [int64] $skipped)....write-host "Transfer completed:"..write-host " Source: $source"..write-host " Target: $target"..write-host " Failed: $failed, skipped: $skipped"....$fsize = "{0:N0}" -f $size..write-host " Size: $fsize"..write-host " Time: $time"..write-host ""....write-host "Sending notification..."....$key = 'YOUR_WEBHOOKS_KEY'....if ($key -eq 'YOUR_WEBHOOKS_KEY') {.. write-host "Please get your own key here: https://ifttt.com/maker_webhooks/settings".. write-host "Press any key to locate this file...".... [void][System.Console]::ReadKey($true).. Invoke-Expression "explorer /select,$PSCommandPath".. exit..}....$url = "https://maker.ifttt.com/trigger/teracopy/with/key/$key"....$JSON = @{.. "value1" = "Source: $source".. "value2" = "Target: $target".. "value3" = "$size bytes, $time `nFailed: $failed, skipped: $skipped"..} \| ConvertTo-Json....$response = Invoke-WebRequest -UseBasicParsing -M

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Notify via Ntfy.ps1

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	5.064109055427305
Encrypted:	false
SSDEEP:
MD5:	C86111E2BA4988EE03C995C8D9598A54
SHA1:	43CEBE6CCB3CFE7060F17532F1DE2D5D51BD6D65
SHA-256:	F1C00F6E0541E14B95ED1A539331D8704AEF743BCDCCDC127438139EADB7560F
SHA-512:	054D6AE519DCC1902829259BA3C8B7A3D64615EC525071B7D31DB682ED39BB6BC9D4B881EFF6A77BFCFCB068D6F8E8323614487FC21713E481EEF312B0576CF8
Malicious:	false
Reputation:	unknown
Preview:	param ($source, $target, [int64] $size, $time, [int64] $failed, [int64] $skipped)....write-host "Transfer completed:"..write-host " Source: $source"..write-host " Target: $target"..write-host " Failed: $failed, skipped: $skipped"....$fsize = "{0:N0}" -f $size..write-host " Size: $fsize"..write-host " Time: $time"..write-host ""....write-host "Sending notification..."....$topic = 'codesector_test'..# 'YOUR_TOPIC'....if ($key -eq 'YOUR_TOPIC') {.. write-host "Please subscribe to a topic in the Ntfy mobile app or at https://ntfy.sh/app".... [void][System.Console]::ReadKey($true).. exit..}....$url = "https://ntfy.sh/$topic"....$headers = @{.. "Title" = "Transfer completed".. "Priority" = "default".. "Tags" = "heavy_check_mark"..}....$body = @"..Source: $source..Target: $target..$size bytes, $time..Failed: $failed, skipped: $skipped.."@....$response = Invoke-WebRequest -Method Post -Uri $url -Headers $headers -Body $body....write-host $response....Start-Sleep -Seconds

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\af\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 42 messages, Project-Id-Version: teracopy 'Voeg by Explorer konteks kieslys'
Category:	dropped
Size (bytes):	2804
Entropy (8bit):	4.993611146038944
Encrypted:	false
SSDEEP:
MD5:	CA9CD54A8419CA61E1B17BA4B05C2F11
SHA1:	4265289479FAEA438ED68D82C5D357C8E57C1E67
SHA-256:	90932491423759776B83C99D3C085A90179F12411370C4B91ACA284010C838B9
SHA-512:	1A26824415C4DA6D2690AF2CE9F16C8F93AD9B17DB896CE66B5B00939FEAE3AFC892DC0ABDE3506AE4682B101C448E2D1E1960B9CD0441DDA29BF8287F39C9D2
Malicious:	false
Reputation:	unknown
Preview:	...............l...;...................................................................................................&.......,.......1.......E...b...U...........................................!...................................".......)...<...5.......r...........................................................................................$....................... ........... .......).......B.......M.......X.......k.......t.......{...........................................t...........:.......C.......K.......Q.......V...)...\...........................................O...................5.......@.......E.......O.......g.......q.......\|..........................."...................................)...&...............%......."................................................... .......!.......................................'..................................#...........$.......(........................................Add to Explorer context menu.Always On Top.Always test after co

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ar\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	21371
Entropy (8bit):	5.244886228407361
Encrypted:	false
SSDEEP:
MD5:	4B0E0FD066887C45D46D283465FAFE3E
SHA1:	EAB115617A26B41CCCE5B810441F323F1047B231
SHA-256:	9A8E627991299248316C054F1AE956630D4F985B82958F89D235B80DC00D4092
SHA-512:	7ADE313707385DA10175C62D7C31BE619E4E3B41371A4510A8C1BF31CB80B0C5A91348C6EFB6D2497DA2F4F555F8B6DDF601EA49266492DE3B91A574EB8E32F0
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=6; plural=(n==0 ? 0 : n==1 ? 1 : n==2 ? 2 : n%100>=3 && n%100<=10 ? 3 : n%100>=11 && n%100<=99 ? 4 : 5);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ar\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Arabic\n"."Language: ar_SA\n"..#. mode..msgid "Copying".msgstr "..."..msgid "Moving".msgstr ".... ....."..msgid "Testing".msgstr "......"..msgid "Verifying".msgstr ".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bg\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17713
Entropy (8bit):	5.222912509853502
Encrypted:	false
SSDEEP:
MD5:	42F96DDD0060EBF2B7A0FDBA9B290F1A
SHA1:	AFD44AC1B3512882BC4C4D9A6152FCFA1B102803
SHA-256:	E496BDE0919E679E36B881B334DC3A5D2DB6E2CD1F8C2400BB2C1A6DFD38A374
SHA-512:	A93F910230014190F4EA14B6B859F473ECFC97BD81F5CD5E806DABE5668AFE210BF1177DCDF536E83B0047A1391E87C0F8A5EB30F54E3C85D1C0A23291A30018
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: bg\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Bulgarian\n"."Language: bg_BG\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "Verified".msgstr ""..msg

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bn\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \340\246\234\340\246\277\340\246\250\340\246\277\340\246\270\340\246\252\340\246\244\340\247\215\340\246\260'
Category:	dropped
Size (bytes):	25707
Entropy (8bit):	4.965735557479812
Encrypted:	false
SSDEEP:
MD5:	402A421F15FB541395D0497F054A28F0
SHA1:	BCBCDE59B94A2FEECF7C916EEBABE1B0F38CAC4C
SHA-256:	A24847037C54AF07DB0B16B660B172DBC016A4398B7FABF4AA41B4751F332B73
SHA-512:	EA346E60B59F4CCC6143AC6149058EB1293DCEC6161A7DEBFFC3D816883902320FFE816CB4A622DC2F0164C3743B7B78AA91B13181A2C5C992DD4DF6E9AAD9F4
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bn\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	26743
Entropy (8bit):	4.979535669135564
Encrypted:	false
SSDEEP:
MD5:	1394EC3FCED9020AA4549E1B7197551B
SHA1:	9568ECB6599CCF508FCED693A0F598343C4E0CB4
SHA-256:	06F4E43CD850DEDB1D15866B3B4D12351BB210ADCA9D034E4DB4EDEF8AE52FD8
SHA-512:	91122058B1403A20F1320D934E8803BF0F15BFC6CE92DEDB3A33820D0D9FD0B1D627A1A2565D27ADBD0DAAD13528FEFBABB7C9CD0D451A190A88F8A4D6B77137
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: bn\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Bengali\n"."Language: bn_BD\n"..#. mode..msgid "Copying".msgstr "..."..msgid "Moving".msgstr "...."..msgid "Testing".msgstr "......."..msgid "Verifying".msgstr "........."..msgid "Deleting".msgstr "......"..#. re

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ca\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	19165
Entropy (8bit):	4.784065583688281
Encrypted:	false
SSDEEP:
MD5:	7E107882808F5B86CCDBCFF245042775
SHA1:	544D9D5122A2D8B965F5A68140FF6C627BA69356
SHA-256:	46CD294241C6106D9B080196D857D176D91A17C5F64299740C2ED512C63B68AA
SHA-512:	AAD473A8EC1925CF1D17BC214E5300EAE50BFED2081E14ABA468857C4C2F084B06649534B69A21E632B661DF05A9B4E9EDC0205446F5E738775DCB4F9F3213DC
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ca\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Catalan\n"."Language: ca_ES\n"..#. mode..msgid "Copying".msgstr "Copiant"..msgid "Moving".msgstr "Movent"..msgid "Testing".msgstr "Provant"..msgid "Verifying".msgstr "Verificant"..msgid "Deleting".msgstr "Esborrant"..#. results..msgid "Added".msgstr "Afegit"..msgid "OK"

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\cs\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy 'P\305\231idat do kontextov\303\251 nab\303\255dky Pr\305\257zkumn\303\255ka'
Category:	dropped
Size (bytes):	3099
Entropy (8bit):	5.263652718030776
Encrypted:	false
SSDEEP:
MD5:	1EF5977497903242039A6FAF191EC2A0
SHA1:	478B20EBCD30E715CDCB9B368091462F8C78C3F1
SHA-256:	A694E9FC84FB100E4CC374C77359DB50292FCA30439A09658504AE086583A69A
SHA-512:	9DF0AB0C08B2B941312B40F44F7C683098ED431275174B243426DD06F0DFA90142B7C8E36C17C7DAC0524174A3C83B2BA535EAF35083779887C9013B218277A5
Malicious:	false
Reputation:	unknown
Preview:	........+.......t...;.......................F...................+.......B.......I.......P.......a.......g.......l.......s.......}...........................b................................... .......%...!..........L.......i.......s.......y...........<...................................................................................#............../...$...G.......l.......s...-...m...[...............$..................5.......=.......T.......].......h.......o.......~...........................x...........5.......?.......H.......P.......V......a...........................................M.......$...$.......I.......U.......\.......d.......z...........................................$.......7...........................*...'...............&.......#...................................................!.......".......................................(...............................+...$...........%.......)........................... ............Add to Explorer context menu.Adds Copy and Move

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\da\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17801
Entropy (8bit):	4.804138945052056
Encrypted:	false
SSDEEP:
MD5:	5988D7C96AF2E3CD809CEE0DE46CE677
SHA1:	3BD6418DEF6BB24DC4E56F1717A34415DDCF07A7
SHA-256:	32D55ED2AD189E71D2BABFFE3BE918D90CD946121C9CB5C2E0999076ED69EC73
SHA-512:	CC27258126AC10F4B4EFE6306EE21A319F5649D72B671250C1A320C2AA258B58B16852CFE60D87D807FD2144300FB8BFD235F88AB4E4557894550CB4D2841A28
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: da\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Danish\n"."Language: da_DK\n"..#. mode..msgid "Copying".msgstr "Kopierer"..msgid "Moving".msgstr "Flytter"..msgid "Testing".msgstr "Afpr.ver"..msgid "Verifying".msgstr "Verificerer"..msgid "Deleting".msgstr "Sletter"..#. results..msgid "Added".msgstr "Tilf.jet"..msgid

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\de\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18309
Entropy (8bit):	4.843767658835897
Encrypted:	false
SSDEEP:
MD5:	7193325B5566225488FD74A96AD24E4B
SHA1:	77BD322D09A1831983FD5C3C0B87A35D4F523494
SHA-256:	A30DA3F25C7C97D256BBD20CC2FF0C7D14D6F85786290E770473FD7E3560A7C2
SHA-512:	CAD1761268E5F0F32C0689C87AD08373436DEF8965EC8B90D691E2BC4C890116863B1AC6C64505EE522338DACC54E944F5CD800A8DD79D2B12DC9EE2C583994E
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: de\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: German\n"."Language: de_DE\n"..#. mode..msgid "Copying".msgstr "Kopieren"..msgid "Moving".msgstr "Verschieben"..msgid "Testing".msgstr "Testen"..msgid "Verifying".msgstr ".berpr.fen"..msgid "Deleting".msgstr "L.schen"..#. results..msgid "Added".msgstr "Hinzugef.gt".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\el\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	25021
Entropy (8bit):	5.262861294468051
Encrypted:	false
SSDEEP:
MD5:	B1F795601EB9ADD50CE3651CAF8308AD
SHA1:	899CA4E25F8FA8126A2A886A6F8B43BCCFB19B04
SHA-256:	A7D7A6C305EEB23FAEB602EC720E6EBB79808C580416F86B22A9A8F27843322A
SHA-512:	19DAC16647AC72E500866EF12BBC50BBBE6C89CC0C97ADC741F550587D12E7498D7BA9CD3B1FDD78BB5719DC9CEF4EA6D3A22832852C6078E94DFF7EA730D4D5
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: el\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Greek\n"."Language: el_GR\n"..#. mode..msgid "Copying".msgstr "........."..msgid "Moving".msgstr ".........."..msgid "Testing".msgstr "......"..msgid "Verifying".msgstr ".........."..msgid "Deleting".msgstr "........"..#. resul

