Edit tour

Windows Analysis Report
Xming-6-9-0-31-setup.exe

Overview

General Information

Sample name:	Xming-6-9-0-31-setup.exe
Analysis ID:	1545727
MD5:	4cd12b9bec0ae19b95584650bbaf534a
SHA1:	8e232d39e7c319ef299364c04b89bd4af1baca0a
SHA256:	9fe52242d63d90c5bf4859b9de46f516c54b80bf8e94939a4986667acf6c5024
Infos:

Detection

Score:	16
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Contains functionality to register a low level keyboard hook

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Xming-6-9-0-31-setup.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe" MD5: 4CD12B9BEC0AE19B95584650BBAF534A)

is-L00DR.tmp (PID: 6728 cmdline: "C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp" /SL4 $2043A "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe" 1923415 73728 MD5: A52A2BC95FC835F16506C0041211B8B7)

Xming.exe (PID: 1532 cmdline: "C:\Program Files (x86)\Xming\Xming.exe" :0 -clipboard -multiwindow MD5: 2118E06C1667CDEF92CB5977D9CC8534)

xkbcomp.exe (PID: 6044 cmdline: "C:\Program Files (x86)\Xming\xkbcomp" -w 1 "-RC:\Program Files (x86)\Xming\xkb" -xkm "C:\Users\user\AppData\Local\Temp\xkb_a01396" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\server-0.xkm" MD5: 57A69BF8F353DCF8FE1B0DCE5A77D15E)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Xming-6-9-0-31-setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0046E2D4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046E2D4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047694C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047694C
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00450EA4 FindFirstFileA,GetLastError,	1_2_00450EA4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045E738 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E738
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00474BD0 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474BD0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045EBB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045EBB4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045D1B4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045D1B4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0048D260 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0048D260
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_004154BC strchr,strchr,strchr,strchr,strchr,FindFirstFileA,sprintf,_stat,FindNextFileA,	6_2_004154BC

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_0042BCE4 recv,WSAGetLastError,_errno,

5_2_0042BCE4

Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-MNUTI.tmp.1.dr	String found in binary or memory: http://bugs.freedesktop.org/show_bug.cgi?id=1896
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://ekushey.org/projects/shadhinota/index.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-SHM8D.tmp.1.dr	String found in binary or memory: http://en.tldp.org/HOWTO/Francophones-HOWTO.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-CA42C.tmp.1.dr	String found in binary or memory: http://ferheng.org
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-SHM8D.tmp.1.dr	String found in binary or memory: http://gpl.insa-lyon.fr/Dvorak-Fr/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-FTQ4P.tmp.1.dr	String found in binary or memory: http://hal.csd.auth.gr/~vvas/i18n/xkb/polytonic-compose.pl
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	String found in binary or memory: http://linux.dd.com.au/quest/linux/keyboard/honeywell/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	String found in binary or memory: http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, Xming.exe, 00000005.00000002.3281575531.00000000001B4000.00000004.00000020.00020000.00000000.sdmp, is-SB758.tmp.1.dr, Xming.0.log.5.dr	String found in binary or memory: http://sourceforge.net/forum/?group_id=156984
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://sourceforge.net/forum/?group_id=156984Contact:
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	String found in binary or memory: http://sourceforge.net/projects/omke
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-JLGR6.tmp.1.dr	String found in binary or memory: http://srpski.org/dunav/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HFSN4.tmp.1.dr	String found in binary or memory: http://sun3.mif.vu.lt/cs/TK4/lithkeyb.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-0BT9P.tmp.1.dr	String found in binary or memory: http://www-lehre.informatik.uni-osnabrueck.de/~rfreund/dvorak.php
Source: is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/Xming
Source: is-L00DR.tmp, 00000001.00000003.2269159023.000000000065D000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2271155295.000000000065D000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2270129401.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingFs
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes$
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes)
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes)http://www.StraightRunning.com/XmingNotes$http://www.Strai
Source: is-L00DR.tmp, 00000001.00000002.2270319193.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2268357326.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, xkbcomp.exe, 00000006.00000000.2271019480.00000000004C8000.00000008.00000001.01000000.0000000D.sdmp, xkbcomp.exe, 00000006.00000002.2272807297.00000000004C9000.00000008.00000001.01000000.0000000D.sdmp, is-7UVK4.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/2
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267978246.0000000000616000.00000008.00000001.01000000.00000009.sdmp, Xming.exe, 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr, is-67AQV.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/6
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000002.3283393897.000000006CB9C000.00000008.00000001.01000000.0000000A.sdmp, is-3RNSV.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/R
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000002.3283212527.000000006248B000.00000008.00000001.01000000.0000000B.sdmp, is-N9TOO.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/d&
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/fonts.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/fonts.phpopenwinAboutDlgProc
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/index.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/index.phpwinAboutDlgProc
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/release.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.StraightRunning.com/XmingNotes/release.phpwinAboutDlgProc
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes6
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotes:
Source: is-L00DR.tmp, 00000001.00000003.2269620225.0000000000619000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2270989958.0000000000619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.StraightRunning.com/XmingNotesxe
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-AT2SM.tmp.1.dr	String found in binary or memory: http://www.afghanischerKulturverein.de/en/afghanComputer_en.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-710K5.tmp.1.dr	String found in binary or memory: http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://www.bhashaindia.com/MSProducts/XpSp2/Articles/IndicLanguageStandards.aspx
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-2ALQC.tmp.1.dr, is-SSBJH.tmp.1.dr	String found in binary or memory: http://www.conectiva.com.br)
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-AT2SM.tmp.1.dr	String found in binary or memory: http://www.evertype.com/standards/af/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-V1AR6.tmp.1.dr	String found in binary or memory: http://www.gakartuleba.org/layouts/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-0BT9P.tmp.1.dr	String found in binary or memory: http://www.goebel-consult.de/de-ergo/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-PMQOI.tmp.1.dr	String found in binary or memory: http://www.hum.uit.no/a/trond/se-lat9-no-keys.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-DD00D.tmp.1.dr, is-NVB42.tmp.1.dr	String found in binary or memory: http://www.hum.uit.no/a/trond/se-lat9-sefi-keys.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://www.indlinux.org/keymap/telugu.php
Source: is-L00DR.tmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	String found in binary or memory: http://www.ircam.ma/
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	String found in binary or memory: http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HFSN4.tmp.1.dr	String found in binary or memory: http://www.kada.lt/litwin/Kbdlta.gif
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-FC4J3.tmp.1.dr	String found in binary or memory: http://www.language-keyboard.com/languages/catalan_layout.htm
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HAJF5.tmp.1.dr	String found in binary or memory: http://www.linux-france.org/macintosh/clavier_gentoo.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-RK5SM.tmp.1.dr	String found in binary or memory: http://www.nida.gov.kh
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-RUP5B.tmp.1.dr	String found in binary or memory: http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-CA42C.tmp.1.dr	String found in binary or memory: http://www.pckurd.net
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-N2A44.tmp.1.dr	String found in binary or memory: http://www.qamus.org/transliteration.htm
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/?ps
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/?psU
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-IO1NN.tmp.1.dr	String found in binary or memory: http://www.sbl-site.org/Resources/Resources_BiblicalFonts.aspx.
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-IA46D.tmp.1.dr	String found in binary or memory: http://www.sci.kz/~sairan/keyboard/kzkbd.html
Source: is-UTJTO.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/trouble.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/trouble.phpwinAboutDlgProc
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/xming.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/xming.phpwinAboutDlgProc
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/xmingrc.php
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotes/xmingrc.phpwinAboutDlgProc
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-67AQV.tmp.1.dr	String found in binary or memory: http://www.straightrunning.com/XmingNotesOLE
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://www.tamilnet99.org)
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	String found in binary or memory: http://www.tscii.org)
Source: is-E9LTG.tmp.1.dr	String found in binary or memory: http://www.unicode.org)
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-DP3US.tmp.1.dr	String found in binary or memory: http://www.uznet.net/index.php?option=com_content&task=view&id=288&Itemid=58
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E2JM7.tmp.1.dr	String found in binary or memory: http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-PMQOI.tmp.1.dr	String found in binary or memory: https://bugs.freedesktop.org/show_bug.cgi?id=4397
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	String found in binary or memory: https://bugs.freedesktop.org/show_bug.cgi?id=7095
Source: is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-N5VAG.tmp.1.dr	String found in binary or memory: https://bugs.freedesktop.org/show_bug.cgi?id=9541

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_0043407B SetWindowsHookExA 0000000D,Function_00033FB0,00000000

5_2_0043407B

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_00445260 IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,GetClipboardData,GetLastError,GlobalLock,WideCharToMultiByte,malloc,WideCharToMultiByte,_strdup,free,GlobalUnlock,free,GlobalUnlock,CloseClipboard,malloc,strcat,malloc,malloc,MultiByteToWideChar,malloc,MultiByteToWideChar,GlobalAlloc,_strdup,GlobalAlloc,GetLastError,GlobalLock,memcpy,free,strcpy,free,GlobalUnlock,SetClipboardData,free,free,SetClipboardData,SetClipboardData,

5_2_00445260

Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00445260 IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,GetClipboardData,GetLastError,GlobalLock,WideCharToMultiByte,malloc,WideCharToMultiByte,_strdup,free,GlobalUnlock,free,GlobalUnlock,CloseClipboard,malloc,strcat,malloc,malloc,MultiByteToWideChar,malloc,MultiByteToWideChar,GlobalAlloc,_strdup,GlobalAlloc,GetLastError,GlobalLock,memcpy,free,strcpy,free,GlobalUnlock,SetClipboardData,free,free,SetClipboardData,SetClipboardData,	5_2_00445260
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0043605A GetClipboardOwner,OpenClipboard,EmptyClipboard,CloseClipboard,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,EmptyClipboard,GetLastError,SetClipboardData,SetClipboardData,CloseClipboard,GetLastError,	5_2_0043605A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00444B9A ChangeClipboardChain,PostQuitMessage,GetClipboardViewer,SetClipboardViewer,GetLastError,SendMessageA,GetClipboardViewer,ChangeClipboardChain,GetClipboardViewer,SetClipboardViewer,GetLastError,ChangeClipboardChain,GetClipboardOwner,IsClipboardFormatAvailable,IsClipboardFormatAvailable,SendMessageA,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,EmptyClipboard,GetLastError,SetClipboardData,SetClipboardData,PostMessageA,CloseClipboard,GetLastError,GetClipboardOwner,OpenClipboard,EmptyClipboard,SetClipboardData,SetClipboardData,CloseClipboard,	5_2_00444B9A

Source: C:\Program Files (x86)\Xming\Xming.exe

5_2_00445260

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_0043C5CC GetDC,CreateCompatibleDC,malloc,CreateDIBSection,GetObjectA,SelectObject,BitBlt,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,malloc,free,free,EnumThreadWindows,

5_2_0043C5CC

Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0043FCE0 GetPropA,RegisterWindowMessageA,SetPropA,ShowWindow,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDeviceCaps,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SetScrollInfo,SetScrollInfo,GetScrollInfo,GetScrollInfo,GetScrollInfo,SetScrollInfo,GetScrollInfo,GetScrollInfo,SetScrollInfo,GetScrollInfo,ScrollWindowEx,UpdateWindow,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,ShowCursor,GetTickCount,ShowCursor,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,KillTimer,GetCursorPos,GetSystemMetrics,GetSystemMetrics,GetTickCount,GetCursorPos,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,PostMessageA,PostMessageA,PostMessageA,GetKeyState,GetKeyState,GetKeyState,ShowWindow,SetActiveWindow,ShowWindow,ShowCursor,ShowCursor,ShowWindow,SetCursor,EnumThreadWindows,EnumThreadWindows,DefWindowProcA,	5_2_0043FCE0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042F64B strcpy,strcpy,GetKeyState,GetKeyState,GetKeyState,GetKeyState,	5_2_0042F64B
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042F629 GetTickCount,strcpy,strcpy,GetKeyState,GetKeyState,GetKeyState,GetKeyState,	5_2_0042F629
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00435945 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	5_2_00435945
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00435944 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	5_2_00435944

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00423B68 NtdllDefWindowProc_A,	1_2_00423B68
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004125BC NtdllDefWindowProc_A,	1_2_004125BC
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0042EBCC NtdllDefWindowProc_A,	1_2_0042EBCC
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00454CF8 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00454CF8
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00431AC0 memset,GetVersionExA,NtProtectVirtualMemory,	5_2_00431AC0

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_0040914C AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040914C
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00409180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_00409180
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004536F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_004536F0

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_004081A8	0_2_004081A8
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004777A8	1_2_004777A8
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00461C80	1_2_00461C80
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00469F50	1_2_00469F50
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00458180	1_2_00458180
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00430454	1_2_00430454
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004446E8	1_2_004446E8
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004348B0	1_2_004348B0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00444AF4	1_2_00444AF4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047CC54	1_2_0047CC54
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045B078	1_2_0045B078
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00413202	1_2_00413202
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0043D2D0	1_2_0043D2D0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004832E4	1_2_004832E4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0042F9F8	1_2_0042F9F8
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00443A48	1_2_00443A48
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00433BAC	1_2_00433BAC
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00463C84	1_2_00463C84
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00443FF0	1_2_00443FF0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00428A00	5_2_00428A00
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042734B	5_2_0042734B
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0043FCE0	5_2_0043FCE0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00456033	5_2_00456033
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045E0D9	5_2_0045E0D9
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0046A170	5_2_0046A170
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044C126	5_2_0044C126
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004222F3	5_2_004222F3
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00464290	5_2_00464290
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045631E	5_2_0045631E
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044633B	5_2_0044633B
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004FE3D8	5_2_004FE3D8
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004663AE	5_2_004663AE
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044C4CD	5_2_0044C4CD
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045C550	5_2_0045C550
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045858F	5_2_0045858F
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044E66C	5_2_0044E66C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045670C	5_2_0045670C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00464720	5_2_00464720
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004487C9	5_2_004487C9
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004467D0	5_2_004467D0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004507F3	5_2_004507F3
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0046A99F	5_2_0046A99F
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0041AAF2	5_2_0041AAF2
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00456AAF	5_2_00456AAF
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044AB64	5_2_0044AB64
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00446BC1	5_2_00446BC1
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00466B85	5_2_00466B85
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045ECC2	5_2_0045ECC2
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00416CE6	5_2_00416CE6
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00456CF1	5_2_00456CF1
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044CCBC	5_2_0044CCBC
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00448CBD	5_2_00448CBD
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0041AD21	5_2_0041AD21
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044EE63	5_2_0044EE63
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00462EE0	5_2_00462EE0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00442EFB	5_2_00442EFB
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042CF19	5_2_0042CF19
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004CEF20	5_2_004CEF20
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00446FC4	5_2_00446FC4
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00456FBD	5_2_00456FBD
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004D10F4	5_2_004D10F4
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004230A4	5_2_004230A4
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0043F150	5_2_0043F150
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004BB160	5_2_004BB160
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044D24A	5_2_0044D24A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00457225	5_2_00457225
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045923C	5_2_0045923C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045735A	5_2_0045735A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004473F3	5_2_004473F3
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004734F2	5_2_004734F2
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0046551D	5_2_0046551D
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004575CE	5_2_004575CE
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004516A1	5_2_004516A1
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044F6BD	5_2_0044F6BD
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00457851	5_2_00457851
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045D805	5_2_0045D805
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044D80E	5_2_0044D80E
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0053F8CA	5_2_0053F8CA
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00461A2B	5_2_00461A2B
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00457AC7	5_2_00457AC7
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0053BB50	5_2_0053BB50
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045DB40	5_2_0045DB40
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00403B6F	5_2_00403B6F
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0044FBC5	5_2_0044FBC5
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0045FC5C	5_2_0045FC5C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00441C5A	5_2_00441C5A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00457C06	5_2_00457C06
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00455DC7	5_2_00455DC7
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00451DE6	5_2_00451DE6
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00469D95	5_2_00469D95
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0053BDA6	5_2_0053BDA6
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0046BDB0	5_2_0046BDB0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00413E46	5_2_00413E46
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00445E70	5_2_00445E70
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00455EFD	5_2_00455EFD
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00457F5C	5_2_00457F5C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB789F7	5_2_6CB789F7
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB4ABF0	5_2_6CB4ABF0
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB47BD7	5_2_6CB47BD7
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB624E6	5_2_6CB624E6
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB58416	5_2_6CB58416
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB5D6BC	5_2_6CB5D6BC
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB65614	5_2_6CB65614
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB6E022	5_2_6CB6E022
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_6CB5F10F	5_2_6CB5F10F
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00402ED6	6_2_00402ED6
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_004431F0	6_2_004431F0
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0042938C	6_2_0042938C
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00443446	6_2_00443446
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00469413	6_2_00469413
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0042F5C2	6_2_0042F5C2
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0043C5FA	6_2_0043C5FA
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00469673	6_2_00469673
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_004106E9	6_2_004106E9
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00468750	6_2_00468750
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_00432850	6_2_00432850
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0046A95B	6_2_0046A95B
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0045396E	6_2_0045396E
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0046997E	6_2_0046997E
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0043B97C	6_2_0043B97C
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0044A92F	6_2_0044A92F
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_004259E1	6_2_004259E1
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0046ABE5	6_2_0046ABE5
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0043AC4B	6_2_0043AC4B

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00406A24 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00403418 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00405974 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00455538 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00445624 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 004034AC appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00455348 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 0040788C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00445354 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00433AC4 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 0040369C appears 198 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00408BA4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: String function: 00451710 appears 67 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00421AB2 appears 32 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00417D80 appears 172 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00417D0B appears 117 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00450B8F appears 43 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00417E82 appears 81 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 0046E1E0 appears 248 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 0046E140 appears 160 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 0044A2C7 appears 81 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 0044A528 appears 34 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00417F85 appears 172 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 00417CC2 appears 260 times
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: String function: 0046E170 appears 82 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 0057CD90 appears 81 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 00431A0D appears 43 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 00431A23 appears 91 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 00426B96 appears 49 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 00426A68 appears 449 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 0057CF70 appears 101 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 004192F0 appears 113 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 00553C07 appears 77 times
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: String function: 0057D000 appears 39 times

Source: is-L00DR.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-L00DR.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-L00DR.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-L00DR.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-0ONS4.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-0ONS4.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-0ONS4.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-0ONS4.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Xming-6-9-0-31-setup.exe
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs Xming-6-9-0-31-setup.exe
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Xming-6-9-0-31-setup.exe
Source: Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs Xming-6-9-0-31-setup.exe

Source: Xming-6-9-0-31-setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: _RegDLL.tmp.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: clean16.spyw.winEXE@7/807@0/1

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_004B52E1 strstr,memset,CreateProcessA,GetLastError,FormatMessageA,LocalFree,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,

5_2_004B52E1

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_0040914C AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040914C
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00409180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_00409180
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004536F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_004536F0

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_00453F20 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_00453F20

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_00454308 CoCreateInstance,CoCreateInstance,SysFreeString,

1_2_00454308

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Code function: 0_2_004098C8 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_004098C8

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

File created: C:\Program Files (x86)\Xming

Jump to behavior

Source: C:\Program Files (x86)\Xming\Xming.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\CYGWINX_DISPLAY:0

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

File created: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Xming.exe	String found in binary or memory: -from local-address specify the local address to connect from
Source: Xming.exe	String found in binary or memory: --help
Source: Xming.exe	String found in binary or memory: --help
Source: Xming.exe	String found in binary or memory: -help
Source: Xming.exe	String found in binary or memory: -help prints message with these options
Source: Xming.exe	String found in binary or memory: -from local-address specify the local address to connect from
Source: Xming.exe	String found in binary or memory: -help prints message with these options
Source: xkbcomp.exe	String found in binary or memory: -?,-help Print this message
Source: xkbcomp.exe	String found in binary or memory: -help
Source: xkbcomp.exe	String found in binary or memory: -?,-help Print this message

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

File read: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe"
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp "C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp" /SL4 $2043A "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe" 1923415 73728
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process created: C:\Program Files (x86)\Xming\Xming.exe "C:\Program Files (x86)\Xming\Xming.exe" :0 -clipboard -multiwindow
Source: C:\Program Files (x86)\Xming\Xming.exe	Process created: C:\Program Files (x86)\Xming\xkbcomp.exe "C:\Program Files (x86)\Xming\xkbcomp" -w 1 "-RC:\Program Files (x86)\Xming\xkb" -xkm "C:\Users\user\AppData\Local\Temp\xkb_a01396" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\server-0.xkm"
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp "C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp" /SL4 $2043A "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe" 1923415 73728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process created: C:\Program Files (x86)\Xming\Xming.exe "C:\Program Files (x86)\Xming\Xming.exe" :0 -clipboard -multiwindow	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Process created: C:\Program Files (x86)\Xming\xkbcomp.exe "C:\Program Files (x86)\Xming\xkbcomp" -w 1 "-RC:\Program Files (x86)\Xming\xkb" -xkm "C:\Users\user\AppData\Local\Temp\xkb_a01396" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\server-0.xkm"	Jump to behavior

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: libfreetype-6.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: pthreadgc2.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: quserex.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Xming.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Xming\Xming.exe
Source: XLaunch.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Xming\XLaunch.exe
Source: Xming on the Web.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Xming\Xming.url
Source: Uninstall Xming.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Xming\unins000.exe

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Xming-6-9-0-31-setup.exe

Static file information: File size 2204914 > 1048576

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_0044A890 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0044A890

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00406518 push 00406555h; ret	0_2_0040654D
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00408C50 push 00408C83h; ret	0_2_00408C7B
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: 0_2_00407EA0 push ecx; mov dword ptr [esp], eax	0_2_00407EA5
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004098E4 push 00409921h; ret	1_2_00409919
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0040A023 push ds; ret	1_2_0040A024
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00430454 push ecx; mov dword ptr [esp], eax	1_2_00430459
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047A6CC push 0047A7AAh; ret	1_2_0047A7A2
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004106B4 push ecx; mov dword ptr [esp], edx	1_2_004106B9
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00450740 push 00450773h; ret	1_2_0045076B
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0041290C push 0041296Fh; ret	1_2_00412967
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004429C0 push ecx; mov dword ptr [esp], ecx	1_2_004429C4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00456D70 push 00456DB4h; ret	1_2_00456DAC
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045AD70 push ecx; mov dword ptr [esp], eax	1_2_0045AD75
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0040D00C push ecx; mov dword ptr [esp], edx	1_2_0040D00E
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00405485 push eax; ret	1_2_004054C1
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00405555 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0040F56C push ecx; mov dword ptr [esp], edx	1_2_0040F56E
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004055D6 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00405653 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004056B8 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047BC58 push ecx; mov dword ptr [esp], ecx	1_2_0047BC5D
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00419C0C push ecx; mov dword ptr [esp], ecx	1_2_00419C11
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00409FF7 push ds; ret	1_2_0040A021
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0047E604 push 6B005A5Eh; ret	5_2_0047E609

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-0ONS4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-7UVK4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-N9TOO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\run.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\libfreetype-6.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\plink.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\pthreadGC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-M36O7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\xkbcomp.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-NF5IN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-3RNSV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\Xming.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-67AQV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\XLaunch.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\Program Files (x86)\Xming\is-SB758.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Xming.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\XLaunch.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Xming on the Web.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Uninstall Xming.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00422840 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422840
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00423BF0 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423BF0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00423BF0 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423BF0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047A09C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0047A09C
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00424178 IsIconic,SetActiveWindow,	1_2_00424178
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_004241C0 IsIconic,SetActiveWindow,SetFocus,	1_2_004241C0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00418368 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418368
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0041757C IsIconic,GetCapture,	1_2_0041757C
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00417CB2 IsIconic,SetWindowPos,	1_2_00417CB2
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00417CB4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CB4
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0043C50C IsIconic,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,ScreenToClient,ScreenToClient,SetRect,GetClientRect,IntersectRect,InvalidateRect,UpdateWindow,	5_2_0043C50C
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00442EFB GetPropA,SetPropA,DestroyWindow,DeleteDC,DeleteObject,ReleaseDC,free,free,RemovePropA,ClientToScreen,GetSystemMetrics,GetSystemMetrics,KillTimer,GetTickCount,SetTimer,SetTimer,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,GetKeyState,SendMessageA,BeginPaint,BitBlt,GetLastError,FormatMessageA,LocalFree,EndPaint,GetSystemMetrics,GetSystemMetrics,GetTickCount,SetForegroundWindow,ClientToScreen,GetSystemMetrics,GetSystemMetrics,memcpy,GetSystemMetrics,GetSystemMetrics,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,IsIconic,IsZoomed,GetClientRect,MapWindowPoints,GetSystemMetrics,GetSystemMetrics,SetCursor,GetClientRect,MapWindowPoints,GetSystemMetrics,GetSystemMetrics,DefWindowProcA,	5_2_00442EFB
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00442EFB GetPropA,SetPropA,DestroyWindow,DeleteDC,DeleteObject,ReleaseDC,free,free,RemovePropA,ClientToScreen,GetSystemMetrics,GetSystemMetrics,KillTimer,GetTickCount,SetTimer,SetTimer,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,ReleaseCapture,GetKeyState,SendMessageA,BeginPaint,BitBlt,GetLastError,FormatMessageA,LocalFree,EndPaint,GetSystemMetrics,GetSystemMetrics,GetTickCount,SetForegroundWindow,ClientToScreen,GetSystemMetrics,GetSystemMetrics,memcpy,GetSystemMetrics,GetSystemMetrics,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,IsIconic,IsZoomed,GetClientRect,MapWindowPoints,GetSystemMetrics,GetSystemMetrics,SetCursor,GetClientRect,MapWindowPoints,GetSystemMetrics,GetSystemMetrics,DefWindowProcA,	5_2_00442EFB
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_004334F8 GetParent,IsIconic,GetDesktopWindow,GetWindowLongA,SetWindowLongA,GetWindowLongA,SetWindowLongA,GetSystemMetrics,GetWindowRect,GetWindowRect,CopyRect,OffsetRect,OffsetRect,OffsetRect,SetWindowPos,LoadIconA,GetSystemMetrics,GetSystemMetrics,LoadImageA,PostMessageA,PostMessageA,	5_2_004334F8
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00437999 GetCurrentProcessId,GetTopWindow,GetWindowThreadProcessId,GetPropA,IsIconic,GetPropA,GetWindow,	5_2_00437999
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00441C5A GetPropA,GetPropA,SetPropA,SetPropA,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,GetWindowPlacement,BeginPaint,BitBlt,GetLastError,FormatMessageA,LocalFree,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,ShowCursor,KillTimer,GetTickCount,ShowCursor,SetTimer,ShowCursor,SetTimer,SendMessageA,GetParent,IsIconic,ShowWindow,GetKeyState,SendMessageA,SendMessageA,GetParent,SetFocus,DestroyWindow,RemovePropA,RemovePropA,RemovePropA,SetPropA,GetWindowLongA,GetWindowLongA,SetRect,AdjustWindowRectEx,SetWindowLongA,GetParent,SetWindowLongA,SetWindowPos,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,memcpy,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,GetPropA,SetCursor,DefWindowProcA,	5_2_00441C5A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00441C5A GetPropA,GetPropA,SetPropA,SetPropA,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,GetWindowPlacement,BeginPaint,BitBlt,GetLastError,FormatMessageA,LocalFree,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,ShowCursor,KillTimer,GetTickCount,ShowCursor,SetTimer,ShowCursor,SetTimer,SendMessageA,GetParent,IsIconic,ShowWindow,GetKeyState,SendMessageA,SendMessageA,GetParent,SetFocus,DestroyWindow,RemovePropA,RemovePropA,RemovePropA,SetPropA,GetWindowLongA,GetWindowLongA,SetRect,AdjustWindowRectEx,SetWindowLongA,GetParent,SetWindowLongA,SetWindowPos,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,memcpy,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,GetPropA,SetCursor,DefWindowProcA,	5_2_00441C5A
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_00437C78 IsIconic,GetSystemMetrics,GetSystemMetrics,SetRect,GetWindowLongA,GetWindowLongA,AdjustWindowRectEx,GetWindowRect,EqualRect,	5_2_00437C78

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

1_2_0044A890

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Xming\Xming.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-0ONS4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-N9TOO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\run.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\plink.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-M36O7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-NF5IN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-3RNSV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\is-67AQV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Xming\XLaunch.exe (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5137

Source: C:\Program Files (x86)\Xming\Xming.exe	API coverage: 6.6 %
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	API coverage: 3.7 %

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0046E2D4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046E2D4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0047694C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047694C
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00450EA4 FindFirstFileA,GetLastError,	1_2_00450EA4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045E738 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E738
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_00474BD0 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474BD0
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045EBB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045EBB4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0045D1B4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045D1B4
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: 1_2_0048D260 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0048D260
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_004154BC strchr,strchr,strchr,strchr,strchr,FindFirstFileA,sprintf,_stat,FindNextFileA,	6_2_004154BC

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Code function: 0_2_0040980C GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_0040980C

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	File opened: C:\Users\user\AppData	Jump to behavior

Source: Xming.exe, 00000005.00000002.3282441882.00000000009DE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllonCC

Source: C:\Program Files (x86)\Xming\Xming.exe

API call chain: ExitProcess graph end node

graph_5-108609

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

1_2_0044A890

Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0040111C SetUnhandledExceptionFilter,__getmainargs,_iob,_setmode,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,_setmode,_iob,		5_2_0040111C
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Code function: 6_2_0040111C SetUnhandledExceptionFilter,__getmainargs,_iob,_setmode,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,_setmode,_iob,		6_2_0040111C

Source: C:\Program Files (x86)\Xming\Xming.exe	Process created: C:\Program Files (x86)\Xming\xkbcomp.exe "c:\program files (x86)\xming\xkbcomp" -w 1 "-rc:\program files (x86)\xming\xkb" -xkm "c:\users\user\appdata\local\temp\xkb_a01396" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\server-0.xkm"
Source: C:\Program Files (x86)\Xming\Xming.exe	Process created: C:\Program Files (x86)\Xming\xkbcomp.exe "c:\program files (x86)\xming\xkbcomp" -w 1 "-rc:\program files (x86)\xming\xkb" -xkm "c:\users\user\appdata\local\temp\xkb_a01396" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\server-0.xkm"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_00459ACC GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

1_2_00459ACC

Source: C:\Program Files (x86)\Xming\Xming.exe

Code function: 5_2_0057C2F0 cpuid

5_2_0057C2F0

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: GetLocaleInfoA,	0_2_0040515C
Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe	Code function: GetLocaleInfoA,	0_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: GetLocaleInfoA,	1_2_00408500
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Code function: GetLocaleInfoA,	1_2_0040854C

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Xming\xkbcomp.exe	Queries volume information: C:\Program Files (x86)\Xming\XKeysymDB VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_0045604C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_0045604C

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Code function: 1_2_00453688 GetUserNameA,