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\es-AR\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Category:	dropped
Size (bytes):	17981
Entropy (8bit):	4.964424980477654
Encrypted:	false
SSDEEP:
MD5:	0DEAF19A8F952D4A1C3351127884A378
SHA1:	4AEF3382BC893639A1B40E5593A4D5EC52D0799C
SHA-256:	7A169D047EC28B296427FFA6D272A5D7824327E8E7F2BDF56921434D8D765C21
SHA-512:	8AE80FC2D3250108DA95D0F770BC4BD2CAF9181F61009795D926F2AA6C7D032431857A3EE82FBCDA0FD415FF3E37E0929AFE2409FB403A899B5C8F9C941806AB
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\es-AR\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	19025
Entropy (8bit):	4.7731749029441985
Encrypted:	false
SSDEEP:
MD5:	AA7BABBC3FC311CEE8830BBA541DD610
SHA1:	04C117B09CF7400153354CD31C83A5D92403024B
SHA-256:	550B157CFF15DD4B4E5DAB9B6598953995B05612EF0B1F18079C8C56CC48C01E
SHA-512:	3234ACA10B39202884BB3B1DFE9A8D54A5E5853890F71C6C4C19B101116D3BFEADC212FB4B47B5A8A9E3217BB4AAA9F2B8EE715B0A3690E0F25E17EA10849125
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-07-13 08:18\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: es-AR\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Spanish, Argentina\n"."Language: es_AR\n"..#. mode..msgid "Copying".msgstr "Copiando"..msgid "Moving".msgstr "Moviendo"..msgid "Testing".msgstr "Testeando"..msgid "Verifying".msgstr "Verificando"..msgid "Deleting".msgstr "Eliminando"..#. results..msgid "Added".msgstr

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\et\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 210 messages, Project-Id-Version: teracopy '%s: l\303\265petatud'
Category:	dropped
Size (bytes):	12182
Entropy (8bit):	4.963068698001432
Encrypted:	false
SSDEEP:
MD5:	85F0FCD55100DAD9848A2ED61F744C85
SHA1:	289B62CE258E1C74CAF9861219698F45F8BDE872
SHA-256:	5BCA726B9ADD636D703968E0424EE41CC4D95A66634B5C8CE963B8FA844F86C0
SHA-512:	297D29842465A5147195385E1B673B079D29E6ADC052CE193A998264921668E72C518AE56072778309EA754B1066DEEFB4EA83416633BFA12F4ED35D075D3298
Malicious:	false
Reputation:	unknown
Preview:	........................<...................................#...................................................'.......-.......=.......G.......U.......l.......w.......\|.......................................................................................................*.......<.......B.......S.......].......b.......m.......u...................................4...................................+.......3.......<..."...I.......l...............................................................................................+.......?.......H.......V.......`.......l.......s...................................&...........................................)......./.......?.......F.......M.......^.......r........................................................................... .......".........../.......9.......N.......e.......\|........... ......."...............................................%...........1.......L.......Q.......e.......k.......r...................................2...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fa\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 158 messages, Project-Id-Version: teracopy '\330\257\330\261\330\250\330\247\330\261\331\207'
Category:	dropped
Size (bytes):	12035
Entropy (8bit):	5.3340999727108445
Encrypted:	false
SSDEEP:
MD5:	3396CD06C65A4068868B8292507A528B
SHA1:	6C77A3CA72296A60FC385A45E53F92C5D3084505
SHA-256:	633B235DB1D552415E8492EF2869B1980E1E9ADA8BAF95FA2778F173C92FFB71
SHA-512:	BF9E5F3BF6522D000D3705CC7D06D3EA2ACC19B3136C59C4AA941BE4B75A1ABA4DEBB4ECF6AC95ADABC078E24992DDF0301A38575EEA5C87B77A7BC8CA12CF12
Malicious:	false
Reputation:	unknown
Preview:	................................H.......I.......O.......V.......`.......l...........F...............................+...........1.......O.......[.......b.......i.......o....................................................................................................... .......'.......E.......V.......^.......g.......t..."...................................................................!.......4.......9.......C...&..._...................................................................b...........\.......l.......v.......}...................................................................................%...........!.......<.......A.......U.......[.......b.......u...........<.......................!...................................'.......1.......=.......R.......Z.......d.......r...........................................<...................".......2.......J.......h...#...................................................................................*.......1.......:.......I.......

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fa\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17962
Entropy (8bit):	5.293924476065809
Encrypted:	false
SSDEEP:
MD5:	17A5822DA299F6F10B18D0622749064E
SHA1:	51A0AAE8A858E349E3721A5F6B1F5C0E570BAA4F
SHA-256:	171B59252E535AA2318F220743B100EECFF4536330B4816F5F2DEDAA84A02E3E
SHA-512:	0B9C25E3B1A0FB608E262B40A2E48992E72DA035040C66A152E89322D4BD274B072FF79DB5DD0818BDEB7DE22957033A736907043BF9E815EF827BC80ABC2062
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: fa\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Persian\n"."Language: fa_IR\n"..#. mode..msgid "Copying".msgstr ".. ... ..."..msgid "Moving".msgstr ".. ... ......"..msgid "Testing".msgstr ".. ... ..."..msgid "Verifying".msgstr ".. ... ............"..msgid "Deleting".msgstr

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fi\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d kohde'
Category:	dropped
Size (bytes):	17403
Entropy (8bit):	5.003578684917916
Encrypted:	false
SSDEEP:
MD5:	95ECBFC855E3532460A80CEF71EC9BF3
SHA1:	6CD4F3219494C651D3B1A7805C00B207C11E426D
SHA-256:	551BD01D2EA53D40BD1C4349F940C56CE6CE5B31B06B37E0EC7D89AD95CC8841
SHA-512:	985DBFC4360B0D06094BE855B0EDCC769A2289AD96CEF16BCE683A555F2DEE2916B30E1815D0875576A4AC0F74586A43C07794AF540D75EDCF2E28549329EC6B
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fi\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18439
Entropy (8bit):	4.824245116001254
Encrypted:	false
SSDEEP:
MD5:	21646A8C9BDBEB6AA7AF488F89A6CD8E
SHA1:	F2B24F01D2E07B6EF4C9E191A412B6E7137C452A
SHA-256:	8A8FFC01DA407500A95C5518001ABC05821B0266C7138C0C421F343240E4F72D
SHA-512:	8D4E1967397AA9E0BC53B023048426B5D165A42CD9CC37F67E520AB80EE1B372C0A331B791E1E852A676E82336789E2EB9EDF2A640431B04240CB06E91E9714D
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: fi\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Finnish\n"."Language: fi_FI\n"..#. mode..msgid "Copying".msgstr "Kopioidaan"..msgid "Moving".msgstr "Siirret..n"..msgid "Testing".msgstr "Testataan"..msgid "Verifying".msgstr "Tarkistetaan"..msgid "Deleting".msgstr "Poistetaan"..#. results..msgid "Added".msgstr "Lis.

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fr\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \303\251l\303\251ments'
Category:	dropped
Size (bytes):	18113
Entropy (8bit):	4.987660555942772
Encrypted:	false
SSDEEP:
MD5:	4439F9457B2645AB2F6183DC9EBAB7BC
SHA1:	9604C472E0BFE0A540EFAE65778BC7F4E3564C08
SHA-256:	59F9F63F90FB823C72124413A50CDDBE325240AB261FB79448C1C09D3EAEF972
SHA-512:	D14D23B902700E699410C4D2E1640497C8D505A9EE36757627C27088609AB4E36C45DC45FAC7F5E82ADA6A2358CE256739D6793063F8DC20AC35558F81D710F4
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fr\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	19149
Entropy (8bit):	4.794416872869295
Encrypted:	false
SSDEEP:
MD5:	420A604963A885B48AD2AB5BAD8BA526
SHA1:	5BBA0AF0C385634953EC494ED45998C7AFC82BF9
SHA-256:	D49089F6EC5881D570C5346682B38735AC906B2B654AFFE3B253C93923707121
SHA-512:	29A06430CCD7A16CE6A1B74A577932A3E023532CBC0EEE74C2DAFA85EA46595C80DB0EF38900FD5E6142008C60EC52D9B4ADB9C56B67F8E1D43B15CA726420FE
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n > 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: fr\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: French\n"."Language: fr_FR\n"..#. mode..msgid "Copying".msgstr "Copie en cours"..msgid "Moving".msgstr "D.placement en cours"..msgid "Testing".msgstr "Essai en cours"..msgid "Verifying".msgstr "V.rification"..msgid "Deleting".msgstr "Suppression de"..#. results..msgid

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hi\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 27 messages, Project-Id-Version: teracopy '%d \340\244\265\340\244\270\340\245\215\340\244\244\340\245\201'
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.219188526836207
Encrypted:	false
SSDEEP:
MD5:	705575977B7C584B36F82C684394B4EE
SHA1:	53B4D1B3CEAF6A7C48B67F2B33CBD40DE87612C1
SHA-256:	889F16EC097680BBC3A79CB8AD8895460552EA59E9BD18B4766C9A80017BAC0C
SHA-512:	79F1954C48F49896A78F69B5ED8E67D48857D4A59C3F3210427D37C67C44C1886A01D9FFEABE8105E8BD9058237EA5316C9902BA84D90535EC878450B89FC8A3
Malicious:	false
Reputation:	unknown
Preview:	....................%...........`.......a.......r.......y.......................................................................................................................................................................#.......+.......4.......>...+.......&...I.../...p...#...............+......./.......&...4...'...[...........'...............2.......-.......6...A...I...x...9.......................#... .......D.......W.......r... .......'.......*............................................................................................................................................................%d item.%d items.Absent.Add to favorites.Added.All items.Copy.Copying.Deleted.Deleting.Error.Failed.File list.Ignored.Log.Moved.Moving.No files added.OK.Options.Skipped.Status.Successful.Target.Testing.Verified.Verifying.Project-Id-Version: teracopy.POT-Creation-Date: 2022-01-02 17:46.PO-Revision-Date: 2022-06-04 07:22.Last-Translator: Somebody <your.email@address.com>.MIME-Version: 1.0.C

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hi\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13494
Entropy (8bit):	4.916387202013139
Encrypted:	false
SSDEEP:
MD5:	CEB6156CD8F2410AADBE4DC6646B994C
SHA1:	805742CAC7238090EB00A9C5E02C058C1C779B9F
SHA-256:	95DF79E99E93E4D87F4E10418E0B0B7C61DCBE88DAE89287F99FBAFE1C0902D5
SHA-512:	64E372EBCA4BA1CF3916FA775B5D410D15DEC2826A3FA860807952157F24DDF57FB47D3A567C946EA8899168B82B4DF37B85DF0377D31206B4AE457DB720C55B
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: hi\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Hindi\n"."Language: hi_IN\n"..#. mode..msgid "Copying".msgstr "......... .... .."..msgid "Moving".msgstr "...... .......... .. ... .."..msgid "Testing".msgstr ".... .... ..".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hr\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 165 messages, Project-Id-Version: teracopy '(ovo zahtjeva administratorske ovlasti)'
Category:	dropped
Size (bytes):	10067
Entropy (8bit):	5.049767415071793
Encrypted:	false
SSDEEP:
MD5:	ABEB64DF1097FE56792EB6AAA3FD6B92
SHA1:	FA67DA1905E696C21480B83A266A6C2E85661E14
SHA-256:	0B111D491826355D0FBE6BC80C0A7D811DB0FE503E972EF345AE220ECEA98A19
SHA-512:	C0B82873BF2CA2A623FF5FFE61FF8D5E01B007BE9ADFEA8353523CAB99207DEC0328C4895AFA17843E3CC153B4E4562709FA55D22763B0CA218524F01C34484E
Malicious:	false
Reputation:	unknown
Preview:	................D.......l...........#...................................$.......0.......M...F...S...........................+...................................!.......(......./.......M.......T.......^.......g.......x...............................................................................................%.......-.......6.......C..."...c...................................................................................................&...:.......a.......k.......y...................................................b...........:.......J.......T.......[.......c.......m...................................................................................%................... .......%.......9.......?.......F.......Y.......g...<...m...........!...........................................................,.......4.......>.......L.......f.......l.......s...................<...................................$.......B...#...Z.......~...............................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hu\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 169 messages, Project-Id-Version: teracopy 'N\303\251vjegy'
Category:	dropped
Size (bytes):	10837
Entropy (8bit):	5.162013660978614
Encrypted:	false
SSDEEP:
MD5:	2FF3F2A1FEAA619614C6B652D1868BD1
SHA1:	095101BD276C57577CB5497C5D6621774D983DA7
SHA-256:	963FCE7750A0AFFA5C209DFB25713981839D67AE944690C29EF32E9B19B2FA87
SHA-512:	B48903303B2DB3316E72585A5F653311DBC3310CC2A11791A9CA41111DA3407921F68097811A8656D9C4EA8D9E2870AC85C321666E36DFEF33DFF46B171FE7D2
Malicious:	false
Reputation:	unknown
Preview:	................d...............8.......9.......?.......I.......U.......r...F...x...........................+...................8.......D.......F.......M.......T.......r.......y...............................................................................................................&.......D.......a.......r.......z..................."...................................................,.......6.......B.......I.......\.......a.......k...&...............................................................................b...$..............................................................................................."... ...:..."...[.......~...................................%.......................................................................<..."......._.......i...!...x.......................................................................................%.......+.......2.......>.......K...<...h...........................................#...........=.......W.......^...&...s.......

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hu\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	16285
Entropy (8bit):	4.9329038125514595
Encrypted:	false
SSDEEP:
MD5:	89822DCE0BEA5BA3191FC48AC56C7AA8
SHA1:	887DA6B081325F37142ABF92D00B69C334E94DC0
SHA-256:	9E11B652ACD4127EAA8A9D328A74BA80CF27E4346D272D367359F2F5FBED0EB4
SHA-512:	B1598B28EA12470B1792FB3EDB6B8F19F28338F51A338F5AEA20C2BA2992BE86E29FFB25504A09E2770E789BFA303F980630B7BBA3177F21044361A2D8C9D1E2
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: hu\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Hungarian\n"."Language: hu_HU\n"..#. mode..msgid "Copying".msgstr "M.sol.s"..msgid "Moving".msgstr ".thelyez.s"..msgid "Testing".msgstr "Tesztel.s"..msgid "Verifying".msgstr "Ellen.rz.s"..msgid "Deleting".msgstr "T.rl.s"..#. results..msgid "Added".msgstr "Hozz.

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\id\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	16412
Entropy (8bit):	4.758265539928012
Encrypted:	false
SSDEEP:
MD5:	04411CF709BC7EC294B0885D01B3BDF0
SHA1:	2A6F221A4D3AF3B971511CB150D400D897D8A69B
SHA-256:	6DC0707FB750407C5916EF706B95570860BE06BB414CB15706ACD6484B075AAE
SHA-512:	14BF12B811ADB281CAF125DC9ABF8DF3A00F18C89608C4D79F4C1A1E67CE8F90A958A9775704F2FD3E6528487D5B5D6859A4ACC8CDCE53EB202958915F70EC5C
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: id\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Indonesian\n"."Language: id_ID\n"..#. mode..msgid "Copying".msgstr "Membuat Salinan"..msgid "Moving".msgstr "Memindahkan"..msgid "Testing".msgstr "Menguji"..msgid "Verifying".msgstr "Memeriksa"..msgid "Deleting".msgstr "Menghapus"..#. results..msgid "Added".msgstr "Ditambahkan

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\it\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d voce'
Category:	dropped
Size (bytes):	17471
Entropy (8bit):	4.924675616291345
Encrypted:	false
SSDEEP:
MD5:	13C197263E8A415F2E4609D231965BDF
SHA1:	C9D8B7364666B6A94D8E9402EB8A04D690AD71FD
SHA-256:	080707E4797903E5F43B8B7AA3F656D85DC207B18B4C7E2A231DDC674EA95973
SHA-512:	718D26856F2019166E54CEFA4B965424FB5B4EB6B85B215BB4EBD4EA3392489CB5FC755369140544BDE411C7853D43BC32F9F25CDBBEB66EA20285AFE3C51903
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ja\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 271 messages, Project-Id-Version: teracopy '%d \351\240\205\347\233\256'
Category:	dropped
Size (bytes):	18638
Entropy (8bit):	5.692796275283653
Encrypted:	false
SSDEEP:
MD5:	44BD0A60D000350432AC85C1FC3C21E7
SHA1:	9F944B55AF1B729FFCEC0D22D49EB2F5AAC75E81
SHA-256:	9FBB2FDAF030ACFAEB4C6BB850C331F0E6137E8D9D693935041420A9959519B3
SHA-512:	5E9E091BA85959AA59014FFDDA24257CB76F182B1183B4BDF8A9702B6E6EFA3635C77A9332C3DC061851E4F68344BCADC959834487F83563F95528A018F07983
Malicious:	false
Reputation:	unknown
Preview:	....................o...............................#...............#...........C.......G.......M...#...T.......x...........................................................F...........9.......C.......Q.......h...+...t.......................................................................................%.......C.......J.......T.......].......o...................................................................................................................4...&.......[.......y..........................................."...................(.......-.......6.......Q.......V.......f.......l.......v.......\|.......................................................................................".......;.......N.......S.......]...&...y.......................................................................................!.......0.......3.......C...b...`...............................................................................$.......:... ...H..."...i........... .......,..............."...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ka\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy '\341\203\231\341\203\235\341\203\234\341\203\242\341\203\224\341\203\245\341\203\241\341\203\242\341\203\243\341\203\240 \341\203\233\341\203\224\341\203\234\341\203\230\341\203\243\341\203\250\341\203\230 \341\203\223\341\203\220\341\203\233\341\203\220\341\203\242\341\203\224\341\203\221\341\203\220'
Category:	dropped
Size (bytes):	4482
Entropy (8bit):	4.956064895514923
Encrypted:	false
SSDEEP:
MD5:	198E30ED96BB03862341A7E4520B5CD1
SHA1:	6BDF61726E1E184645953AA5478624783049D1D7
SHA-256:	F6083E5AAEF34B03C38DBD86F578F0E0C539216400E1140DDFB85562AB135EE4
SHA-512:	4811F6585A4E685C2308A30644B9648C42E06B7461734E281FBF3CFAD0FFF63848DB6893BDEEE2D10B19C4D781A6BC2FCE168690188ADB89F5473D0B8913791B
Malicious:	false
Reputation:	unknown
Preview:	........+.......t...;.......................F...................+.......B.......I.......P.......a.......g.......l.......s.......}...........................b................................... .......%...!..........L.......i.......s.......y...........<...................................................................................#............../...$...G.......l.......s...M...U...............C...`...c...................G...........>.......T.......m...%...}...................P.......)...........D...$...Z...........................................T...]...................!.......!...............M...........D.......c...:...\|...2...............'...........1.......A.......W.......m...S...................f...............*...'...............&.......#...................................................!.......".......................................(...............................+...$...........%.......)........................... ............Add to Explorer context menu.Adds Copy and Move

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ka\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	14846
Entropy (8bit):	5.013628609954672
Encrypted:	false
SSDEEP:
MD5:	DFD9783716BC2A69546D5011FDF350B7
SHA1:	658D2EAD06F73419A4DCD98CDB8299084CC4B52D
SHA-256:	AE0CDCF67F7A753A13A0654B934AE4C7248F91DE8AD7AD0FE1270D1EDF1FE76E
SHA-512:	40D39D57F21322C22C959E71F0970DB52BB3AA6B859B81A5F290C3E1EF96613A5B3917BD02C1592F7B984811CD8D768EA4967C8803BE0392DC868F3D393CFC3C
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ka\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Georgian\n"."Language: ka_GE\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "Verified".msgstr ""..msgi

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ko\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \355\225\255\353\252\251'
Category:	dropped
Size (bytes):	17691
Entropy (8bit):	5.669612496353697
Encrypted:	false
SSDEEP:
MD5:	4CCCD9CEFABA77451FF15B6CB0D038E2
SHA1:	C2541715D4200ACDBF66C8689A5DBD8D2E9C3337
SHA-256:	8CF83CB29E2377737D933B2DDEAB81CECA4A90BD97444340B5C954F50226AC3F
SHA-512:	5145E553A8F0D3895BA74D1C0A6C80C9D74377BE31DAB16DF95B678C6BBFB35B83CFAC4E22C164FF4CF26DBF17642062E2731D5249E2C09A9486F39271827960
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ms\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: teracopy
Category:	dropped
Size (bytes):	529
Entropy (8bit):	5.328248002637431
Encrypted:	false
SSDEEP:
MD5:	4A8183CC5E8B4EE6C030EBB66EA4830C
SHA1:	D166B771DDA33ED90D07F455D5F37663C8155FBE
SHA-256:	81507149F316911786F354DB9FF0754282AD3A19118EA1DA1BAB3CA7F0CE4C35
SHA-512:	D11EDFC6E82F4C0385D5405368E5A14207BC69B1F20F4CDF11FE06CDF114C022C0E9DB9A84D3E63474BE07468B92D9E0A265D5F2B642348E226DED6C1B274EEA
Malicious:	false
Reputation:	unknown
Preview:	................$.......,.......8.......9................Project-Id-Version: teracopy.POT-Creation-Date: 2022-01-02 17:46.PO-Revision-Date: 2022-01-02 14:49.Last-Translator: Somebody <your.email@address.com>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.3.1.Plural-Forms: nplurals=1; plural=0;.X-Crowdin-Project: teracopy.X-Crowdin-Project-ID: 490081.X-Crowdin-Language: ms.X-Crowdin-File: default.po.X-Crowdin-File-ID: 5.Language-Team: Malay.Language: ms_MY..

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ms\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	12503
Entropy (8bit):	4.646734211889118
Encrypted:	false
SSDEEP:
MD5:	031DF90A1B541B9928CB3E96B9348E49
SHA1:	F6FEBFB6450068EFAE8F54D394D1A50A7F85EA7C
SHA-256:	52D7EA7ED870CF42D6D05632E74AB73F4EC5EA757C759292F7E8C0D892340945
SHA-512:	1FDDD1E39A6438A5B5A18AE1950476543574C6ADD9670168F642609BB4D032C42EA973F2F66A63F73363FA448A392DF7B31B583F323CC4F8439B45D10391AA25
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-01-02 14:49\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ms\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Malay\n"."Language: ms_MY\n"..#. mode..msgid "Copying".msgstr ""..msgid "Moving".msgstr ""..msgid "Testing".msgstr ""..msgid "Verifying".msgstr ""..msgid "Deleting".msgstr ""..#. results..msgid "Added".msgstr ""..msgid "OK".msgstr ""..msgid "Verified".msgstr ""..msgid "Error".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\nl\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	4.944305465276067
Encrypted:	false
SSDEEP:
MD5:	F845354BF90F3888606CFBFFFB80FCF2
SHA1:	DAFAE7A76ADDA0D8C835C7F6AEFFA15599FD025F
SHA-256:	E90114A133F6BA1240B1E02696FF91DBFDD7D37FFE6A24EBB48377BCD56F6A0E
SHA-512:	9F5AC2B4D38E3F7FCCDD5D25FEAD18242B02EB5DA4644DF5A1E4A0CDB556ABA8344A5919CB1A34284BE133CB8C83B5BBDC9642625DB8BFD4599E56A89B74284F
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\nl\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18420
Entropy (8bit):	4.758351588661835
Encrypted:	false
SSDEEP:
MD5:	905399CAB7C735BDCF3158F74214DAF7
SHA1:	2F160AD6ADB32B697731B345B189B14825E32D68
SHA-256:	5C45306F61D685BED63ABAFD6CDCD8EF1032C38A60D66C6282F895E6210C6CC0
SHA-512:	F41C84DD4E3A94C8B3FF6CDEC67BCE587A9E63E9BEABF760142C90818BD7FC8613F880F54595604A1CB6EBC49DC412B508970FD1CA8E43C00BD672CBCF872316
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: nl\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Dutch\n"."Language: nl_NL\n"..#. mode..msgid "Copying".msgstr "Kopi.ren"..msgid "Moving".msgstr "Verplaatsen"..msgid "Testing".msgstr "Testen"..msgid "Verifying".msgstr "Verifi.ren"..msgid "Deleting".msgstr "Verwijderen"..#. results..msgid "Added".msgstr "Toegevoegd".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\no\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17665
Entropy (8bit):	4.779049693750268
Encrypted:	false
SSDEEP:
MD5:	846985AC31E420D4D79BFAE49CB4F524
SHA1:	5B062ECF403AE1DED309F1D2E865CF0F44E6B5EF
SHA-256:	D46BF540EE683AD07AF0691D442ACA36C79C2585188A55CC7941DEAF8887404E
SHA-512:	7086EB9FE0A2786E7B656F51CE6B841A748B49E91B2CD81937E831730D1E742B53A3E8FA326FDAF1B17E8D62A52CA4E0DA79B240E3B835702D9014C4FB46ACA0
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: no\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Norwegian\n"."Language: no_NO\n"..#. mode..msgid "Copying".msgstr "Kopierer"..msgid "Moving".msgstr "Flytter"..msgid "Testing".msgstr "Tester"..msgid "Verifying".msgstr "Validerer"..msgid "Deleting".msgstr "Sletter"..#. results..msgid "Added".msgstr "Lagt til"..msgid "O