1_2_00453688

Source: C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe

Code function: 0_2_00405C44 GetVersionExA,

0_2_00405C44

Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042BEDC strtol,sprintf,getservbyname,_errno,strtol,htons,htonl,_errno,Sleep,bind,setsockopt,listen,_errno,_errno,_errno,closesocket,_errno,_errno,_errno,_errno,		5_2_0042BEDC
Source: C:\Program Files (x86)\Xming\Xming.exe	Code function: 5_2_0042ACED atoi,socket,setsockopt,bind,		5_2_0042ACED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	111 Input Capture	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	2 Process Injection	1 Access Token Manipulation	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	111 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	35 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Xming-6-9-0-31-setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Xming\XLaunch.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Xming\Xming.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-0ONS4.tmp	3%	ReversingLabs
C:\Program Files (x86)\Xming\is-3RNSV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-67AQV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-7UVK4.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-M36O7.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-N9TOO.tmp	3%	ReversingLabs
C:\Program Files (x86)\Xming\is-NF5IN.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\is-SB758.tmp	0%	ReversingLabs
C:\Program Files (x86)\Xming\libfreetype-6.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Xming\plink.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Xming\pthreadGC2.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\Xming\run.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Xming\unins000.exe (copy)	3%	ReversingLabs
C:\Program Files (x86)\Xming\xkbcomp.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp	2%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.innosetup.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.StraightRunning.com/XmingNotes/release.phpwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes/trouble.phpwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes/xmingrc.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://srpski.org/dunav/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-JLGR6.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/fonts.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://en.tldp.org/HOWTO/Francophones-HOWTO.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-SHM8D.tmp.1.dr	false		unknown
http://www.gakartuleba.org/layouts/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-V1AR6.tmp.1.dr	false		unknown
http://sourceforge.net/projects/omke	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes/xming.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.nida.gov.kh	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-RK5SM.tmp.1.dr	false		unknown
http://ekushey.org/projects/shadhinota/index.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes)http://www.StraightRunning.com/XmingNotes$http://www.Strai	Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://linux.dd.com.au/quest/linux/keyboard/honeywell/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/release.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.sbl-site.org/Resources/Resources_BiblicalFonts.aspx.	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-IO1NN.tmp.1.dr	false		unknown
https://bugs.freedesktop.org/show_bug.cgi?id=4397	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-PMQOI.tmp.1.dr	false		unknown
http://sourceforge.net/forum/?group_id=156984	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, Xming.exe, 00000005.00000002.3281575531.00000000001B4000.00000004.00000020.00020000.00000000.sdmp, is-SB758.tmp.1.dr, Xming.0.log.5.dr	false		unknown
http://www.language-keyboard.com/languages/catalan_layout.htm	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-FC4J3.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes6	Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.linux-france.org/macintosh/clavier_gentoo.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HAJF5.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/index.phpwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes:	Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.StraightRunning.com/XmingNotes/d&	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000002.3283212527.000000006248B000.00000008.00000001.01000000.0000000B.sdmp, is-N9TOO.tmp.1.dr	false		unknown
http://www.goebel-consult.de/de-ergo/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-0BT9P.tmp.1.dr	false		unknown
http://www.ircam.ma/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	false		unknown
http://www.qamus.org/transliteration.htm	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-N2A44.tmp.1.dr	false		unknown
http://www.unicode.org)	is-E9LTG.tmp.1.dr	false		unknown
http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-RUP5B.tmp.1.dr	false		unknown
http://bugs.freedesktop.org/show_bug.cgi?id=1896	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-MNUTI.tmp.1.dr	false		unknown
http://ferheng.org	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-CA42C.tmp.1.dr	false		unknown
https://bugs.freedesktop.org/show_bug.cgi?id=7095	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-VEJUK.tmp.1.dr	false		unknown
http://sun3.mif.vu.lt/cs/TK4/lithkeyb.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HFSN4.tmp.1.dr	false		unknown
http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	false		unknown
http://www.evertype.com/standards/af/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-AT2SM.tmp.1.dr	false		unknown
http://www.tamilnet99.org)	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	false		unknown
http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	false		unknown
http://www.innosetup.com/	is-L00DR.tmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	false	URL Reputation: safe	unknown
http://www.straightrunning.com/XmingNotes/trouble.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotesOLE	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-67AQV.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/R	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000002.3283393897.000000006CB9C000.00000008.00000001.01000000.0000000A.sdmp, is-3RNSV.tmp.1.dr	false		unknown
http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E2JM7.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes	is-UTJTO.tmp.1.dr	false		unknown
http://www.pckurd.net	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-CA42C.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes$	Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.kada.lt/litwin/Kbdlta.gif	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-HFSN4.tmp.1.dr	false		unknown
http://www.remobjects.com/?ps	Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotesxe	is-L00DR.tmp, 00000001.00000003.2269620225.0000000000619000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2270989958.0000000000619000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.StraightRunning.com/XmingNotes)	Xming-6-9-0-31-setup.exe, 00000000.00000003.2025675432.0000000002330000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027322863.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.uznet.net/index.php?option=com_content&task=view&id=288&Itemid=58	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-DP3US.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes	Xming-6-9-0-31-setup.exe, 00000000.00000003.2271853220.0000000002101000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2025750199.0000000002101000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2269993649.0000000002154000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.StraightRunning.com/XmingFs	is-L00DR.tmp, 00000001.00000003.2269159023.000000000065D000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2271155295.000000000065D000.00000004.00000020.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2270129401.000000000065D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.StraightRunning.com/XmingNotes/index.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
https://bugs.freedesktop.org/show_bug.cgi?id=9541	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-N5VAG.tmp.1.dr	false		unknown
http://www.hum.uit.no/a/trond/se-lat9-sefi-keys.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-DD00D.tmp.1.dr, is-NVB42.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/2	is-L00DR.tmp, 00000001.00000002.2270319193.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000003.2268357326.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, xkbcomp.exe, 00000006.00000000.2271019480.00000000004C8000.00000008.00000001.01000000.0000000D.sdmp, xkbcomp.exe, 00000006.00000002.2272807297.00000000004C9000.00000008.00000001.01000000.0000000D.sdmp, is-7UVK4.tmp.1.dr	false		unknown
http://www.hum.uit.no/a/trond/se-lat9-no-keys.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-PMQOI.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/6	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267978246.0000000000616000.00000008.00000001.01000000.00000009.sdmp, Xming.exe, 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr, is-67AQV.tmp.1.dr	false		unknown
http://sourceforge.net/forum/?group_id=156984Contact:	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.indlinux.org/keymap/telugu.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	false		unknown
http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-G4TDS.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes/xmingrc.phpwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.conectiva.com.br)	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-2ALQC.tmp.1.dr, is-SSBJH.tmp.1.dr	false		unknown
http://www.afghanischerKulturverein.de/en/afghanComputer_en.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-AT2SM.tmp.1.dr	false		unknown
http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-710K5.tmp.1.dr	false		unknown
http://www.sci.kz/~sairan/keyboard/kzkbd.html	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-IA46D.tmp.1.dr	false		unknown
http://www.straightrunning.com/XmingNotes/xming.phpwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://www.tscii.org)	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-E9LTG.tmp.1.dr	false		unknown
http://gpl.insa-lyon.fr/Dvorak-Fr/	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-SHM8D.tmp.1.dr	false		unknown
http://www.StraightRunning.com/XmingNotes/fonts.phpopenwinAboutDlgProc	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, Xming.exe, 00000005.00000000.2267919234.0000000000596000.00000002.00000001.01000000.00000009.sdmp, is-SB758.tmp.1.dr	false		unknown
http://hal.csd.auth.gr/~vvas/i18n/xkb/polytonic-compose.pl	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-FTQ4P.tmp.1.dr	false		unknown
http://www-lehre.informatik.uni-osnabrueck.de/~rfreund/dvorak.php	is-L00DR.tmp, 00000001.00000003.2268357326.0000000004DA2000.00000004.00001000.00020000.00000000.sdmp, is-0BT9P.tmp.1.dr	false		unknown
http://www.StraightRunning.com/Xming	is-L00DR.tmp, 00000001.00000003.2027774062.0000000002156000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.remobjects.com/?psU	Xming-6-9-0-31-setup.exe, 00000000.00000003.2026050551.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Xming-6-9-0-31-setup.exe, 00000000.00000003.2026191239.0000000002108000.00000004.00001000.00020000.00000000.sdmp, is-L00DR.tmp, 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-L00DR.tmp.0.dr, is-0ONS4.tmp.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545727
Start date and time:	2024-10-30 22:10:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xming-6-9-0-31-setup.exe
Detection:	CLEAN
Classification:	clean16.spyw.winEXE@7/807@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 247 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Xming-6-9-0-31-setup.exe

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18351
Entropy (8bit):	4.732761382906099
Encrypted:	false
SSDEEP:	384:tq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0sDP2:tzuVLiY+rTZo0sDP2
MD5:	0CCE1E42EF3FB133940946534FCF8896
SHA1:	7ECBD605447C221CB27F24102F4E71922FC7C25F
SHA-256:	40A607E086BC23F10E2953BCCCDCCDF857D26AD40B8CBDC974DF96C678F51AFA
SHA-512:	42972E3AD469C2B852498FE273F1B557E447C2C11D080C436C3666428184F9754907B162AC1D0A744626853D862881D1906693911A827D975C54D90157EAC668
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.. GNU GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc... 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed........ Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..License is intended to guarantee your freedom to share and change free..software--to make sure the software is free for all its users. This..General Public License applies to most of the Free Software..Foundation's software and to any other program whose authors commit to..using it. (Some other Free Software Foundation software is covered by..the GNU Library General Public License instead.) You can apply it to..your programs, too..... When we speak of free software, we are referring to freedom, not..price.

C:\Program Files (x86)\Xming\SecurityPolicy (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	5.2130157881482875
Encrypted:	false
SSDEEP:	48:vcE8UgkKHlyI/rjXwNkaWaRakar7aaalaYaFWZXVi4ctb669V7vHy4DPtkGP5N2:F8Zk8LzwNkaWaRakavaaalaYaUZStb6f
MD5:	5E63F298721BDD4062D3C66967DF99BA
SHA1:	97C9A04BF4EFC0674B42D5CFD4A137679A38FFA6
SHA-256:	3AAAA9C9F874165CA661716ED6E46F7445209EA3E3EE5F887DDB012B7B1604BD
SHA-512:	51D27C9CB46909B0810EC8C1D4F2A8D9FEBAAB0EECDBE3D28AA72F3DADF56BEE7ABF1BFBC67957B15BD1DA879315430CDF3BDE0339A943283C68491AEA9ADBF0
Malicious:	false
Reputation:	low
Preview:	version-1 ..# $Xorg: SecurityPolicy,v 1.3 2000/08/17 19:47:56 cpqbld Exp $..# The site policy fields are interpreted by the XC-QUERY-SECURITY-1.# authorization protocol. The values are arbitrary and site-specific..# Refer to the Security Extension Specification for the usage of the policies..#sitepolicy A.#sitepolicy B.#sitepolicy C..# Property access rules:.# property <property> <window> <permissions>.# <window> ::= any \| root \| <propertyselector>.# <propertyselector> ::= <property> \| <property>=<value>.# <permissions> :== [ <operation> \| <action> \| <space> ]*.# <operation> :== r \| w \| d.#.r.read.#.w.write.#.d.delete.# <action> :== a \| i \| e.#.a.allow.#.i.ignore.#.e.error..# Allow reading of application resources, but not writing..property RESOURCE_MANAGER.root.ar iw.property SCREEN_RESOURCES.root.ar iw..# Ignore attempts to use cut buffers. Giving errors causes apps to crash,.# and allowing access may give away too much information..property CUT_BUFFER0.root.irw.property CUT_BUFFER

C:\Program Files (x86)\Xming\X0.hosts (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:4NNJ:ANJ
MD5:	B8419160170A41AE01ABAB13A3B887DF
SHA1:	EA75706155CFFED0A1BD43DDBA4543DA27D73A67
SHA-256:	D906AECB61D076A967D9FFE8821C7B04B063F72DF9D9E35B33EF36B1C0D98F16
SHA-512:	174B7D983472D1087FA530E893450BCB4AA7737113018FDC30E9894FC8017FF2AC0D7590BD13F214D0B61480069C4E6C4BB84B155BD62975B09C0DF517491646
Malicious:	false
Reputation:	low
Preview:	localhost.

C:\Program Files (x86)\Xming\XErrorDB (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	37893
Entropy (8bit):	5.319071117194183
Encrypted:	false
SSDEEP:	768:bIa22o9Y77ZD+ex7bNH/ZWWdhwlpqanKKC9y7nCGfQMhdBSiQZ26+Aq1DfYLxj/J:0a22o9Y77ZD+wnNH/ZWWdhwlpqanKKC9
MD5:	59C77DCB1231B55922E1FED7CE3FB88B
SHA1:	EBF597D0C9C49D32EEB0A43FCAEAF039D17800CD
SHA-256:	7181B9CA80B528C1DA0DA331DD7582E92B4A4E8587038339C0AD64DBF428F7BD
SHA-512:	9A282255472B5AEBBE43AAF5B1A970861510E1CC8F57F89E3D71536EB8126BCD370DD2A16FA83FFE9763A2ABDD5D7F6E8E64D9FB49DF63DFBE4ABEF0AF7510FB
Malicious:	false
Preview:	! $Xorg: XErrorDB,v 1.3 2000/08/17 19:44:59 cpqbld Exp $.! $XdotOrg: $.!.! Copyright 1993, 1995, 1998 The Open Group..! Permission to use, copy, modify, distribute, and sell this software and its.! documentation for any purpose is hereby granted without fee, provided that.! the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation..! .! The above copyright notice and this permission notice shall be.! included in all copies or substantial portions of the Software..! .! THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.! EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.! MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..! IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.! OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.! ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.! OTHER DEALI

C:\Program Files (x86)\Xming\XKeysymDB (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	5.137751613708224
Encrypted:	false
SSDEEP:	192:zO+YPEK/hQEyPoy4jp58rq5eqYNzbSdDKhRWBh3JtT0uSyv:asy8rOYNzeKRuJ05a
MD5:	BF5A056D18D6EF7FE75067B0977D73B7
SHA1:	2FC4742B30C05597C4C973D8A7ABB134FEAA6098
SHA-256:	A857DC2C676228CC4DC9C710F8064ECF88BB3A9D401F18028783D6E928BEC41E
SHA-512:	F03CBECD22A6421B92C591FF3B8C1C3E71BE523F486044C8DB8AAEFCF74EF4E118F6CDDEC81E0F39815CE59771AB3251D9F74F8054BAD3A94713E20BC5FE9258
Malicious:	false
Preview:	! $Xorg: XKeysymDB,v 1.3 2000/08/17 19:45:04 cpqbld Exp $.! Copyright 1993 Massachusetts Institute of Technology.!.! Permission to use, copy, modify, distribute, and sell this software and.! its documentation for any purpose is hereby granted without fee, provided.! that the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation, and that the name of M.I.T. not be used in advertising or.! publicity pertaining to distribution of the software without specific,.! written prior permission. M.I.T. makes no representations about the.! suitability of this software for any purpose. It is provided "as is".! without express or implied warranty..!.! $XFree86: xc/lib/X11/XKeysymDB,v 3.16 2003/02/11 02:51:10 dawes Exp $..hpmute_acute..:100000A8.hpmute_grave..:100000A9.hpmute_asciicircum.:100000AA.hpmute_diaeresis.:100000AB.hpmute_asciitilde.:100000AC.hplira...:100000AF.hpguilder..:100000BE.hpYdiaeresis..:10

C:\Program Files (x86)\Xming\XLaunch.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	115092
Entropy (8bit):	7.808550646475096
Encrypted:	false
SSDEEP:	3072:Vxdd7hlcFfd4jVbzcRAA0NIylLflSP3dIRL9i:VxddPcL4j9IRqNIwi
MD5:	B45D44EEAB4C2A77BF5EB491DB07DA59
SHA1:	ABBD9C8B2B7AC54BD8EE8D271A60CDD2D5CAA444
SHA-256:	BE0F8D6C78D892BED207A1DEE7A91B257972E5D0A52B1E7DB14ED04E80E04491
SHA-512:	FFF410213EA1C0D1C240830E107EF5D29CD71E88BDE1DBD1AA6DF5757502590642376A6B5F4534FD6C670E28C579050078E3E7449327EA520AE2C7D845C7F9CC
Malicious:	false
Preview:	ITSF....`.......N..........\|.{.......".....\|.{......."..`...............x.......T.......................................ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR...j.../#ITBITS..../#IVB...c4./#STRINGS.....[./#SYSTEM..V.4./#TOPICS...j.p./#URLSTR.....h./#URLTBL...Z.T./$FIftiMain...e..../$OBJINST...J.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...F../$WWKeywordLinks/..../$WWKeywordLinks/Property...B../common.css...R.g./IDH_CLIENTS.htm..'.<./IDH_CLIPBOARD.htm...X.i./IDH_DISPLAY.htm....../IDH_FINISH.htm...A.M./IDH_PROGRAM.htm..c.../IDH_XDMCP.htm...c.u./moin-www.png......./PuTTY1.jpg.....z./PuTTY1.png...$.o./PuTTY1a.jpg...,.#./PuTTY1a.png......./PuTTY2.jpg...&.)./PuTTY2.png...O.W./PuTTY3.jpg...C.../PuTTY3.png...O.t./PuTTY4.jpg...{.W./PuTTY4.png...B.9./screen.css...9.../X2.bmp...W.../XLaunch.hhc...../XLaunch.txt.....+.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....>,::DataSpace/Stora

C:\Program Files (x86)\Xming\XLaunch.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	858112
Entropy (8bit):	7.0773481017453115
Encrypted:	false
SSDEEP:	12288:utJlE+PycGgq6astN6811B15heuWHzL/lvPp4hSkfm8GlhV+FNjovV:4a+PyzgJastT18HhGfxGlhViNjo
MD5:	C5E497604D50A3AB3CC75CD1F0C54687
SHA1:	307BF554121882B8DD141BBCA45BF087C551313F
SHA-256:	78EC8C6FB0122AE04FE868CBD318D4EB1E171B646A25BAD998C68BB233CC9388
SHA-512:	82090CF4869EEE6243499D3D9E1BB0CC2767E2077243B5EE8555429E32BBC6A6AEE78E065545FC9C9D6F94D3E9428EC3D004EA6FBF038A724E0C0AB0BD41F131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8........P..(........@....@.................................S......... ..............................P..`.......8............................................................................................................text...4(.........................`..`.data....<...@...>..................@....rdata..P~...........l..............@..@.bss.....N...............................idata..`....P......................@....CRT.........p......................@....rsrc...8...........................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\XLaunch.xsd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	4.716105414364201
Encrypted:	false
SSDEEP:	48:VSz76wJ/3Gq/asY/IEn/DMgqXZ0cI9hqf6Nwa71i6qmp:wGwZTO1DMgMhIDqfuNh
MD5:	9B002D6BC6A2579A279CCA956E63607B
SHA1:	625B14626556D7925A83861B1D2ABB19880B4124
SHA-256:	B192A16AC0AA533DD089515EF1BE7CE7C3227F488C44921C4BAE8CEEE0CE7AE0
SHA-512:	979D79A75729F3F1CFB66EC1461BB909080E64DB71CA404A84C71279FB266AD2E5CB5EBEC29871F99FC62E4F37534A1862B0963FCBFBB354A36FB99E43CD0E7D
Malicious:	false
Preview:	<?xml version="1.0"?>. XLaunch.xsd -->. File version 6.9.0.25 -->. Copyright (c) 2006-2007 Colin Harrison -->.<xs:schema. xmlns:tns="http://www.straightrunning.com/XmingNotes". attributeFormDefault="unqualified" elementFormDefault="qualified". targetNamespace="http://www.straightrunning.com/XmingNotes". xmlns:xs="http://www.w3.org/2001/XMLSchema">. <xs:element name="XLaunch">. <xs:complexType>. <xs:attribute name="WindowMode" use="required">. <xs:simpleType>. <xs:restriction base="xs:string">. <xs:enumeration value="MultiWindow"/>. <xs:enumeration value="Fullscreen"/>. <xs:enumeration value="Windowed"/>. <xs:enumeration value="Nodecoration"/>. </xs:restriction>. </xs:simpleType>. </xs:attribute>. <xs:attribute name="ClientMode" use="required">. <xs:simpleType>. <xs:restriction base="xs:string">. <xs:enumeration value="NoClient"/>. <xs:enum

C:\Program Files (x86)\Xming\Xming.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2106368
Entropy (8bit):	6.824895692087127
Encrypted:	false
SSDEEP:	24576:cKmTvi55n/P6kZUl2wAr6NMLEOFcSe6rINIZA4wkyt2kZU7mSpX8ir8sx3GGfxRV:ZikZ02aecSenXc2U9pX8d+/lhV3
MD5:	2118E06C1667CDEF92CB5977D9CC8534
SHA1:	EA01719FCE83C6D0EDBD93D7CD9EE3F375413497
SHA-256:	93A837C2469A96A3DF28056F8BFFCE15B8F70E86CAF257A91584BB41973A8C8E
SHA-512:	D87B67CF2FFC7E5EA33B04FE62C757082321942256F15E52055279CF3D8B2388DF8DE7245FFAF1D02C3CF08745F7326EDD184AC4B0E417E2D4C862E947BCF164
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8..... ...................@..........................@".....[. ....... ..............................`!..H....!..............................................................................................................text...............................`..`.data...`~..........................@....rdata..`....`.......R..............@..@.bss....P....`...........................idata...H...`!..J...N..............@....rsrc.........!.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\Xming.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.straightrunning.com/XmingNotes>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.583651689973413
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S45Du42y0hy:HRYFVm/r45DFp
MD5:	1372F740BBC8773341BC092C2ACCB1AD
SHA1:	CC00D449812C2607E07D8C7BE2940074CD8EFB69
SHA-256:	379C30C6160115E3514E5E415E73957CEC4F13F1CAB4960E40F3FD819090D117
SHA-512:	02DB739D739549CD1F6C9F1393AAC8553685B105EF86711BE0972748D863D88DD8151A0BA921F078714F613FA6F78FC798A803D3231F8AF9F73B3D09501E27BB
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.straightrunning.com/XmingNotes..

C:\Program Files (x86)\Xming\example_Xmingrc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	5.087913824532092
Encrypted:	false
SSDEEP:	48:XzfP/bF0m00C8c05HZC+Vr0CMzhq4WcRYz1vs5obAVETWveftPZ6W6FszA:X7r+CTFZCqTShq4WcOz1vxK3effYuA
MD5:	4FD9DD51F25578D629D092468DE8925E
SHA1:	868EC275833C09AB2F0B65D25DC43CA55548C1D0
SHA-256:	36E4D48F2931D48AFD839FA0DD6100937B3A04890C8AE0FA4E8055631986213A
SHA-512:	0D865AF9EF4A6477A5D2B3A846DF20F6FBDD003344D95180092DB9672AF37F2A61F421E1E4259EDAA52F3A07AB7EB87FC15C80CCA7D24526B46F29C6CAFA8AF1
Malicious:	false
Preview:	# Xming Server Resource File - EXAMPLE.# Earle F. Philhower, III..# Place in C:\Program Files\Xming\Xmingrc..# Keywords are case insensitive, comments legal pretty much anywhere.# you can have an end-of-line..# Comments begin with "#" or "//" and go to the end-of-line..# Paths to icons are WINDOWS based (i.e. c:\windows\icons)..# Menus are defined as....# MENU <name> {.#.<Menu Text>.EXEC.<command>.#....^^ Create a process for the command without a console.# or.<Menu Text>.EXECD.<command>.#....^^ Create a process for the command with a console.# or.<Menu Text>.MENU.<name-of-some-prior-defined-menu>.# or.<Menu Text>.ALWAYSONTOP.# ^^ Sets the window to display above all others.# or <Menu Text>.RELOAD.# ^^ Causes Xmingrc file.# to be reloaded and icons and menus regenerated.# or.SEPARATOR.# ....# }..# Set the taskmar menu with.# ROOTMENU <name-of-some-prior-defined-menu>..# If you want a menu to be

C:\Program Files (x86)\Xming\font-dirs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.835822994586987
Encrypted:	false
SSDEEP:	6:ScAbR5+r3xse/vUnHGFlgX1s8mul+qoGl+jMsd8Eo:wbz+r3ee/v2wKa8m4togU1d8n
MD5:	154ABC6D973711CD1E414E376BE66770
SHA1:	7B93DB8A9364A106F8802C198AE6FEB2456B92A1
SHA-256:	759BAE863C59EDFBE0A5EEDDC99C5CA1286EC232AE80E136AF99CC38C96051FF
SHA-512:	D895AD56EC039BCC7A7153A1D88D1E6660A2692A22D69F38E753FF3DDF12333AAA024360424571BCD7B8BB3139E0146474C414B36789C3C3F13DCF2CD2988A4E
Malicious:	false
Preview:	# font-dirs.# comma-separated list of directories to add to the default font path.# defaults are built-ins, misc, TTF, Type1, 75dpi, 100dpi.# also allows entries on individual lines.C:\Program Files\Xming\fonts\dejavu,C:\Program Files\Xming\fonts\cyrillic.C:\WINDOWS\Fonts.

C:\Program Files (x86)\Xming\is-0K5LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	5.2130157881482875
Encrypted:	false
SSDEEP:	48:vcE8UgkKHlyI/rjXwNkaWaRakar7aaalaYaFWZXVi4ctb669V7vHy4DPtkGP5N2:F8Zk8LzwNkaWaRakavaaalaYaUZStb6f
MD5:	5E63F298721BDD4062D3C66967DF99BA
SHA1:	97C9A04BF4EFC0674B42D5CFD4A137679A38FFA6
SHA-256:	3AAAA9C9F874165CA661716ED6E46F7445209EA3E3EE5F887DDB012B7B1604BD
SHA-512:	51D27C9CB46909B0810EC8C1D4F2A8D9FEBAAB0EECDBE3D28AA72F3DADF56BEE7ABF1BFBC67957B15BD1DA879315430CDF3BDE0339A943283C68491AEA9ADBF0
Malicious:	false
Preview:	version-1 ..# $Xorg: SecurityPolicy,v 1.3 2000/08/17 19:47:56 cpqbld Exp $..# The site policy fields are interpreted by the XC-QUERY-SECURITY-1.# authorization protocol. The values are arbitrary and site-specific..# Refer to the Security Extension Specification for the usage of the policies..#sitepolicy A.#sitepolicy B.#sitepolicy C..# Property access rules:.# property <property> <window> <permissions>.# <window> ::= any \| root \| <propertyselector>.# <propertyselector> ::= <property> \| <property>=<value>.# <permissions> :== [ <operation> \| <action> \| <space> ]*.# <operation> :== r \| w \| d.#.r.read.#.w.write.#.d.delete.# <action> :== a \| i \| e.#.a.allow.#.i.ignore.#.e.error..# Allow reading of application resources, but not writing..property RESOURCE_MANAGER.root.ar iw.property SCREEN_RESOURCES.root.ar iw..# Ignore attempts to use cut buffers. Giving errors causes apps to crash,.# and allowing access may give away too much information..property CUT_BUFFER0.root.irw.property CUT_BUFFER

C:\Program Files (x86)\Xming\is-0ONS4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704793
Entropy (8bit):	6.439623157307891
Encrypted:	false
SSDEEP:	12288:xkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWoVphKvV2xgd:uFRCUn4rP/37YzHXA6QJsoPtdpQ0xgd
MD5:	23E1E052242979A9C8BC0FB1ACCBDA56
SHA1:	00CA7A223DE7955A6EDF58A2BCF27EB750F043B5
SHA-256:	AF4F9E45F56F896D4797C183DB860C0D040A9A403FCF6E1AE11D69CFD31F475A
SHA-512:	55079E3389DE9516D361135B42B90DDA70130EDBAD9DFDCEF12B85B8426D08F2935CEF586706757F9981D1860D4C1652AE51234A381F73400F32020B72F0E3C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@..............................<%......p....................`...............................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc...p...........................@..P.............0......................@..P........................................................................................................................................

C:\Program Files (x86)\Xming\is-2COJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	37893
Entropy (8bit):	5.319071117194183
Encrypted:	false
SSDEEP:	768:bIa22o9Y77ZD+ex7bNH/ZWWdhwlpqanKKC9y7nCGfQMhdBSiQZ26+Aq1DfYLxj/J:0a22o9Y77ZD+wnNH/ZWWdhwlpqanKKC9
MD5:	59C77DCB1231B55922E1FED7CE3FB88B
SHA1:	EBF597D0C9C49D32EEB0A43FCAEAF039D17800CD
SHA-256:	7181B9CA80B528C1DA0DA331DD7582E92B4A4E8587038339C0AD64DBF428F7BD
SHA-512:	9A282255472B5AEBBE43AAF5B1A970861510E1CC8F57F89E3D71536EB8126BCD370DD2A16FA83FFE9763A2ABDD5D7F6E8E64D9FB49DF63DFBE4ABEF0AF7510FB
Malicious:	false
Preview:	! $Xorg: XErrorDB,v 1.3 2000/08/17 19:44:59 cpqbld Exp $.! $XdotOrg: $.!.! Copyright 1993, 1995, 1998 The Open Group..! Permission to use, copy, modify, distribute, and sell this software and its.! documentation for any purpose is hereby granted without fee, provided that.! the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation..! .! The above copyright notice and this permission notice shall be.! included in all copies or substantial portions of the Software..! .! THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.! EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.! MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..! IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.! OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.! ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.! OTHER DEALI

C:\Program Files (x86)\Xming\is-2KHC2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18351
Entropy (8bit):	4.732761382906099
Encrypted:	false
SSDEEP:	384:tq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0sDP2:tzuVLiY+rTZo0sDP2
MD5:	0CCE1E42EF3FB133940946534FCF8896
SHA1:	7ECBD605447C221CB27F24102F4E71922FC7C25F
SHA-256:	40A607E086BC23F10E2953BCCCDCCDF857D26AD40B8CBDC974DF96C678F51AFA
SHA-512:	42972E3AD469C2B852498FE273F1B557E447C2C11D080C436C3666428184F9754907B162AC1D0A744626853D862881D1906693911A827D975C54D90157EAC668
Malicious:	false
Preview:	.. GNU GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc... 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed........ Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..License is intended to guarantee your freedom to share and change free..software--to make sure the software is free for all its users. This..General Public License applies to most of the Free Software..Foundation's software and to any other program whose authors commit to..using it. (Some other Free Software Foundation software is covered by..the GNU Library General Public License instead.) You can apply it to..your programs, too..... When we speak of free software, we are referring to freedom, not..price.

C:\Program Files (x86)\Xming\is-3RNSV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.7585626123594675
Encrypted:	false
SSDEEP:	6144:8aHTqqZCk04kwWy7c/tqhpORb5GHHu4hgCWbVDq5k2KwrgAgGvgX:8aHTlkOBA/tqcb5GHO6gBbN2LgAN4
MD5:	65C14DA6870229953D7C6395AF17AB0A
SHA1:	8DD4821278E8F860E89CC44E3DE8F4D3960C7912
SHA-256:	D673921F0B2471A8D66413B3F524601D5F64F7B26C2C0031D3DD37DCA38514E5
SHA-512:	9F40B23C9069667754161EB429060A91A63837517E49F28F5ACCD16E820FCF1F4F25E4BFFDAAEBDF5E16E6ADAAE9E7F351B211BE268C00D3A81E3589599580C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V.:F...........#...8.....\|......`..............l................................@......... ..........................#..............$............................................................................................................text...............................`..`.data...............................@....rdata...`.......b..................@..@.bss.........p...........................edata...#.......$...@..............@..@.idata...............d..............@....rsrc...$............h..............@....reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-5MDNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.835822994586987
Encrypted:	false
SSDEEP:	6:ScAbR5+r3xse/vUnHGFlgX1s8mul+qoGl+jMsd8Eo:wbz+r3ee/v2wKa8m4togU1d8n
MD5:	154ABC6D973711CD1E414E376BE66770
SHA1:	7B93DB8A9364A106F8802C198AE6FEB2456B92A1
SHA-256:	759BAE863C59EDFBE0A5EEDDC99C5CA1286EC232AE80E136AF99CC38C96051FF
SHA-512:	D895AD56EC039BCC7A7153A1D88D1E6660A2692A22D69F38E753FF3DDF12333AAA024360424571BCD7B8BB3139E0146474C414B36789C3C3F13DCF2CD2988A4E
Malicious:	false
Preview:	# font-dirs.# comma-separated list of directories to add to the default font path.# defaults are built-ins, misc, TTF, Type1, 75dpi, 100dpi.# also allows entries on individual lines.C:\Program Files\Xming\fonts\dejavu,C:\Program Files\Xming\fonts\cyrillic.C:\WINDOWS\Fonts.