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pl\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Category:	dropped
Size (bytes):	17722
Entropy (8bit):	5.19691860841188
Encrypted:	false
SSDEEP:
MD5:	01D3764428E7B274FDE63C3C97F61E7A
SHA1:	957A97066C0EB1B6A3F5E1611FB3819BA00AB305
SHA-256:	E27046A14F5689FAAEC488298170C868FCC904278B26A9F6C2231C412896FCC0
SHA-512:	2434210125401066262DD435D021934226634F213CCACF652B28A93A347D403E762CDEF52F27407A1671528DB7DEF296C4802C8EE9FF1D46EFE239FA6D31E38B
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pl\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18806
Entropy (8bit):	5.04516084252042
Encrypted:	false
SSDEEP:
MD5:	8FF14ED5F375842E1E29E4CABDCB3E03
SHA1:	3FC734F2ADDE1AB1A4A053A975AC0F428B8B8259
SHA-256:	06827294BC726C97541C452CA7246735C2977FC08EA1E06EFCCBC22DDDA683B2
SHA-512:	6AAEC580772AD3F26A3258CA834FAEA5DC96D1CD00B495395A3E101A0F868B947438640600EF6F3C42D3CDAA935804259B06F890DC139A98BD4A60FF2B359149
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=(n==1 ? 0 : (n%10>=2 && n%10<=4) && (n%100<12 \|\| n%100>14) ? 1 : n!=1 && (n%10>=0 && n%10<=1) \|\| (n%10>=5 && n%10<=9) \|\| (n%100>=12 && n%100<=14) ? 2 : 3);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: pl\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Polish\n"."Language: pl_PL\n"..#. mode..msgid "Copying".msgstr "Kopiowanie"..msgid "Moving".msgstr "Przenoszenie"..msgid "Te

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pt-BR\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Category:	dropped
Size (bytes):	17690
Entropy (8bit):	5.005787181181036
Encrypted:	false
SSDEEP:
MD5:	720C72ACF614B3F0389E9A194E2AD228
SHA1:	BD49AC04761C7F51488AB048F72B92A80C7602E2
SHA-256:	640E1383107A46410B5FAFB917C422790D298EAC2B4F29220A9C4CAD745F9C8E
SHA-512:	8B90DA8750AA10EB95593D955A001ACF3E81377039FDA59C38208A4B6BFCFF9691833FB21F6705A05BA293377B66A79A8D94F39D8D9F8394BA0F3474FE7C97D8
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ro\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 272 messages, Project-Id-Version: teracopy '%d element'
Category:	dropped
Size (bytes):	17607
Entropy (8bit):	5.0368909046923
Encrypted:	false
SSDEEP:
MD5:	9CBDDD4EAB2C1EAB8D7603E3FAD97467
SHA1:	ECD942FBBC4D3B558CA20912EF463A9C690E107A
SHA-256:	FB0F7F5DCB5E463EDD1A2FCD2DC61B88CF4B956AB70525EE2DF7E177DC93FDDC
SHA-512:	2F5598222EB7AE05A79882F3C4D07C055A1F1EEDCEC4CE0DC848DEFC12F7FDC441C1FB812C05D710CF15C931D87EBA3BC32FEE0285F01F51DDB77966DECF3664
Malicious:	false
Reputation:	unknown
Preview:	....................o...............................#...........!...#.../.......S.......W.......]...#...d...................................................................F...........I.......S.......a.......x...+...........................................................................................1.......7.......U.......\.......f.......o.......................................................................................................$.......,.......1.......8.......V.......s..................................."...................................................3.......C.......I.......S.......Y.......p...............................................................................................+.......0.......:...&...V.......}....................................................................................................... ...b...=........................................................................................... ...%..."...F.......i... ...s...,..............."...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ro\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18773
Entropy (8bit):	4.865419631816407
Encrypted:	false
SSDEEP:
MD5:	DA295A0F3DA9EC2B401330E7D1F8345D
SHA1:	76D07D87966BE44DCC7D4250DF7B50D718EB6386
SHA-256:	82DADB683704BDDE2668901E50B33D7212D66DD0E14B6B823443B96FB0501380
SHA-512:	FEC613DCB7E617C02B49CC0592A4FF5246106078E38FC84A1AC8F123DC3156892B3D17326AF196D749CC126A93F6539980788063E67001FAC138CC3668B3298A
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:21\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=3; plural=(n==1 ? 0 : (n==0 \|\| (n%100>0 && n%100<20)) ? 1 : 2);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: ro\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Romanian\n"."Language: ro_RO\n"..#. mode..msgid "Copying".msgstr "Copiere"..msgid "Moving".msgstr "Mutare"..msgid "Testing".msgstr "Testare"..msgid "Verifying".msgstr "Verificare"..msgid "Deleting".msgstr ".tergere"..#. resul

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ru\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \320\276\320\261\321\212\320\265\320\272\321\202'
Category:	dropped
Size (bytes):	21509
Entropy (8bit):	5.289696670779707
Encrypted:	false
SSDEEP:
MD5:	4677AF638E4C63A78104DBCBEAA3A944
SHA1:	39E2670A6B85F1861C5FD93CC3A66CCCD4ED079E
SHA-256:	6608C7073EF3D052F1559E10953B1C0201BFDBDCAEB3E6C79D0552B22E29BD6B
SHA-512:	51C3F6FEF5D8EFBE24AE993863C48906BD01C1E11E6539CF7ED098A5E2C0FD126D3671326178C2E29DE6773C5C75F74B323F0C0377E79DBDE007292BB29074B8
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sk\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d polo\305\276ka'
Category:	dropped
Size (bytes):	18196
Entropy (8bit):	5.240024732296052
Encrypted:	false
SSDEEP:
MD5:	446AD85298B9E4FBC508B2AECE0EC1F9
SHA1:	1FE76AAC29621C608FD294677A2F12B4E91EC3E5
SHA-256:	F6BC2338FBDC315B307AB37C1B56EB277A21CAC4B335A7B28C5F7C6BF79DDD62
SHA-512:	B23ED4A4E676B14E54EB44A2240A9639EBD78038939FFF3889E2459300617FF55E8EE6EDCA4FD4AF6DCE580518B5694C0C3B5073DAFDF4F4B79A98B4494F0A8A
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sk\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	19280
Entropy (8bit):	5.092304395204247
Encrypted:	false
SSDEEP:
MD5:	88549C938B09CC529FD6A5D01D875946
SHA1:	47CEDB4D493EAFA387BBE9D11EC94CD5A5EB2EA4
SHA-256:	665BD85FC684737DD427E338AACC85C88AB38D8C4330901CC12F06F99AF16E83
SHA-512:	3574B5A31D521051BF712D3FDDA0F8A622387523A274CB0A6625489DE4A0DAFA8C4BB9CF70D45FD1C2E9EB134F0791002522596A8972615F57DABE5EE25EC486
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2023-11-19 07:45\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 3;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: sk\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Slovak\n"."Language: sk_SK\n"..#. mode..msgid "Copying".msgstr "Kop.rovanie"..msgid "Moving".msgstr "Pres.vanie"..msgid "Testing".msgstr "Testovanie"..msgid "Verifying".msgstr "Overovanie"..msgid "Deleting".msgstr "Odstra.ovanie"..#. result

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sl\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d postavka'
Category:	dropped
Size (bytes):	17263
Entropy (8bit):	5.033719475181113
Encrypted:	false
SSDEEP:
MD5:	1B5010E557672C8F894A4A47093DC8A0
SHA1:	725A73C3F6786FFC4E78FE692B434644FD0AEB11
SHA-256:	B87D0C0AE78B83C54883D77F4E07255D240E8AB874C7F37DE5ACCC9467D9CEED
SHA-512:	E70256AC9653C370CCA81A5AE069965CA03BF9F8DF7E275019E70B8AFC394D0747489179ECFD1078D77D1A6AD82A33F4F3CD8FE6C1BAA43022CFB69014BC656C
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sv-SE\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d objekt'
Category:	dropped
Size (bytes):	16840
Entropy (8bit):	5.036979847204208
Encrypted:	false
SSDEEP:
MD5:	D4DBAA49054C42D617B05DF65C2912FA
SHA1:	88AD2BCB9836AE57F687D2FF84C57A80F8D7B18D
SHA-256:	0F73C2C75D44E93E93410F45633EDCC62DAAED215D99523E3B7C946B1D03535C
SHA-512:	628C69A2C3F8762D1F88B5E929D715A1F3DFE6F65B2A139DDD3F9DC750A7F03E60666B427E07DA7D9C0EA0EA3CAEB356CE33853855DABBE2560963B1BD5EEBAA
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sv-SE\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17876
Entropy (8bit):	4.8505622187827955
Encrypted:	false
SSDEEP:
MD5:	75018460F57E6A000E4AEAE108FB3AA2
SHA1:	11007D32581500761E2FDD476F49720C98B8A73D
SHA-256:	8B88E3023C16597644499A8451F7B9B199710815408B87310347CCD0AB959EF9
SHA-512:	4F651FBB66B327BE8EF438A45CEB2F33F9744AF320B6363C4AF8EAFAF1637DC36A789F30FE36FC388DCEA3790BE658A42BAD66023B12694A5BED7E3D11915E35
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=2; plural=(n != 1);\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: sv-SE\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Swedish\n"."Language: sv_SE\n"..#. mode..msgid "Copying".msgstr "Kopierar"..msgid "Moving".msgstr "Flyttar"..msgid "Testing".msgstr "Testar"..msgid "Verifying".msgstr "Verifierar"..msgid "Deleting".msgstr "Raderar"..#. results..msgid "Added".msgstr "Tillagd"..msgid "

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\th\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 178 messages, Project-Id-Version: teracopy '(\340\271\203\340\270\212\340\271\211\340\271\204\340\270\224\340\271\211\340\271\200\340\270\211\340\270\236\340\270\262\340\270\260\340\270\243\340\270\270\340\271\210\340\270\231\340\271\202\340\270\233\340\270\243)'
Category:	dropped
Size (bytes):	15012
Entropy (8bit):	5.036455323333889
Encrypted:	false
SSDEEP:
MD5:	1759814BE65AB5A63731215EF3CCC782
SHA1:	18082ED1984B6C320FC1B6D704127080D0AE2770
SHA-256:	A8D7A74AA9240A2211E293CDAD3438C4BE350FA3B4CF87FAA7F242B0662D6F7F
SHA-512:	60265BDA9768A07D22DA17B6EBCDAB7B1827ADD728CCE4EA51BC4FE0922D810B8BE39093288ECEF4864235B65DF6199C057EA5C8AAB5BB17A2B68ECA8C0027C8
Malicious:	false
Reputation:	unknown
Preview:	........................<...........#...................#.......*.......4.......I.......U.......r.......}...........F................................................... .......".......).......0.......6.......T.......[.......e.......n.......................................................................................................#.......+.......2.......P.......m.......~...............................................................................................................................1.......6.......@...&...\...................................................................b...........H.......M.......T.......\.......f.......i...,...s..........."...................................5.......M.......Q.......T.......Y.......^.......c.......h.......\|...................................................................!...................................&.......C.......M.......Y.......a.......o.......y...........................................................<.......&...0...'...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\uk\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \320\265\320\273\320\265\320\274\320\265\320\275\321\202'
Category:	dropped
Size (bytes):	22157
Entropy (8bit):	5.293867731137159
Encrypted:	false
SSDEEP:
MD5:	3F88E540CA883209E13D2A5A060EE616
SHA1:	F996DB36179D9F02D3861B10B5D65C1D0481C5D2
SHA-256:	715F708E252C0B4A9EEA8E5A0E35B1D9708D12558F917B9A960C96108B91CB1E
SHA-512:	D69B9F32B5FF838E0D8EE48DC4F3E3EA6AF1C0D33D7B428398D3D83EE79C171131D47A4A31D95A39E32663C4BA4246F2720169EA8F1CDCAF449E5D95E30DB3DB
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\uk\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	23241
Entropy (8bit):	5.301176801033972
Encrypted:	false
SSDEEP:
MD5:	7B9844056122BF8B261AF39A7110ED37
SHA1:	C5AE0526463D4C71AE8EFBA413405B4460033329
SHA-256:	6C994404BAB8A8075410337739E083554FF8D9058C5F0A5D2D81CB74DBBAD6B1
SHA-512:	DAAFCA28765AACBC6E4EDC67BC16A746F45AEE7D10CDEBA1A67AC6AB0B5C0CDAA67E7DC328DDD089C612C0502CBC6899CA2DF02ABE83B1BE3609223903F7CB0C
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=4; plural=((n%10==1 && n%100!=11) ? 0 : ((n%10 >= 2 && n%10 <=4 && (n%100 < 12 \|\| n%100 > 14)) ? 1 : ((n%10 == 0 \|\| (n%10 >= 5 && n%10 <=9)) \|\| (n%100 >= 11 && n%100 <= 14)) ? 2 : 3));\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: uk\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Ukrainian\n"."Language: uk_UA\n"..#. mode..msgid "Copying".msgstr ".........."..msgid "Moving".

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\vi\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 205 messages, Project-Id-Version: teracopy '%s: \304\221\303\243 ho\303\240n th\303\240nh'
Category:	dropped
Size (bytes):	12753
Entropy (8bit):	5.367375148782935
Encrypted:	false
SSDEEP:
MD5:	CBC19EC2E7558B55DA6D6D9BBDF4ED79
SHA1:	4667C15C73ADBCB84DEB85893CC347A34AA82FC9
SHA-256:	39F90EEF246F668286CCA72CE43CB69FC3B240F576D3443E0BFEDB551E100509
SHA-512:	CACD15184F655857FDCA0C6B24DDB9CABD5F4952A2BB4968827EF8EAE6792DC4ACA136D7E198A46525A462B6264B60A9826A48651102D3206F0451FCF7AC179F
Malicious:	false
Reputation:	unknown
Preview:	................................@.......A...#...O.......s.......y...#...............................................................F...........T.......^.......l...+...................................................................................%.......C.......J.......T.......].......o.......................................................................................................................&.......D.......a.......r.......z..................."........................................................................... ...............8.......D.......K.......^.......c.......m.......w...................................................................b...........M.......R.......b.......l.......s.......{...................................,...........................#.......:.......Q.......i... ......."...................................................................................................&.......9.......G.......M.......R.......a.......k...!...z.......................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\vi\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17033
Entropy (8bit):	5.189218638419314
Encrypted:	false
SSDEEP:
MD5:	B4575838EEF5E6E42CCA38F2ADBEE835
SHA1:	16A217C2B933782997150C28AF5EACA16B5B244F
SHA-256:	A91C23AA6FAEA4795454370D213C92B1C4F6C449E0F0BCD4B7977C1B15FD01E8
SHA-512:	AA705B0EA51E4B414B5109C32D8329110A2FF214B5124285D58962B23220516EF8E458859485F53D01C2681ECFBA96DA5B3C97C2BE94326CC6F30DE9291DC65A
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-12-28 05:44\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: vi\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Vietnamese\n"."Language: vi_VN\n"..#. mode..msgid "Copying".msgstr ".ang ch.p"..msgid "Moving".msgstr ".ang di chuy.n"..msgid "Testing".msgstr ".ang ki.m tra"..msgid "Verifying".msgstr ".ang x.c nh.n"..msgid "Deleting".msgstr ".ang x.a"..#. results..msgid "Added"

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\zh-CN\default.mo

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \344\270\252\351\241\271\347\233\256'
Category:	dropped
Size (bytes):	16322
Entropy (8bit):	5.7565563718733825
Encrypted:	false
SSDEEP:
MD5:	C6182A14CB3CF761A23196CEDD2C5612
SHA1:	516F65E66C39925C3A89E1738D0B9B543FFF5FF5
SHA-256:	403A32237844660E229116E351506235AD7C7FEBCCD3904A0D3E65EAAACC39DA
SHA-512:	C8491D0B0D73985C647A3F1B7B151892920489D67B43F957AE2D01E98ACA045BAAFFEC534A7CAC649DF290848C262F32974C30CCB58CD75EE3C84C8A4C035443
Malicious:	false
Reputation:	unknown
Preview:	....................o...,...........................#...........1...#...?.......c.......g.......m...#...t...................................................................F...........Y.......c.......q...........+...................................................................................".......A.......G.......e.......l.......v.......................................................................................................%.......4.......<.......A...4...H.......}..................................................."...........*.......J.......O.......X.......s.......x...............................................................................................'.......3.......=.......D.......].......p.......u...........&.................................................................................../.......C.......R.......U.......e...b.................................................................../.......2.......F.......\... ...j..."............... .......,...........

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\zh-TW\default.po

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	5.7658486962320685
Encrypted:	false
SSDEEP:
MD5:	CB9B5BAE05526AB3F347B6B0FB27F7E4
SHA1:	15F095587062E14E43932E526B3ACF318EBBFE9E
SHA-256:	A0952259C8994392FB55FA0BC535CCCBAA8A64910F4024F27D990B39616759CE
SHA-512:	CBDD6C4D595602911E02E78CE494538BDAB4712915234BAB33379FF2214C3CED19B79AD9D75D4B6E528A2414C501C5155F5F87409BC7C0C997CCC1CBCD399473
Malicious:	false
Reputation:	unknown
Preview:	# SOME DESCRIPTIVE TITLE...# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER..# This file is distributed under the same license as the PACKAGE package...# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR...# ..msgid "".msgstr ""."Project-Id-Version: teracopy\n"."POT-Creation-Date: 2022-01-02 17:46\n"."PO-Revision-Date: 2022-06-04 07:22\n"."Last-Translator: Somebody <your.email@address.com>\n"."MIME-Version: 1.0\n"."Content-Type: text/plain; charset=UTF-8\n"."Content-Transfer-Encoding: 8bit\n"."X-Generator: dxgettext 1.3.1\n"."Plural-Forms: nplurals=1; plural=0;\n"."X-Crowdin-Project: teracopy\n"."X-Crowdin-Project-ID: 490081\n"."X-Crowdin-Language: zh-TW\n"."X-Crowdin-File: default.po\n"."X-Crowdin-File-ID: 5\n"."Language-Team: Chinese Traditional\n"."Language: zh_TW\n"..#. mode..msgid "Copying".msgstr "..."..msgid "Moving".msgstr "..."..msgid "Testing".msgstr "..."..msgid "Verifying".msgstr "..."..msgid "Deleting".msgstr "..."..#. results..msgid "Added".msgstr "..

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Sounds\Error.wav

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	135552
Entropy (8bit):	3.9082543423673757
Encrypted:	false
SSDEEP:
MD5:	9D8740630DDC575EA17B8AD4D51F6DDF
SHA1:	76D08AB95C2C44105F9BA07AF1FEF24A556F75F5
SHA-256:	18D84B46610ED7EABEDD55E1B983ED6EE07BCF5CF4777651E3F6629248002F77
SHA-512:	781A37E38FE9E4BCD9EB70E62C914A0C31F814F5DCC2EE341717F8FC72881309BBFF80B381F279BD552C587501E87543348186A46206C731AEF87235669F15C3
Malicious:	false
Reputation:	unknown
Preview:	RIFFx...WAVEfmt ........D...........data................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Blake3.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162816
Entropy (8bit):	6.407622112858739
Encrypted:	false
SSDEEP:
MD5:	48C5198CA37878B9B5DDB89A2E90497F
SHA1:	49EFA09453B2867BA822811FCE25D595DE042E28
SHA-256:	0DB71F38E0E64CD855C9BCF5B8F4AC0BB9DFE45E27C18F9AAD949FCEE946BC9B
SHA-512:	168743B0AB0336AE2BB8E9A8113F130B4BFDED41AC8586D101B7E3F5FAD9D9BEEB62AA0C3A22D785E03EBE958FC76146FD84764D3941DEA1EF3FA6D381EFAFD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........So.\|=<.\|=<.\|=<..9=.\|=<..>=.\|=<..8= \|=<..8=.\|=<..9=.\|=<..>=.\|=<..>=.\|=<..9=.\|=<..<=.\|=<.\|<<.\|=<..4=.\|=<..==.\|=<..?=.\|=<Rich.\|=<........PE..d...fs.d.........." ...$..................................................................`..........................................^.......^..(...............4...............<...`M..8........................... L..@............................................text...P........................... ..`.rdata.............................@..@.data........p.......X..............@....pdata..4............b..............@..@_RDATA..\............r..............@..@.reloc..<............t..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Directory Opus.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	917
Entropy (8bit):	5.093924084992883
Encrypted:	false
SSDEEP:
MD5:	DA536A00C47327CF9750AFB7798E6EB8
SHA1:	EA95AED802524E8EADAD649DDFD9375331E3BFD8
SHA-256:	727633B122C814BDB58D83737AE0BCC0613CCFFA2808CE319910A4567FAAECA3
SHA-512:	5E6F024310B241265274CF1861EA55515B9ACEA990D6503D2C584B30F9ED4C52C74D03827528C9FD7356CE3073F7602B9AB8A67D9256C67D74C67F22E3092A24
Malicious:	true
Reputation:	unknown
Preview:	Copy this code to the clipboard, go to the Directory Opus, and ..paste "Copy" button to the toolbar in the Customize mode. ....<?xml version="1.0" encoding="UTF-8"?>..<usercommand backcol="none" textcol="none">..<label>TeraCopy_CopyFile</label>..<tip>Copy files with TeraCopy</tip>..<icon1>%ProgramFiles%\TeraCopy\TeraCopy.exe,1</icon1>..<function type="normal">..<instruction>%ProgramFiles%\TeraCopy\TeraCopy.exe Copy {allfilepath\|filem} {destpath}</instruction>..</function>..</usercommand>....Repeat with this code to insert the "Move" button.....<?xml version="1.0" encoding="UTF-8"?>..<usercommand backcol="none" textcol="none">..<label>TeraCopy_MoveFile</label>..<tip>Move files with TeraCopy</tip>..<icon1>%ProgramFiles%\TeraCopy\TeraCopy.exe,2</icon1>..<function type="normal">..<instruction>%ProgramFiles%\TeraCopy\TeraCopy.exe Move {allfilepath\|filem} {destpath}</instruction>..</function>..</usercommand>

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.509786823178353
Encrypted:	false
SSDEEP:
MD5:	0C020E9EC866A7426AA62A593D77A894
SHA1:	DC75A260EAAE962462B84C14045837E029A7263D
SHA-256:	7DCFBD0351C64C0798EC5CC14BB32BAB7B224A854A456A7E20CA15E103BB8D7F
SHA-512:	89011E39CF9D7700B1DAE0FA190D075D7D3EC0FDE032EB65D0E1CAB7830A686FD71FAC07D5B9648CA99E48AF3ABCEFB95C71B99ADC015A608F9512E8462069C2
Malicious:	false
Reputation:	unknown
Preview:	Please read the following terms and conditions carefully before using this software. Use of this software indicates you accept the terms of this license agreement and warranty.....1. Disclaimer of Warranty....TeraCopy (this software) is provided "as-is" and without warranty of any kind, express, implied or otherwise, including without limitation, any warranty of merchantability or fitness for a particular purpose. ....In no event shall the author of this software be held liable for data loss, damages, loss of profits or any other kind of loss while using or misusing this software.....2. License....TeraCopy is provided as FREEWARE for private (non-commercial) or educational (including non-profit organization) use. In these cases, you are granted the right to use and to make an unlimited number of copies of this software.....Should TeraCopy be used for commercial purposes, the user is required to purchase a license code. It is an important source of support in the development of future v

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Portable.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.2499567048116305
Encrypted:	false
SSDEEP:
MD5:	7D6446E2EE411F4C3FDD42E5E9F35E05
SHA1:	9E022E3FA52BFE456AD6F7D2FD3AA25130E5E235
SHA-256:	877336267C4FC71A5C8B202B629875FDB492DE485B263B1CD5D862A7BD87AAB5
SHA-512:	838919B0481D888A45EBE112398624EDE7BC001D7BFA100F6E5B1E51022F0E00E881F188F5ED941F91CBFF212D8041454186D2E90D8326B9FB630E72A41A5FFD
Malicious:	false
Reputation:	unknown
Preview:	Rename this file to 'Portable' (remove .txt) to keep settings in this folder...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1869544
Entropy (8bit):	5.946439284223796
Encrypted:	false
SSDEEP:
MD5:	3DD02D5A01043942218AA58F655F3AF5
SHA1:	8BBF0A8ADA30812110580DED53F65741A222B29C
SHA-256:	6005273FECD0104B9798E834C33C3F6D23E1E5FCC7D2A4DAFC493CBC49BD84AF
SHA-512:	EB8C8C044ADEC6A62A02D42ECD7D4B915A88F327D212E9AFE6D29CF0C41731AC9117E2C7892EA7F893EF7D2BA4E987D8B150A32AC67767C71BBB85BF3133F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d...=.Qe.........." ................0.........@.....................................^n....`.......................... ............... ..........................@d...Z...,...@...?..................................................X...........J....................text............................... ..`.data....K.......L..................@....bss......... ...........................idata..............................@....didata.J............ ..............@....edata....... .......(..............@..@.rdata..E....0.......*..............@..@.reloc...?...@...@...,..............@..B.pdata..@d.......f...l..............@..@.rsrc...............................@..@.....................Z..............@..@........................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4825824
Entropy (8bit):	7.466669442254551
Encrypted:	false
SSDEEP:
MD5:	0599E55C4EB4729FA508E2A1EF36BA2A
SHA1:	12635B1CCBEC25C75D858C1729240E1CEF8F60BF
SHA-256:	4F4E3C5D265C7350D56638BE72413E62A0D48A94411DA68836DD630E1E61391C
SHA-512:	0078AEFFB216A26737271EED570917D01F1EA437CBB27872EF9F633CC5CBB03C4022349547B4190C106001DB5C79320970749B67F54154CA593C42F595C30537
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ....j.d.....F..PF...X..q..g.$.%.Y?h...{.b.b....s\|.............Q..=r.%...BD..c.%m.............................................................................................................................................................................PE..d....]le..........".....L.k...)...............@......................................J...`..........@............... ..............h...t.......h.....{..............vI..,.....................................(...........................................................\.h......................... ..`.........$....h.....................@.................s.................................v]....v.....................@................@w.....................@...........q....`w.....................@..@.............pw.................................m.....w.....................@..@.reloc........w.....................@..B.rsrc.........{.....................@..@.........J.......L..................`...........................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.msi