C:\Program Files (x86)\Xming\is-67AQV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	858112
Entropy (8bit):	7.0773481017453115
Encrypted:	false
SSDEEP:	12288:utJlE+PycGgq6astN6811B15heuWHzL/lvPp4hSkfm8GlhV+FNjovV:4a+PyzgJastT18HhGfxGlhViNjo
MD5:	C5E497604D50A3AB3CC75CD1F0C54687
SHA1:	307BF554121882B8DD141BBCA45BF087C551313F
SHA-256:	78EC8C6FB0122AE04FE868CBD318D4EB1E171B646A25BAD998C68BB233CC9388
SHA-512:	82090CF4869EEE6243499D3D9E1BB0CC2767E2077243B5EE8555429E32BBC6A6AEE78E065545FC9C9D6F94D3E9428EC3D004EA6FBF038A724E0C0AB0BD41F131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8........P..(........@....@.................................S......... ..............................P..`.......8............................................................................................................text...4(.........................`..`.data....<...@...>..................@....rdata..P~...........l..............@..@.bss.....N...............................idata..`....P......................@....CRT.........p......................@....rsrc...8...........................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-7UVK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	833536
Entropy (8bit):	7.0617971573042215
Encrypted:	false
SSDEEP:	12288:ez1wEmIIlrG2AnZejdn5cf5TsgKZ1W1YflhV+wL/lvPp4hSkfm8C6vV:ez/d4rG2EejV5cf54gKiyflhVhGfxC6
MD5:	57A69BF8F353DCF8FE1B0DCE5A77D15E
SHA1:	2B84CFF4556D6CC569D5D22A826E725042684B38
SHA-256:	3BDAC020A77E800E4B1094B107CFF927F3A3BA33521341061A506D438D731D34
SHA-512:	40A3D3051A5EBCF00D6707CE91EBF9C0FBD8D79069C9DCE51C722BC1A8ACB13486909F7B5B324A75FAD69F69D54DB2ECCCD1598620CA65494F9A59A42E1663DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8............(.............@.................................A......... .................................X........h...........................................................................................................text...............................`..`.data....=.......>..................@....rdata...(...0...*..................@..@.bss.........`...........................idata..X............B..............@....rsrc....h.......j...N..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-KC6IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	5.137751613708224
Encrypted:	false
SSDEEP:	192:zO+YPEK/hQEyPoy4jp58rq5eqYNzbSdDKhRWBh3JtT0uSyv:asy8rOYNzeKRuJ05a
MD5:	BF5A056D18D6EF7FE75067B0977D73B7
SHA1:	2FC4742B30C05597C4C973D8A7ABB134FEAA6098
SHA-256:	A857DC2C676228CC4DC9C710F8064ECF88BB3A9D401F18028783D6E928BEC41E
SHA-512:	F03CBECD22A6421B92C591FF3B8C1C3E71BE523F486044C8DB8AAEFCF74EF4E118F6CDDEC81E0F39815CE59771AB3251D9F74F8054BAD3A94713E20BC5FE9258
Malicious:	false
Preview:	! $Xorg: XKeysymDB,v 1.3 2000/08/17 19:45:04 cpqbld Exp $.! Copyright 1993 Massachusetts Institute of Technology.!.! Permission to use, copy, modify, distribute, and sell this software and.! its documentation for any purpose is hereby granted without fee, provided.! that the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation, and that the name of M.I.T. not be used in advertising or.! publicity pertaining to distribution of the software without specific,.! written prior permission. M.I.T. makes no representations about the.! suitability of this software for any purpose. It is provided "as is".! without express or implied warranty..!.! $XFree86: xc/lib/X11/XKeysymDB,v 3.16 2003/02/11 02:51:10 dawes Exp $..hpmute_acute..:100000A8.hpmute_grave..:100000A9.hpmute_asciicircum.:100000AA.hpmute_diaeresis.:100000AB.hpmute_asciitilde.:100000AC.hplira...:100000AF.hpguilder..:100000BE.hpYdiaeresis..:10

C:\Program Files (x86)\Xming\is-M36O7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	299008
Entropy (8bit):	6.592965073031339
Encrypted:	false
SSDEEP:	6144:jpqg3aFy1R6UAUHMfN/ydVt448GKlZF3jWM8602z6Sq991xnxrwc:ITy/6T/fEVt4s3U6f1vV
MD5:	A873014ED92F2B618D24A7DD6296E484
SHA1:	2BE625EF787DD5666477B3DF81C7E88BCCCB3175
SHA-256:	EAC13EB482B2E50B626B280DA4AF678DAB19DAF46F0C01BE8276D60DFC1CD8AD
SHA-512:	11305C6B9BD4C3720D329129E3B28582550A9D7208DFFBFFC1D3A5236DF2B89C257779D1DCF7E5FAA63CD163D218E99E5B2A771194F5B97504878AAAA463C1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,8F...............8.".......:...........@....@.................................4T........ .................................`.......Pl...........................................................................................................text....!......."..................`..`.data...P....@.......&..............@....rdata..`....P.......*..............@..@.bss.....8...@...........................idata..`...........................@....rsrc...Pl.......n..."..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-MIVKN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:4NNJ:ANJ
MD5:	B8419160170A41AE01ABAB13A3B887DF
SHA1:	EA75706155CFFED0A1BD43DDBA4543DA27D73A67
SHA-256:	D906AECB61D076A967D9FFE8821C7B04B063F72DF9D9E35B33EF36B1C0D98F16
SHA-512:	174B7D983472D1087FA530E893450BCB4AA7737113018FDC30E9894FC8017FF2AC0D7590BD13F214D0B61480069C4E6C4BB84B155BD62975B09C0DF517491646
Malicious:	false
Preview:	localhost.

C:\Program Files (x86)\Xming\is-N9TOO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	6.007853549593218
Encrypted:	false
SSDEEP:	384:mEpbJJMT+oIlhXIXFCPZUx25aEKRAV+F/vmw65wN6fsQn1n7a2iH32JuRXge6Zbw:mEpVJeonYXFCRUxJnqNfDn7XiH3Yau
MD5:	89C46CB0E159B34E4F19C47CA2D49A8C
SHA1:	D6BE559E20E9078610FF38B3C08977331141AECA
SHA-256:	210286E517AD62130C967E7E686E290487D77FEB51E4E9B275A2620CA9450E38
SHA-512:	D4A973929C95F88580924E529FC8C7C81FC7DDD3A66649016089404ABAF6B4A683ADCE29B540FA48F319C82AE93D295AFCABC6F4AF796B9C93016F7AA53B35B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+..F...........#...8.N...t......`........`....Hb.......................................... .................................d.......\............................................................................................................text....M.......N..................`..`.data...`....`.......R..............@....rdata..0....p.......T..............@..@.bss.....................................edata...............V..............@..@.idata..d............f..............@....rsrc...\............n..............@....reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-NF5IN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	5.12909801577702
Encrypted:	false
SSDEEP:	768:xwXEBpShpq9KB5dr4zs0lM2Jsn+o5dJB4FYlmR+iz/rrXCxDz:xwUB8hF5o+asn+o5d/4FYl27jGxDz
MD5:	DDA147704A1EE890A38646A67E115B09
SHA1:	B0AA55221C73B4EE2A975AACC879643C64C1E7FD
SHA-256:	8B8699CEC8D47F0B02182EC56B6E3ADEA84E7096256114B1E63B400AF3711463
SHA-512:	29435D7EE96C3B89D7C4B6D5B29A67484953CEC4EBAD0D3DC01482166EFA0685F0B620BCE66C1CB3D480F26519DFA4C9A55172E7ED474FC98C94743D5C8E1C4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......F...............8. ...................0....@.................................\i........ ..............................`.......p...t...........................................................................................................text............ ..................`..`.data...`....0.......$..............@....rdata.......@.......&..............@..@.bss.........P...........................idata.......`.......,..............@....rsrc....t...p...v...4..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-RUM8N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	115092
Entropy (8bit):	7.808550646475096
Encrypted:	false
SSDEEP:	3072:Vxdd7hlcFfd4jVbzcRAA0NIylLflSP3dIRL9i:VxddPcL4j9IRqNIwi
MD5:	B45D44EEAB4C2A77BF5EB491DB07DA59
SHA1:	ABBD9C8B2B7AC54BD8EE8D271A60CDD2D5CAA444
SHA-256:	BE0F8D6C78D892BED207A1DEE7A91B257972E5D0A52B1E7DB14ED04E80E04491
SHA-512:	FFF410213EA1C0D1C240830E107EF5D29CD71E88BDE1DBD1AA6DF5757502590642376A6B5F4534FD6C670E28C579050078E3E7449327EA520AE2C7D845C7F9CC
Malicious:	false
Preview:	ITSF....`.......N..........\|.{.......".....\|.{......."..`...............x.......T.......................................ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR...j.../#ITBITS..../#IVB...c4./#STRINGS.....[./#SYSTEM..V.4./#TOPICS...j.p./#URLSTR.....h./#URLTBL...Z.T./$FIftiMain...e..../$OBJINST...J.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...F../$WWKeywordLinks/..../$WWKeywordLinks/Property...B../common.css...R.g./IDH_CLIENTS.htm..'.<./IDH_CLIPBOARD.htm...X.i./IDH_DISPLAY.htm....../IDH_FINISH.htm...A.M./IDH_PROGRAM.htm..c.../IDH_XDMCP.htm...c.u./moin-www.png......./PuTTY1.jpg.....z./PuTTY1.png...$.o./PuTTY1a.jpg...,.#./PuTTY1a.png......./PuTTY2.jpg...&.)./PuTTY2.png...O.W./PuTTY3.jpg...C.../PuTTY3.png...O.t./PuTTY4.jpg...{.W./PuTTY4.png...B.9./screen.css...9.../X2.bmp...W.../XLaunch.hhc...../XLaunch.txt.....+.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....>,::DataSpace/Stora

C:\Program Files (x86)\Xming\is-SB758.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2106368
Entropy (8bit):	6.824895692087127
Encrypted:	false
SSDEEP:	24576:cKmTvi55n/P6kZUl2wAr6NMLEOFcSe6rINIZA4wkyt2kZU7mSpX8ir8sx3GGfxRV:ZikZ02aecSenXc2U9pX8d+/lhV3
MD5:	2118E06C1667CDEF92CB5977D9CC8534
SHA1:	EA01719FCE83C6D0EDBD93D7CD9EE3F375413497
SHA-256:	93A837C2469A96A3DF28056F8BFFCE15B8F70E86CAF257A91584BB41973A8C8E
SHA-512:	D87B67CF2FFC7E5EA33B04FE62C757082321942256F15E52055279CF3D8B2388DF8DE7245FFAF1D02C3CF08745F7326EDD184AC4B0E417E2D4C862E947BCF164
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8..... ...................@..........................@".....[. ....... ..............................`!..H....!..............................................................................................................text...............................`..`.data...`~..........................@....rdata..`....`.......R..............@..@.bss....P....`...........................idata...H...`!..J...N..............@....rsrc.........!.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\is-SPB6G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	5.087913824532092
Encrypted:	false
SSDEEP:	48:XzfP/bF0m00C8c05HZC+Vr0CMzhq4WcRYz1vs5obAVETWveftPZ6W6FszA:X7r+CTFZCqTShq4WcOz1vxK3effYuA
MD5:	4FD9DD51F25578D629D092468DE8925E
SHA1:	868EC275833C09AB2F0B65D25DC43CA55548C1D0
SHA-256:	36E4D48F2931D48AFD839FA0DD6100937B3A04890C8AE0FA4E8055631986213A
SHA-512:	0D865AF9EF4A6477A5D2B3A846DF20F6FBDD003344D95180092DB9672AF37F2A61F421E1E4259EDAA52F3A07AB7EB87FC15C80CCA7D24526B46F29C6CAFA8AF1
Malicious:	false
Preview:	# Xming Server Resource File - EXAMPLE.# Earle F. Philhower, III..# Place in C:\Program Files\Xming\Xmingrc..# Keywords are case insensitive, comments legal pretty much anywhere.# you can have an end-of-line..# Comments begin with "#" or "//" and go to the end-of-line..# Paths to icons are WINDOWS based (i.e. c:\windows\icons)..# Menus are defined as....# MENU <name> {.#.<Menu Text>.EXEC.<command>.#....^^ Create a process for the command without a console.# or.<Menu Text>.EXECD.<command>.#....^^ Create a process for the command with a console.# or.<Menu Text>.MENU.<name-of-some-prior-defined-menu>.# or.<Menu Text>.ALWAYSONTOP.# ^^ Sets the window to display above all others.# or <Menu Text>.RELOAD.# ^^ Causes Xmingrc file.# to be reloaded and icons and menus regenerated.# or.SEPARATOR.# ....# }..# Set the taskmar menu with.# ROOTMENU <name-of-some-prior-defined-menu>..# If you want a menu to be

C:\Program Files (x86)\Xming\is-TMEU4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	17371
Entropy (8bit):	4.708589475815843
Encrypted:	false
SSDEEP:	384:49jf0Kv7lpt3oQiJoGiW1pfdVzg5jdmK9RABxCyPhccrsiq4wCoOmAMbA:4BdbGiWvUTqzPqcrslA
MD5:	4896B3E3380A6A2AF1920709BC31B140
SHA1:	6EE6212C18619D4B0EDD54B7D259314FC4170D8A
SHA-256:	9B7B5F0B798A4A8AEB27F7E040E6FB05830E95BCFB7F6E53CC4710D0B2680FC0
SHA-512:	992ECE273EE78647A53169134363D185A58B0E583F977757970E341CF6D64C8D0C71C9057935523BDE062C8E6A4B4BA637E43BA5792409C869194E651D0C3C77
Malicious:	false
Preview:	! $Xorg: rgb.txt,v 1.3 2000/08/17 19:54:00 cpqbld Exp $.255 250 250..snow.248 248 255..ghost white.248 248 255..GhostWhite.245 245 245..white smoke.245 245 245..WhiteSmoke.220 220 220..gainsboro.255 250 240..floral white.255 250 240..FloralWhite.253 245 230..old lace.253 245 230..OldLace.250 240 230..linen.250 235 215..antique white.250 235 215..AntiqueWhite.255 239 213..papaya whip.255 239 213..PapayaWhip.255 235 205..blanched almond.255 235 205..BlanchedAlmond.255 228 196..bisque.255 218 185..peach puff.255 218 185..PeachPuff.255 222 173..navajo white.255 222 173..NavajoWhite.255 228 181..moccasin.255 248 220..cornsilk.255 255 240..ivory.255 250 205..lemon chiffon.255 250 205..LemonChiffon.255 245 238..seashell.240 255 240..honeydew.245 255 250..mint cream.245 255 250..MintCream.240 255 255..azure.240 248 255..alice blue.240 248 255..AliceBlue.230 230 250..lavender.255 240 245..lavender blush.255 240 245..LavenderBlush.255 228 225..misty rose.255 228 225..MistyRose.255 255 255..white

C:\Program Files (x86)\Xming\is-UTJTO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	4.716105414364201
Encrypted:	false
SSDEEP:	48:VSz76wJ/3Gq/asY/IEn/DMgqXZ0cI9hqf6Nwa71i6qmp:wGwZTO1DMgMhIDqfuNh
MD5:	9B002D6BC6A2579A279CCA956E63607B
SHA1:	625B14626556D7925A83861B1D2ABB19880B4124
SHA-256:	B192A16AC0AA533DD089515EF1BE7CE7C3227F488C44921C4BAE8CEEE0CE7AE0
SHA-512:	979D79A75729F3F1CFB66EC1461BB909080E64DB71CA404A84C71279FB266AD2E5CB5EBEC29871F99FC62E4F37534A1862B0963FCBFBB354A36FB99E43CD0E7D
Malicious:	false
Preview:	<?xml version="1.0"?>. XLaunch.xsd -->. File version 6.9.0.25 -->. Copyright (c) 2006-2007 Colin Harrison -->.<xs:schema. xmlns:tns="http://www.straightrunning.com/XmingNotes". attributeFormDefault="unqualified" elementFormDefault="qualified". targetNamespace="http://www.straightrunning.com/XmingNotes". xmlns:xs="http://www.w3.org/2001/XMLSchema">. <xs:element name="XLaunch">. <xs:complexType>. <xs:attribute name="WindowMode" use="required">. <xs:simpleType>. <xs:restriction base="xs:string">. <xs:enumeration value="MultiWindow"/>. <xs:enumeration value="Fullscreen"/>. <xs:enumeration value="Windowed"/>. <xs:enumeration value="Nodecoration"/>. </xs:restriction>. </xs:simpleType>. </xs:attribute>. <xs:attribute name="ClientMode" use="required">. <xs:simpleType>. <xs:restriction base="xs:string">. <xs:enumeration value="NoClient"/>. <xs:enum

C:\Program Files (x86)\Xming\libfreetype-6.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.7585626123594675
Encrypted:	false
SSDEEP:	6144:8aHTqqZCk04kwWy7c/tqhpORb5GHHu4hgCWbVDq5k2KwrgAgGvgX:8aHTlkOBA/tqcb5GHO6gBbN2LgAN4
MD5:	65C14DA6870229953D7C6395AF17AB0A
SHA1:	8DD4821278E8F860E89CC44E3DE8F4D3960C7912
SHA-256:	D673921F0B2471A8D66413B3F524601D5F64F7B26C2C0031D3DD37DCA38514E5
SHA-512:	9F40B23C9069667754161EB429060A91A63837517E49F28F5ACCD16E820FCF1F4F25E4BFFDAAEBDF5E16E6ADAAE9E7F351B211BE268C00D3A81E3589599580C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V.:F...........#...8.....\|......`..............l................................@......... ..........................#..............$............................................................................................................text...............................`..`.data...............................@....rdata...`.......b..................@..@.bss.........p...........................edata...#.......$...@..............@..@.idata...............d..............@....rsrc...$............h..............@....reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\locale\C\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	772
Entropy (8bit):	5.404095609177563
Encrypted:	false
SSDEEP:	12:FLEavtuttckJWrRdsnbXE2XiIJMhRDYblcjdRahwqfDJ7/tRlGmvX7F6R9k:FLEa1ILEIMeQQwqfDJ7/tfGm/7F6zk
MD5:	7299CE6B3A61885DFCA9C22EE8E4798D
SHA1:	C50E284CEDE480553DE8B1B791CA91A6DDF9CE9E
SHA-256:	BC6D6BD06243674622B8974C97F3AD0ED4A591AB6AB0FB052F47A31DDEEAC577
SHA-512:	E056D8924B0DBCD78132C2E341BD4535189AF8606E3913F88E610E84AD9E07D20E284DA66892C27AA384C26A4A2DF95C0F728A48BA01A5CCF2E19FCD38CFF3E8
Malicious:	false
Preview:	# $Xorg: C,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.# XLocale Database Sample for C..# $XFree86: xc/nls/XLC_LOCALE/C,v 1.3 2000/02/25 21:02:32 dawes Exp $.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..STRING.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\C\is-O5JQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	772
Entropy (8bit):	5.404095609177563
Encrypted:	false
SSDEEP:	12:FLEavtuttckJWrRdsnbXE2XiIJMhRDYblcjdRahwqfDJ7/tRlGmvX7F6R9k:FLEa1ILEIMeQQwqfDJ7/tfGm/7F6zk
MD5:	7299CE6B3A61885DFCA9C22EE8E4798D
SHA1:	C50E284CEDE480553DE8B1B791CA91A6DDF9CE9E
SHA-256:	BC6D6BD06243674622B8974C97F3AD0ED4A591AB6AB0FB052F47A31DDEEAC577
SHA-512:	E056D8924B0DBCD78132C2E341BD4535189AF8606E3913F88E610E84AD9E07D20E284DA66892C27AA384C26A4A2DF95C0F728A48BA01A5CCF2E19FCD38CFF3E8
Malicious:	false
Preview:	# $Xorg: C,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.# XLocale Database Sample for C..# $XFree86: xc/nls/XLC_LOCALE/C,v 1.3 2000/02/25 21:02:32 dawes Exp $.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..STRING.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\armscii-8\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	4.959920770119443
Encrypted:	false
SSDEEP:	6:LeEL5kc/OetdtmXgHuvr/rB/Whz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LzRvtShge6ldo0+62XdUmhn
MD5:	734BD8D184E0F87BD064FD791C528806
SHA1:	565030D9976142C5D548669E01FB136330EF154C
SHA-256:	BD0259B97ED29830AD3F931F44C6EA2F4F88CFFE865511B6D839FDB04E356CD8
SHA-512:	0FE5171FC86F2FACF9798D20B4C51110B28E004DF451D290048511894A5658696AA5C800FF118D93F127141852B5E80DF2531B385494D9C55877F7328E42B54B
Malicious:	false
Preview:	#.# ARMSCII-8 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/armscii-8,v 1.1 1999/08/28 09:00:33 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\armscii-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.3758308516597
Encrypted:	false
SSDEEP:	24:a12X7WET28Xvt1v4uO4eXQ+fDJ7/q7GGm/7Fvc:a1c5Txv4uOxNwl
MD5:	A6B10E0FD46BA376356071E959B99E30
SHA1:	CBD416FE31AB971B5FE6316AB0E906A2067E6CFB
SHA-256:	BB8F5E15A89C58DEA45A2EC08A1F719AF24EF143FFE98AF2645CE1B584DE7F09
SHA-512:	9FA97BB5892EFFA5C1291BE1DEFBA4DCA598B6E0997683EF1715E9DE43A174BE9B12D9774C718A6F3FC62096EC2F62331D7A4413036B2B5A0E088C45239A2E3B
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/armscii-8,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for armscii-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ARMSCII-8:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ARMSCII-8:GR..font ARMSCII-8:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ARMSCII-8..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ARMSCII-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ARMSCII-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ARMSCII-8:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\armscii-8\is-5KA88.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.3758308516597
Encrypted:	false
SSDEEP:	24:a12X7WET28Xvt1v4uO4eXQ+fDJ7/q7GGm/7Fvc:a1c5Txv4uOxNwl
MD5:	A6B10E0FD46BA376356071E959B99E30
SHA1:	CBD416FE31AB971B5FE6316AB0E906A2067E6CFB
SHA-256:	BB8F5E15A89C58DEA45A2EC08A1F719AF24EF143FFE98AF2645CE1B584DE7F09
SHA-512:	9FA97BB5892EFFA5C1291BE1DEFBA4DCA598B6E0997683EF1715E9DE43A174BE9B12D9774C718A6F3FC62096EC2F62331D7A4413036B2B5A0E088C45239A2E3B
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/armscii-8,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for armscii-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ARMSCII-8:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ARMSCII-8:GR..font ARMSCII-8:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ARMSCII-8..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ARMSCII-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ARMSCII-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ARMSCII-8:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\armscii-8\is-SB3PK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	4.959920770119443
Encrypted:	false
SSDEEP:	6:LeEL5kc/OetdtmXgHuvr/rB/Whz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LzRvtShge6ldo0+62XdUmhn
MD5:	734BD8D184E0F87BD064FD791C528806
SHA1:	565030D9976142C5D548669E01FB136330EF154C
SHA-256:	BD0259B97ED29830AD3F931F44C6EA2F4F88CFFE865511B6D839FDB04E356CD8
SHA-512:	0FE5171FC86F2FACF9798D20B4C51110B28E004DF451D290048511894A5658696AA5C800FF118D93F127141852B5E80DF2531B385494D9C55877F7328E42B54B
Malicious:	false
Preview:	#.# ARMSCII-8 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/armscii-8,v 1.1 1999/08/28 09:00:33 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\compose.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26942
Entropy (8bit):	5.091757422799471
Encrypted:	false
SSDEEP:	192:5kXDLgalTaYPligbgQy3MZY5uoeIt21aEkkXeoFuGq4qe5Yo0xj:5SFlTaYPligbYcGEoeIt21aEkWqU0xj
MD5:	32C20184F1D8E007382D6DF6F77B17E3
SHA1:	CD8329F5DFF991B205213607F9F5495934553D34
SHA-256:	5B13778EEBA3B8BB1320BF60D747CDB397078129785E8990CC8A1EC7576E062D
SHA-512:	FF79525A044AF8E2D1DA0F8A28F44CCBAD0348A6D8368229BFB90F32A4C0F1C35A34218FA725C17E360F6AA5AA1820F1E745E3830D2AF47955B50C267EE00AC3
Malicious:	false
Preview:	# $Xorg: compose.dir,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains compose table file name..#.The first word is the compose table file name and.#.the second word is full locale name..#.# $XFree86: xc/nls/compose.dir,v 1.24 2003/08/06 14:04:00 eich Exp $.#.iso8859-1/Compose..C.iso8859-1/Compose..af_ZA.ISO8859-1.iso8859-6/Compose..ar_AA.ISO8859-6.iso8859-6/Compose..ar_BH.ISO8859-6.iso8859-6/Compose..ar_DZ.ISO8859-6.iso8859-6/Compose..ar_EG.ISO8859-6.iso8859-6/Compose..ar_IQ.ISO8859-6.iso8859-6/Compose..ar_JO.ISO8859-6.iso8859-6/Compose..ar_KW.ISO8859-6.iso8859-6/Compose..ar_LB.ISO8859-6.iso8859-6/Compose..ar_LY.ISO8859-6.iso8859-6/Compose..ar_MA.ISO8859-6.iso8859-6/Compose..ar_OM.ISO8859-6.iso8859-6/Compose..ar_QA.ISO8859-6.iso8859-6/Compose..ar_SA.ISO8859-6.iso8859-6/Compose..ar_TN.ISO8859-6.iso8859-6/Compose..ar_YE.ISO8859-6.iso8859-9e/Compose..az_AZ.ISO8859-9E.koi8-c/Compose...a3_AZ.KOI8-C.microsoft-cp1251/Compose.be_BY.CP1251.iso8859-5/Compose..bg_BG.ISO8859-5.microso

C:\Program Files (x86)\Xming\locale\el_GR.UTF-8\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	92932
Entropy (8bit):	4.875129618541308
Encrypted:	false
SSDEEP:	1536:t1lxPaY3ULLgSFBbex53eousabTz7jjZX5ZzP:t169LgSFBbex53eousabTz7jj9
MD5:	CDB52F5273385D9ED35F09C3F329248D
SHA1:	B0AEF5AD7D44EF004DAC63F57CA564BAC717A18D
SHA-256:	ECAB7FD4002A4E8C23F417F08CA4ED71F89D8C201F5356C065086FEBED48BAB4
SHA-512:	ADB1C36EC1C48DE68EEB4710ADDFE1C6403334D5839F7A54E7BC6D1E06C54FE42CC3D386471DFFD03E23D8B88FACCC73A7C4F25FDFF4650494A0DE8379651B98
Malicious:	false
Preview:	#.# $XFree86$.#.# UTF-8 compose sequence definitions for the greek keyboard layout..#.# This file is mostly meant to be used along with the xkb/symbols/el.# symbols definition file. In addition, the dead key definitions in.# the machine generated part are really only relevant to the.# "polytonic" variant in that file..#.# The definitions herein cover the following ISO 10646 / Unicode.# ranges:.#.- Basic Latin (0000-007F) (complete coverage).#.- Latin-1 Supplement (0080-00FF) (complete coverage).#.- Greek and Coptic (0370-03FF) (only the big ISO 8859-7 based.#. part at the beginning).#.- Greek Extended (1F00-1FFF) (complete coverage).#.- There are also six (6) characters from other ranges..# Moreover, the following character sets are completely covered:.#.- ISO 8859-1.#.- ISO 8859-7.#.# This file consists of four parts. Two of them have been adapted from.# the iso8859-1/Compose and iso8859-7/Compose files. The other two.# parts have been created by:.#.Vasilis Vasaitis <vvas@hal.csd.aut

C:\Program Files (x86)\Xming\locale\el_GR.UTF-8\is-FTQ4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	92932
Entropy (8bit):	4.875129618541308
Encrypted:	false
SSDEEP:	1536:t1lxPaY3ULLgSFBbex53eousabTz7jjZX5ZzP:t169LgSFBbex53eousabTz7jj9
MD5:	CDB52F5273385D9ED35F09C3F329248D
SHA1:	B0AEF5AD7D44EF004DAC63F57CA564BAC717A18D
SHA-256:	ECAB7FD4002A4E8C23F417F08CA4ED71F89D8C201F5356C065086FEBED48BAB4
SHA-512:	ADB1C36EC1C48DE68EEB4710ADDFE1C6403334D5839F7A54E7BC6D1E06C54FE42CC3D386471DFFD03E23D8B88FACCC73A7C4F25FDFF4650494A0DE8379651B98
Malicious:	false
Preview:	#.# $XFree86$.#.# UTF-8 compose sequence definitions for the greek keyboard layout..#.# This file is mostly meant to be used along with the xkb/symbols/el.# symbols definition file. In addition, the dead key definitions in.# the machine generated part are really only relevant to the.# "polytonic" variant in that file..#.# The definitions herein cover the following ISO 10646 / Unicode.# ranges:.#.- Basic Latin (0000-007F) (complete coverage).#.- Latin-1 Supplement (0080-00FF) (complete coverage).#.- Greek and Coptic (0370-03FF) (only the big ISO 8859-7 based.#. part at the beginning).#.- Greek Extended (1F00-1FFF) (complete coverage).#.- There are also six (6) characters from other ranges..# Moreover, the following character sets are completely covered:.#.- ISO 8859-1.#.- ISO 8859-7.#.# This file consists of four parts. Two of them have been adapted from.# the iso8859-1/Compose and iso8859-7/Compose files. The other two.# parts have been created by:.#.Vasilis Vasaitis <vvas@hal.csd.aut

C:\Program Files (x86)\Xming\locale\en_US.UTF-8\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	558518
Entropy (8bit):	5.368803801727249
Encrypted:	false
SSDEEP:	6144:Wmjr85ev3x9U07EbF+Hos2Khh49ISCL+abU+iifP+8hkbscP+4b:hCb
MD5:	1FA8979775CAA316C79494BDE37D51E0
SHA1:	8CDBCCC71EDCCEF70CD14C03A616A18E4A557948
SHA-256:	92AEF5852CD9D8D132A046CF3AB69F86540DD8EB0D7DCF58C67DD810F59D1882
SHA-512:	211B2A63DF1B35571351AC7B4BF2D087EDDAD2EFD047993AD04B5937264A04E2831E5825D576FA74E0236BC6B9B460B13BE02BF019CC0F94DB728ECA63FCD06A
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#.# $XFree86: xc/nls/Compose/en_US.UTF-8,v 1.11 2004/01/06 13:14:04 pascal Exp $..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space> .: "~" asciitilde # TILDE.<dead_tilde> <dead_tilde> .: "~" asciitilde # TILDE.<dead_acute> <space> .: "'" apostrophe # APOSTROPHE.<dead_acute> <dead_acute> .: "." acute # ACUTE ACCENT.<dead_grave> <space> .: "`" grave # GRAVE ACCENT.<dead_grave> <dead_grave> .: "`" grave # GRAVE ACCENT.<dead_circumflex> <space> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_circumflex> <dead_circumflex> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_abovering> <space> .: "." degree # DEGREE SIGN.<dead_abovering> <dead_abovering> .: "." degree # DEGREE SIGN.<dead_macron> <space> .: "." macron # MACRON.<dead_macron> <dead_macron> .: "." macron # MACRON.<dead_breve> <spa

C:\Program Files (x86)\Xming\locale\en_US.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	5.261197037203482
Encrypted:	false
SSDEEP:	48:a1RwdZj2V3bkptsH/N87etUwdGuAD44FOu8aj6xdC8e:XGF87eiz
MD5:	1E1234BDA58B06AD9AF725662021C4E7
SHA1:	BABC70FF171D8CD30AA31B790837BFD80D6A69A5
SHA-256:	E8E5D71F31EF9A07C2DD14FBA033CDFB6AD0B9680941FCDD1FD0D7C007816CB2
SHA-512:	321CFD224893B9F9DCD966FF5D9176D5DAC4074132BD643E6C8E9BAB452C1AEB98485E02EE2B34DAEA7E6968EBD93DBEF4D39CA56D526F34756C53B2713B32DB
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/en_US.UTF-8,v 1.2 2000/02/29 03:09:07 dawes Exp $.# XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.#.ISO10646 should come last so the fonts above will actually be u

C:\Program Files (x86)\Xming\locale\en_US.UTF-8\is-EDGQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	5.261197037203482
Encrypted:	false
SSDEEP:	48:a1RwdZj2V3bkptsH/N87etUwdGuAD44FOu8aj6xdC8e:XGF87eiz
MD5:	1E1234BDA58B06AD9AF725662021C4E7
SHA1:	BABC70FF171D8CD30AA31B790837BFD80D6A69A5
SHA-256:	E8E5D71F31EF9A07C2DD14FBA033CDFB6AD0B9680941FCDD1FD0D7C007816CB2
SHA-512:	321CFD224893B9F9DCD966FF5D9176D5DAC4074132BD643E6C8E9BAB452C1AEB98485E02EE2B34DAEA7E6968EBD93DBEF4D39CA56D526F34756C53B2713B32DB
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/en_US.UTF-8,v 1.2 2000/02/29 03:09:07 dawes Exp $.# XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.#.ISO10646 should come last so the fonts above will actually be u