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C56D35C2-CC91-4532-A3CB-D382D42AD5C2}, Number of Words: 0, Subject: TeraCopy, Author: Code Sector, Name of Creating Application: TeraCopy, Template: ;1033, Comments: This installer database contains the logic and data required to install TeraCopy., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Dec 3 11:04:55 2023, Last Saved Time/Date: Sun Dec 3 11:04:55 2023, Last Printed: Sun Dec 3 11:04:55 2023, Number of Pages: 450
Category:	dropped
Size (bytes):	5838848
Entropy (8bit):	6.2900649822101204
Encrypted:	false
SSDEEP:
MD5:	9FC34C508EDAD437F2078FADFD430C8A
SHA1:	4BDD6AAABEDEA1CB20D0F40DAB8E28DC9A235483
SHA-256:	5D471A6033421972F14E02A8FB76A3EC3EC93ED106B9EACAA2121CDE1E017676
SHA-512:	26795DA3406E6985ACC7C24BE44A2D631274185530C1814CDFC17D28C091B54464D309AB0F8B1A5813B580CED992D857336E5E3096BDC43F6A2CCABBB31B5BC3
Malicious:	false
Reputation:	unknown
Preview:	......................>...................Z...................................n...............................e...f...g................................................................... ...!.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...V.......................................................y&..z&..{&..\|&..}&......c)..d)..e)..f)..g)..h)..s,..........................................................................................................................D...............F............................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...C...8...9...:...;...<...=...>...?...@...A...B.......E...c...G...P...H...I...J...K...L...M...N...O...S...Q...R.......T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...m...d...e...f...g...h...i...j...k...l....(...(......p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {D2625015-F105-4D7F-9742-61C2BD0660E8}, Number of Words: 0, Subject: TeraCopy, Author: Code Sector, Name of Creating Application: TeraCopy, Template: x64;1033, Comments: This installer database contains the logic and data required to install TeraCopy., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Dec 3 11:04:56 2023, Last Saved Time/Date: Sun Dec 3 11:04:56 2023, Last Printed: Sun Dec 3 11:04:56 2023, Number of Pages: 450
Category:	dropped
Size (bytes):	5841408
Entropy (8bit):	6.2900441769357425
Encrypted:	false
SSDEEP:
MD5:	9529D790607ECA409B70C780F99E05A3
SHA1:	C1852C6D0CE7EE0B424890A3D7E9C6FF338FD459
SHA-256:	C8077AD69802259FCB291E528C9BE01ECED4E7302C1DBD337D53BB879B6E7B02
SHA-512:	AB9DEBB175C7635EC3BEB326C5A0F5486D7EFB029872D6DDEF4A64A9BA52CCE4F2934F54E8B3BAD6055D4277FCA551A844CD1019239BF25FC7B7F6FA1E6779F4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................Z...................................r...............................h...i...j....................................................... ...!..."...#...$....... ...!...".......................................................................M...N...O...P...Q...R...S...T...U...V...W...X...Y.......................................................\|&..}&..~&...&...&......i)..j)..k)..l)..m)..n)..x,..........................................................................................................................H...................J........................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...G...;...<...=...>...?...@...A...B...C...D...E...F.......I...g...K...T...L...M...N...O...P...Q...R...S...W...U...V.......X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...q...h...i...j...k...l...m...n...o...p....(...(......t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	317664
Entropy (8bit):	5.980055216713549
Encrypted:	false
SSDEEP:
MD5:	E90CB56D8C42B86E74CD1C87C4D9958E
SHA1:	7734817EC380B8D53714840D448A306065C8C973
SHA-256:	44F9500E24722730A9D2FA271051DE46BD1C0A5AA1971C5FC2A01942E348609A
SHA-512:	4D6C1E2EAF428527358EDEB5C8B60C92A58C25783B83D12AA11D8AE6511032071FA6E976A4149A3D444ACEA368056B79B97C8176DDF0D9849FAB9DBC5FE4DB84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d.....d.........."..................g........@......................................x....`..........@............... ............... ..x.......,................/.......,...P...+...........................@..(.......................H.......j....................text...p........................... ..`.data....g.......h..................@....bss....H....0...........................idata..,...........................@....didata.j............0..............@....edata..x.... .......4..............@..@.tls....$....0...........................rdata..m....@.......6..............@..@.reloc...+...P...,...8..............@..B.pdata.../.......0...d..............@..@.rsrc...............................@..@....................................@..@

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Total Commander.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.927728678926896
Encrypted:	false
SSDEEP:
MD5:	4952471CF7D4A5246883940D341805B8
SHA1:	E616B90AD7A7DAE80631E0D848085D9E1393C2C3
SHA-256:	4B6BBA5C3480144437670CD1E47B9AEDA31776474A841867004DCF48C77C2D95
SHA-512:	3B50D781F6A06F8E24C979ECAFFF6C628C84A25AAF4B5876EF928642DE08B47D333C302DC267411A60B9CC93EFFD394308BB09A8C18FB7BD0FE6BD42DE7BE613
Malicious:	false
Reputation:	unknown
Preview:	Drag TeraCopy.exe to the button bar in Total Commander, right click and select "Change..."....Copy the next line to Parameters field: ....Copy "%UL" "%T"....Next, copy path from 'Command' field to 'Icon file' field. Select icon #1.....Repeat the same for Move button, just use ....Move "%UL" "%T"....and select icon #2.....Note: %UL produces a UTF-8 Unicode list file, you can also use %WL (UTF-16).

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Whatsnew.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19505
Entropy (8bit):	4.885750246339191
Encrypted:	false
SSDEEP:
MD5:	265DB33349DA50400770FBD69704A7FD
SHA1:	29AA93A5C99B5F44D4B2BE291B096BF585472E24
SHA-256:	50B9F938FF6D5FE984D7B926498DF5852D4CDF68026181935E5226C8F0B6B0EE
SHA-512:	4035007DCF322655029395DF4EF765DFF7CFF0F5CDFD7290440F2613AA422947BD5F086616C0DC87BCA992005669734B09D9A0A0324326EEBE4C075FC8F39FB3
Malicious:	false
Reputation:	unknown
Preview:	TeraCopy Change Log....Version 3.17....- Clone & Rescan feature...- Enhanced xxHash support for SSE2 processors...- Upgraded reporting and checksum export features...- Implemented network recovery wait function during testing and verification...- Expanded maximum buffer capacity to 256 MB...- Resolved minor bugs and improved user interface design.....Version 3.12....- Async copy mode has been disabled due to RaiDrive incompatibility.....Version 3.10....- Added xxHash3 support (64/128-bit)...- Blake3 speed improved significantly...- Automatically check if the target FAT32 device has a 4 GB limit...- Limited service access to the user folder only...- Multiple bug fixes and UI improvements.....Version 3.9.7....- Added option to run PowerShell scripts on transfer completion:.. - Eject removable drives... - Send notifications via IFTTT...- Hash detected in Clipboard will be shown during testing...- Pressing Ctrl+Home will scroll the file list to the current file...- Fixed time estimation

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\XYplorer.txt

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	4.97319210070016
Encrypted:	false
SSDEEP:
MD5:	14994B64AF1F1C512E42CF227F936CEB
SHA1:	45348BBFB908BCED201575632493E0DC59FF2834
SHA-256:	1F4B20EC1AA01F7DCB26CF97AF275A26454FC34A517C25DD44793F138894A07C
SHA-512:	D11B6781ACAA7D9B722B3169985DBE0318E4F6477FECC14EE716B2F72078B93F9AEF0C81534A5262C4AD5D77CD0CDA1367C5DEBD985C5D8985A24B4A35446C75
Malicious:	false
Reputation:	unknown
Preview:	"Copy".. $list = eval('%appdata%')."\TeraCopy\FileList.dat"; .. $teracopy = '"C:\Program Files\TeraCopy\teracopy.exe"';.... if(getinfo("FocusedControl") == "T"){.. $items="<focitem>";.. $selitems=1.. } else {.. focus l;.. $items=getinfo("SelectedItemsPathNames"); .. $selitems=getinfo("CountSelected");.. } .... if($selitems<1){.. status "Nothing selected!",$color_e,alert; .. end 1;.. }.... $files = replace($items, "\|", "<crlf>");.. writefile($list, $files);.. .. $copycmd = $teracopy.' copy *"'.$list.'" "<get path i>"';.. open $copycmd,w;

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\share.html

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.024775453895666
Encrypted:	false
SSDEEP:
MD5:	35433F2FE5AD1DCE57646D1D66BFC2F5
SHA1:	E9D7BBF52369F8AFAF41FE8D1044A8E0F2BBB679
SHA-256:	5A723CFF0A7883595342272A28C57D0C67AF83ECC468DF9AD8ED1307D95E1D44
SHA-512:	33CAD676E3EA2AD6AA7B4039C4B2BF6D59D8F0B21EAEB2DD3151057385A71FA07BB50C4EB37EBC05FB118F5314F5DBA92DDBF3B02B59016EEBF8D5A2D0FD1A0D
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <title>Products - Code Sector</title>......</head>....<body>....<h1>Share TeraCopy</h1>....<div class="addthis_inline_share_toolbox"></div>....<div class="addthis_toolbox addthis_default_style addthis_32x32_style">.. <a class="addthis_button_preferred_1"></a>.. <a class="addthis_button_preferred_2"></a>.. <a class="addthis_button_preferred_3"></a>.. <a class="addthis_button_preferred_4"></a>.. <a class="addthis_button_compact"></a>..</div>....<script type="text/javascript">..var addthis_share =..{.. url : "http://teracopy.com";......}..</script>.... <script type="text/javascript" src="http://s7.addthis.com/js/300/addthis_widget.js#pubid=ra-5c8881288716c342"></script>......</body>....</html>

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\xxHashSSE2.dll

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	299744
Entropy (8bit):	6.1909968298841065
Encrypted:	false
SSDEEP:
MD5:	9A827C4F515DAC829A2FE23D15140660
SHA1:	AFEA4AA99F7704A8F98A056294FACFA80C2A8949
SHA-256:	409DB72C74AFFFEDB0BCCB8981756A71EACC430A02FD65D694E4F133477DE938
SHA-512:	2A9D08796ADACCA745F0244B9F36EC74A2C593B1ADEC9C9C31E8AFA5959ABAD2FE4DE9468BE1E2FDA9682E67BC44D330DFA23D6257877814E09F9E50F7FD3CFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......d.........." ................._........@...........................................`.......................... ..........................~....`.......0..`$...f...,......H!..................................................(...........`....................text...8........................... ..`.data....a.......b..................@....bss....................................idata..~...........................@....didata.`...........................@....edata..............................@..@.rdata..E...........................@..@.reloc..H!......."..................@..B.pdata..`$...0...&...*..............@..@.rsrc........`.......P..............@..@.....................f..............@..@........................................