C:\Program Files (x86)\Xming\locale\en_US.UTF-8\is-RLA56.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	558518
Entropy (8bit):	5.368803801727249
Encrypted:	false
SSDEEP:	6144:Wmjr85ev3x9U07EbF+Hos2Khh49ISCL+abU+iifP+8hkbscP+4b:hCb
MD5:	1FA8979775CAA316C79494BDE37D51E0
SHA1:	8CDBCCC71EDCCEF70CD14C03A616A18E4A557948
SHA-256:	92AEF5852CD9D8D132A046CF3AB69F86540DD8EB0D7DCF58C67DD810F59D1882
SHA-512:	211B2A63DF1B35571351AC7B4BF2D087EDDAD2EFD047993AD04B5937264A04E2831E5825D576FA74E0236BC6B9B460B13BE02BF019CC0F94DB728ECA63FCD06A
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#.# $XFree86: xc/nls/Compose/en_US.UTF-8,v 1.11 2004/01/06 13:14:04 pascal Exp $..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space> .: "~" asciitilde # TILDE.<dead_tilde> <dead_tilde> .: "~" asciitilde # TILDE.<dead_acute> <space> .: "'" apostrophe # APOSTROPHE.<dead_acute> <dead_acute> .: "." acute # ACUTE ACCENT.<dead_grave> <space> .: "`" grave # GRAVE ACCENT.<dead_grave> <dead_grave> .: "`" grave # GRAVE ACCENT.<dead_circumflex> <space> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_circumflex> <dead_circumflex> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_abovering> <space> .: "." degree # DEGREE SIGN.<dead_abovering> <dead_abovering> .: "." degree # DEGREE SIGN.<dead_macron> <space> .: "." macron # MACRON.<dead_macron> <dead_macron> .: "." macron # MACRON.<dead_breve> <spa

C:\Program Files (x86)\Xming\locale\georgian-academy\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.912361723840168
Encrypted:	false
SSDEEP:	6:L4JKL5kc/OetdtmXwxuvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4J0Rvtewx8+Ye6ldo0+62XdUmhn
MD5:	9B9602BB893112FF7548468116E86E8E
SHA1:	12F872F09F00982684DEB6DB59DAC53FD7735AAB
SHA-256:	74B2A2B0157830B10BDCAE3BD15AEA1E2F03CD61EAB26DAC25C01E0C16047D7A
SHA-512:	3E841B161604B6F0A06DF1D778D900A3132A44BC71D26B44103C4B47DB51B4F23D52565D0FC39D6E6B1911B7E68A9A02AE8E54E6078D8D8631296B6A6230940B
Malicious:	false
Preview:	#.# georgian-academy Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/georgian-academy,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\georgian-academy\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.4085522622518285
Encrypted:	false
SSDEEP:	24:a1daX5WE/28Xl1vcuO4eQ+fDJ7/iGGm/7FFc:a1du5/tvcuObN0p
MD5:	41C421CDBFBFB612F88CF16500CC3605
SHA1:	142204A163DE029B96D712AE773E42B37EE7AE77
SHA-256:	6233031EE4E5E8F11F1A7ABA9606B798D6EF39BEDA83A7A6B44965BD3BDF515F
SHA-512:	54F8D50FF9E3162C45048B1096375C5977C2ECA28DB3E796A4111FBEDC5FA9874F9CFB1BEDA7D7C21834B3822E0A28F1F8777377E76869C99A8EAB59EDDBFD0F
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/georgian-academy,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for georgian-academy.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-ACADEMY:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-ACADEMY:GR..font GEORGIAN-ACADEMY:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-ACADEMY..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-ACADEMY.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-ACADEMY:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x

C:\Program Files (x86)\Xming\locale\georgian-academy\is-2E86Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.4085522622518285
Encrypted:	false
SSDEEP:	24:a1daX5WE/28Xl1vcuO4eQ+fDJ7/iGGm/7FFc:a1du5/tvcuObN0p
MD5:	41C421CDBFBFB612F88CF16500CC3605
SHA1:	142204A163DE029B96D712AE773E42B37EE7AE77
SHA-256:	6233031EE4E5E8F11F1A7ABA9606B798D6EF39BEDA83A7A6B44965BD3BDF515F
SHA-512:	54F8D50FF9E3162C45048B1096375C5977C2ECA28DB3E796A4111FBEDC5FA9874F9CFB1BEDA7D7C21834B3822E0A28F1F8777377E76869C99A8EAB59EDDBFD0F
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/georgian-academy,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for georgian-academy.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-ACADEMY:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-ACADEMY:GR..font GEORGIAN-ACADEMY:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-ACADEMY..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-ACADEMY.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-ACADEMY:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x

C:\Program Files (x86)\Xming\locale\georgian-academy\is-42UEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.912361723840168
Encrypted:	false
SSDEEP:	6:L4JKL5kc/OetdtmXwxuvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4J0Rvtewx8+Ye6ldo0+62XdUmhn
MD5:	9B9602BB893112FF7548468116E86E8E
SHA1:	12F872F09F00982684DEB6DB59DAC53FD7735AAB
SHA-256:	74B2A2B0157830B10BDCAE3BD15AEA1E2F03CD61EAB26DAC25C01E0C16047D7A
SHA-512:	3E841B161604B6F0A06DF1D778D900A3132A44BC71D26B44103C4B47DB51B4F23D52565D0FC39D6E6B1911B7E68A9A02AE8E54E6078D8D8631296B6A6230940B
Malicious:	false
Preview:	#.# georgian-academy Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/georgian-academy,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\georgian-ps\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.90334224638097
Encrypted:	false
SSDEEP:	6:L4BxL5kc/OetdtmX6rvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4FRvteq+Ye6ldo0+62XdUmhn
MD5:	D87B5787AFD8FB6739512AA3B56EB8EE
SHA1:	4554479659DAB42474A85009F7CB45AFD531427E
SHA-256:	5F0441AD47AC8BDCD2B61800FDBFE6E205DEB1ED5987F4F70AB75E3ABA12BDE7
SHA-512:	2828E7B01D415FA66A4BB11157EB1F36F0EE719B3B5A45C96F84F6F6BA4EE488536465FE3273ED591CAE0B7BD112ABBFDC4953A32D287CA75F3C1C8623113891
Malicious:	false
Preview:	#.# georgian-ps Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/georgian-ps,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\georgian-ps\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.38006885366438
Encrypted:	false
SSDEEP:	24:a1FXUWEmo8XjMyv5uO4pQ+fDJ7/coGGm/7Fj/:a1C5gv5uOaN3O
MD5:	815AA540256D810BF72921057B919719
SHA1:	732D81B9F708E9DA1BEC0EA588BFDA69D6CADD5C
SHA-256:	229CF4857354CF9BFF8222D82FA8E512AEE135B4DE082A6ECE611ADDE36A3132
SHA-512:	2494C098A3AD53257D23AA37389EBE954DCF22BB3A5DC354CAE075B88CA276D639D2DA345E5BF186890DE8DCE5A4B4626AE66D64ADB26F9048D35789116ADAC0
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/georgian-ps,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for georgian-ps.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-PS:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-PS:GR..font GEORGIAN-PS:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-PS..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-PS.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-PS:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-P

C:\Program Files (x86)\Xming\locale\georgian-ps\is-12T09.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.90334224638097
Encrypted:	false
SSDEEP:	6:L4BxL5kc/OetdtmX6rvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4FRvteq+Ye6ldo0+62XdUmhn
MD5:	D87B5787AFD8FB6739512AA3B56EB8EE
SHA1:	4554479659DAB42474A85009F7CB45AFD531427E
SHA-256:	5F0441AD47AC8BDCD2B61800FDBFE6E205DEB1ED5987F4F70AB75E3ABA12BDE7
SHA-512:	2828E7B01D415FA66A4BB11157EB1F36F0EE719B3B5A45C96F84F6F6BA4EE488536465FE3273ED591CAE0B7BD112ABBFDC4953A32D287CA75F3C1C8623113891
Malicious:	false
Preview:	#.# georgian-ps Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/georgian-ps,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\georgian-ps\is-4V10R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.38006885366438
Encrypted:	false
SSDEEP:	24:a1FXUWEmo8XjMyv5uO4pQ+fDJ7/coGGm/7Fj/:a1C5gv5uOaN3O
MD5:	815AA540256D810BF72921057B919719
SHA1:	732D81B9F708E9DA1BEC0EA588BFDA69D6CADD5C
SHA-256:	229CF4857354CF9BFF8222D82FA8E512AEE135B4DE082A6ECE611ADDE36A3132
SHA-512:	2494C098A3AD53257D23AA37389EBE954DCF22BB3A5DC354CAE075B88CA276D639D2DA345E5BF186890DE8DCE5A4B4626AE66D64ADB26F9048D35789116ADAC0
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/georgian-ps,v 1.1 1999/06/06 14:05:58 dawes Exp $.# XLocale Database Sample for georgian-ps.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-PS:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-PS:GR..font GEORGIAN-PS:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-PS..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-PS.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-PS:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-P

C:\Program Files (x86)\Xming\locale\ibm-cp1133\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	384
Entropy (8bit):	4.964409383461866
Encrypted:	false
SSDEEP:	6:L2HBxL5kc/Oetdtmf2quvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LmRvtS58+Ye6ldo0+62XdUmhn
MD5:	3B9B91C89241C6AD556B2581C6240BC2
SHA1:	7A1DC2561EFC396C92B26E78AEAE423EF38A9D7E
SHA-256:	A12064AC6866A351426D0419B2D17427D2AE2D1F83E1B24006C19B0A11CA2228
SHA-512:	BEDA74E45A4C7147BBA017FED4DAD3F5F6671B3086FB661430D1DCD6BA93115A53BC3A6C3BB7D62AB88C8A69DD89865DE92DAD67A879AF5D3D0BF8D513BEDD39
Malicious:	false
Preview:	#.# ibm-cp1133 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ibm-cp1133,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ibm-cp1133\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.419220339949335
Encrypted:	false
SSDEEP:	24:a1DcNanWES28XBvLJuO4NQ+fDJ7/WKGGm/7FZ:a1AK5S7vFuOcNWc6
MD5:	A9F38A123F76E46086FE3053C016A3B5
SHA1:	86BE843DD0D6976A737A094914D22F2291EA78BE
SHA-256:	5B8A834E1F06285AF8E502B139F7CAACF957F9D87D8B6459F47672204FD381B6
SHA-512:	D623DCCDD4FB61513D543C041EADBF5143DC1781DD47E5FEF0309C7A65F9E8F9A3D197DE76F2C99C95C761648C317B39269DDC6FAAE6FB872D9945AF15F9CE88
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ibm-cp1133,v 1.1 1999/06/06 14:05:59 dawes Exp $.# XLocale Database Sample for ibm-cp1133..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..IBM-CP1133:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset IBM-CP1133:GR..font IBM-CP1133:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.IBM-CP1133..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name IBM-CP1133.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding IBM-CP1133:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding IBM-CP1133:GR.}..E

C:\Program Files (x86)\Xming\locale\ibm-cp1133\is-UT99T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	384
Entropy (8bit):	4.964409383461866
Encrypted:	false
SSDEEP:	6:L2HBxL5kc/Oetdtmf2quvr/aOhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LmRvtS58+Ye6ldo0+62XdUmhn
MD5:	3B9B91C89241C6AD556B2581C6240BC2
SHA1:	7A1DC2561EFC396C92B26E78AEAE423EF38A9D7E
SHA-256:	A12064AC6866A351426D0419B2D17427D2AE2D1F83E1B24006C19B0A11CA2228
SHA-512:	BEDA74E45A4C7147BBA017FED4DAD3F5F6671B3086FB661430D1DCD6BA93115A53BC3A6C3BB7D62AB88C8A69DD89865DE92DAD67A879AF5D3D0BF8D513BEDD39
Malicious:	false
Preview:	#.# ibm-cp1133 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ibm-cp1133,v 1.1 1999/08/28 09:00:34 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ibm-cp1133\is-VQVMD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.419220339949335
Encrypted:	false
SSDEEP:	24:a1DcNanWES28XBvLJuO4NQ+fDJ7/WKGGm/7FZ:a1AK5S7vFuOcNWc6
MD5:	A9F38A123F76E46086FE3053C016A3B5
SHA1:	86BE843DD0D6976A737A094914D22F2291EA78BE
SHA-256:	5B8A834E1F06285AF8E502B139F7CAACF957F9D87D8B6459F47672204FD381B6
SHA-512:	D623DCCDD4FB61513D543C041EADBF5143DC1781DD47E5FEF0309C7A65F9E8F9A3D197DE76F2C99C95C761648C317B39269DDC6FAAE6FB872D9945AF15F9CE88
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ibm-cp1133,v 1.1 1999/06/06 14:05:59 dawes Exp $.# XLocale Database Sample for ibm-cp1133..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..IBM-CP1133:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset IBM-CP1133:GR..font IBM-CP1133:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.IBM-CP1133..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name IBM-CP1133.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding IBM-CP1133:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding IBM-CP1133:GR.}..E

C:\Program Files (x86)\Xming\locale\is-EK8UO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	32977
Entropy (8bit):	5.097966972962208
Encrypted:	false
SSDEEP:	192:bKnoGJ1c7KLR3rL05Nr2vnhsKLgnUKbQCjc9J/oPzb2xQMBG:afSr2PhqjUBib2SMBG
MD5:	D21C2771B5BC7C08346AA0569A36EF95
SHA1:	6F8D59FC05A95D381CBC7E97900813905F7B4FB8
SHA-256:	46738699395212D66136636C7A4F6360A42AF0F76990ACC5DF485C6B000D237A
SHA-512:	81E48E4DF1C880B3418D362181916953F73A6D40AA34B374F0372C6255E923AE6F8EBB63EEE01664B2A857AB55EC9B8B2DF5705B87D45A841DA85F7971AF3DF8
Malicious:	false
Preview:	#.$XdotOrg: lib/X11/nls/locale.dir.pre,v 1.10 2005-09-30 07:52:46 daniels Exp $.#.$Xorg: locale.dir,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains locale database file names.#.The first word is the locale database file name and.#.the second word is the full locale name..#.#.$XFree86: xc/nls/locale.dir,v 1.44 2003/12/18 04:14:22 dawes Exp $.#..C/XLC_LOCALE....C.iso8859-1/XLC_LOCALE...af_ZA.ISO8859-1.iso8859-6/XLC_LOCALE...ar_AA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_BH.ISO8859-6.iso8859-6/XLC_LOCALE...ar_DZ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_EG.ISO8859-6.iso8859-6/XLC_LOCALE...ar_IQ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_JO.ISO8859-6.iso8859-6/XLC_LOCALE...ar_KW.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LB.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_MA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_OM.ISO8859-6.iso8859-6/XLC_LOCALE...ar_QA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SD.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SY.ISO8859-

C:\Program Files (x86)\Xming\locale\is-QKAUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	78122
Entropy (8bit):	5.109894891927789
Encrypted:	false
SSDEEP:	1536:wX9vu3IOiIjR3a6eIoeULkDHON+89FR0jL:pIJIj0+89a
MD5:	135A00F336C0B3E82DDB2B4E0B577371
SHA1:	9A5D55325661C8672C85C221DE48E0F53179843F
SHA-256:	6FCB7D864366EEF56610400AA35F1172392B32C1E2408BFF0C0C049E23062527
SHA-512:	7F69EF663E68C5BD8E23BEA092C0F273E14A682673DBBD73255C188E6E3DF5CF38FB140F218C662AFE2C09096549A689026111A549785EC33804FDF5EAC35817
Malicious:	false
Preview:	#.$XdotOrg: lib/X11/nls/locale.alias.pre,v 1.12 2005-09-30 07:52:46 daniels Exp $.#.$Xorg: locale.alias,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains alias name of locale..#.Each alias name is described within one line..#.The first word is the alias name (simplified locale name).#.the second word is full locale name..#.#.$XFree86: xc/nls/locale.alias,v 1.65 2004/01/03 03:31:00 dawes Exp $.#..POSIX......C.POSIX-UTF2.....C.C_C.C......C.C.en......C.C.iso88591.....en_US.ISO8859-1.Cextend.....en_US.ISO8859-1.Cextend.en.....en_US.ISO8859-1.English_United-States.437...C.# a3 is not an ISO 639 language code, but in Cyrillic, "Z" looks like "3"..a3......a3_AZ.KOI8-C.a3_AZ......a3_AZ.KOI8-C.a3_AZ.koi8c.....a3_AZ.KOI8-C.af......af_ZA.ISO8859-1.af_ZA......af_ZA.ISO8859-1.af_ZA.iso88591.....af_ZA.ISO8859-1.af_ZA.ISO-8859-1....af_ZA.ISO8859-1.af_ZA.utf8....af_ZA.UTF-8.am......am_ET.UTF-8.am_ET......am_ET.UTF-8.ar......ar_AA.ISO8859-6.ar_AA......ar_AA.ISO8859-6.AR_AA......ar_AA.ISO885

C:\Program Files (x86)\Xming\locale\is-UB8LM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26942
Entropy (8bit):	5.091757422799471
Encrypted:	false
SSDEEP:	192:5kXDLgalTaYPligbgQy3MZY5uoeIt21aEkkXeoFuGq4qe5Yo0xj:5SFlTaYPligbYcGEoeIt21aEkWqU0xj
MD5:	32C20184F1D8E007382D6DF6F77B17E3
SHA1:	CD8329F5DFF991B205213607F9F5495934553D34
SHA-256:	5B13778EEBA3B8BB1320BF60D747CDB397078129785E8990CC8A1EC7576E062D
SHA-512:	FF79525A044AF8E2D1DA0F8A28F44CCBAD0348A6D8368229BFB90F32A4C0F1C35A34218FA725C17E360F6AA5AA1820F1E745E3830D2AF47955B50C267EE00AC3
Malicious:	false
Preview:	# $Xorg: compose.dir,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains compose table file name..#.The first word is the compose table file name and.#.the second word is full locale name..#.# $XFree86: xc/nls/compose.dir,v 1.24 2003/08/06 14:04:00 eich Exp $.#.iso8859-1/Compose..C.iso8859-1/Compose..af_ZA.ISO8859-1.iso8859-6/Compose..ar_AA.ISO8859-6.iso8859-6/Compose..ar_BH.ISO8859-6.iso8859-6/Compose..ar_DZ.ISO8859-6.iso8859-6/Compose..ar_EG.ISO8859-6.iso8859-6/Compose..ar_IQ.ISO8859-6.iso8859-6/Compose..ar_JO.ISO8859-6.iso8859-6/Compose..ar_KW.ISO8859-6.iso8859-6/Compose..ar_LB.ISO8859-6.iso8859-6/Compose..ar_LY.ISO8859-6.iso8859-6/Compose..ar_MA.ISO8859-6.iso8859-6/Compose..ar_OM.ISO8859-6.iso8859-6/Compose..ar_QA.ISO8859-6.iso8859-6/Compose..ar_SA.ISO8859-6.iso8859-6/Compose..ar_TN.ISO8859-6.iso8859-6/Compose..ar_YE.ISO8859-6.iso8859-9e/Compose..az_AZ.ISO8859-9E.koi8-c/Compose...a3_AZ.KOI8-C.microsoft-cp1251/Compose.be_BY.CP1251.iso8859-5/Compose..bg_BG.ISO8859-5.microso

C:\Program Files (x86)\Xming\locale\iscii-dev\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.358373902168428
Encrypted:	false
SSDEEP:	24:a1NybItWEWzO28XtzsYzsivMzruO4szHQ+fDJ7/4zrGGm/7Ftzsv:a1UU59tv6uOrNub
MD5:	CAD345314600C1D452AF9BDFEB49BD98
SHA1:	1634EEB4FDEA12867B2F675BAAD3FD94243379FF
SHA-256:	7363312FE953271B061EE71C28E77C266905FDB1E92F5DB4A37E5CFEC8F0B9D3
SHA-512:	18161A51025172ACC1BA318BDBE962AEA76BE70C29C7436927AAE6FD6A9CDA9D21F8D14070587B776D26B6490CB361C4AB3ADB1C6D6753BB3AD6BD8D849A946C
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/iscii-dev,v 1.1 2000/10/27 18:30:53 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISCII-DEV:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISCII-DEV:GR..font ISCII-DEV:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISCII-DEV..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISCII-DEV.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISCII-DEV:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISCII-DEV:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\iscii-dev\is-0MOH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.358373902168428
Encrypted:	false
SSDEEP:	24:a1NybItWEWzO28XtzsYzsivMzruO4szHQ+fDJ7/4zrGGm/7Ftzsv:a1UU59tv6uOrNub
MD5:	CAD345314600C1D452AF9BDFEB49BD98
SHA1:	1634EEB4FDEA12867B2F675BAAD3FD94243379FF
SHA-256:	7363312FE953271B061EE71C28E77C266905FDB1E92F5DB4A37E5CFEC8F0B9D3
SHA-512:	18161A51025172ACC1BA318BDBE962AEA76BE70C29C7436927AAE6FD6A9CDA9D21F8D14070587B776D26B6490CB361C4AB3ADB1C6D6753BB3AD6BD8D849A946C
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/iscii-dev,v 1.1 2000/10/27 18:30:53 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISCII-DEV:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISCII-DEV:GR..font ISCII-DEV:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISCII-DEV..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISCII-DEV.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISCII-DEV:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISCII-DEV:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\isiri-3342\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.393087814603468
Encrypted:	false
SSDEEP:	24:a1uitWEo8XjvouO4RwQ+fDJ7/eGGm/7F+:a1n5LvouOXN4V
MD5:	995C363FAC851A4FDFCC378BF07468E6
SHA1:	1BC4C636532DC202D10012651FBCB6D2BA38E9FB
SHA-256:	1C8DF52643916D5A1EFA423145CA3D10F0C249B9AC55CF16AFF20D75C724023B
SHA-512:	AA7AD6CB00719825C5124BB58C677C9FAC15A63A2A590E4542702428A5A2F2B6735AFAE00D30D75BA443643FB44E93208FC75DAA969C4C7ECCE83C8274551557
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/isiri-3342,v 1.1 2000/10/27 18:30:55 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISIRI-3342:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISIRI-3342:GR..font ISIRI-3342:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISIRI-3342..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISIRI-3342.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISIRI-3342:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISIRI-3342:GR.}..E

C:\Program Files (x86)\Xming\locale\isiri-3342\is-RA94O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.393087814603468
Encrypted:	false
SSDEEP:	24:a1uitWEo8XjvouO4RwQ+fDJ7/eGGm/7F+:a1n5LvouOXN4V
MD5:	995C363FAC851A4FDFCC378BF07468E6
SHA1:	1BC4C636532DC202D10012651FBCB6D2BA38E9FB
SHA-256:	1C8DF52643916D5A1EFA423145CA3D10F0C249B9AC55CF16AFF20D75C724023B
SHA-512:	AA7AD6CB00719825C5124BB58C677C9FAC15A63A2A590E4542702428A5A2F2B6735AFAE00D30D75BA443643FB44E93208FC75DAA969C4C7ECCE83C8274551557
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/isiri-3342,v 1.1 2000/10/27 18:30:55 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISIRI-3342:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISIRI-3342:GR..font ISIRI-3342:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISIRI-3342..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISIRI-3342.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISIRI-3342:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISIRI-3342:GR.}..E

C:\Program Files (x86)\Xming\locale\iso8859-10\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.96971326301161
Encrypted:	false
SSDEEP:	6:LWBkL5kc/OetdtmWvqvr/d2hhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCKRvtlYRCe6ldo0+62XdUmhn
MD5:	C723FA222B6626620472613D1940C09A
SHA1:	6B963418B42ADE3420F1158905F865E11C2DD837
SHA-256:	36F0FB6856A8BFAC6A6B0797B07678B75B64A2051CA93E6F36A06F18EE63FC56
SHA-512:	F48ED2E46AEAAE4A0E35A8C3AEE49C893F21200D20BB28C427C01D73BDA9800F6935DDBA347B3233DC9649569892A552866B3C0447817868A4DC4C987A94EB1B
Malicious:	false
Preview:	#.# ISO 8859-10 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-10,v 1.1 1999/08/28 09:00:35 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-10\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	848
Entropy (8bit):	5.320212273977771
Encrypted:	false
SSDEEP:	12:Paa0wttckJWtevnUXE2q2qXi45UU2vJMhRYFblcjdRahwqfDJ7/tRHcVGmvX7F6S:CfevWEd28NFR8QQwqfDJ7/tlGGm/7F6S
MD5:	CB7A33032AD3F6D660AA8CC2F08542A0
SHA1:	E431AD5A0ED736FE2037E6CF19B483881FF39688
SHA-256:	CCB454B8F9D79F75E6B9C815623E3E12C81E608D4191F0693F4FEA961AD496EC
SHA-512:	93CA0EC71B4AED575B7A3D0AFC6EEBEB704FE3B109108245B31D073059077C893D68DEE9D15550A3BC070BF1E348BF7D8E14D1A502B2BDA493BBDBAF42907B7E
Malicious:	false
Preview:	# $Xorg: iso8859-10,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-10:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-10:GR..}..font.{...primary..ISO8859-10:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-10.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-10:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-10:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-10\is-K5HJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.96971326301161
Encrypted:	false
SSDEEP:	6:LWBkL5kc/OetdtmWvqvr/d2hhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCKRvtlYRCe6ldo0+62XdUmhn
MD5:	C723FA222B6626620472613D1940C09A
SHA1:	6B963418B42ADE3420F1158905F865E11C2DD837
SHA-256:	36F0FB6856A8BFAC6A6B0797B07678B75B64A2051CA93E6F36A06F18EE63FC56
SHA-512:	F48ED2E46AEAAE4A0E35A8C3AEE49C893F21200D20BB28C427C01D73BDA9800F6935DDBA347B3233DC9649569892A552866B3C0447817868A4DC4C987A94EB1B
Malicious:	false
Preview:	#.# ISO 8859-10 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-10,v 1.1 1999/08/28 09:00:35 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-10\is-UA9GS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	848
Entropy (8bit):	5.320212273977771
Encrypted:	false
SSDEEP:	12:Paa0wttckJWtevnUXE2q2qXi45UU2vJMhRYFblcjdRahwqfDJ7/tRHcVGmvX7F6S:CfevWEd28NFR8QQwqfDJ7/tlGGm/7F6S
MD5:	CB7A33032AD3F6D660AA8CC2F08542A0
SHA1:	E431AD5A0ED736FE2037E6CF19B483881FF39688
SHA-256:	CCB454B8F9D79F75E6B9C815623E3E12C81E608D4191F0693F4FEA961AD496EC
SHA-512:	93CA0EC71B4AED575B7A3D0AFC6EEBEB704FE3B109108245B31D073059077C893D68DEE9D15550A3BC070BF1E348BF7D8E14D1A502B2BDA493BBDBAF42907B7E
Malicious:	false
Preview:	# $Xorg: iso8859-10,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-10:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-10:GR..}..font.{...primary..ISO8859-10:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-10.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-10:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-10:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-11\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	882
Entropy (8bit):	5.338298391416329
Encrypted:	false
SSDEEP:	24:ele4YuoUeevWE028NmcY+QQwqfDJ7/taGGm/7F6Ovk:gZYutew50iTw1N63
MD5:	F3C3C2DB2655EF3D58FB48020CDDA02B
SHA1:	0783CB99161E517AC9E39294EDEAB25F4CEF7FC0
SHA-256:	BE8D5C749C1568CEBB869847C87FDCDAE9E3B10B92E7F1BFD945367DC03C5F9F
SHA-512:	34E5743A999AA38D7C3E515654DD4AB7D0F7A4569CD1F00F3B78C17F87F12C967A4D5A8C5A1152B5CF77C9801286FEC46E61838327A41D09AB7FDFD41D960DBD
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-11..# .# Id: xf-cvs20020709-iso8859_11locale.patch,v 1.1 2002/07/09 12:24:01 thep Exp .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-11:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-11:GR..}..font.{...primary..ISO8859-11:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-11.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-11:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-11\is-EPR03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	882
Entropy (8bit):	5.338298391416329
Encrypted:	false
SSDEEP:	24:ele4YuoUeevWE028NmcY+QQwqfDJ7/taGGm/7F6Ovk:gZYutew50iTw1N63
MD5:	F3C3C2DB2655EF3D58FB48020CDDA02B
SHA1:	0783CB99161E517AC9E39294EDEAB25F4CEF7FC0
SHA-256:	BE8D5C749C1568CEBB869847C87FDCDAE9E3B10B92E7F1BFD945367DC03C5F9F
SHA-512:	34E5743A999AA38D7C3E515654DD4AB7D0F7A4569CD1F00F3B78C17F87F12C967A4D5A8C5A1152B5CF77C9801286FEC46E61838327A41D09AB7FDFD41D960DBD
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-11..# .# Id: xf-cvs20020709-iso8859_11locale.patch,v 1.1 2002/07/09 12:24:01 thep Exp .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-11:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-11:GR..}..font.{...primary..ISO8859-11:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-11.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-11:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-13\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20425
Entropy (8bit):	4.732410569345669
Encrypted:	false
SSDEEP:	192:zvSofeBbHUmnQRu6Oa8nR8JAcJgBpxm8aTSOlCQ68NO7YUsRHHh5dBpod+Zk76wA:zvSofvupxmuQ68NO7YLTdBpJy88qN
MD5:	78304F85AE08387C546B90D9138A7007
SHA1:	6FFE4DE05A1656CFD46CAE22F1FAEE7071CD29A3
SHA-256:	D39173E01A6BA32A7D58C6838D39A5B89AC499DEE09765B713A5B8C004B18DF1
SHA-512:	4654A6178506FC6B58220BA9FE1E9FDD969B7FE9A56811559DBDD8854072B9DAEE9696A86F184425C742F53A369EA44282D3EB89486441EA6D7C5B7624D6CCF4
Malicious:	false
Preview:	# $XFree86: xc/nls/Compose/iso8859-13,v 1.1 2000/10/27 18:30:50 dawes Exp $.#.# ISO 8859-13 (Latin7) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum>

C:\Program Files (x86)\Xming\locale\iso8859-13\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.381225614145491
Encrypted:	false
SSDEEP:	24:8x71FeCevWEe28NcGxQQwqfDJ7/t9KGGm/7F6j:891cCw5eo81N/cJ
MD5:	F80A26192449A52A2F2CACEC0C8430BD
SHA1:	7D4CDC0C72717C47860CB237BD432E69040B99E0
SHA-256:	25A32740BFE2BF345315D76E777C512121B606AE724B0C2B4561CC70CEE2E1A1
SHA-512:	4531F3EB84CBAC88FB61A6D2A456C9AA7D090A2ED79CA57579663D78BCC3F0B38D34787BD9F95B77FC627081D38B0C8BD665FBF8BFD56639FD38F1BB2BD87D53
Malicious:	false
Preview:	# $TOG: iso8859-13 /main/1 1998/05/20 13:49:21 kaleb $.# XLocale Database Sample for iso8859-13..# .# $XFree86: xc/nls/XLC_LOCALE/iso8859-13,v 1.1 1999/06/06 13:05:59 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-13:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-13:GR..}..font.{...primary..ISO8859-13:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-13.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-13:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-13:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-13\is-CDQ7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.381225614145491
Encrypted:	false
SSDEEP:	24:8x71FeCevWEe28NcGxQQwqfDJ7/t9KGGm/7F6j:891cCw5eo81N/cJ
MD5:	F80A26192449A52A2F2CACEC0C8430BD
SHA1:	7D4CDC0C72717C47860CB237BD432E69040B99E0
SHA-256:	25A32740BFE2BF345315D76E777C512121B606AE724B0C2B4561CC70CEE2E1A1
SHA-512:	4531F3EB84CBAC88FB61A6D2A456C9AA7D090A2ED79CA57579663D78BCC3F0B38D34787BD9F95B77FC627081D38B0C8BD665FBF8BFD56639FD38F1BB2BD87D53
Malicious:	false
Preview:	# $TOG: iso8859-13 /main/1 1998/05/20 13:49:21 kaleb $.# XLocale Database Sample for iso8859-13..# .# $XFree86: xc/nls/XLC_LOCALE/iso8859-13,v 1.1 1999/06/06 13:05:59 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-13:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-13:GR..}..font.{...primary..ISO8859-13:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-13.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-13:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-13:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-13\is-I4S3B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20425
Entropy (8bit):	4.732410569345669
Encrypted:	false
SSDEEP:	192:zvSofeBbHUmnQRu6Oa8nR8JAcJgBpxm8aTSOlCQ68NO7YUsRHHh5dBpod+Zk76wA:zvSofvupxmuQ68NO7YLTdBpJy88qN
MD5:	78304F85AE08387C546B90D9138A7007
SHA1:	6FFE4DE05A1656CFD46CAE22F1FAEE7071CD29A3
SHA-256:	D39173E01A6BA32A7D58C6838D39A5B89AC499DEE09765B713A5B8C004B18DF1
SHA-512:	4654A6178506FC6B58220BA9FE1E9FDD969B7FE9A56811559DBDD8854072B9DAEE9696A86F184425C742F53A369EA44282D3EB89486441EA6D7C5B7624D6CCF4
Malicious:	false
Preview:	# $XFree86: xc/nls/Compose/iso8859-13,v 1.1 2000/10/27 18:30:50 dawes Exp $.#.# ISO 8859-13 (Latin7) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum>

C:\Program Files (x86)\Xming\locale\iso8859-14\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20935
Entropy (8bit):	5.049818534705975
Encrypted:	false
SSDEEP:	384:u+U+u+wT+HCFhkBMNVTzL7zz7TZRXqhnnOBWHqnGhcsRwMMGgCN+qjuBdRu/32gu:1L1wT+HCbkBM/qhnnQWHqnGhcsRwMMG+
MD5:	223AFD854B098E54AB6607DCB510D489
SHA1:	A73EBCE15A2854419FB316D40C739D34A6AC7AC9
SHA-256:	75074C51D7833018ACFF80DAEC60553676572EAA8FF2F758D2E2A6CF2B69512C
SHA-512:	7D84BBD4225C2B589992413AD2BEDB22E5759FBE053DBAD6215A04C001129ACDD3BACAB505BCEDE456E8E32A0203AC64B1F2082496C0D245DCBCF961A524156E
Malicious:	false
Preview:	# ISO 8859-14 (Latin 8) Compose Sequences.#.# Original version by Alastair McKinstry, <amck@maths.tcd.ie>.# Fixed and tidied up by Seamus O Ciardhuain <seoc@cnds.ucd.ie> (Dec 2002).#.# $XFree86: xc/nls/Compose/iso8859-14,v 1.4 2001/04/26 21:09:40 dawes Exp $.#.# First part is taken from the Latin-1 definitions,.# i.e. characters the same in 8859-1 and 8859-14..#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key

C:\Program Files (x86)\Xming\locale\iso8859-14\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.336208512929047
Encrypted:	false
SSDEEP:	24:CUeevWEf528NxFHwQQwqfDJ7/txGGm/7F6m:7ew5xlU1NpY
MD5:	5A17CDD539CD3DCD49F0B7F0FD55EC0D
SHA1:	ED58BCB73DA66B33B52173DB7FA471807DE5E6FF
SHA-256:	DB8FBBCEE8BA29EA707A3D01AF7B77E84E15B252FA998C6C4E15495CD5DA4532
SHA-512:	BDC7FBE94E2EF3C5F8E50719247CCBDDE1D3E8145D0A324D6D6FBEE53405695702682EFA507465AEF17DF667AF52EC62E15DC29253A188C9F5F5D1C043BE2EC2
Malicious:	false
Preview:	# $TOG: iso8859-14 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for iso8859-14..# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-14:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-14:GR..}..font.{...primary..ISO8859-14:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-14.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-14:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-14:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-14\is-4FDAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.336208512929047
Encrypted:	false
SSDEEP:	24:CUeevWEf528NxFHwQQwqfDJ7/txGGm/7F6m:7ew5xlU1NpY
MD5:	5A17CDD539CD3DCD49F0B7F0FD55EC0D
SHA1:	ED58BCB73DA66B33B52173DB7FA471807DE5E6FF
SHA-256:	DB8FBBCEE8BA29EA707A3D01AF7B77E84E15B252FA998C6C4E15495CD5DA4532
SHA-512:	BDC7FBE94E2EF3C5F8E50719247CCBDDE1D3E8145D0A324D6D6FBEE53405695702682EFA507465AEF17DF667AF52EC62E15DC29253A188C9F5F5D1C043BE2EC2
Malicious:	false
Preview:	# $TOG: iso8859-14 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for iso8859-14..# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-14:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-14:GR..}..font.{...primary..ISO8859-14:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-14.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-14:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-14:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-14\is-GFK3U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20935
Entropy (8bit):	5.049818534705975
Encrypted:	false
SSDEEP:	384:u+U+u+wT+HCFhkBMNVTzL7zz7TZRXqhnnOBWHqnGhcsRwMMGgCN+qjuBdRu/32gu:1L1wT+HCbkBM/qhnnQWHqnGhcsRwMMG+
MD5:	223AFD854B098E54AB6607DCB510D489
SHA1:	A73EBCE15A2854419FB316D40C739D34A6AC7AC9
SHA-256:	75074C51D7833018ACFF80DAEC60553676572EAA8FF2F758D2E2A6CF2B69512C
SHA-512:	7D84BBD4225C2B589992413AD2BEDB22E5759FBE053DBAD6215A04C001129ACDD3BACAB505BCEDE456E8E32A0203AC64B1F2082496C0D245DCBCF961A524156E
Malicious:	false
Preview:	# ISO 8859-14 (Latin 8) Compose Sequences.#.# Original version by Alastair McKinstry, <amck@maths.tcd.ie>.# Fixed and tidied up by Seamus O Ciardhuain <seoc@cnds.ucd.ie> (Dec 2002).#.# $XFree86: xc/nls/Compose/iso8859-14,v 1.4 2001/04/26 21:09:40 dawes Exp $.#.# First part is taken from the Latin-1 definitions,.# i.e. characters the same in 8859-1 and 8859-14..#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key

C:\Program Files (x86)\Xming\locale\iso8859-15\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20400
Entropy (8bit):	5.012077935076567
Encrypted:	false
SSDEEP:	384:T+U+u+lZnTEozHbJxmscE8yAFhkTMufJ6IwOt5VkDR/i9L7zz7T/P/RpLiN:CL1lJTEsHbJxm/bkTMGQN
MD5:	6B9005B234CA23AE589DA99C85A1CC53
SHA1:	C76B4488DE962161B58165559351F722F2F4908B
SHA-256:	C4B8CE6E3269D70FB774E0C0A6598F48A6AE4C54B1DF8AC06EF39E9E1A1A6BC2
SHA-512:	F18C5E9355D763A2F5190D0A9E6807CE142A9E46F65A47BB19DD9F2A61E73DF505A5179D751FFB66531BBEC4C5F783B7F7A7A2FDAC7B9343323A3D28C2387010
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-15 (Latin1) Compose Sequence.#.# $XFree86: xc/nls/Compose/iso8859-15,v 1.8 2002/10/16 01:44:48 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".brac

C:\Program Files (x86)\Xming\locale\iso8859-15\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	5.34255082170959
Encrypted:	false
SSDEEP:	24:+KTrHmEpdo48G3evWE5m2dnlw5emeQQwqfDJ7/tmzGGm/7F6mk:/HzHV3w5o/7Q1Nuz
MD5:	ECAA7599ABC06E9021A0D05DF988CDAD
SHA1:	35FAF5ECF271B273DE30BCA755205C5A32F47309
SHA-256:	AE76F50722E37247C4721C75ED347F1511F894C19EDC598A3493021ACD478412
SHA-512:	1C603DF18EFCAA1F97BD1C98E56C236FCD386BA114A49AEBF8C47D4EB9820C20FE7D84EDC018AA704338DA312D2AC5D129F307CDA591D91A15E1991D605BCA70
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/1 1998/05/20 14:49:16 kaleb $.# XLocale Database Sample for fcd/dis/iso 8859-15..# When Final Committee Draft (FCD) 8859-15 is formalized.# then this file will be renamed iso8859-15..# This file is provided as preliminary support for the Latin-9.# (a.k.a. Latin-0) character set so that Europeans who want.# the Euro currency character can do so..# .# $XFree86$.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-15:GL...substitute.ISO8859-15:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-15:GR..}..font.{...primary..ISO8859-15:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-15.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-15:G

C:\Program Files (x86)\Xming\locale\iso8859-15\is-LFVH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	5.34255082170959
Encrypted:	false
SSDEEP:	24:+KTrHmEpdo48G3evWE5m2dnlw5emeQQwqfDJ7/tmzGGm/7F6mk:/HzHV3w5o/7Q1Nuz
MD5:	ECAA7599ABC06E9021A0D05DF988CDAD
SHA1:	35FAF5ECF271B273DE30BCA755205C5A32F47309
SHA-256:	AE76F50722E37247C4721C75ED347F1511F894C19EDC598A3493021ACD478412
SHA-512:	1C603DF18EFCAA1F97BD1C98E56C236FCD386BA114A49AEBF8C47D4EB9820C20FE7D84EDC018AA704338DA312D2AC5D129F307CDA591D91A15E1991D605BCA70
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/1 1998/05/20 14:49:16 kaleb $.# XLocale Database Sample for fcd/dis/iso 8859-15..# When Final Committee Draft (FCD) 8859-15 is formalized.# then this file will be renamed iso8859-15..# This file is provided as preliminary support for the Latin-9.# (a.k.a. Latin-0) character set so that Europeans who want.# the Euro currency character can do so..# .# $XFree86$.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-15:GL...substitute.ISO8859-15:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-15:GR..}..font.{...primary..ISO8859-15:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-15.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-15:G

C:\Program Files (x86)\Xming\locale\iso8859-15\is-T2AE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20400
Entropy (8bit):	5.012077935076567
Encrypted:	false
SSDEEP:	384:T+U+u+lZnTEozHbJxmscE8yAFhkTMufJ6IwOt5VkDR/i9L7zz7T/P/RpLiN:CL1lJTEsHbJxm/bkTMGQN
MD5:	6B9005B234CA23AE589DA99C85A1CC53
SHA1:	C76B4488DE962161B58165559351F722F2F4908B
SHA-256:	C4B8CE6E3269D70FB774E0C0A6598F48A6AE4C54B1DF8AC06EF39E9E1A1A6BC2
SHA-512:	F18C5E9355D763A2F5190D0A9E6807CE142A9E46F65A47BB19DD9F2A61E73DF505A5179D751FFB66531BBEC4C5F783B7F7A7A2FDAC7B9343323A3D28C2387010
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-15 (Latin1) Compose Sequence.#.# $XFree86: xc/nls/Compose/iso8859-15,v 1.8 2002/10/16 01:44:48 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".brac

C:\Program Files (x86)\Xming\locale\iso8859-1\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20411
Entropy (8bit):	5.008161516651376
Encrypted:	false
SSDEEP:	384:A+U+u+ltnTjozHbJxmrVcE8yKFhkBMgfJ6twOt5VK3PDR/y9L7zz7TZ0WN:fL1ltTjsHbJxmrIbkBM7s4N
MD5:	E34D68394373AF265055299696713B0D
SHA1:	52353A32F502E3D16E351017061B7CE4D8AB05B7
SHA-256:	BD709BFE34B01F0E3D920FE1857BB33672E5E240C53A18ABA7352D645FA7496B
SHA-512:	ACA25B49CC5A097C8FD3760E7F03668D7D693CE18771CC09B26469759342B52734E9EF18B02F445AD039307F3CC2BD8BE2C41BBBEBC3334F483B76A978CA44BA
Malicious:	false
Preview:	# $Xorg: iso8859-1,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.#.# ISO 8859-1 (Latin1) Compose Sequence.#.#.# $XFree86: xc/nls/Compose/iso8859-1,v 1.8 2001/12/24 17:15:09 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".b

C:\Program Files (x86)\Xming\locale\iso8859-1\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.316447193644249
Encrypted:	false
SSDEEP:	12:Pla4GwttckJWtevnbXE2Xi45b5EB5fJMhRYDblcjdRahwqfDJ7/tRVGmvX7F6R9k:teevLEINICQQQwqfDJ7/tPGm/7F6zk
MD5:	C146C80B41EAA65FBFD333960D680D8E
SHA1:	74B2637024E1D61854F4C902A29A7496A8B259F6
SHA-256:	A288349A51C131849ABC2AC713BFF8FBF0D6166B899F113737C20ACC92AF6B78
SHA-512:	107260BB0C54E13D73CCAD7864C106BD3F82D7BF039E2A469FB910B6A6134533D30E561BEA181CA6A83BE12264A22086A61ADF1B41E5C1E41839EE85596EFB5E
Malicious:	false
Preview:	# $Xorg: iso8859-1,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.# XLocale Database Sample for iso8859-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-1\is-52U6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.316447193644249
Encrypted:	false
SSDEEP:	12:Pla4GwttckJWtevnbXE2Xi45b5EB5fJMhRYDblcjdRahwqfDJ7/tRVGmvX7F6R9k:teevLEINICQQQwqfDJ7/tPGm/7F6zk
MD5:	C146C80B41EAA65FBFD333960D680D8E
SHA1:	74B2637024E1D61854F4C902A29A7496A8B259F6
SHA-256:	A288349A51C131849ABC2AC713BFF8FBF0D6166B899F113737C20ACC92AF6B78
SHA-512:	107260BB0C54E13D73CCAD7864C106BD3F82D7BF039E2A469FB910B6A6134533D30E561BEA181CA6A83BE12264A22086A61ADF1B41E5C1E41839EE85596EFB5E
Malicious:	false
Preview:	# $Xorg: iso8859-1,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.# XLocale Database Sample for iso8859-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-1\is-5CA8F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20411
Entropy (8bit):	5.008161516651376
Encrypted:	false
SSDEEP:	384:A+U+u+ltnTjozHbJxmrVcE8yKFhkBMgfJ6twOt5VK3PDR/y9L7zz7TZ0WN:fL1ltTjsHbJxmrIbkBM7s4N
MD5:	E34D68394373AF265055299696713B0D
SHA1:	52353A32F502E3D16E351017061B7CE4D8AB05B7
SHA-256:	BD709BFE34B01F0E3D920FE1857BB33672E5E240C53A18ABA7352D645FA7496B
SHA-512:	ACA25B49CC5A097C8FD3760E7F03668D7D693CE18771CC09B26469759342B52734E9EF18B02F445AD039307F3CC2BD8BE2C41BBBEBC3334F483B76A978CA44BA
Malicious:	false
Preview:	# $Xorg: iso8859-1,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.#.# ISO 8859-1 (Latin1) Compose Sequence.#.#.# $XFree86: xc/nls/Compose/iso8859-1,v 1.8 2001/12/24 17:15:09 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".b

C:\Program Files (x86)\Xming\locale\iso8859-2\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	23775
Entropy (8bit):	4.952571323823578
Encrypted:	false
SSDEEP:	384:Q5+U+u+hHETxdzQOy66mYIDqbPfO3T6klFvHkYZeN:ZL1hHETxdzQOyzmYEUN
MD5:	5BF0C8CC10B7635929929A692C6D8E33
SHA1:	5DF4AC1EED9B6D494410ACD3B44A0A5FFD50523B
SHA-256:	004B4A47798937414AEF6C46C36C6E1C00160156E904FDBD5485A1CA4BB70AC4
SHA-512:	90ABE6BDAE9A60025FBF367634C32DE2C53F69BDFC044C1874C67EB5651411836566C0D913D04BBB6600EA93790E360C012364A7150029BCBD26DD0D9A2B72BE
Malicious:	false
Preview:	# $Xorg: iso8859-2,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.#.# ISO 8859-2 (Latin2) Compose Sequence.#.# $XFree86: xc/nls/Compose/iso8859-2,v 1.6 2001/05/18 23:35:29 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bra

C:\Program Files (x86)\Xming\locale\iso8859-2\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.340453868909265
Encrypted:	false
SSDEEP:	12:PTaGwttckJWtevnUXE2N52qXi45Uz2MJMhRY+blcjdRahwqfDJ7/tRscVGmvX7Fu:LJevWEm28NseVQQwqfDJ7/tCGGm/7F6d
MD5:	A653B62C800E7D4856F56FF73C3D193C
SHA1:	26E6B40582B88935DF2126DB930FE1E243BE99E1
SHA-256:	941FC7524B5809898B8758B2BE2D2D1A9C2B560DE70A0CF1C392F379195E0168
SHA-512:	0243244F4E9CA81F8158208C0EE3ED70F34BF43EDD11076743F359ABA4C74FCA68DB734419C0F3C9E375F080C40F3188ACD826DAE828B65849C18E04A583B32E
Malicious:	false
Preview:	# $Xorg: iso8859-2,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-2..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-2:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-2:GR..}..font.{...primary..ISO8859-2:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-2.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-2:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-2:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-2\is-BCP5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.340453868909265
Encrypted:	false
SSDEEP:	12:PTaGwttckJWtevnUXE2N52qXi45Uz2MJMhRY+blcjdRahwqfDJ7/tRscVGmvX7Fu:LJevWEm28NseVQQwqfDJ7/tCGGm/7F6d
MD5:	A653B62C800E7D4856F56FF73C3D193C
SHA1:	26E6B40582B88935DF2126DB930FE1E243BE99E1
SHA-256:	941FC7524B5809898B8758B2BE2D2D1A9C2B560DE70A0CF1C392F379195E0168
SHA-512:	0243244F4E9CA81F8158208C0EE3ED70F34BF43EDD11076743F359ABA4C74FCA68DB734419C0F3C9E375F080C40F3188ACD826DAE828B65849C18E04A583B32E
Malicious:	false
Preview:	# $Xorg: iso8859-2,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-2..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-2:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-2:GR..}..font.{...primary..ISO8859-2:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-2.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-2:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-2:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-2\is-QO2GN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	23775
Entropy (8bit):	4.952571323823578
Encrypted:	false
SSDEEP:	384:Q5+U+u+hHETxdzQOy66mYIDqbPfO3T6klFvHkYZeN:ZL1hHETxdzQOyzmYEUN
MD5:	5BF0C8CC10B7635929929A692C6D8E33
SHA1:	5DF4AC1EED9B6D494410ACD3B44A0A5FFD50523B
SHA-256:	004B4A47798937414AEF6C46C36C6E1C00160156E904FDBD5485A1CA4BB70AC4
SHA-512:	90ABE6BDAE9A60025FBF367634C32DE2C53F69BDFC044C1874C67EB5651411836566C0D913D04BBB6600EA93790E360C012364A7150029BCBD26DD0D9A2B72BE
Malicious:	false
Preview:	# $Xorg: iso8859-2,v 1.3 2000/08/17 19:46:59 cpqbld Exp $.#.# ISO 8859-2 (Latin2) Compose Sequence.#.# $XFree86: xc/nls/Compose/iso8859-2,v 1.6 2001/05/18 23:35:29 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bra

C:\Program Files (x86)\Xming\locale\iso8859-3\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.893411934789346
Encrypted:	false
SSDEEP:	384:A+U+u+bWnTBQvJxm3LPX7IYU4m6mzOooW8AfyXwOt5VkDR/MzRj771HWODcVzCTt:fL1bsTBWJxm3LPX7IYU4m6maooW8A4bN
MD5:	9422BD5D002EC30C4161EB6F5BD2B030
SHA1:	C6EDCD8D0D911C797F650C24321B8A4C8E96613A
SHA-256:	6D0497DD260E808018BA5C6932B0F7008E60CD9CD98D324D9E68FC6C9AEB33E4
SHA-512:	35D52BB439260AEDEDC248467F25DF47D45111F29DE9E0DB9533ACBB40A5A82AA6092151CA056D6C6A76AAF933E27F54B2CC6F6AA2D2E1096C77F85928E088E1
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-3 (Latin3) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-3,v 1.1 1999/06/06 14:05:57 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bracel

C:\Program Files (x86)\Xming\locale\iso8859-3\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.334782602215013
Encrypted:	false
SSDEEP:	24:iHsevWEx528NbbyQQwqfDJ7/tqKGGm/7F6q:1w5x5vI1NQcE
MD5:	38B3160F3B20BAC29ABEC4FC0A444DC7
SHA1:	2F67F5A715533D329179BF6A6E9BC99776A586E3
SHA-256:	BA83CC6319F97DE53E149F7A125019BC0A8FB5D8D4827E56D06DA92A1FD51637
SHA-512:	5E8419EE0AC4FD21B00458813CEA53EE8EB2A72C2A5424849B1C7C3BA01E8761AD0C514D39CB39AE831574EA19F86F762454AAEC0DA901C578E8D875ED25FBD7
Malicious:	false
Preview:	# $Xorg: iso8859-3,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-3..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-3:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-3:GR..}..font.{...primary..ISO8859-3:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-3.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-3:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-3:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-3\is-GFORJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.893411934789346
Encrypted:	false
SSDEEP:	384:A+U+u+bWnTBQvJxm3LPX7IYU4m6mzOooW8AfyXwOt5VkDR/MzRj771HWODcVzCTt:fL1bsTBWJxm3LPX7IYU4m6maooW8A4bN
MD5:	9422BD5D002EC30C4161EB6F5BD2B030
SHA1:	C6EDCD8D0D911C797F650C24321B8A4C8E96613A
SHA-256:	6D0497DD260E808018BA5C6932B0F7008E60CD9CD98D324D9E68FC6C9AEB33E4
SHA-512:	35D52BB439260AEDEDC248467F25DF47D45111F29DE9E0DB9533ACBB40A5A82AA6092151CA056D6C6A76AAF933E27F54B2CC6F6AA2D2E1096C77F85928E088E1
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-3 (Latin3) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-3,v 1.1 1999/06/06 14:05:57 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bracel

C:\Program Files (x86)\Xming\locale\iso8859-3\is-KV7N3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.334782602215013
Encrypted:	false
SSDEEP:	24:iHsevWEx528NbbyQQwqfDJ7/tqKGGm/7F6q:1w5x5vI1NQcE
MD5:	38B3160F3B20BAC29ABEC4FC0A444DC7
SHA1:	2F67F5A715533D329179BF6A6E9BC99776A586E3
SHA-256:	BA83CC6319F97DE53E149F7A125019BC0A8FB5D8D4827E56D06DA92A1FD51637
SHA-512:	5E8419EE0AC4FD21B00458813CEA53EE8EB2A72C2A5424849B1C7C3BA01E8761AD0C514D39CB39AE831574EA19F86F762454AAEC0DA901C578E8D875ED25FBD7
Malicious:	false
Preview:	# $Xorg: iso8859-3,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-3..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-3:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-3:GR..}..font.{...primary..ISO8859-3:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-3.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-3:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-3:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-4\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15186
Entropy (8bit):	5.002964387283405
Encrypted:	false
SSDEEP:	384:PT4cE8y4mG2QSnGwkTSLvimd/V/4fLD0biSON:PT5mG2QSnzk+Lamd6N
MD5:	27063923835BD62A899E720037C55042
SHA1:	9E8BE92ECCD47172D79C334C005B54A7555947B1
SHA-256:	76EEC5A31E5E396F2FB21809E0F716D35046D8FFEDC142F33517CE88FED0297E
SHA-512:	7D731FE865768F17ACDB16C20C24DEB749CE1608CB44CE30496C3D2EE65CB43D10B1F6811D79BC18F8A3D70877C82CC153AF7380D72BD04F55672680EF73FFD8
Malicious:	false
Preview:	# $XFree86: xc/nls/Compose/iso8859-4,v 1.2 2000/10/27 18:30:51 dawes Exp $.#.# ISO 8859-4 (Latin4) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <A> <comma>...: "\241".Aogonek.<Multi_key> <comma> <A>...: "\241".Aogonek.<Multi_key> <k> <k>...: "\242".kra.<Multi_key> <R> <comma>...: "\243".Rcedilla.<Multi_key> <comma> <R>...: "\243".Rcedilla.<Multi_key> <x> <o>...: "\244".currency.<Multi_key> <o> <x>...: "\244".currency.<Multi_key> <X> <O>...: "\244".currency.<Multi_key> <O> <X>...: "\244".currency.<Multi_key> <x> <O>...: "\244".currency.<Multi_key> <O> <x>...: "\244".currency.<Multi_key> <X> <o>...: "\244".currency.<Multi_key> <o> <X>...: "\244".currency.<Multi_key> <x> <0>...: "\244".currency.<Multi_key> <0> <x>...: "\244".currency.<Multi_key>

C:\Program Files (x86)\Xming\locale\iso8859-4\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.340453868909265
Encrypted:	false
SSDEEP:	12:PVa0wttckJWtevnUXE2F2qXi45UZ2yJMhRY4blcjdRahwqfDJ7/tR+cVGmvX7F6f:tfevWEQ28NSYPQQwqfDJ7/tIGGm/7F6f
MD5:	84E5B3721E98238E103956AAC9256E78
SHA1:	43D2F80057A056E5CF0CE2DE0EB0118DA134B9AE
SHA-256:	00E2E5EC755BAB0F9A096B2B9A623EFEB625469B514D400983EA64290F963977
SHA-512:	F35C04643F99A0CB894D77B588AAC2B09B8FAC71AAF1269F8B1D17D3CA27A33C56F670251258FC2F07774621483DEA17EC601AEF4C378F3C86A1BAE1A4A95319
Malicious:	false
Preview:	# $Xorg: iso8859-4,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-4:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-4:GR..}..font.{...primary..ISO8859-4:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-4.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-4:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-4:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-4\is-33BTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15186
Entropy (8bit):	5.002964387283405
Encrypted:	false
SSDEEP:	384:PT4cE8y4mG2QSnGwkTSLvimd/V/4fLD0biSON:PT5mG2QSnzk+Lamd6N
MD5:	27063923835BD62A899E720037C55042
SHA1:	9E8BE92ECCD47172D79C334C005B54A7555947B1
SHA-256:	76EEC5A31E5E396F2FB21809E0F716D35046D8FFEDC142F33517CE88FED0297E
SHA-512:	7D731FE865768F17ACDB16C20C24DEB749CE1608CB44CE30496C3D2EE65CB43D10B1F6811D79BC18F8A3D70877C82CC153AF7380D72BD04F55672680EF73FFD8
Malicious:	false
Preview:	# $XFree86: xc/nls/Compose/iso8859-4,v 1.2 2000/10/27 18:30:51 dawes Exp $.#.# ISO 8859-4 (Latin4) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <A> <comma>...: "\241".Aogonek.<Multi_key> <comma> <A>...: "\241".Aogonek.<Multi_key> <k> <k>...: "\242".kra.<Multi_key> <R> <comma>...: "\243".Rcedilla.<Multi_key> <comma> <R>...: "\243".Rcedilla.<Multi_key> <x> <o>...: "\244".currency.<Multi_key> <o> <x>...: "\244".currency.<Multi_key> <X> <O>...: "\244".currency.<Multi_key> <O> <X>...: "\244".currency.<Multi_key> <x> <O>...: "\244".currency.<Multi_key> <O> <x>...: "\244".currency.<Multi_key> <X> <o>...: "\244".currency.<Multi_key> <o> <X>...: "\244".currency.<Multi_key> <x> <0>...: "\244".currency.<Multi_key> <0> <x>...: "\244".currency.<Multi_key>

C:\Program Files (x86)\Xming\locale\iso8859-4\is-BFAIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.340453868909265
Encrypted:	false
SSDEEP:	12:PVa0wttckJWtevnUXE2F2qXi45UZ2yJMhRY4blcjdRahwqfDJ7/tR+cVGmvX7F6f:tfevWEQ28NSYPQQwqfDJ7/tIGGm/7F6f
MD5:	84E5B3721E98238E103956AAC9256E78
SHA1:	43D2F80057A056E5CF0CE2DE0EB0118DA134B9AE
SHA-256:	00E2E5EC755BAB0F9A096B2B9A623EFEB625469B514D400983EA64290F963977
SHA-512:	F35C04643F99A0CB894D77B588AAC2B09B8FAC71AAF1269F8B1D17D3CA27A33C56F670251258FC2F07774621483DEA17EC601AEF4C378F3C86A1BAE1A4A95319
Malicious:	false
Preview:	# $Xorg: iso8859-4,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-4:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-4:GR..}..font.{...primary..ISO8859-4:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-4.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-4:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-4:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-5\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.967111514141827
Encrypted:	false
SSDEEP:	6:LWBaL5kc/OetdtmWvkvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCERvtl6Ice6ldo0+62XdUmhn
MD5:	E22350B5758B525262A9B457138723AC
SHA1:	E69FC43F7C0BBF2AE69522967B3220D49684865F
SHA-256:	F2B536B39B04761959BC80F2D30C9B54CB666819D001F88E30764695F129DB77
SHA-512:	2B2C63D646C30FACA08888684E2DCA06C2F17E6EC7D00641F9DFFEDF4CC99D80D5C35874CA6474C124F6E59B8F694253AE922BDFA3FDBACF0F3F01A7BB76F807
Malicious:	false
Preview:	#.# ISO 8859-5 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-5,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-5\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.323655355309459
Encrypted:	false
SSDEEP:	24:0/VEevWEBX28N1PBL8QQwqfDJ7/tSoGGm/7F6S/:UEw5Z9E1Nza
MD5:	DB92B8F03F244B9DBC2B515AC58ED1CD
SHA1:	D4574A1D1479A73796E2C4210BD570DF9F5ACCD0
SHA-256:	6B87ABB93A606F4C1B58CC15A0C52C36F4730B30BE3D264DE9AE67D61AA52109
SHA-512:	A1477CB795B1ECA4B70773FF5CE387D8BD19EA8428394232F869E04B2F49636EC494E9A79A881E37743E2F290E27390B505D3C16EDE8DAC87CB48DE619E9D4EB
Malicious:	false
Preview:	# $Xorg: iso8859-5,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-5..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-5:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-5:GR..}..font.{...primary..ISO8859-5:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-5.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-5:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-5:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-5\is-ARG5P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.323655355309459
Encrypted:	false
SSDEEP:	24:0/VEevWEBX28N1PBL8QQwqfDJ7/tSoGGm/7F6S/:UEw5Z9E1Nza
MD5:	DB92B8F03F244B9DBC2B515AC58ED1CD
SHA1:	D4574A1D1479A73796E2C4210BD570DF9F5ACCD0
SHA-256:	6B87ABB93A606F4C1B58CC15A0C52C36F4730B30BE3D264DE9AE67D61AA52109
SHA-512:	A1477CB795B1ECA4B70773FF5CE387D8BD19EA8428394232F869E04B2F49636EC494E9A79A881E37743E2F290E27390B505D3C16EDE8DAC87CB48DE619E9D4EB
Malicious:	false
Preview:	# $Xorg: iso8859-5,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-5..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-5:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-5:GR..}..font.{...primary..ISO8859-5:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-5.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-5:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-5:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-5\is-TPRKA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.967111514141827
Encrypted:	false
SSDEEP:	6:LWBaL5kc/OetdtmWvkvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCERvtl6Ice6ldo0+62XdUmhn
MD5:	E22350B5758B525262A9B457138723AC
SHA1:	E69FC43F7C0BBF2AE69522967B3220D49684865F
SHA-256:	F2B536B39B04761959BC80F2D30C9B54CB666819D001F88E30764695F129DB77
SHA-512:	2B2C63D646C30FACA08888684E2DCA06C2F17E6EC7D00641F9DFFEDF4CC99D80D5C35874CA6474C124F6E59B8F694253AE922BDFA3FDBACF0F3F01A7BB76F807
Malicious:	false
Preview:	#.# ISO 8859-5 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-5,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-6\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.967111514141827
Encrypted:	false
SSDEEP:	6:LWBo8L5kc/OetdtmWvsSlvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCoSRvtlBFIce6ldo0+62XdUmhn
MD5:	9FE3937EF2A305DBDE8580D2A7D4301A
SHA1:	9C4FC98CF648581E5B1D90B84F9930492D44C03B
SHA-256:	98587190C3D59B5289C2FD6D74AABD99307F30AA050A00C3B42E8E1B5E636785
SHA-512:	34A33C39B68B4DD2BCB676835D707DDE331AA022E4EC975FF27000AB23558050748E11C52027727AD373373E27B5763BC31BA4762DE378FAF47BE506E9153DBE
Malicious:	false
Preview:	#.# ISO 8859-6 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-6,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-6\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.345839511017447
Encrypted:	false
SSDEEP:	24:JJNevWEa28NYixQQwqfDJ7/tOGGm/7F6x:JXw5a0C1N+r
MD5:	230B9A6D87F317056C18E2808F06C1C0
SHA1:	CADC977AE434B60BDE83FA7926060F5834286AB4
SHA-256:	47693FEC1C47B68AA0DD351E8185D6835347D75D3715B1896DCFE488ABF11100
SHA-512:	087656108FA6F0D09B0D6B90373E95878B6C96FA5A7EA5667EC7D1857FF5AD63566D080130A2AC05DAEAC46594D3B92DBFCBE223164C8552C0A435E0E6AE5AF8
Malicious:	false
Preview:	# $Xorg: iso8859-6,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-6..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-6:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-6:GR..}..font.{...primary..ISO8859-6:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-6.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-6:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-6:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-6\is-EKR6C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.967111514141827
Encrypted:	false
SSDEEP:	6:LWBo8L5kc/OetdtmWvsSlvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCoSRvtlBFIce6ldo0+62XdUmhn
MD5:	9FE3937EF2A305DBDE8580D2A7D4301A
SHA1:	9C4FC98CF648581E5B1D90B84F9930492D44C03B
SHA-256:	98587190C3D59B5289C2FD6D74AABD99307F30AA050A00C3B42E8E1B5E636785
SHA-512:	34A33C39B68B4DD2BCB676835D707DDE331AA022E4EC975FF27000AB23558050748E11C52027727AD373373E27B5763BC31BA4762DE378FAF47BE506E9153DBE
Malicious:	false
Preview:	#.# ISO 8859-6 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-6,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-6\is-FQFNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.345839511017447
Encrypted:	false
SSDEEP:	24:JJNevWEa28NYixQQwqfDJ7/tOGGm/7F6x:JXw5a0C1N+r
MD5:	230B9A6D87F317056C18E2808F06C1C0
SHA1:	CADC977AE434B60BDE83FA7926060F5834286AB4
SHA-256:	47693FEC1C47B68AA0DD351E8185D6835347D75D3715B1896DCFE488ABF11100
SHA-512:	087656108FA6F0D09B0D6B90373E95878B6C96FA5A7EA5667EC7D1857FF5AD63566D080130A2AC05DAEAC46594D3B92DBFCBE223164C8552C0A435E0E6AE5AF8
Malicious:	false
Preview:	# $Xorg: iso8859-6,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-6..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-6:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-6:GR..}..font.{...primary..ISO8859-6:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-6.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-6:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-6:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-7\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10798
Entropy (8bit):	5.125578783678171
Encrypted:	false
SSDEEP:	192:s+U+u+gTvIvJxmxRBiJdwt5VK3OdHpkC+Argh9EhgCOZc+9cgg0wD5tZna:s+U+u+gTAvJxmxXiJdwt5VK3S29
MD5:	0106D8BD6BDDEFD70A68519D4FB0C4F7
SHA1:	722D367DDB00B08D5347F02E9E7D0E35FE52CEF5
SHA-256:	D9AFBE0633072B4DAD1D9DAB00957C75E7D9F496A114338C89B50E489D7CD4F5
SHA-512:	797FDA20284874C8C4DC2ED29984C8500FB2342C2D5D40556224389F46D9879DC6C4511B76F599133C2CD422178F7669B24D5174164B4D489AFD0E0AADD4C647
Malicious:	false
Preview:	# $TOG: iso8859-7 /main/7 1998/05/20 15:33:23 kaleb $.#.# ISO 8859-7 (Greek) Compose Sequence.#.#.# $XFree86: xc/nls/Compose/iso8859-7,v 1.4 2001/04/26 21:09:40 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bracel

C:\Program Files (x86)\Xming\locale\iso8859-7\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.334782602215013
Encrypted:	false
SSDEEP:	12:Pua9wttckJWtevnUXE2G2qXi45UQ27JMhRYRblcjdRahwqfDJ7/tRTcVGmvX7F6e:GAevWE728NnPeQQwqfDJ7/t5GGm/7F6e
MD5:	CFA93B49B5D3E2E4ED2108D71D5B3421
SHA1:	EF72D87013996039DEF63F436D4FC0C7959FA67F
SHA-256:	14E8264A27C93BBD31DBA3901A98A6B5A33348D366B378CD06A20D184EFEE15D
SHA-512:	684174CC973855419F82A16AB2816864B67ACB4DD425697FC7BB3D4DE09DE332350343CC0973B10F727BE52E5067C55C3A996F99EBDCCB63DB77742E0E38DFE9
Malicious:	false
Preview:	# $Xorg: iso8859-7,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-7..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-7:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-7:GR..}..font.{...primary..ISO8859-7:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-7.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-7:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-7:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-7\is-44BCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.334782602215013
Encrypted:	false
SSDEEP:	12:Pua9wttckJWtevnUXE2G2qXi45UQ27JMhRYRblcjdRahwqfDJ7/tRTcVGmvX7F6e:GAevWE728NnPeQQwqfDJ7/t5GGm/7F6e
MD5:	CFA93B49B5D3E2E4ED2108D71D5B3421
SHA1:	EF72D87013996039DEF63F436D4FC0C7959FA67F
SHA-256:	14E8264A27C93BBD31DBA3901A98A6B5A33348D366B378CD06A20D184EFEE15D
SHA-512:	684174CC973855419F82A16AB2816864B67ACB4DD425697FC7BB3D4DE09DE332350343CC0973B10F727BE52E5067C55C3A996F99EBDCCB63DB77742E0E38DFE9
Malicious:	false
Preview:	# $Xorg: iso8859-7,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-7..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-7:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-7:GR..}..font.{...primary..ISO8859-7:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-7.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-7:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-7:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-7\is-CFHL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10798
Entropy (8bit):	5.125578783678171
Encrypted:	false
SSDEEP:	192:s+U+u+gTvIvJxmxRBiJdwt5VK3OdHpkC+Argh9EhgCOZc+9cgg0wD5tZna:s+U+u+gTAvJxmxXiJdwt5VK3S29
MD5:	0106D8BD6BDDEFD70A68519D4FB0C4F7
SHA1:	722D367DDB00B08D5347F02E9E7D0E35FE52CEF5
SHA-256:	D9AFBE0633072B4DAD1D9DAB00957C75E7D9F496A114338C89B50E489D7CD4F5
SHA-512:	797FDA20284874C8C4DC2ED29984C8500FB2342C2D5D40556224389F46D9879DC6C4511B76F599133C2CD422178F7669B24D5174164B4D489AFD0E0AADD4C647
Malicious:	false
Preview:	# $TOG: iso8859-7 /main/7 1998/05/20 15:33:23 kaleb $.#.# ISO 8859-7 (Greek) Compose Sequence.#.#.# $XFree86: xc/nls/Compose/iso8859-7,v 1.4 2001/04/26 21:09:40 dawes Exp $.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".bracel

C:\Program Files (x86)\Xming\locale\iso8859-8\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.959597570124654
Encrypted:	false
SSDEEP:	6:LWBPfL5kc/OetdtmWvUuvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCFRvtlFIce6ldo0+62XdUmhn
MD5:	15F44328DBA3F790EF463111D6742493
SHA1:	01BD9FFA083020D29FE3E5ADD7BC13509FEF4DFD
SHA-256:	08D0559FA426C400E4A267CB05978F85CDC11303B462EE6F5743BFC57AD5AC1E
SHA-512:	2B7DA8D60961A94EA8D5D9305B5C713BD9016A1CCB2AD5F30698B2D4A8566904A425171C731F7EF291662F71D9BBA0A275DC912D095DD6ECC3EA6D48245527E7
Malicious:	false
Preview:	#.# ISO 8859-8 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-8,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.315473089337683
Encrypted:	false
SSDEEP:	24:eUTevWEE28NeM7QQwqfDJ7/tUGGm/7F6D:egw5ESy1N8J
MD5:	0ED8E8716CCC89A97D619119753EB7E9
SHA1:	4E4CC6372BAA0A368FACE86DB855DFE5A17DF714
SHA-256:	521C07CBC7677B2A393312F08F81F85791F507401226D62EBBD24EBB00942FBC
SHA-512:	84982B5E7ADDF9C1DC94A31EBEDAB8A4AA644E9E4ECDC2FAF4ADBA4F7DA43477B4A6719B34EB44F819A3A57A3A915B6407492FA23094074C9A4D6C0F1283FA84
Malicious:	false
Preview:	# $Xorg: iso8859-8,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-8:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-8:GR..}..font.{...primary..ISO8859-8:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-8:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-8\is-3H6UI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.315473089337683
Encrypted:	false
SSDEEP:	24:eUTevWEE28NeM7QQwqfDJ7/tUGGm/7F6D:egw5ESy1N8J
MD5:	0ED8E8716CCC89A97D619119753EB7E9
SHA1:	4E4CC6372BAA0A368FACE86DB855DFE5A17DF714
SHA-256:	521C07CBC7677B2A393312F08F81F85791F507401226D62EBBD24EBB00942FBC
SHA-512:	84982B5E7ADDF9C1DC94A31EBEDAB8A4AA644E9E4ECDC2FAF4ADBA4F7DA43477B4A6719B34EB44F819A3A57A3A915B6407492FA23094074C9A4D6C0F1283FA84
Malicious:	false
Preview:	# $Xorg: iso8859-8,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-8:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-8:GR..}..font.{...primary..ISO8859-8:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-8:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-8\is-SI4OP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.959597570124654
Encrypted:	false
SSDEEP:	6:LWBPfL5kc/OetdtmWvUuvr/5Syhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCFRvtlFIce6ldo0+62XdUmhn
MD5:	15F44328DBA3F790EF463111D6742493
SHA1:	01BD9FFA083020D29FE3E5ADD7BC13509FEF4DFD
SHA-256:	08D0559FA426C400E4A267CB05978F85CDC11303B462EE6F5743BFC57AD5AC1E
SHA-512:	2B7DA8D60961A94EA8D5D9305B5C713BD9016A1CCB2AD5F30698B2D4A8566904A425171C731F7EF291662F71D9BBA0A275DC912D095DD6ECC3EA6D48245527E7
Malicious:	false
Preview:	#.# ISO 8859-8 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-8,v 1.1 1999/08/28 09:00:36 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\iso8859-9\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	21435
Entropy (8bit):	4.957759032461957
Encrypted:	false
SSDEEP:	384:S+U+u+lYWnTsozHbJxm9cE8yvD3f+FhkTMIyXwOt5VkDR/MzL7Rn7TaRGN:xL1lYsTssHbJxmVD3f+bkTMDpN
MD5:	450C791E729DB36A902A200A73460EBE
SHA1:	D56A9F08C4CB20A176455532AEF9933F9447AAFA
SHA-256:	A3A0BBC2161BD5851D41AA91B4C8C1CAE9EB50E1B97F62227C79885C9848818C
SHA-512:	68DB162D37F888FC0CF1E73E9E6A31A829E96FDE8D9C22F7F3869F2EF5D1AE0DAB8DD3C91C9D4FD5F040F4759B8F011F09C5399858DCDB3DCA4F62000A6BE648
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-9 (Latin5) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-9,v 1.1 1999/06/06 14:05:57 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenl

C:\Program Files (x86)\Xming\locale\iso8859-9\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.322749128271795
Encrypted:	false
SSDEEP:	24:4mevWEj528N9BpeQQwqfDJ7/tfGGm/7F6o:5w5tBbQ1NH2
MD5:	1DA8ED086F3252250570789392171E32
SHA1:	E000B56DB55110B16D06E08A06FF3740534A4D14
SHA-256:	3C95AC4668444DFEAB174B74D220C66C3187B9C0C74428173F3FC28134ED5B78
SHA-512:	F7A34A6DD54F709A73639F722EC152843356DD311D9AFA81BA2DAFC8E6D7885BE26D0BD10F6490579F5B9ADBE354CF511C9C2A74D18900F3962C442B3208CA10
Malicious:	false
Preview:	# $Xorg: iso8859-9,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-9..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9:GR..}..font.{...primary..ISO8859-9:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-9\is-MKV03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.322749128271795
Encrypted:	false
SSDEEP:	24:4mevWEj528N9BpeQQwqfDJ7/tfGGm/7F6o:5w5tBbQ1NH2
MD5:	1DA8ED086F3252250570789392171E32
SHA1:	E000B56DB55110B16D06E08A06FF3740534A4D14
SHA-256:	3C95AC4668444DFEAB174B74D220C66C3187B9C0C74428173F3FC28134ED5B78
SHA-512:	F7A34A6DD54F709A73639F722EC152843356DD311D9AFA81BA2DAFC8E6D7885BE26D0BD10F6490579F5B9ADBE354CF511C9C2A74D18900F3962C442B3208CA10
Malicious:	false
Preview:	# $Xorg: iso8859-9,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for iso8859-9..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9:GR..}..font.{...primary..ISO8859-9:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\iso8859-9\is-O1AEP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	21435
Entropy (8bit):	4.957759032461957
Encrypted:	false
SSDEEP:	384:S+U+u+lYWnTsozHbJxm9cE8yvD3f+FhkTMIyXwOt5VkDR/MzL7Rn7TaRGN:xL1lYsTssHbJxmVD3f+bkTMDpN
MD5:	450C791E729DB36A902A200A73460EBE
SHA1:	D56A9F08C4CB20A176455532AEF9933F9447AAFA
SHA-256:	A3A0BBC2161BD5851D41AA91B4C8C1CAE9EB50E1B97F62227C79885C9848818C
SHA-512:	68DB162D37F888FC0CF1E73E9E6A31A829E96FDE8D9C22F7F3869F2EF5D1AE0DAB8DD3C91C9D4FD5F040F4759B8F011F09C5399858DCDB3DCA4F62000A6BE648
Malicious:	false
Preview:	# $TOG: fcd8859-15 /main/2 1998/06/17 15:53:45 kaleb $.#.# ISO 8859-9 (Latin5) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-9,v 1.1 1999/06/06 14:05:57 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenl

C:\Program Files (x86)\Xming\locale\iso8859-9e\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	21969
Entropy (8bit):	4.945936347460948
Encrypted:	false
SSDEEP:	384:6+U+u+lYWnTsozHbJxm9cE8yBD3f+FhkTM7yXwOt5VkDR/MzL7Rn7TPRfN:ZL1lYsTssHbJxm/D3f+bkTMM/N
MD5:	3FC0264DFD0B00BA3B8B6D2625F6B51E
SHA1:	F8517CDB48B80193C83A5529972AA2FAA7624499
SHA-256:	D7A6A9A4771A4083F3B2A72F5798612F656A0CD9DAA824CC330A226F9A89F24C
SHA-512:	C04DA2B025A6A8509E4D91D3BBEEE5E27B164F7D00BC29180E99E306A0D7CABD57CD0C329C010CD8F6CF6ED68A7A57F574168F2500E2287EF4F99C81EA451CB2
Malicious:	false
Preview:	#.# ISO 8859-9e (Latin??) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-9e,v 1.1 2000/10/27 18:30:51 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicirc

C:\Program Files (x86)\Xming\locale\iso8859-9e\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.416858255960952
Encrypted:	false
SSDEEP:	24:sEReia1FwevWEQ28NNEZ5vDuO4bQQwqfDJ7/t+GGm/7F6h:E1Ow5QpEZ5vDuOs1Nmb
MD5:	F5480D499268B31FC26E575E99AE5CDB
SHA1:	55C46592CCD8A1A07925403B828EE099971D1A61
SHA-256:	6D55A434755FBC37032D92D6E3A60A3B42DB3059D6A2FB0B2C9DFC14D1A43D04
SHA-512:	17E1073713B392BF5BA9F33B56E48B3C150F52972668322D731C0B49E36884ECDB2D48A51AE08D1B74735AE9329B5BAB23D6470AD6BE5A22DAABD1BD3292CD6E
Malicious:	false
Preview:	# $XConsortium: iso8859-9e /main/7 1996/09/28 16:51:50 rws $.# XLocale Database Sample for iso8859-9e..# .# $XFree86: xc/nls/XLC_LOCALE/iso8859-9e,v 1.2 2000/10/28 00:34:03 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9E:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9E:GR..}..font.{...primary..ISO8859-9E:GR..}.}.END XLC_FONTSET.#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISO8859-9E..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9E.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9E:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{.

C:\Program Files (x86)\Xming\locale\iso8859-9e\is-FESNS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	21969
Entropy (8bit):	4.945936347460948
Encrypted:	false
SSDEEP:	384:6+U+u+lYWnTsozHbJxm9cE8yBD3f+FhkTM7yXwOt5VkDR/MzL7Rn7TPRfN:ZL1lYsTssHbJxm/D3f+bkTMM/N
MD5:	3FC0264DFD0B00BA3B8B6D2625F6B51E
SHA1:	F8517CDB48B80193C83A5529972AA2FAA7624499
SHA-256:	D7A6A9A4771A4083F3B2A72F5798612F656A0CD9DAA824CC330A226F9A89F24C
SHA-512:	C04DA2B025A6A8509E4D91D3BBEEE5E27B164F7D00BC29180E99E306A0D7CABD57CD0C329C010CD8F6CF6ED68A7A57F574168F2500E2287EF4F99C81EA451CB2
Malicious:	false
Preview:	#.# ISO 8859-9e (Latin??) Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/iso8859-9e,v 1.1 2000/10/27 18:30:51 dawes Exp $.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicirc

C:\Program Files (x86)\Xming\locale\iso8859-9e\is-MGCL0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.416858255960952
Encrypted:	false
SSDEEP:	24:sEReia1FwevWEQ28NNEZ5vDuO4bQQwqfDJ7/t+GGm/7F6h:E1Ow5QpEZ5vDuOs1Nmb
MD5:	F5480D499268B31FC26E575E99AE5CDB
SHA1:	55C46592CCD8A1A07925403B828EE099971D1A61
SHA-256:	6D55A434755FBC37032D92D6E3A60A3B42DB3059D6A2FB0B2C9DFC14D1A43D04
SHA-512:	17E1073713B392BF5BA9F33B56E48B3C150F52972668322D731C0B49E36884ECDB2D48A51AE08D1B74735AE9329B5BAB23D6470AD6BE5A22DAABD1BD3292CD6E
Malicious:	false
Preview:	# $XConsortium: iso8859-9e /main/7 1996/09/28 16:51:50 rws $.# XLocale Database Sample for iso8859-9e..# .# $XFree86: xc/nls/XLC_LOCALE/iso8859-9e,v 1.2 2000/10/28 00:34:03 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9E:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9E:GR..}..font.{...primary..ISO8859-9E:GR..}.}.END XLC_FONTSET.#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISO8859-9E..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9E.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9E:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{.

C:\Program Files (x86)\Xming\locale\ja.JIS\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.9465136281720925
Encrypted:	false
SSDEEP:	6:LVL5kc/Oetdtm8LvtUvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LHRvt7LUdce6ldo0+62XdUmhn
MD5:	D79F8F4A93CA56C0566CE0112B3248CC
SHA1:	2C8F0255878C2AD355269A7B46DC5C3B487CE3EB
SHA-256:	EC051BF26D417F26002DE222EB3316AF45FE23A7F95F60E428A211E4E911A509
SHA-512:	641923D8CC333E27A935469705F529AE099B698A4E16F039093A29D0D072E4451D8B2D95E3D3FB93289A0BD7EC499F9684F4E31E72FB985BC1361FEB6213B1FC
Malicious:	false
Preview:	#.# ja.JIS Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja.JIS,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja.JIS\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	5.468630362768272
Encrypted:	false
SSDEEP:	24:a1CbOE6WEIg2yyK2rEQf+r97Ij4ADQQwqfDJ7h6xX6FtwfGmr626EZR26DwU6+1j:a1CJ65lWKAfwIc+1XwiB0bD2nUN
MD5:	A1C6355864B4BCAE33C1284DCB17A206
SHA1:	DE5C03C52E77DB45E45C81E6D01F01DE4F3C1D1E
SHA-256:	7F591A5CBE8FE123CBEB99A523075716EBDE302C7F0B7896363421CA57346939
SHA-512:	5ED68AEEC06D091E112355647F177E6A02A0539C75CFB6FD82F594444C996BC06F3CCAAD91ADB0863A73409CB88FC2CC3D53AFFF6BCA1C73CFDDE584CB766DDC
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja.JIS,v 1.3 1997/08/26 11:57:23 hohndel Exp $.# .# .# .# $Xorg: ja.JIS,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# .# XLocale Database Sample for ja_JP.jis.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.jis.mb_cur_max..5.state_depend_encoding.True..wc_encoding_mask.\x30000000

C:\Program Files (x86)\Xming\locale\ja.JIS\is-2LCQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.9465136281720925
Encrypted:	false
SSDEEP:	6:LVL5kc/Oetdtm8LvtUvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LHRvt7LUdce6ldo0+62XdUmhn
MD5:	D79F8F4A93CA56C0566CE0112B3248CC
SHA1:	2C8F0255878C2AD355269A7B46DC5C3B487CE3EB
SHA-256:	EC051BF26D417F26002DE222EB3316AF45FE23A7F95F60E428A211E4E911A509
SHA-512:	641923D8CC333E27A935469705F529AE099B698A4E16F039093A29D0D072E4451D8B2D95E3D3FB93289A0BD7EC499F9684F4E31E72FB985BC1361FEB6213B1FC
Malicious:	false
Preview:	#.# ja.JIS Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja.JIS,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja.JIS\is-TQ9CN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	5.468630362768272
Encrypted:	false
SSDEEP:	24:a1CbOE6WEIg2yyK2rEQf+r97Ij4ADQQwqfDJ7h6xX6FtwfGmr626EZR26DwU6+1j:a1CJ65lWKAfwIc+1XwiB0bD2nUN
MD5:	A1C6355864B4BCAE33C1284DCB17A206
SHA1:	DE5C03C52E77DB45E45C81E6D01F01DE4F3C1D1E
SHA-256:	7F591A5CBE8FE123CBEB99A523075716EBDE302C7F0B7896363421CA57346939
SHA-512:	5ED68AEEC06D091E112355647F177E6A02A0539C75CFB6FD82F594444C996BC06F3CCAAD91ADB0863A73409CB88FC2CC3D53AFFF6BCA1C73CFDDE584CB766DDC
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja.JIS,v 1.3 1997/08/26 11:57:23 hohndel Exp $.# .# .# .# $Xorg: ja.JIS,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# .# XLocale Database Sample for ja_JP.jis.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.jis.mb_cur_max..5.state_depend_encoding.True..wc_encoding_mask.\x30000000

C:\Program Files (x86)\Xming\locale\ja.S90\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	5.542696304575092
Encrypted:	false
SSDEEP:	48:l3Njv9ux6N2Duj6NQIpdEjwocJVgBl1DzuhsjQ0ZGIbN1OHRdtkFdv3:NNjlSld3VVgBl1nuUy7q/
MD5:	1573533317890DE08D1BEA399F62E621
SHA1:	8C1592844E39915BF7F787C106A2C97D3E968DEF
SHA-256:	65DDB21BB5C8F1FFAE2EB51DBD5400B8D64A2DFB398A986AF246D56212216A90
SHA-512:	DDEAAA1330CFB3CAF800D43F7588941CCBF23A0D0734D0DB2ADC7B7094EF36DB3A3EA1ED1463D8F540C97BF6DC7ED7C8E42DD5A9D26DDE706DD0468770527706
Malicious:	false
Preview:	# $Xorg: ja.S90,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.S90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL...udc_area \x7521,\x7e7e..}..font.{...primary..fujitsu.

C:\Program Files (x86)\Xming\locale\ja.S90\is-6GPJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	5.542696304575092
Encrypted:	false
SSDEEP:	48:l3Njv9ux6N2Duj6NQIpdEjwocJVgBl1DzuhsjQ0ZGIbN1OHRdtkFdv3:NNjlSld3VVgBl1nuUy7q/
MD5:	1573533317890DE08D1BEA399F62E621
SHA1:	8C1592844E39915BF7F787C106A2C97D3E968DEF
SHA-256:	65DDB21BB5C8F1FFAE2EB51DBD5400B8D64A2DFB398A986AF246D56212216A90
SHA-512:	DDEAAA1330CFB3CAF800D43F7588941CCBF23A0D0734D0DB2ADC7B7094EF36DB3A3EA1ED1463D8F540C97BF6DC7ED7C8E42DD5A9D26DDE706DD0468770527706
Malicious:	false
Preview:	# $Xorg: ja.S90,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.S90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL...udc_area \x7521,\x7e7e..}..font.{...primary..fujitsu.

C:\Program Files (x86)\Xming\locale\ja.SJIS\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.950796633126475
Encrypted:	false
SSDEEP:	6:LsRL5kc/Oetdtm8LRLvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeRvt7LRTdce6ldo0+62XdUmhn
MD5:	019F7ECE8CBE30ED4C5E66059ED0FA2C
SHA1:	422A5D364F7BC51F743180DD308385B1F2771D40
SHA-256:	93A277C5081E33821095CB3406461949F0494DFC3AE91714D29585930E0F32E8
SHA-512:	5D2D33D5EC5EC59B1D529B5BA9215ED272A814B221DCA18F321F329447ADA9C9AF2507074D0AB9C9362A6DF4957ADEBEA5E1A138DEFD05B23D582B0C38C620AF
Malicious:	false
Preview:	#.# ja.SJIS Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja.SJIS,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja.SJIS\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (3586)
Category:	dropped
Size (bytes):	5311
Entropy (8bit):	5.163371637113679
Encrypted:	false
SSDEEP:	96:lVbepEyMW2N+oJX8VjdH8K9ke9ObIMjCSJ9O7nJ1tHO:jsWxadcK2b1GOgnM
MD5:	535562BBB8AA58E4E4C9B08598EFAFD0
SHA1:	70AD6B9DE482AA59BF4F8FAB35519A972C015593
SHA-256:	E77863F185121911C44FAADBC9BDE6D6A2477108D6A9036131AE131F80987061
SHA-512:	530F6F9E2676449A1ABFAB25374B84788569C09CA547B8B5E068EED3FB4FFF570D14AF66099BB7BA86B903D97654A1980633A685592390E1570A49ABEC78DF9D
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja.SJIS,v 1.3 1997/08/26 11:57:23 hohndel Exp $.# .# .# .# $Xorg: ja.SJIS,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# .# XLocale Database Sample for ja_JP.sjis.# ....# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.sjis.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x3

C:\Program Files (x86)\Xming\locale\ja.SJIS\is-GSAB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (3586)
Category:	dropped
Size (bytes):	5311
Entropy (8bit):	5.163371637113679
Encrypted:	false
SSDEEP:	96:lVbepEyMW2N+oJX8VjdH8K9ke9ObIMjCSJ9O7nJ1tHO:jsWxadcK2b1GOgnM
MD5:	535562BBB8AA58E4E4C9B08598EFAFD0
SHA1:	70AD6B9DE482AA59BF4F8FAB35519A972C015593
SHA-256:	E77863F185121911C44FAADBC9BDE6D6A2477108D6A9036131AE131F80987061
SHA-512:	530F6F9E2676449A1ABFAB25374B84788569C09CA547B8B5E068EED3FB4FFF570D14AF66099BB7BA86B903D97654A1980633A685592390E1570A49ABEC78DF9D
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja.SJIS,v 1.3 1997/08/26 11:57:23 hohndel Exp $.# .# .# .# $Xorg: ja.SJIS,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# .# XLocale Database Sample for ja_JP.sjis.# ....# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.sjis.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x3

C:\Program Files (x86)\Xming\locale\ja.SJIS\is-NAPDU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.950796633126475
Encrypted:	false
SSDEEP:	6:LsRL5kc/Oetdtm8LRLvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeRvt7LRTdce6ldo0+62XdUmhn
MD5:	019F7ECE8CBE30ED4C5E66059ED0FA2C
SHA1:	422A5D364F7BC51F743180DD308385B1F2771D40
SHA-256:	93A277C5081E33821095CB3406461949F0494DFC3AE91714D29585930E0F32E8
SHA-512:	5D2D33D5EC5EC59B1D529B5BA9215ED272A814B221DCA18F321F329447ADA9C9AF2507074D0AB9C9362A6DF4957ADEBEA5E1A138DEFD05B23D582B0C38C620AF
Malicious:	false
Preview:	#.# ja.SJIS Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja.SJIS,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja.U90\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	5.540768945158981
Encrypted:	false
SSDEEP:	48:3N5v9ux6N2Duj6NQIpVL9wJVgBl1DzuhsjQSBGIdN1OHRdt0Fdvh:3N5lSlVoVgBl1nuUbcZSJ
MD5:	54EFC82A1107934BD458218C142BEDFE
SHA1:	4EF19332BDBB2930977D721AC5165C766808E495
SHA-256:	242D61C83B4BA9BE81290D8008AE4181A7DE032228D6ED7D3D6C070DBDD5E905
SHA-512:	226E2FB84B419DFFDCF37CE254CFD1F04A61632CD70F66E75E9BC3F71E1ACB8425876352CE4B8D6353CAB9C5123DC758879EC864FDA39E4FD3F8A4CEF9E899F9
Malicious:	false
Preview:	# $Xorg: ja.U90,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.U90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL..}..font.{. primary fujitsu.u90x

C:\Program Files (x86)\Xming\locale\ja.U90\is-B2VRE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	5.540768945158981
Encrypted:	false
SSDEEP:	48:3N5v9ux6N2Duj6NQIpVL9wJVgBl1DzuhsjQSBGIdN1OHRdt0Fdvh:3N5lSlVoVgBl1nuUbcZSJ
MD5:	54EFC82A1107934BD458218C142BEDFE
SHA1:	4EF19332BDBB2930977D721AC5165C766808E495
SHA-256:	242D61C83B4BA9BE81290D8008AE4181A7DE032228D6ED7D3D6C070DBDD5E905
SHA-512:	226E2FB84B419DFFDCF37CE254CFD1F04A61632CD70F66E75E9BC3F71E1ACB8425876352CE4B8D6353CAB9C5123DC758879EC864FDA39E4FD3F8A4CEF9E899F9
Malicious:	false
Preview:	# $Xorg: ja.U90,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.U90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL..}..font.{. primary fujitsu.u90x

C:\Program Files (x86)\Xming\locale\ja\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.894440030624076
Encrypted:	false
SSDEEP:	6:LfhL5kc/Oetdtm8Jxuvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LfTRvt7H8dce6ldo0+62XdUmhn
MD5:	677906EE1B356274DFE3FCF7BC9C7053
SHA1:	7F9DB2E43E4D86E74515454E702B58617C9B1A2F
SHA-256:	11E6562F526EC97232FF36CF4B02A88C66FFC1A9E4FD04485BB2CD19616BBF41
SHA-512:	940E21C563C7FD2C42A5D1201F497453CA9C64DC914528FD5CEA06D0652DEED53C6C17B9F53B9A9150838E3A0F18674012C037E7049EB3D2BD5443DBFCDEB464
Malicious:	false
Preview:	#.# ja Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	5.425305312102024
Encrypted:	false
SSDEEP:	24:a1TOEH8OWEIg2yFEmAEQf+r9FvkID4MQQwqfDJ7/twfGm/73ZRRdbwRd+GG1F:a1BHB5lBEHfqvkI8G1NBgRdERd+GC
MD5:	D62E473F7C447E6BF8F0A7035CCCDF8B
SHA1:	ADCA28DD61A0B8A167B3AE00FAF1255C5EA7C4CF
SHA-256:	708C87CA62EB5D358506E4024C651A76CE17BFC64E44911F64A590EF3DC05BA4
SHA-512:	E342B793CF7B64BBC5D0C86CFB55BFB0578497DC69B4C57B531FE030D08A22EED16BCA1790D1083B4FB242484C266A129CD82BA7FCBFF647F50EF06B165D16AC
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja,v 1.3 1997/08/26 11:57:22 hohndel Exp $.# .# .#.# $Xorg: ja,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.#.# XLocale Database Sample for ja_JP.euc .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL...udc_area.\x7521,\x7e7e..}..font.{...primary..JISX0208.1983-0:GL. substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#..udc_area.\x7521,\x7e7e.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.# .}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.euc.mb_cur_max..

C:\Program Files (x86)\Xming\locale\ja\is-5P1N6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	5.425305312102024
Encrypted:	false
SSDEEP:	24:a1TOEH8OWEIg2yFEmAEQf+r9FvkID4MQQwqfDJ7/twfGm/73ZRRdbwRd+GG1F:a1BHB5lBEHfqvkI8G1NBgRdERd+GC
MD5:	D62E473F7C447E6BF8F0A7035CCCDF8B
SHA1:	ADCA28DD61A0B8A167B3AE00FAF1255C5EA7C4CF
SHA-256:	708C87CA62EB5D358506E4024C651A76CE17BFC64E44911F64A590EF3DC05BA4
SHA-512:	E342B793CF7B64BBC5D0C86CFB55BFB0578497DC69B4C57B531FE030D08A22EED16BCA1790D1083B4FB242484C266A129CD82BA7FCBFF647F50EF06B165D16AC
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/ja,v 1.3 1997/08/26 11:57:22 hohndel Exp $.# .# .#.# $Xorg: ja,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.#.# XLocale Database Sample for ja_JP.euc .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL...udc_area.\x7521,\x7e7e..}..font.{...primary..JISX0208.1983-0:GL. substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#..udc_area.\x7521,\x7e7e.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.# .}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.euc.mb_cur_max..

C:\Program Files (x86)\Xming\locale\ja\is-M5C60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.894440030624076
Encrypted:	false
SSDEEP:	6:LfhL5kc/Oetdtm8Jxuvr/3Byhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LfTRvt7H8dce6ldo0+62XdUmhn
MD5:	677906EE1B356274DFE3FCF7BC9C7053
SHA1:	7F9DB2E43E4D86E74515454E702B58617C9B1A2F
SHA-256:	11E6562F526EC97232FF36CF4B02A88C66FFC1A9E4FD04485BB2CD19616BBF41
SHA-512:	940E21C563C7FD2C42A5D1201F497453CA9C64DC914528FD5CEA06D0652DEED53C6C17B9F53B9A9150838E3A0F18674012C037E7049EB3D2BD5443DBFCDEB464
Malicious:	false
Preview:	#.# ja Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ja,v 1.1 1999/08/28 09:00:37 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ja_JP.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	5.173024466093806
Encrypted:	false
SSDEEP:	48:aa5d306cpBU2l3bkTtsH/WKrTbcQuAD44zOu8aj6xdC8e:V5+6cYGOEX
MD5:	98AD409D7F44DF6CCBF53A4D6198CB11
SHA1:	198A133C603E0DE4CF04491F8E5E306B05DBA6FE
SHA-256:	A46D475D9BD80B2140F306FDA619AF3A659B73FF47FC176CF9943468A2D0A3FB
SHA-512:	95858570A0867868485BF99AC2243E980804F43854858188BB36AD004EC3C964F4078DEED4D8E96FC74A34A2114D974AD8345615FFCF95DF41BD345EF0E5A57D
Malicious:	false
Preview:	# $XFree86$.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}..# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}..# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646-1 is put last to make usually bet

C:\Program Files (x86)\Xming\locale\ja_JP.UTF-8\is-LLO46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	5.173024466093806
Encrypted:	false
SSDEEP:	48:aa5d306cpBU2l3bkTtsH/WKrTbcQuAD44zOu8aj6xdC8e:V5+6cYGOEX
MD5:	98AD409D7F44DF6CCBF53A4D6198CB11
SHA1:	198A133C603E0DE4CF04491F8E5E306B05DBA6FE
SHA-256:	A46D475D9BD80B2140F306FDA619AF3A659B73FF47FC176CF9943468A2D0A3FB
SHA-512:	95858570A0867868485BF99AC2243E980804F43854858188BB36AD004EC3C964F4078DEED4D8E96FC74A34A2114D974AD8345615FFCF95DF41BD345EF0E5A57D
Malicious:	false
Preview:	# $XFree86$.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}..# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}..# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646-1 is put last to make usually bet

C:\Program Files (x86)\Xming\locale\ko\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.877115632546416
Encrypted:	false
SSDEEP:	6:L0emK8L5kc/OetdtmFuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0e0Rvte8Ze6ldo0+62XdUmhn
MD5:	4958FD505EAF94CBAA1A9116FE01D655
SHA1:	E857215327A6CF63C328199246E1655368DEFF36
SHA-256:	EC98BEE1E56B8BA46B9E026EFF8035633EB11621827ABC1485A70CF931E2336F
SHA-512:	EFD0D2CF0332C0DC7B00AE779DDE9F68DBA660DFC89907D28CDD6F1D23EFE3D1B221C15D41BD66F592DB8CDF95E9307322534A499DC36AAC545DD7FB0898D70D
Malicious:	false
Preview:	#.# ko Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ko,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ko\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.4038893032866975
Encrypted:	false
SSDEEP:	24:tzFtLEINc3jZ52hz9QQwqfDJ7/tfGm/72E:XtwF3d5AR1NsPE
MD5:	EE97C1BBFC4878E18B1E0C00E139FD17
SHA1:	5A1730F7B57F0A56862FCB1792F53A67D2D467D1
SHA-256:	4C9C242EE6CCDA01CD8C72E2D087A12C23EF0E0A755A1A99578216C1ACFB0570
SHA-512:	6734EF1832BF6BCEF0462100D61A1FC7D913BBCB09009D28D3E9E33C1E1CE077E9EBA83C847D7AC5867A55F8BB65E300C23B2B47922393A8B47475BB534D78AF
Malicious:	false
Preview:	# $Xorg: ko,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for ko..# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary..KSC5601.1987-0:GL...substitute.KSC5601.1987-0:GL..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ko.euc.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2...wc_encoding.\x30000000.....ct_encoding.KSC5601.1987-0:GL; KSC5601.1987-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\ko\is-89P43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.877115632546416
Encrypted:	false
SSDEEP:	6:L0emK8L5kc/OetdtmFuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0e0Rvte8Ze6ldo0+62XdUmhn
MD5:	4958FD505EAF94CBAA1A9116FE01D655
SHA1:	E857215327A6CF63C328199246E1655368DEFF36
SHA-256:	EC98BEE1E56B8BA46B9E026EFF8035633EB11621827ABC1485A70CF931E2336F
SHA-512:	EFD0D2CF0332C0DC7B00AE779DDE9F68DBA660DFC89907D28CDD6F1D23EFE3D1B221C15D41BD66F592DB8CDF95E9307322534A499DC36AAC545DD7FB0898D70D
Malicious:	false
Preview:	#.# ko Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/ko,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\ko\is-PPC8R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.4038893032866975
Encrypted:	false
SSDEEP:	24:tzFtLEINc3jZ52hz9QQwqfDJ7/tfGm/72E:XtwF3d5AR1NsPE
MD5:	EE97C1BBFC4878E18B1E0C00E139FD17
SHA1:	5A1730F7B57F0A56862FCB1792F53A67D2D467D1
SHA-256:	4C9C242EE6CCDA01CD8C72E2D087A12C23EF0E0A755A1A99578216C1ACFB0570
SHA-512:	6734EF1832BF6BCEF0462100D61A1FC7D913BBCB09009D28D3E9E33C1E1CE077E9EBA83C847D7AC5867A55F8BB65E300C23B2B47922393A8B47475BB534D78AF
Malicious:	false
Preview:	# $Xorg: ko,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for ko..# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary..KSC5601.1987-0:GL...substitute.KSC5601.1987-0:GL..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ko.euc.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2...wc_encoding.\x30000000.....ct_encoding.KSC5601.1987-0:GL; KSC5601.1987-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\ko_KR.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2189
Entropy (8bit):	5.174882466637225
Encrypted:	false
SSDEEP:	48:ep5d306cpBU3bkS2wtsH/MKrTbcQuAD44zd8TOj6xdC8e:k5+6cYGEE9
MD5:	65853D5D6897087C528BB3338D27D0C3
SHA1:	04F3074ECE815CCBC385BA4ECA6A27DBF01FC3DA
SHA-256:	8320D5BEB5223826D5AE1242E3E04A0E7956BC65319769A67DA50B6B8819EEB6
SHA-512:	B38F810DB85F753DBF88FECC3C9E2291E1FB97910AAFFF79E88132C969189A267411023E5E5A71F7367C16A24ECA328C4E2526353C7F58533D91926C67FE689A
Malicious:	false
Preview:	# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Korean Character).fs2.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# .fs3 class (Kanji).fs3.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}..# ISO10646-1 is put last to make usually better-l

C:\Program Files (x86)\Xming\locale\ko_KR.UTF-8\is-F1I1H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2189
Entropy (8bit):	5.174882466637225
Encrypted:	false
SSDEEP:	48:ep5d306cpBU3bkS2wtsH/MKrTbcQuAD44zd8TOj6xdC8e:k5+6cYGEE9
MD5:	65853D5D6897087C528BB3338D27D0C3
SHA1:	04F3074ECE815CCBC385BA4ECA6A27DBF01FC3DA
SHA-256:	8320D5BEB5223826D5AE1242E3E04A0E7956BC65319769A67DA50B6B8819EEB6
SHA-512:	B38F810DB85F753DBF88FECC3C9E2291E1FB97910AAFFF79E88132C969189A267411023E5E5A71F7367C16A24ECA328C4E2526353C7F58533D91926C67FE689A
Malicious:	false
Preview:	# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Korean Character).fs2.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# .fs3 class (Kanji).fs3.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}..# ISO10646-1 is put last to make usually better-l

C:\Program Files (x86)\Xming\locale\koi8-c\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6342
Entropy (8bit):	4.890366346124397
Encrypted:	false
SSDEEP:	96:X773/rwRnWGRoReRplgYoAEwamowxpxpqyaq1wwfxHJH4SrrhrfrVrDhBXsyWOlG:XYvSofRVLBc2xkah3wFUdXBq9N
MD5:	1616DD3ABBB3372FAE98804F8E5ECDC9
SHA1:	06BF541F4767A1CB1258DEEB924385426AA60E17
SHA-256:	DF86B227173F2DF398172A28500787D3B52A63370DACDFD6B0D1FA09A85D4DC1
SHA-512:	0227C532418C138F79803F55F5681463DC0BAAF52CA9E83DB7D855C9C413BFA2A51D84F56377D761E9A5521A542C44D7699E54421369B917249BEC2D109C1C50
Malicious:	false
Preview:	#.# koi8-c Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-c,v 1.1 2000/10/27 18:30:52 dawes Exp $.#..# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asciicircum.<Multi_key> <space> <greater> : "^" asciicircum.<Multi_key> <grave> <space> : "`" grave.<Mul

C:\Program Files (x86)\Xming\locale\koi8-c\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	979
Entropy (8bit):	5.360753631387589
Encrypted:	false
SSDEEP:	24:a13gHdnWEB28XLvLOuO4Z+Q+fDJ7/QGGm/7F4:a1305B9vLOuOFN27
MD5:	308744BC1EFF70A3D6BD76FEEFED4B6A
SHA1:	CE8250788A17DE169AF2BFC8806B104A27D1EB1A
SHA-256:	59DABF7AE5FC9E6F8ED0763C5A0B90F83FF0DB7E336C9286E2A402C19E90C3DE
SHA-512:	57515FF290A9877503E66447B2749D91F6BA1E011375835865830CFCD63D89B11E906E5E209B46729CB40316FED6E265C57FBC9D5B442A214E8B27AB6617C373
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/koi8-c,v 1.1 2000/10/27 18:30:56 dawes Exp $.# XLocale Database Sample for koi8-c..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-C:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-C:GR..font KOI8-C:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-C..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-C.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-C:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-C:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\koi8-c\is-4MLOK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	979
Entropy (8bit):	5.360753631387589
Encrypted:	false
SSDEEP:	24:a13gHdnWEB28XLvLOuO4Z+Q+fDJ7/QGGm/7F4:a1305B9vLOuOFN27
MD5:	308744BC1EFF70A3D6BD76FEEFED4B6A
SHA1:	CE8250788A17DE169AF2BFC8806B104A27D1EB1A
SHA-256:	59DABF7AE5FC9E6F8ED0763C5A0B90F83FF0DB7E336C9286E2A402C19E90C3DE
SHA-512:	57515FF290A9877503E66447B2749D91F6BA1E011375835865830CFCD63D89B11E906E5E209B46729CB40316FED6E265C57FBC9D5B442A214E8B27AB6617C373
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/koi8-c,v 1.1 2000/10/27 18:30:56 dawes Exp $.# XLocale Database Sample for koi8-c..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-C:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-C:GR..font KOI8-C:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-C..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-C.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-C:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-C:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\koi8-c\is-UDQQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6342
Entropy (8bit):	4.890366346124397
Encrypted:	false
SSDEEP:	96:X773/rwRnWGRoReRplgYoAEwamowxpxpqyaq1wwfxHJH4SrrhrfrVrDhBXsyWOlG:XYvSofRVLBc2xkah3wFUdXBq9N
MD5:	1616DD3ABBB3372FAE98804F8E5ECDC9
SHA1:	06BF541F4767A1CB1258DEEB924385426AA60E17
SHA-256:	DF86B227173F2DF398172A28500787D3B52A63370DACDFD6B0D1FA09A85D4DC1
SHA-512:	0227C532418C138F79803F55F5681463DC0BAAF52CA9E83DB7D855C9C413BFA2A51D84F56377D761E9A5521A542C44D7699E54421369B917249BEC2D109C1C50
Malicious:	false
Preview:	#.# koi8-c Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-c,v 1.1 2000/10/27 18:30:52 dawes Exp $.#..# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asciicircum.<Multi_key> <space> <greater> : "^" asciicircum.<Multi_key> <grave> <space> : "`" grave.<Mul

C:\Program Files (x86)\Xming\locale\koi8-r\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.902134576141488
Encrypted:	false
SSDEEP:	6:L0cFmDL5kc/OetdtmLJAlvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0cF0RvtAAFZe6ldo0+62XdUmhn
MD5:	9F501EE1917A2C51C4DEDD142D31057E
SHA1:	4F68C7E3B9616F909896476F6E3DA1CEA5075782
SHA-256:	6B525A4058AAB0F66F8E71508FAEB71A4C109C186A6C30A1EACFF6CE97E9E2D4
SHA-512:	20CCBFB6BD7F18E2A9F0B9B5050BCAB649BAE8C006B662CBC9DC0CC13FE6D36A6BBDB83F68EB7B53F93A1C2D894DA25D4F03D2AA68E778C0E604B1CB05B44DFF
Malicious:	false
Preview:	#.# koi8-r Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-r,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\koi8-r\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.413019222344604
Encrypted:	false
SSDEEP:	24:tcJ4Nw1ehHoWEo28XSUlvL7uO4jHQ+fDJ7/3rGGm/7FSM:61KI5ojvL7uO6Nhw
MD5:	56D53EBA7ED1ABC302D36495C2F210F1
SHA1:	0AF2C2E6053734F6B2906A6BC1BEAD87A9198621
SHA-256:	28E0E9415287A0D7BBD6C37C5592E931A09567ADB21B41C861B918F55820CB95
SHA-512:	9F34E779264FD745DC08FA0793504ED0CD78DEC9406BC8CBC8548573CB034422581BE0177487D08FB3B68731C8BF1BF3A347D67BC9BACFE24F44900B96FE586C
Malicious:	false
Preview:	# $Xorg: koi8-r,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for koi8-r..# .# .# $XFree86: xc/nls/XLC_LOCALE/koi8-r,v 3.3 2000/12/01 17:43:03 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-R:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-R:GR..font KOI8-R:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-R..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-R.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-R:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_enco

C:\Program Files (x86)\Xming\locale\koi8-r\is-OQUTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.902134576141488
Encrypted:	false
SSDEEP:	6:L0cFmDL5kc/OetdtmLJAlvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0cF0RvtAAFZe6ldo0+62XdUmhn
MD5:	9F501EE1917A2C51C4DEDD142D31057E
SHA1:	4F68C7E3B9616F909896476F6E3DA1CEA5075782
SHA-256:	6B525A4058AAB0F66F8E71508FAEB71A4C109C186A6C30A1EACFF6CE97E9E2D4
SHA-512:	20CCBFB6BD7F18E2A9F0B9B5050BCAB649BAE8C006B662CBC9DC0CC13FE6D36A6BBDB83F68EB7B53F93A1C2D894DA25D4F03D2AA68E778C0E604B1CB05B44DFF
Malicious:	false
Preview:	#.# koi8-r Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-r,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\koi8-r\is-S1168.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.413019222344604
Encrypted:	false
SSDEEP:	24:tcJ4Nw1ehHoWEo28XSUlvL7uO4jHQ+fDJ7/3rGGm/7FSM:61KI5ojvL7uO6Nhw
MD5:	56D53EBA7ED1ABC302D36495C2F210F1
SHA1:	0AF2C2E6053734F6B2906A6BC1BEAD87A9198621
SHA-256:	28E0E9415287A0D7BBD6C37C5592E931A09567ADB21B41C861B918F55820CB95
SHA-512:	9F34E779264FD745DC08FA0793504ED0CD78DEC9406BC8CBC8548573CB034422581BE0177487D08FB3B68731C8BF1BF3A347D67BC9BACFE24F44900B96FE586C
Malicious:	false
Preview:	# $Xorg: koi8-r,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for koi8-r..# .# .# $XFree86: xc/nls/XLC_LOCALE/koi8-r,v 3.3 2000/12/01 17:43:03 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-R:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-R:GR..font KOI8-R:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-R..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-R.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-R:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_enco

C:\Program Files (x86)\Xming\locale\koi8-u\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.906972848834616
Encrypted:	false
SSDEEP:	6:L0/ohL5kc/OetdtmKuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0/SRvtwZe6ldo0+62XdUmhn
MD5:	B6ABB2D3A72D03788355C29D40FCD62C
SHA1:	CA71957DC07FCE8D239E38BBF8E72C10D7572BF8
SHA-256:	CC918649DFFF299D73066D8E21E520E69C3E3F88995776491BBFF32767FB6959
SHA-512:	188DDC5F986F44BE438E2DA2193C9386141D102AA176EEBA780B7EA4737456298F73B20C0D2E54156C34B2090C07D486D7C2FDD3B5C4D78C229A9639586C01A8
Malicious:	false
Preview:	#.# koi8-u Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-u,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\koi8-u\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	979
Entropy (8bit):	5.389325871373256
Encrypted:	false
SSDEEP:	24:a13KHWEf28XJzNvLguO4WQ+fDJ7/aGGm/7FZk:a1+5fjzNvLguOfNsMk
MD5:	BED4FCB41D7BBD011822B3E80B730525
SHA1:	F7A57525C2493BF75A24130B2B78F92F2CF6CEB2
SHA-256:	204C8198D52ABFCC3B8DFB308189FCA5F7238CADAD6594E98289B399E2D4EB85
SHA-512:	8F3C6274072ABE38D9F7D4FFAF561FF0BA49D01CE874E9578D47C71380D02D6EA9C24D7DB634E263DABC8A7C537D73C0A5F0961C71447ADD468D4AB6F4F25A75
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/koi8-u,v 1.1 1999/05/30 02:28:03 dawes Exp $.# XLocale Database Sample for koi8-u..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-U:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-U:GR..font KOI8-U:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-U..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-U.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-U:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-U:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\koi8-u\is-EUF5L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	979
Entropy (8bit):	5.389325871373256
Encrypted:	false
SSDEEP:	24:a13KHWEf28XJzNvLguO4WQ+fDJ7/aGGm/7FZk:a1+5fjzNvLguOfNsMk
MD5:	BED4FCB41D7BBD011822B3E80B730525
SHA1:	F7A57525C2493BF75A24130B2B78F92F2CF6CEB2
SHA-256:	204C8198D52ABFCC3B8DFB308189FCA5F7238CADAD6594E98289B399E2D4EB85
SHA-512:	8F3C6274072ABE38D9F7D4FFAF561FF0BA49D01CE874E9578D47C71380D02D6EA9C24D7DB634E263DABC8A7C537D73C0A5F0961C71447ADD468D4AB6F4F25A75
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/koi8-u,v 1.1 1999/05/30 02:28:03 dawes Exp $.# XLocale Database Sample for koi8-u..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-U:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-U:GR..font KOI8-U:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-U..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-U.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-U:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-U:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\koi8-u\is-UBR8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.906972848834616
Encrypted:	false
SSDEEP:	6:L0/ohL5kc/OetdtmKuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0/SRvtwZe6ldo0+62XdUmhn
MD5:	B6ABB2D3A72D03788355C29D40FCD62C
SHA1:	CA71957DC07FCE8D239E38BBF8E72C10D7572BF8
SHA-256:	CC918649DFFF299D73066D8E21E520E69C3E3F88995776491BBFF32767FB6959
SHA-512:	188DDC5F986F44BE438E2DA2193C9386141D102AA176EEBA780B7EA4737456298F73B20C0D2E54156C34B2090C07D486D7C2FDD3B5C4D78C229A9639586C01A8
Malicious:	false
Preview:	#.# koi8-u Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/koi8-u,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\locale.alias (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	78122
Entropy (8bit):	5.109894891927789
Encrypted:	false
SSDEEP:	1536:wX9vu3IOiIjR3a6eIoeULkDHON+89FR0jL:pIJIj0+89a
MD5:	135A00F336C0B3E82DDB2B4E0B577371
SHA1:	9A5D55325661C8672C85C221DE48E0F53179843F
SHA-256:	6FCB7D864366EEF56610400AA35F1172392B32C1E2408BFF0C0C049E23062527
SHA-512:	7F69EF663E68C5BD8E23BEA092C0F273E14A682673DBBD73255C188E6E3DF5CF38FB140F218C662AFE2C09096549A689026111A549785EC33804FDF5EAC35817
Malicious:	false
Preview:	#.$XdotOrg: lib/X11/nls/locale.alias.pre,v 1.12 2005-09-30 07:52:46 daniels Exp $.#.$Xorg: locale.alias,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains alias name of locale..#.Each alias name is described within one line..#.The first word is the alias name (simplified locale name).#.the second word is full locale name..#.#.$XFree86: xc/nls/locale.alias,v 1.65 2004/01/03 03:31:00 dawes Exp $.#..POSIX......C.POSIX-UTF2.....C.C_C.C......C.C.en......C.C.iso88591.....en_US.ISO8859-1.Cextend.....en_US.ISO8859-1.Cextend.en.....en_US.ISO8859-1.English_United-States.437...C.# a3 is not an ISO 639 language code, but in Cyrillic, "Z" looks like "3"..a3......a3_AZ.KOI8-C.a3_AZ......a3_AZ.KOI8-C.a3_AZ.koi8c.....a3_AZ.KOI8-C.af......af_ZA.ISO8859-1.af_ZA......af_ZA.ISO8859-1.af_ZA.iso88591.....af_ZA.ISO8859-1.af_ZA.ISO-8859-1....af_ZA.ISO8859-1.af_ZA.utf8....af_ZA.UTF-8.am......am_ET.UTF-8.am_ET......am_ET.UTF-8.ar......ar_AA.ISO8859-6.ar_AA......ar_AA.ISO8859-6.AR_AA......ar_AA.ISO885

C:\Program Files (x86)\Xming\locale\locale.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	32977
Entropy (8bit):	5.097966972962208
Encrypted:	false
SSDEEP:	192:bKnoGJ1c7KLR3rL05Nr2vnhsKLgnUKbQCjc9J/oPzb2xQMBG:afSr2PhqjUBib2SMBG
MD5:	D21C2771B5BC7C08346AA0569A36EF95
SHA1:	6F8D59FC05A95D381CBC7E97900813905F7B4FB8
SHA-256:	46738699395212D66136636C7A4F6360A42AF0F76990ACC5DF485C6B000D237A
SHA-512:	81E48E4DF1C880B3418D362181916953F73A6D40AA34B374F0372C6255E923AE6F8EBB63EEE01664B2A857AB55EC9B8B2DF5705B87D45A841DA85F7971AF3DF8
Malicious:	false
Preview:	#.$XdotOrg: lib/X11/nls/locale.dir.pre,v 1.10 2005-09-30 07:52:46 daniels Exp $.#.$Xorg: locale.dir,v 1.3 2000/08/17 19:46:48 cpqbld Exp $.#.#.This file contains locale database file names.#.The first word is the locale database file name and.#.the second word is the full locale name..#.#.$XFree86: xc/nls/locale.dir,v 1.44 2003/12/18 04:14:22 dawes Exp $.#..C/XLC_LOCALE....C.iso8859-1/XLC_LOCALE...af_ZA.ISO8859-1.iso8859-6/XLC_LOCALE...ar_AA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_BH.ISO8859-6.iso8859-6/XLC_LOCALE...ar_DZ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_EG.ISO8859-6.iso8859-6/XLC_LOCALE...ar_IQ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_JO.ISO8859-6.iso8859-6/XLC_LOCALE...ar_KW.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LB.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_MA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_OM.ISO8859-6.iso8859-6/XLC_LOCALE...ar_QA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SD.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SY.ISO8859-

C:\Program Files (x86)\Xming\locale\microsoft-cp1251\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.477275595670559
Encrypted:	false
SSDEEP:	24:+PRQ1CMg/evWElJ28NJ9l2vQ+ODuO4PiQQwqfDJ7/aCGGm/7FTIk:+pQ1CMYw5lJV9l2vQ+4uOU01NaUud
MD5:	153D382C0A829EB57A38A2DF80CEF3B8
SHA1:	D7DB9E0F45569BFDA61EE543E8C765A0CB86BEEA
SHA-256:	55F8A77D33561B7863218DBF7E8836431023EB148B08ECEB786B98054C4C06E0
SHA-512:	704F106228B2625CF412F929112E0089E64A5DBBFB54F5BE789650834DD7CB67CD4FB1D58D933ECDC031B34F3401B7D6FCBBAEC1D6076B7F9A3A8F30E442F468
Malicious:	false
Preview:	# $TOG: microsoft-cp1251 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1251..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1251,v 1.1 2000/10/27 18:30:56 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1251:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1251:GR..}..font.{...primary..MICROSOFT-CP1251:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1251..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1251.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\microsoft-cp1251\is-135A3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.477275595670559
Encrypted:	false
SSDEEP:	24:+PRQ1CMg/evWElJ28NJ9l2vQ+ODuO4PiQQwqfDJ7/aCGGm/7FTIk:+pQ1CMYw5lJV9l2vQ+4uOU01NaUud
MD5:	153D382C0A829EB57A38A2DF80CEF3B8
SHA1:	D7DB9E0F45569BFDA61EE543E8C765A0CB86BEEA
SHA-256:	55F8A77D33561B7863218DBF7E8836431023EB148B08ECEB786B98054C4C06E0
SHA-512:	704F106228B2625CF412F929112E0089E64A5DBBFB54F5BE789650834DD7CB67CD4FB1D58D933ECDC031B34F3401B7D6FCBBAEC1D6076B7F9A3A8F30E442F468
Malicious:	false
Preview:	# $TOG: microsoft-cp1251 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1251..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1251,v 1.1 2000/10/27 18:30:56 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1251:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1251:GR..}..font.{...primary..MICROSOFT-CP1251:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1251..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1251.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\microsoft-cp1255\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.484690535875314
Encrypted:	false
SSDEEP:	24:+bRk1C3/evWEltX28NJtEEltEBvQ+MuO4POQQwqfDJ7/atoGGm/7FTt/:+tk1Cvw5lVVJlqvQ+MuOUA1Naoux
MD5:	6D94CDC8C937F76B2B0C8D13038328BA
SHA1:	1808B845E8937A2E63FF23AA879212813E6B5F44
SHA-256:	ED84A0992688587D515522A2BBF3449F2DC9023852A0E7F8007A79A5D9102A95
SHA-512:	1F0EC9FCA9F5B41C226041F5594E6EAE58593BB32BE22353111229C479DCFAD4BB6E25EECBC257BC886D574F6221CA5E6F45A219706A282FB246021204918E15
Malicious:	false
Preview:	# $TOG: microsoft-cp1255 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1255..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1255,v 1.1 2000/10/27 18:30:56 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1255:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1255:GR..}..font.{...primary..MICROSOFT-CP1255:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1255..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1255.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\microsoft-cp1255\is-9B677.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.484690535875314
Encrypted:	false
SSDEEP:	24:+bRk1C3/evWEltX28NJtEEltEBvQ+MuO4POQQwqfDJ7/atoGGm/7FTt/:+tk1Cvw5lVVJlqvQ+MuOUA1Naoux
MD5:	6D94CDC8C937F76B2B0C8D13038328BA
SHA1:	1808B845E8937A2E63FF23AA879212813E6B5F44
SHA-256:	ED84A0992688587D515522A2BBF3449F2DC9023852A0E7F8007A79A5D9102A95
SHA-512:	1F0EC9FCA9F5B41C226041F5594E6EAE58593BB32BE22353111229C479DCFAD4BB6E25EECBC257BC886D574F6221CA5E6F45A219706A282FB246021204918E15
Malicious:	false
Preview:	# $TOG: microsoft-cp1255 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1255..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1255,v 1.1 2000/10/27 18:30:56 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1255:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1255:GR..}..font.{...primary..MICROSOFT-CP1255:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1255..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1255.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\microsoft-cp1256\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.500825605394372
Encrypted:	false
SSDEEP:	24:+Y/Rqc1CIBEevWElW28NJAlVvQ+zuO4P/QQwqfDJ7/ajGGm/7FTU:+Y5qc1CJw5lWVAlVvQ+zuOUf1NaJuU
MD5:	8F74E4115D9B8D3C5AB17D43E81036A3
SHA1:	A5879AF43D1B34C685409981EA230C6FABC7B278
SHA-256:	4CCA752086FA9D0F851622334E2556600A7EEDCDBA40E5B250268AE60CD04904
SHA-512:	14D9EDA9E579959A82423D4A377D5AB628DD9863221C0529EEB22EDF6D4466B8C1A5224F8918CB543A3118E8F986428EC8D710BF6F26935720F1BFA5EF9BEBF7
Malicious:	false
Preview:	# $TOG: microsoft-cp1256 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1256..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1256,v 1.1 2000/10/27 18:30:57 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1256:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1256:GR..}..font.{...primary..MICROSOFT-CP1256:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1256..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1256.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\microsoft-cp1256\is-FDLK1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.500825605394372
Encrypted:	false
SSDEEP:	24:+Y/Rqc1CIBEevWElW28NJAlVvQ+zuO4P/QQwqfDJ7/ajGGm/7FTU:+Y5qc1CJw5lWVAlVvQ+zuOUf1NaJuU
MD5:	8F74E4115D9B8D3C5AB17D43E81036A3
SHA1:	A5879AF43D1B34C685409981EA230C6FABC7B278
SHA-256:	4CCA752086FA9D0F851622334E2556600A7EEDCDBA40E5B250268AE60CD04904
SHA-512:	14D9EDA9E579959A82423D4A377D5AB628DD9863221C0529EEB22EDF6D4466B8C1A5224F8918CB543A3118E8F986428EC8D710BF6F26935720F1BFA5EF9BEBF7
Malicious:	false
Preview:	# $TOG: microsoft-cp1256 /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for microsoft-cp1256..# .# $XFree86: xc/nls/XLC_LOCALE/microsoft-cp1256,v 1.1 2000/10/27 18:30:57 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1256:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1256:GR..}..font.{...primary..MICROSOFT-CP1256:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1256..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1256.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOF

C:\Program Files (x86)\Xming\locale\mulelao-1\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	4.904854641036723
Encrypted:	false
SSDEEP:	6:LycxL5kc/Oetdtmgtuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LNRvt5t8Ze6ldo0+62XdUmhn
MD5:	906036E03094159553FFAC13A04BB5BF
SHA1:	B91103E67280BFAAB29607D3F4505DDC12134DAC
SHA-256:	27199C778D2ED39511E13ACEA7A790BCE70E5323F80CBC53F5CF85F3BB13C3AE
SHA-512:	A0BB4FC1E5688D4FD31390DDFA8B5241049D147723CD8E5AE708F9EB3ED11EEA5616E672C235E316BECFD042F44F97F896955F7BB7C9D1E3A28EEBFF14D3E795
Malicious:	false
Preview:	#.# mulelao-1 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/mulelao-1,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\mulelao-1\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.371866908165463
Encrypted:	false
SSDEEP:	24:a1BacNtWEIg28XK6YKNvQc/2uO4YQ+fDJ7/gGGm/7FKKk:a1BX35llvQJuOPNGL
MD5:	A84771EFAE7C844CDD20D4B044359F7B
SHA1:	1530D84F1EF945B69E2D3CA6D06978109D9DA580
SHA-256:	5A8BD8E5209D8E4DCABED10978AFB13EB64A9D100718181A9F1B8573BAF1B6D5
SHA-512:	416974913514C8F4768E322C39D62690B0BD164C5EB80FBF440F2AE6FACE422538176F3401CBFB2E43079D70B118F6635F5F180EBE6E3EE1EBFF85725966EA7E
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/mulelao-1,v 1.1 1999/06/06 14:05:59 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MULELAO-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset MULELAO-1:GR..font MULELAO-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MULELAO-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name MULELAO-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding MULELAO-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding MULELAO-1:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\mulelao-1\is-0KOF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.371866908165463
Encrypted:	false
SSDEEP:	24:a1BacNtWEIg28XK6YKNvQc/2uO4YQ+fDJ7/gGGm/7FKKk:a1BX35llvQJuOPNGL
MD5:	A84771EFAE7C844CDD20D4B044359F7B
SHA1:	1530D84F1EF945B69E2D3CA6D06978109D9DA580
SHA-256:	5A8BD8E5209D8E4DCABED10978AFB13EB64A9D100718181A9F1B8573BAF1B6D5
SHA-512:	416974913514C8F4768E322C39D62690B0BD164C5EB80FBF440F2AE6FACE422538176F3401CBFB2E43079D70B118F6635F5F180EBE6E3EE1EBFF85725966EA7E
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/mulelao-1,v 1.1 1999/06/06 14:05:59 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MULELAO-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset MULELAO-1:GR..font MULELAO-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MULELAO-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name MULELAO-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding MULELAO-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding MULELAO-1:GR.}..END XLC_XL

C:\Program Files (x86)\Xming\locale\mulelao-1\is-O10SB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	4.904854641036723
Encrypted:	false
SSDEEP:	6:LycxL5kc/Oetdtmgtuvr/uWhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LNRvt5t8Ze6ldo0+62XdUmhn
MD5:	906036E03094159553FFAC13A04BB5BF
SHA1:	B91103E67280BFAAB29607D3F4505DDC12134DAC
SHA-256:	27199C778D2ED39511E13ACEA7A790BCE70E5323F80CBC53F5CF85F3BB13C3AE
SHA-512:	A0BB4FC1E5688D4FD31390DDFA8B5241049D147723CD8E5AE708F9EB3ED11EEA5616E672C235E316BECFD042F44F97F896955F7BB7C9D1E3A28EEBFF14D3E795
Malicious:	false
Preview:	#.# mulelao-1 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/mulelao-1,v 1.1 1999/08/28 09:00:38 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\nokhchi-1\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.380088532534939
Encrypted:	false
SSDEEP:	24:a1VwgBetWE18XiwNvK2uO4pQ+fDJ7/NGGm/7FCk:a1Vwf5sv5uOeNfe
MD5:	AF438585C28B4E4B2AE007DB99D48F84
SHA1:	D4546688CADFB5747ECF7139E780FCE395F001D7
SHA-256:	EC0BF18BB6D4BB13AF2969DCA32F4BE95EBFECEFD967026F3BEF8DDED654C369
SHA-512:	75CB5AB21A8F539C68A558548647EF23C89ED7C85C380B44732FCB43D56309E771EB92D9368865888DEE9F5D6EA1CC785CFD20452287F8CD98FFD4A6649E7518
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/nokhchi-1,v 1.1 2000/10/27 18:30:57 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..NOKHCHI-1:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset NOKHCHI-1:GR..font NOKHCHI-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.NOKHCHI-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name NOKHCHI-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding NOKHCHI-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding NOKHCHI-1:GR.}..END XLC_X

C:\Program Files (x86)\Xming\locale\nokhchi-1\is-S7IRG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.380088532534939
Encrypted:	false
SSDEEP:	24:a1VwgBetWE18XiwNvK2uO4pQ+fDJ7/NGGm/7FCk:a1Vwf5sv5uOeNfe
MD5:	AF438585C28B4E4B2AE007DB99D48F84
SHA1:	D4546688CADFB5747ECF7139E780FCE395F001D7
SHA-256:	EC0BF18BB6D4BB13AF2969DCA32F4BE95EBFECEFD967026F3BEF8DDED654C369
SHA-512:	75CB5AB21A8F539C68A558548647EF23C89ED7C85C380B44732FCB43D56309E771EB92D9368865888DEE9F5D6EA1CC785CFD20452287F8CD98FFD4A6649E7518
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/nokhchi-1,v 1.1 2000/10/27 18:30:57 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..NOKHCHI-1:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset NOKHCHI-1:GR..font NOKHCHI-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.NOKHCHI-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name NOKHCHI-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding NOKHCHI-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding NOKHCHI-1:GR.}..END XLC_X

C:\Program Files (x86)\Xming\locale\pt_BR.UTF-8\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	517159
Entropy (8bit):	5.5552422053003045
Encrypted:	false
SSDEEP:	3072:IL1U9HCAsUBeiRbmFrAkY/q3OCd8kpXdkqNn:HuUBeiRbmFrAkY/q3OSh
MD5:	D53F33844A5BF94E0DC67622288D9926
SHA1:	1ECD68C7374F5B0D4F55B0A4EA9830D0B767D02D
SHA-256:	86B82FAFE1DEE321B8879228A9DA3ED1B1AB81712B1247558D01186679284602
SHA-512:	E8F918CA76EC8C05C381FE770D412D7D0CA2A3A9CD44CE7933D99C5C2A799EE8040B8D76AC7CED494AD75314B58BA021A234D8DE6141ACE7C675AF6CF5F8DF54
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#.# Modified for Brazilian Portuguese by Gustavo Noronha Silva <kov@debian.org>..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space>...: "~".asciitilde.<dead_tilde> <dead_tilde>..: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <dead_acute>..: ".".acute.<dead_grave> <space>...: "`".grave.<dead_grave> <dead_grave>..: "`".grave.<dead_circumflex> <space>..: "^".asciicircum.<dead_circumflex> <dead_circumflex>.: "^".asciicircum.<dead_abovering> <space>..: ".".degree.<dead_abovering> <dead_abovering>.: ".".degree.<dead_macron> <space>...: ".".macron.<dead_macron> <dead_macron>..: ".".macron.<dead_breve> <space>...: ".".breve.<dead_breve> <dead_breve>..: ".".breve.<dead_abovedot> <space>...: ".".abovedot.<dead_abovedot> <dead_abovedot>..: ".".abovedot.<dead_diaeresis> <dead_diaeresis>.: ".".diaeresis.<dead_diaeresis> <space>..: "\"".quotedbl.<dead_doubleacute> <space>..

C:\Program Files (x86)\Xming\locale\pt_BR.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2019
Entropy (8bit):	5.264451883593012
Encrypted:	false
SSDEEP:	48:TwdZj2V3bkptsH/8WR/GuAD44FOu8aj6xdC8e:iGEWRW
MD5:	D86AFE7D30BDEE1CE6A6830A55944D67
SHA1:	F01652B53EB0D6099D918764777E050ED4D3B03D
SHA-256:	A8271A57A99CF58580664463C77F7BAAC1E0EFA7AFA4734AE04939F8AD339C2E
SHA-512:	63F31BDCD9C65C01B6CF5B2C4EDECB92B916C787DA85C03AD66A2531639342F0027C8E2F27CC21B778E6AB8387E2EE6A91BEC5674884967D3691229A92223F28
Malicious:	false
Preview:	# XLocale Database Sample for pt_BR.UTF-8.#.# Based on XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646 is last, per Roland Mainz in.# http://bugs.freedesktop.org/show_bug.cgi?id=1896.f

C:\Program Files (x86)\Xming\locale\pt_BR.UTF-8\is-FCL0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	517159
Entropy (8bit):	5.5552422053003045
Encrypted:	false
SSDEEP:	3072:IL1U9HCAsUBeiRbmFrAkY/q3OCd8kpXdkqNn:HuUBeiRbmFrAkY/q3OSh
MD5:	D53F33844A5BF94E0DC67622288D9926
SHA1:	1ECD68C7374F5B0D4F55B0A4EA9830D0B767D02D
SHA-256:	86B82FAFE1DEE321B8879228A9DA3ED1B1AB81712B1247558D01186679284602
SHA-512:	E8F918CA76EC8C05C381FE770D412D7D0CA2A3A9CD44CE7933D99C5C2A799EE8040B8D76AC7CED494AD75314B58BA021A234D8DE6141ACE7C675AF6CF5F8DF54
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#.# Modified for Brazilian Portuguese by Gustavo Noronha Silva <kov@debian.org>..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space>...: "~".asciitilde.<dead_tilde> <dead_tilde>..: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <dead_acute>..: ".".acute.<dead_grave> <space>...: "`".grave.<dead_grave> <dead_grave>..: "`".grave.<dead_circumflex> <space>..: "^".asciicircum.<dead_circumflex> <dead_circumflex>.: "^".asciicircum.<dead_abovering> <space>..: ".".degree.<dead_abovering> <dead_abovering>.: ".".degree.<dead_macron> <space>...: ".".macron.<dead_macron> <dead_macron>..: ".".macron.<dead_breve> <space>...: ".".breve.<dead_breve> <dead_breve>..: ".".breve.<dead_abovedot> <space>...: ".".abovedot.<dead_abovedot> <dead_abovedot>..: ".".abovedot.<dead_diaeresis> <dead_diaeresis>.: ".".diaeresis.<dead_diaeresis> <space>..: "\"".quotedbl.<dead_doubleacute> <space>..

C:\Program Files (x86)\Xming\locale\pt_BR.UTF-8\is-MNUTI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2019
Entropy (8bit):	5.264451883593012
Encrypted:	false
SSDEEP:	48:TwdZj2V3bkptsH/8WR/GuAD44FOu8aj6xdC8e:iGEWRW
MD5:	D86AFE7D30BDEE1CE6A6830A55944D67
SHA1:	F01652B53EB0D6099D918764777E050ED4D3B03D
SHA-256:	A8271A57A99CF58580664463C77F7BAAC1E0EFA7AFA4734AE04939F8AD339C2E
SHA-512:	63F31BDCD9C65C01B6CF5B2C4EDECB92B916C787DA85C03AD66A2531639342F0027C8E2F27CC21B778E6AB8387E2EE6A91BEC5674884967D3691229A92223F28
Malicious:	false
Preview:	# XLocale Database Sample for pt_BR.UTF-8.#.# Based on XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646 is last, per Roland Mainz in.# http://bugs.freedesktop.org/show_bug.cgi?id=1896.f

C:\Program Files (x86)\Xming\locale\tatar-cyr\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.413523895335923
Encrypted:	false
SSDEEP:	24:M41WBEevWE928NdCvq6guO40QQwqfDJ7/VGGm/7F7:b1vw59RCv6uOz1Nnm
MD5:	2994EC482510B6799CFC248ED667897E
SHA1:	8D783EA8FA6C95C0CF03DC67A0A8C67C8324F9EB
SHA-256:	83C15B291CD80448A5A0EF05B3A0E304BB3E29BE5B03F25A88CB2CD1567D1398
SHA-512:	7CCA7D10183F604AD52B61EA47D442894B9BABE83BC9D31848AE9B7A12D526D6CCF92EAA7B16009D5542575C954085D0ABBFBD34994BE23AFCF71C8A2EF7777E
Malicious:	false
Preview:	# $TOG: tatar-cyr /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for tatar-cyr..# .# $XFree86: xc/nls/XLC_LOCALE/tatar-cyr,v 1.1 2000/10/27 18:30:57 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TATAR-CYR:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..TATAR-CYR:GR..}..font.{...primary..TATAR-CYR:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TATAR-CYR..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..TATAR-CYR.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.TATAR-CYR:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Defa

C:\Program Files (x86)\Xming\locale\tatar-cyr\is-8MK46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.413523895335923
Encrypted:	false
SSDEEP:	24:M41WBEevWE928NdCvq6guO40QQwqfDJ7/VGGm/7F7:b1vw59RCv6uOz1Nnm
MD5:	2994EC482510B6799CFC248ED667897E
SHA1:	8D783EA8FA6C95C0CF03DC67A0A8C67C8324F9EB
SHA-256:	83C15B291CD80448A5A0EF05B3A0E304BB3E29BE5B03F25A88CB2CD1567D1398
SHA-512:	7CCA7D10183F604AD52B61EA47D442894B9BABE83BC9D31848AE9B7A12D526D6CCF92EAA7B16009D5542575C954085D0ABBFBD34994BE23AFCF71C8A2EF7777E
Malicious:	false
Preview:	# $TOG: tatar-cyr /main/1 1998/05/20 14:49:21 kaleb $.# XLocale Database Sample for tatar-cyr..# .# $XFree86: xc/nls/XLC_LOCALE/tatar-cyr,v 1.1 2000/10/27 18:30:57 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TATAR-CYR:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..TATAR-CYR:GR..}..font.{...primary..TATAR-CYR:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TATAR-CYR..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..TATAR-CYR.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.TATAR-CYR:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Defa

C:\Program Files (x86)\Xming\locale\th_TH.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	992
Entropy (8bit):	5.246999981710049
Encrypted:	false
SSDEEP:	24:CNuBMiqKh41Jrdc/Ic6JRPQClw5fDJ7/3GGm/7F4pv:0iqs415dZsNlzl
MD5:	95B3B7A01E6BB7706830D12A0F76590D
SHA1:	878D9F1ED1E29C1060C2895704B1A1DBB21E1A7D
SHA-256:	AD4389EB7978EA35AF64BE5CE87432F36DEBFD3C266037E6B7B4DBDFA0E8F2F2
SHA-512:	D1458C6306CAB5A3D042BA76B57862D35D123BBC5F09A0B59BB550F73CAADB0D62EBFC17FCC21ADF3733C3EA898BD3F34144F94B8590F0641251CCD3F5241811
Malicious:	false
Preview:	# $XConsortium: th_TH$.# XLocale Database Sample for th_TH.#.# $XFree86:$.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.#.fs0 class.fs0.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs1.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs2.{..charset TIS620-0:GR..font TIS620-0:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name UTF-8.mb_cur_max..3.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000..ct_encoding TIS620-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\th_TH.UTF-8\is-FIPRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	992
Entropy (8bit):	5.246999981710049
Encrypted:	false
SSDEEP:	24:CNuBMiqKh41Jrdc/Ic6JRPQClw5fDJ7/3GGm/7F4pv:0iqs415dZsNlzl
MD5:	95B3B7A01E6BB7706830D12A0F76590D
SHA1:	878D9F1ED1E29C1060C2895704B1A1DBB21E1A7D
SHA-256:	AD4389EB7978EA35AF64BE5CE87432F36DEBFD3C266037E6B7B4DBDFA0E8F2F2
SHA-512:	D1458C6306CAB5A3D042BA76B57862D35D123BBC5F09A0B59BB550F73CAADB0D62EBFC17FCC21ADF3733C3EA898BD3F34144F94B8590F0641251CCD3F5241811
Malicious:	false
Preview:	# $XConsortium: th_TH$.# XLocale Database Sample for th_TH.#.# $XFree86:$.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.#.fs0 class.fs0.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs1.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs2.{..charset TIS620-0:GR..font TIS620-0:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name UTF-8.mb_cur_max..3.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000..ct_encoding TIS620-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\th_TH\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.1959980983376415
Encrypted:	false
SSDEEP:	24:CNuBMiZH/IcrJRdVQClw5fDJ7/3GGm/7F6v:0iZTsNlB
MD5:	2217D137A94C6374B15E5CCB51738AC9
SHA1:	704EFA6D37CAFF74B76E2FE32A86298D095745D3
SHA-256:	120A79AE42DBEEA8A967D44E2FED9A422CC132DE41FEF2CECDB64EAD2E4C7EAF
SHA-512:	D77F2C1FF6AE3C8A7AAA25764F866B5088669B423CD0F737BFC15637F36526C2E70A4386D680EA986FF7E23D5F2BB704F817DE8C4A053C6A2F0D2665565EE2FA
Malicious:	false
Preview:	# $XConsortium: th_TH$.# XLocale Database Sample for th_TH.#.# $XFree86:$.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs1.{..charset TIS620-0:GR..font TIS620-0:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TIS620.mb_cur_max..1.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TIS620-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\th_TH\is-HBOFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.1959980983376415
Encrypted:	false
SSDEEP:	24:CNuBMiZH/IcrJRdVQClw5fDJ7/3GGm/7F6v:0iZTsNlB
MD5:	2217D137A94C6374B15E5CCB51738AC9
SHA1:	704EFA6D37CAFF74B76E2FE32A86298D095745D3
SHA-256:	120A79AE42DBEEA8A967D44E2FED9A422CC132DE41FEF2CECDB64EAD2E4C7EAF
SHA-512:	D77F2C1FF6AE3C8A7AAA25764F866B5088669B423CD0F737BFC15637F36526C2E70A4386D680EA986FF7E23D5F2BB704F817DE8C4A053C6A2F0D2665565EE2FA
Malicious:	false
Preview:	# $XConsortium: th_TH$.# XLocale Database Sample for th_TH.#.# $XFree86:$.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs1.{..charset TIS620-0:GR..font TIS620-0:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TIS620.mb_cur_max..1.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TIS620-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\tscii-0\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	990
Entropy (8bit):	5.3267144458899605
Encrypted:	false
SSDEEP:	24:a19UBetWEh28Xbv8MMuO4wQ+fDJ7/gGGm/7FK:a19T5htviuOTNGz
MD5:	8E4536EC7EE82E798B70B44C8898643F
SHA1:	71A6A3330483194B802E1C358F8027A20DE7F4FC
SHA-256:	E2BB5AC029C6F5B94017D9894D4D3A5DBC346FD545AFC9B4A11DF84008D1EDCE
SHA-512:	0EB88574FCDA66FC2CD3713C86D7857B06E4C4E8B0A8C4E4A18DA12F46F4A3324E75F1716BE26E7DA0DBCA67FDA79A6E5E91DEF294E80EEFB7FABDAE4F29C072
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/tscii-0,v 1.1 2000/10/27 18:30:57 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TSCII-0:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TSCII-0:GR..font TSCII-0:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TSCII-0..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TSCII-0.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TSCII-0:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TSCII-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\tscii-0\is-O42OS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	990
Entropy (8bit):	5.3267144458899605
Encrypted:	false
SSDEEP:	24:a19UBetWEh28Xbv8MMuO4wQ+fDJ7/gGGm/7FK:a19T5htviuOTNGz
MD5:	8E4536EC7EE82E798B70B44C8898643F
SHA1:	71A6A3330483194B802E1C358F8027A20DE7F4FC
SHA-256:	E2BB5AC029C6F5B94017D9894D4D3A5DBC346FD545AFC9B4A11DF84008D1EDCE
SHA-512:	0EB88574FCDA66FC2CD3713C86D7857B06E4C4E8B0A8C4E4A18DA12F46F4A3324E75F1716BE26E7DA0DBCA67FDA79A6E5E91DEF294E80EEFB7FABDAE4F29C072
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/tscii-0,v 1.1 2000/10/27 18:30:57 dawes Exp $.# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TSCII-0:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TSCII-0:GR..font TSCII-0:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TSCII-0..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TSCII-0.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TSCII-0:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TSCII-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\vi_VN.tcvn\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	5.032815069973251
Encrypted:	false
SSDEEP:	96:e3aeYftCu0fsuraug6Dj7E5wWh26RvT7kdLJdl6xUjFofIEjQoLBcp68m7rc3N:deitCu03ra4DPE5rtRvHkdL0xpfIEjQ1
MD5:	214C552BD3F8301D9198AA9AA5753C3F
SHA1:	B193B07F6E6C8ACE385B234DA42C2DAA03418621
SHA-256:	6FE477CFD983D99998514067A6B931D5A995E404595180B4CF3AFD58BF5216D0
SHA-512:	16658FBE4BC677693753E8CF1FE45722CCBA16BA8B4F3A43B088B2F93856CC3200972AF29DBFC7F7693D441CD53F47066AB6FDE865DC8604665F7C990E038B5D
Malicious:	false
Preview:	# $XConsortium: iso8859-1 /main/6 1995/11/08 07:24:10 kaleb $.# $XFree86: xc/nls/Compose/vi_VN.tcvn,v 1.2 2000/10/27 18:30:52 dawes Exp $.# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\200".Agrave.<dead_grave> <a>...: "\265".agrave.<dead_hook> <A>....: "\266".Ahook.<dead_hook> <a>....: "\266".ahook.<dead_tilde> <A>...: "\202".Atilde.<dead_tilde> <a>...: "\267".atilde.<dead_acute> <A>...: "\203".Aacute.<dead_acute> <a>...: "\270".aacute.<dead_belowdot> <A>...: "\271".Abelowdot.<dead_belowdot> <a>...: "\271".abelowdot.<dead_grave> <Abreve>...: "\273".Abrevegrave.<dead_grave> <abreve>...: "\273".abrevegrave.<dead_hook> <Abreve>...: "\274".Abrevehook.<dead_hook> <abreve>...:

C:\Program Files (x86)\Xming\locale\vi_VN.tcvn\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.411702462588742
Encrypted:	false
SSDEEP:	24:ewN11WE728XXvBGuO4iQ+fDJ7/GGGm/7Fs:l1157xvBGuOZNA1
MD5:	33DBDFA2874E3F330B7D6C841D5AE7E6
SHA1:	20515B72BBB2A099CA9A313E8574997C5AA19A43
SHA-256:	5F5ADA757136D3C77C42A508C54DB3647492B245076F942CAEC9304F7BA974FC
SHA-512:	0E96B818622E3A21175392A16B149050DDABF8AF286757034E0CBB1C513E081161372B02B4477C72DA07BDAA8B1D86E6CFC74C6CE2C2F105142A7B47EA61FB8B
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.TCVN.# .# $XFree86: xc/nls/XLC_LOCALE/vi_VN.tcvn,v 1.1 1999/06/06 14:06:02 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TCVN-5712:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TCVN-5712:GR..font TCVN-5712:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TCVN-5712..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TCVN-5712.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TCVN-5712:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TCVN-5712:GR.}..END XLC_X

C:\Program Files (x86)\Xming\locale\vi_VN.tcvn\is-091BS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	5.032815069973251
Encrypted:	false
SSDEEP:	96:e3aeYftCu0fsuraug6Dj7E5wWh26RvT7kdLJdl6xUjFofIEjQoLBcp68m7rc3N:deitCu03ra4DPE5rtRvHkdL0xpfIEjQ1
MD5:	214C552BD3F8301D9198AA9AA5753C3F
SHA1:	B193B07F6E6C8ACE385B234DA42C2DAA03418621
SHA-256:	6FE477CFD983D99998514067A6B931D5A995E404595180B4CF3AFD58BF5216D0
SHA-512:	16658FBE4BC677693753E8CF1FE45722CCBA16BA8B4F3A43B088B2F93856CC3200972AF29DBFC7F7693D441CD53F47066AB6FDE865DC8604665F7C990E038B5D
Malicious:	false
Preview:	# $XConsortium: iso8859-1 /main/6 1995/11/08 07:24:10 kaleb $.# $XFree86: xc/nls/Compose/vi_VN.tcvn,v 1.2 2000/10/27 18:30:52 dawes Exp $.# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\200".Agrave.<dead_grave> <a>...: "\265".agrave.<dead_hook> <A>....: "\266".Ahook.<dead_hook> <a>....: "\266".ahook.<dead_tilde> <A>...: "\202".Atilde.<dead_tilde> <a>...: "\267".atilde.<dead_acute> <A>...: "\203".Aacute.<dead_acute> <a>...: "\270".aacute.<dead_belowdot> <A>...: "\271".Abelowdot.<dead_belowdot> <a>...: "\271".abelowdot.<dead_grave> <Abreve>...: "\273".Abrevegrave.<dead_grave> <abreve>...: "\273".abrevegrave.<dead_hook> <Abreve>...: "\274".Abrevehook.<dead_hook> <abreve>...:

C:\Program Files (x86)\Xming\locale\vi_VN.tcvn\is-3JSH4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.411702462588742
Encrypted:	false
SSDEEP:	24:ewN11WE728XXvBGuO4iQ+fDJ7/GGGm/7Fs:l1157xvBGuOZNA1
MD5:	33DBDFA2874E3F330B7D6C841D5AE7E6
SHA1:	20515B72BBB2A099CA9A313E8574997C5AA19A43
SHA-256:	5F5ADA757136D3C77C42A508C54DB3647492B245076F942CAEC9304F7BA974FC
SHA-512:	0E96B818622E3A21175392A16B149050DDABF8AF286757034E0CBB1C513E081161372B02B4477C72DA07BDAA8B1D86E6CFC74C6CE2C2F105142A7B47EA61FB8B
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.TCVN.# .# $XFree86: xc/nls/XLC_LOCALE/vi_VN.tcvn,v 1.1 1999/06/06 14:06:02 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TCVN-5712:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TCVN-5712:GR..font TCVN-5712:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TCVN-5712..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TCVN-5712.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TCVN-5712:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TCVN-5712:GR.}..END XLC_X

C:\Program Files (x86)\Xming\locale\vi_VN.viscii\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	5.0336385437952424
Encrypted:	false
SSDEEP:	96:63aeYUjrt0SdKR6TMtK7xCrhf6YTvK66r6/8j5/XCGUKRTOKXN7Z6cGN:5edjrt0Sd7T8K76iYTvK6p/6XCGUKTXK
MD5:	72FA62E6ABE8F91E6137DEC505EEA9DE
SHA1:	632DF180153562008DC581F2EB0CCD63A61B86A5
SHA-256:	E5EC0BF8FD83C700FCD50D96B62B42B62921ECA1F56ECA1C1FF80EDADEEEB16A
SHA-512:	EEC8BCE0868F887D89F507B5DB1888B27A4F7538DEA7335B435B3F054A4C0864123C1540DC52452D0528B79A63326684E2D989BEE2047D5E19ABF46B8CC45050
Malicious:	false
Preview:	# $XConsortium: iso8859-1 /main/6 1995/11/08 07:24:10 kaleb $.# $XFree86: xc/nls/Compose/vi_VN.viscii,v 1.2 2000/10/27 18:30:52 dawes Exp $.# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\300".Agrave.<dead_grave> <a>...: "\340".agrave.<dead_hook> <A>....: "\304".Ahook.<dead_hook> <a>....: "\344".ahook.<dead_tilde> <A>...: "\303".Atilde.<dead_tilde> <a>...: "\343".atilde.<dead_acute> <A>...: "\301".Aacute.<dead_acute> <a>...: "\341".aacute.<dead_belowdot> <A>...: "\200".Abelowdot.<dead_belowdot> <a>...: "\325".abelowdot.<dead_grave> <Abreve>...: "\202".Abrevegrave.<dead_grave> <abreve>...: "\242".abrevegrave.<dead_hook> <Abreve>...: "\002".Abrevehook.<dead_hook> <abreve>...

C:\Program Files (x86)\Xming\locale\vi_VN.viscii\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	5.376316984302553
Encrypted:	false
SSDEEP:	24:eo1RWETWg28XlS+nS+Nv5L2uO4USYQ+fDJ7/AS0GGm/7FlS+k:R1R5TTihmv56uOMCNNSxj
MD5:	CADF3DF030ECAF3D07BFE7BAF6D23F05
SHA1:	B77A2C61F87E42166BE28E3741422531017E85E7
SHA-256:	6A618A34AE48BE63C2CDF39488E6D38BA80BFA948AD8E9AACD5803638B124AB6
SHA-512:	AAA5DEDE05B64F4F51B34A2F4C984EAA18BB8B81FDB5BA3C558D67D262618F54C11E153FEE5DCF649097CEE943199421B113903B718BBB0724218023C841FCE0
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.VISCII.# .# $XFree86: xc/nls/XLC_LOCALE/vi_VN.viscii,v 1.1 1999/06/06 14:06:02 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..VISCII1.1-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset VISCII1.1-1:GR..font VISCII1.1-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.VISCII1.1-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name VISCII1.1-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding VISCII1.1-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding VISCII1.1

C:\Program Files (x86)\Xming\locale\vi_VN.viscii\is-5INAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	5.0336385437952424
Encrypted:	false
SSDEEP:	96:63aeYUjrt0SdKR6TMtK7xCrhf6YTvK66r6/8j5/XCGUKRTOKXN7Z6cGN:5edjrt0Sd7T8K76iYTvK6p/6XCGUKTXK
MD5:	72FA62E6ABE8F91E6137DEC505EEA9DE
SHA1:	632DF180153562008DC581F2EB0CCD63A61B86A5
SHA-256:	E5EC0BF8FD83C700FCD50D96B62B42B62921ECA1F56ECA1C1FF80EDADEEEB16A
SHA-512:	EEC8BCE0868F887D89F507B5DB1888B27A4F7538DEA7335B435B3F054A4C0864123C1540DC52452D0528B79A63326684E2D989BEE2047D5E19ABF46B8CC45050
Malicious:	false
Preview:	# $XConsortium: iso8859-1 /main/6 1995/11/08 07:24:10 kaleb $.# $XFree86: xc/nls/Compose/vi_VN.viscii,v 1.2 2000/10/27 18:30:52 dawes Exp $.# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\300".Agrave.<dead_grave> <a>...: "\340".agrave.<dead_hook> <A>....: "\304".Ahook.<dead_hook> <a>....: "\344".ahook.<dead_tilde> <A>...: "\303".Atilde.<dead_tilde> <a>...: "\343".atilde.<dead_acute> <A>...: "\301".Aacute.<dead_acute> <a>...: "\341".aacute.<dead_belowdot> <A>...: "\200".Abelowdot.<dead_belowdot> <a>...: "\325".abelowdot.<dead_grave> <Abreve>...: "\202".Abrevegrave.<dead_grave> <abreve>...: "\242".abrevegrave.<dead_hook> <Abreve>...: "\002".Abrevehook.<dead_hook> <abreve>...

C:\Program Files (x86)\Xming\locale\vi_VN.viscii\is-BV464.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	5.376316984302553
Encrypted:	false
SSDEEP:	24:eo1RWETWg28XlS+nS+Nv5L2uO4USYQ+fDJ7/AS0GGm/7FlS+k:R1R5TTihmv56uOMCNNSxj
MD5:	CADF3DF030ECAF3D07BFE7BAF6D23F05
SHA1:	B77A2C61F87E42166BE28E3741422531017E85E7
SHA-256:	6A618A34AE48BE63C2CDF39488E6D38BA80BFA948AD8E9AACD5803638B124AB6
SHA-512:	AAA5DEDE05B64F4F51B34A2F4C984EAA18BB8B81FDB5BA3C558D67D262618F54C11E153FEE5DCF649097CEE943199421B113903B718BBB0724218023C841FCE0
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.VISCII.# .# $XFree86: xc/nls/XLC_LOCALE/vi_VN.viscii,v 1.1 1999/06/06 14:06:02 dawes Exp $..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..VISCII1.1-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset VISCII1.1-1:GR..font VISCII1.1-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.VISCII1.1-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name VISCII1.1-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding VISCII1.1-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding VISCII1.1

C:\Program Files (x86)\Xming\locale\zh_CN.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	4.393649385279863
Encrypted:	false
SSDEEP:	48:eU3WgNGVf5dLpdI26uUr7118fYb/hMd44Id6xEw3K:sd5dpd96uUrRaOb
MD5:	2DC59701A8BE86F82E45363CCDA8108B
SHA1:	DCAA0D08272BC10CAD14330EBC5B7BC9EC19CA99
SHA-256:	55DE26186C4EC2D892A9824E5B4CD559CD67D262FEF5044DEA6FD05E94B815C2
SHA-512:	C2EA51D073B65B5EDBCE871212EA3EA1B0DD82B63F9DF2D09FCA4F7AA9