C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\teracopy.exe
File Type:	data
Category:	dropped
Size (bytes):	19111918
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2CA47A2E74806C970EC62186CC206C2C
SHA1:	FD9E0B72F28142608A14D940CBCC38D311F2D2C9
SHA-256:	FD253B81CC9926CEEBEF055269D78D35A68C6C2C5BBBDA6FFCAF0657F407C8B5
SHA-512:	37FECE8ACCD263A9B8403706574E369069EAD4ADF32ED5AE76351704FBE5DD7589C87B4EF629DBF944835624E34BB97831BFEEDA825D9E2C5F323E4988CA18CA
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Obsidium x64\{3708183A-73D6E94B-A04B1AB3-BDD30077}.1894784316145562426

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	data
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.9916348537462545
Encrypted:	false
SSDEEP:
MD5:	E9079B8E01C9123E1F52F440C494A0DD
SHA1:	B772C19AEE3EC9839881EFA325D97BDA42BA9FC3
SHA-256:	F49CEC65C29BCC0EEB31D5CAF561CB133AB9AD5705A915112F69B0E1B92FE013
SHA-512:	F8291946A9C9DC16827C23B6FEE9E300A2F9C0580E8BE3329F8EE00E1770BE30FEAC240059AF4DDEA747B9D371215011F23A841CA3C8726A2EE36CA3DC30EEF9
Malicious:	false
Reputation:	unknown
Preview:	.....b8..\|...$j......~..?......mD8..P.w.z<.M.r._}..........0.........J..f..h.m.1..?....{%...........Z..@.V....$.v......{%..............k#..{...X.....{%..................l...:d....{%...............Y...^a#........{%...........q.5.....N.N.....{%..........&.O?.W.."cz.yS......{%............hM.N.....3.......{%...........,.+.....}.........{%..........D.>........h>.......{%..........a.....6"H.;rU.d.....{%..............y..$.....]SE....{%............c].6-...$........{%..........-L.=.,P5.'>..v.j....{%............d...:p).QV."M....{%..........Z......>...f.u_.....{%.............8)..D..+J...V....{%...............skE...4.......{%..........&)+..z%Hj9t..a#.....{%..........K..W...].4.J.?^.....{%..........p.9..&.o.H..x.......{%.............l~..or...r......{%..........IwX...OsC...s.C....{%..........'.K"8%.xn....j......{%..........mPT.m.xSsW....P....{%............68..n.0.m...st....{%...........=.....?..........{%..........)..T/9.....V.......{%............/S..j.h..R..n.....{%..........\t.l

C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3044002, writer version 2, read version 2, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.4400474284285706
Encrypted:	false
SSDEEP:
MD5:	D11C0CA1732476356E8BC78062DE2FED
SHA1:	82E3CACFD29A19C83140DB3C682C55B5D51765ED
SHA-256:	33A2E67A84406F94549B3195AF470DEA9D3E4BECB2EB520F0A6F499846C92194
SHA-512:	5E7945C62199FF8E5EBDE394A7C0FA65B574CCA8C6059352922693083A81F5AD4CA460C9AEB460E85867B3E7FDF3888FD38204A602C1974F475F73861D31E510
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................r.......N....N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-journal

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	1.062303656645155
Encrypted:	false
SSDEEP:
MD5:	8665C3C957F8177AB842D0DAD8B6EB0E
SHA1:	5A90A129240D7254D3EE1B449EE42C76E09463BA
SHA-256:	4687628A080CA9B59DB4BAC91C59307F38C6A74CF237B36E05749894F102D302
SHA-512:	153E84D3DA193D540B69D880B0CC8C476EF259898B7966492A627666B3BE5679A9C6DC8D563BEE3038590BA3651DB4DB861F308D3BC9FAA64F965316CCC59B98
Malicious:	false
Reputation:	unknown
Preview:	.... .c......?H.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................r.......N....N....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-shm

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03647612055610564
Encrypted:	false
SSDEEP:
MD5:	7C5F0EA6E531E5708A5D270AB85D80DA
SHA1:	E3FE3F771C36F9A46943E86917FC634CEA9C6D79
SHA-256:	81F84A3B984DB7245386D2D93E05932CE48F41A1B0F9C6149BBAC13A0D66D0B8
SHA-512:	9B1232EB1B0B1D76AA48E32F617D8973199B963C8CF856174A05B056C3CDA3F294230E4828DB0F70956AC3EA1359B2F6E5ACFB43D29B10FF535BB1506C45FDD5
Malicious:	false
Reputation:	unknown
Preview:	..-.....................d>=e....3..;gQ...N..Z6@1..-.....................d>=e....3..;gQ...N..Z6@1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-wal

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	0.3216029925069804
Encrypted:	false
SSDEEP:
MD5:	E22A1C7D46A0A26CC3266EE5F8D12EE2
SHA1:	BA68E01C238D0B59AC16CCFB856D6CCE3D213283
SHA-256:	F6E02FAA23D59A433999B4976865C215EA556481296CBE782BA30489DE54F08E
SHA-512:	6A8A1A1498FB076133C6E483BE71870D67F8F1C0DABF421AD3CCB0678F6CB12C9C4037429691B4B80153B6DF82C4544C26579360AFF9587338230128811B0BBB
Malicious:	false
Reputation:	unknown
Preview:	7....-..........3..;gQ.....F..+R........3..;gQ...=.)L..N................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeraCopy\PowerOff.cmd (copy)

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F95082B2D55F940FFD919C87C3432C38
SHA1:	1ADACA6FC0A241AA405C67EEAC4513AB204E98DE
SHA-256:	50C0BC8A1097A40A940133FDA83E77D109E1C30FE385E142C646CCFAEC9BD4BD
SHA-512:	BFF12129C00419A030E1379CA2497B725FEB78F6DFF6EF7A801AF887C405871932310BD62C7F02E2355FAF50B83924FB4AA3E3E1027A69E5835F851033B95089
Malicious:	false
Reputation:	unknown
Preview:	@ECHO OFF..ECHO System will be turned off automatically in 5 minutes. Press N to cancel...ECHO...CHOICE /M "Shutdown" /C YN /T 300 /D Y..IF ERRORLEVEL 1 IF NOT ERRORLEVEL 2 SHUTDOWN -s -t 60..IF ERRORLEVEL 2 ECHO Shutdown cancelled....REM Wait 2 sec..CHOICE /C AB /T 2 /D A > NUL

C:\Users\user\AppData\Roaming\TeraCopy\main.db

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.5284548883794503
Encrypted:	false
SSDEEP:
MD5:	784371DB5B4557F2BD19E2A16A95EB9D
SHA1:	026F2B6D3D9B884518B480585A24C4DA7770A440
SHA-256:	68725F46F1CBD560B59ABD6B0F4AC69CA88EDD574DF54ECF0913FA571E17E4BC
SHA-512:	5327FBC5E8F068ED0B92A0535D61E434A4C12E6F37873FD1F10D50151CC9DDABD73067C052FC7AD64D28A81350BE8338E55779ED7C38C4617F5B2866A48A794E
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeraCopy\main.db-journal

Download File

Process:	C:\Program Files\TeraCopy\TeraCopy.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.4824046121686224
Encrypted:	false
SSDEEP:
MD5:	1E791F31B3533E5A362FA2E16A1C2046
SHA1:	8513B5587125BAD616D83C353AC11FD0EF53E558
SHA-256:	4DA6FD8E9FD841EEDC948CA911951C6BCA34D38DCFB4A1E1A661F0CD4AFCEE07
SHA-512:	D99EA13CEB5ACC6FCD7E094E3E5026F8DFB897273F9BE77682C4DD6534C207D841C7F570CC2AAB7CE573D6B2066F3DA9CF041B2C611D7CCB64678D631234FDCD
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....5vu.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8C4D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	858464
Entropy (8bit):	6.582068652578541
Encrypted:	false
SSDEEP:
MD5:	4A3F6A4023ABD6BBA56534DE47D20017
SHA1:	02DD888E467143E2E35465D73F39CF3E66AFAD10
SHA-256:	A8DFDC283AD8D4DC6F500DDFAB564E79DADAE075C0D54784B50E1CA548709B30
SHA-512:	580C7918EF90EB0020901BAB645B72BCAF945CEB5BD56C2E7847F229B31A961BC4CD4CA9CB2583DB480947CA8A0880B5AE4BD26717217ABCACC9754352AABA28
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Yc&.8.u.8.u.8.u^J.t.8.u^J.t!8.u.G.t.8.u.G.t.8.u^J.t.8.u.G.t.8.u^J.t.8.u^J.t.8.u.8.u.9.u...t.8.u...t.8.u...u.8.u.8.u.8.u...t.8.uRich.8.u................PE..L.....Te.........."!...%.<..........G........P............................... ......".....@..........................E.......F..........h...............`=.......r..0+..p....................+.......5..@............P.......B..@....................text...\:.......<.................. ..`.rdata..l....P.......@..............@..@.data...((...`.......L..............@....rsrc...h............b..............@..@.reloc...r.......t...h..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9C7C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2124042
Entropy (8bit):	6.507534058087644
Encrypted:	false
SSDEEP:
MD5:	E0784E5953A40E54F10132E912406D7E
SHA1:	A6B6B6001185B0FE07D5CB85A14A32E89375F584
SHA-256:	3724D9782520A0C7E721488C9D292E8B556E0A4833A1AD3115B4936178E117AF
SHA-512:	B0447432EEE1011F8FA9166BFF566A981FF0E9FEB38D6FB4B3EB823DAF1A2DC23BA7084E955BAACFB4834AE1DC9332B683FEBC07F4E9DFA83A4F9C93C3EC33AE
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.CY.@.....@.....@.....@.....@.....@......&.{DF5325DF-1F43-4282-85D5-1CA3353E6B13}..TeraCopy..TeraCopy.x64.msi.@.....@.....@.....@......TeraCopySmall.exe..&.{D2625015-F105-4D7F-9742-61C2BD0660E8}.....@.....@.....@.....@.......@.....@.....@.......@......TeraCopy......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_AiBackupRollbackImpersonate..Rollback backup..Path: [1]J...AI_AiBackupRollbackImpersonate.@.%....`...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.e3..63..63..6...78..6...7...6&..7"..6&..7$..6&..7o..6...7$..6...7 ..63..6...6.$.7g..6.$.72..6.$)62..63.A62..6.$.72..6Rich3..6................PE..L.....Te.........."!...%.p...j.......J..............................................MJ....@..........................5......t9..........................`=.......l...2..p....................2.......e..@....................4..@.........

C:\Windows\Installer\MSIABB0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1709413
Entropy (8bit):	6.640064596845264
Encrypted:	false
SSDEEP:
MD5:	5323E17228F82247A8BDFF9FEA9D5708
SHA1:	D31B98FB356821EE84652918FA74B2F1572ABFE1
SHA-256:	01EBB0F15B5901146CC8B6C096C80F2501EC69A5164CC914F5E157B7647BEAC4
SHA-512:	828A1DC5B3896BB0C5648E1C7EA8E03068305C03729A0843E26103A51C64559C321D385C188A68FC54AB428E711F71A526AD354AF9EA06E28F635B924E026523
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.CY.@.....@.....@.....@.....@.....@......&.{DF5325DF-1F43-4282-85D5-1CA3353E6B13}..TeraCopy..TeraCopy.x64.msi.@.....@.....@.....@......TeraCopySmall.exe..&.{D2625015-F105-4D7F-9742-61C2BD0660E8}.....@.....@.....@.....@.......@.....@.....@.......@......TeraCopy......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_AiRestoreDeferredImpersonate..Executing restore operation..Path: [1]J...AI_AiRestoreDeferredImpersonate.@.$....`...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.e3..63..63..6...78..6...7...6&..7"..6&..7$..6&..7o..6...7$..6...7 ..63..6...6.$.7g..6.$.72..6.$)62..63.A62..6.$.72..6Rich3..6................PE..L.....Te.........."!...%.p...j.......J..............................................MJ....@..........................5......t9..........................`=.......l...2..p....................2.......e..@...................

C:\Windows\Installer\MSIAC6C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	854368
Entropy (8bit):	6.6398518527554735
Encrypted:	false
SSDEEP:
MD5:	065FAB0D856B9896887392A021578E0B
SHA1:	11087B4DBBC6855C245C9E686CEFC96D581A578F
SHA-256:	A9A34D9C6CC14ED252CF0A07896F266187D57B4635C31A89779DAC5843F17411
SHA-512:	19F23C2A9F2BBF6D9F05F29548740A5BA495CE340A1166549AB1ADCCCC5D582C9C5B6040F9514F03875894D25AAB73A8F217D39E0AD36C0BC0F01AE988EFF98C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.e3..63..63..6...78..6...7...6&..7"..6&..7$..6&..7o..6...7$..6...7 ..63..6...6.$.7g..6.$.72..6.$)62..63.A62..6.$.72..6Rich3..6................PE..L.....Te.........."!...%.p...j.......J..............................................MJ....@..........................5......t9..........................`=.......l...2..p....................2.......e..@....................4..@....................text...(o.......p.................. ..`.rdata...............t..............@..@.data...$(...P.......@..............@....rsrc................X..............@..@.reloc...l.......n...^..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{DF5325DF-1F43-4282-85D5-1CA3353E6B13}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.389723561558948
Encrypted:	false
SSDEEP:
MD5:	08317C5F1EEF597C3A78798A57DB1C01
SHA1:	F02DFE68B3777AEFCD66CF7510E367F2E118C381
SHA-256:	6D2F54A0CFD2A687D640F34DA60450615F5B38B35476DFBBF7076EAE6045348C
SHA-512:	6F0207FF22011D3B3A10091718E23F1DAC4E7F28DD97C58538B4D22BE89434D7E9B5293603EACE491AF311BB7779347BDD7A5D00E55E226A25FF7B794D34329D
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8311191050205071
Encrypted:	false
SSDEEP:
MD5:	96329177FDF4DC3B97D856AB82C7148B
SHA1:	663C9806DAC8B0C7CBAAD0BDF192C70F30610A45
SHA-256:	90A3E6CF5628077035A6035F9DA3EA2361DEC31E72CE488825F44E4711F9D11A
SHA-512:	70259FBE5B59C0CE3ACD1A6DAE2953385B869251766DA2EAF0C5EA2AE04CA5BD9AA3BC7F9E435DEDC463B30679781EA693B46BD246D58E224777710A14D50FD1
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\TeraCopySmall.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	22382
Entropy (8bit):	5.51651585000608
Encrypted:	false
SSDEEP:
MD5:	7698A4D82EC091355F18365E5AAF01B0
SHA1:	1F072A459E79C547A7CAE28EE297F174B0DE0578
SHA-256:	3DCA645264F8906BD2A2546FFF401AD5C74CD415364BB239B80F5225F0FE75CF
SHA-512:	45FE3EBCA3EEF00D647D08F4B1F2B355ACB49DEEBF58FDCE61B274E07821CFA17760F9140B20A6F84F123E1534DC554A26F198D5DD5AFF14D2A8D168580C986A
Malicious:	false
Reputation:	unknown
Preview:	......@@.... .(B..6... .... .....^B........ .h....S..(...@......... ......B..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................FFJA]]]bVVVgjjl.nnq.ppq.iil.VVVg]]`b(((3........................................................................................................................................................................................................RRVSmmo....................................

C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\ext.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	360414
Entropy (8bit):	5.130071348708676
Encrypted:	false
SSDEEP:
MD5:	3202AC23C823AC94BC539C6275495EA7
SHA1:	87A9140DFBAE09E26596D8EDD4BA53B9CF8739F9
SHA-256:	6DCBC5AD556363A6175C92131B6B8EF12433D078AD22AF3C0FD4BFDA0C85E0AE
SHA-512:	F29F66A2541238E856D77BAC89AFC3DD6F3F625C76AA4CA49A12CC20DCEF42264AA3FEF594FF1816C2A7C3F32082CF9AE191F90406C54E031F43234D842B8CBA
Malicious:	false
Reputation:	unknown
Preview:	............ .( ..V......... .(...~ ..@@.... .(B...(.. .... ......j........ .h...v{..(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356165555073333
Encrypted:	false
SSDEEP:
MD5:	5E5DB5231723E0608DD8FF0970A7624F
SHA1:	82B50D20BE9638A08443028C3D4FB8A08D3DFD45
SHA-256:	4D625F21C466AD889385AF8B36FCED91805DB113E89140C600A0CF6EB9A174A4
SHA-512:	A38065EB612D3E96FAE63E78E4B369CC1153E400608E055B7162A09321A0F937AE5AE637ABC9BC112921F8CAE6FE16FE92493025A93250D1DA5B4C6DD10E0B7C
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2473301369046137
Encrypted:	false
SSDEEP:
MD5:	B41DF119D8683CB253262D1098C9BE09
SHA1:	0B44EAA8DC78D52B1C1E4179456AE0B3C431EBE1
SHA-256:	4E1A06D8097A33CBA79F95382AEC80E230CFF4CF03C678B5BCDA4D43849D00DE
SHA-512:	9CDE8D35C8532DEDE7F009226A3DD6788A9100C8FEA1BE9FC987EAD888DCF0482C9F7FE1F9C290AAF45FDF39960CDFC34BB34D959A3510E72977F8026A0EBE73
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Temp\~DF4151D848D35753D6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	2.2145291689138396
Encrypted:	false
SSDEEP:
MD5:	1DC20990DDD400F7C8B5F158C8CB669C
SHA1:	EB7D3D56BD8ED58728C04F15E44F4171E9C89EA3
SHA-256:	E505ABF11C400B614FC7FD2573329C2AF0DE4432F289E98734753647BA4F0762
SHA-512:	1A433C8A6EE7990B0072DC19ED7D9189997804D60580654ADCF19E320074DEE229C95267BFE36F5CFFC648B67691563D98875F9F5BAB2CB831C32CCEB1678052
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4EED7D5946988D2D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6D6C8C3E43CCAF73.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4464214144982606
Encrypted:	false
SSDEEP:
MD5:	BB3AF0B687603CFFA46F293CFBA09603
SHA1:	43DD3F223617DB1D23E46ADB2E20FF4B6DBF9D5E
SHA-256:	0DE2EC4C2E4671F3D6ED0EF75FDA4C74163924587594C487352CAC8706225E37
SHA-512:	BF7E85E979A547896257B7E2C5DF805AA6B3C44071AAECBB49A95E6B6EA934F3E7DD7A96023F010C92977DEBCB96B38707926F1B3F4F5E60D844E5B86479C512
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7557BAFF32C28170.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.23762485740465858
Encrypted:	false
SSDEEP:
MD5:	17CAF12375FA158F47C2861802E3A5F4
SHA1:	575CD80F68B66ADD96387F6465E5F13542C7BF4B
SHA-256:	F6C6EA2575E9F33926F4BBBAEC3A0373BEA49AEBC5D234BC7C74E30C337F2179
SHA-512:	A478DB108E0EC6D7C243ED0AD38DE1C28E76ACD9673235AD8EACDBE62D8127BCDAC906CFAC85CB0373077F5C4E9ED9D9A61C7260C8C80205360B2EED36072B4A
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.764291052511955
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	teracopy.exe
File size:	12'403'216 bytes
MD5:	d704e453e065a23ed414927d9b203086
SHA1:	352e4b98faebc35f5c8cfeaebb7bcb36d7c7fbfc
SHA256:	ac03db52bb68a013d3a8bf4db703ec11976fa1d0aa557eb988e3f926a26656cf
SHA512:	0ec2c8cd14a7f4dfd704b19729239ee78e54fc1fb87ba1a2a80da4b7d595fd573861271ca220c3a7b264209ceed1ca96da12d6bdf2b34c35771790cd6337cf49
SSDEEP:	196608:AAKBx4px+sN23RSEfvYfXf1v3j+FX3/yXg3Kf5T72gFUbUamFbSf4k5EBGUQ:AAK/4px/23bfvYvf1bI/8RfVGwdFbSfD
TLSH:	1CC6F131724AC43FDA6255B0192C8E9A512C7E750BB264CBB7CC2E3E5BB45C21736E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E...........................................................l...................................8=......8=@.......(.....8=.....

File Icon


Icon Hash:	07054753462c599f

Static PE Info

General

Entrypoint:	0x5f0aa6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6554C88C [Wed Nov 15 13:33:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d79dd35f147f0bd91cc18a6615fcfa5d

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	17/11/2023 01:00:00 17/11/2026 00:59:59
Subject Chain	CN=CODE SECTOR PTY LTD, O=CODE SECTOR PTY LTD, S=Queensland, C=AU
Version:	3
Thumbprint MD5:	29A72BECE9B91DD9E2940E7A34396C39
Thumbprint SHA-1:	1A003AEA4859D0FFCFBFACA791B91D9071F06F23
Thumbprint SHA-256:	D916652E5A8AF0C85BA3E7A4548C68B14E19A9AD6EA7D5DAFDD6DA0DBCF04428
Serial:	00C6D67F2FDCEB01655D2183F049CAF6E8

Entrypoint Preview

Instruction
call 00007FBBE48187C9h
jmp 00007FBBE4817FFFh
push ebp
mov ebp, esp
and dword ptr [0072E2ECh], 00000000h
sub esp, 24h
or dword ptr [0072A020h], 01h
push 0000000Ah
call dword ptr [0067D268h]
test eax, eax
je 00007FBBE4818332h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007FBBE48181C5h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007FBBE48181A5h
cmp eax, 00020660h
je 00007FBBE481819Eh
cmp eax, 00020670h
je 00007FBBE4818197h
cmp eax, 00030650h
je 00007FBBE4818190h
cmp eax, 00030660h
je 00007FBBE4818189h
cmp eax, 00030670h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x328488	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x338000	0x3d4b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xbd1530	0x2ce0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x376000	0x293e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ca3c0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2ca440	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29bdd0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x27d000	0x320	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x32590c	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27bb46	0x27bc00	1db02e52f878f2dd7f2f91c78a03ae87	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x27d000	0xac6e2	0xac800	e7fed990d2510dbb5bcfabd2fcdef376	False	0.3263063292572464	data	5.065809708093856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32a000	0xd2c0	0x3c00	e97d850f16b7e2d1b0922ce342cb8d72	False	0.26588541666666665	data	4.762511365050742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x338000	0x3d4b8	0x3d600	6aebf13ef39771e535ca06b13ff26427	False	0.1949266484215886	data	5.615920564170885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x376000	0x293e0	0x29400	ecbac196b72514e8cf770d87286a47ff	False	0.4415897253787879	data	6.515820895329522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3388e0	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x338a20	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x339248	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x33daf0	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x33e55c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x33e6b0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x33eed8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.29380101739027564
RT_ICON	0x34f700	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.420583372697213
RT_ICON	0x353928	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.598264540337711
RT_ICON	0x3549d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5913120567375887
RT_ICON	0x354e38	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3262411347517731
RT_DIALOG	0x3552a0	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x35534c	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x355418	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x3555cc	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x355704	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x355750	0x234	data	English	United States	0.4645390070921986
RT_STRING	0x355984	0x182	data	English	United States	0.5103626943005182
RT_STRING	0x355b08	0x50	data	English	United States	0.7375
RT_STRING	0x355b58	0x9a	data	English	United States	0.37662337662337664
RT_STRING	0x355bf4	0x2f6	data	English	United States	0.449868073878628
RT_STRING	0x355eec	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x3564ac	0x434	data	English	United States	0.32899628252788105
RT_STRING	0x3568e0	0x100	data	English	United States	0.5703125
RT_STRING	0x3569e0	0x484	data	English	United States	0.39186851211072665
RT_STRING	0x356e64	0x1ea	data	English	United States	0.44081632653061226
RT_STRING	0x357050	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x3571dc	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x3573f4	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x357a18	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x358078	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x35835c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x35839c	0x2e0	data	English	United States	0.4633152173913043
RT_HTML	0x35867c	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x35beb4	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x35d1cc	0x8c77	HTML document, ASCII text, with CRLF line terminators	English	United States	0.08081426068578103
RT_HTML	0x365e44	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x36c914	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x36cfb8	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x36e004	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x36f5b8	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x371614	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x374ca4	0x813	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41025641025641024

Imports

DLL

Import

KERNEL32.dll

WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, CreateProcessW, GetLastError, GetExitCodeProcess, SetEvent, RemoveDirectoryW, GetProcAddress, GetModuleHandleW, GetWindowsDirectoryW, CreateDirectoryW, GetTempPathW, GetTempFileNameW, MoveFileW, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, GetFinalPathNameByHandleW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SetFileTime, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, GetVersionExW, CreateSemaphoreW, ReleaseSemaphore, GlobalMemoryStatus, GetModuleHandleA, GetProcessAffinityMask, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, LocalFree, LocalAlloc, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, CloseHandle, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW, FlushFileBuffers, CreateFileW

imagehlp.dll

SymGetModuleBase, SymFunctionTableAccess, SymGetLineFromAddr, SymSetSearchPath, SymCleanup, SymInitialize, SymSetOptions, StackWalk

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report teracopy.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

C:\Config.Msi\4a89ab.rbs

C:\Config.Msi\4a89ad.rbs

C:\Program Files\TeraCopy\App\DefaultData\PowerOff.cmd

C:\Program Files\TeraCopy\App\Locale\af\default.po

C:\Program Files\TeraCopy\App\Locale\ar\default.mo

C:\Program Files\TeraCopy\App\Locale\bg\default.mo

C:\Program Files\TeraCopy\App\Locale\ca\default.mo

C:\Program Files\TeraCopy\App\Locale\cs\default.po

C:\Program Files\TeraCopy\App\Locale\da\default.mo

C:\Program Files\TeraCopy\App\Locale\de\default.mo

C:\Program Files\TeraCopy\App\Locale\el\default.mo

C:\Program Files\TeraCopy\App\Locale\es-ES\default.mo

C:\Program Files\TeraCopy\App\Locale\es-ES\default.po

C:\Program Files\TeraCopy\App\Locale\es-MX\default.mo

C:\Program Files\TeraCopy\App\Locale\es-MX\default.po

C:\Program Files\TeraCopy\App\Locale\et\default.po

C:\Program Files\TeraCopy\App\Locale\he\default.mo

C:\Program Files\TeraCopy\App\Locale\he\default.po

C:\Program Files\TeraCopy\App\Locale\hr\default.po

C:\Program Files\TeraCopy\App\Locale\id\default.mo

C:\Program Files\TeraCopy\App\Locale\it\default.po

C:\Program Files\TeraCopy\App\Locale\ja\default.po

C:\Program Files\TeraCopy\App\Locale\ko\default.po

C:\Program Files\TeraCopy\App\Locale\lt\default.mo

C:\Program Files\TeraCopy\App\Locale\lt\default.po

C:\Program Files\TeraCopy\App\Locale\no\default.mo

C:\Program Files\TeraCopy\App\Locale\pt-BR\default.po

Windows Analysis Report
teracopy.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre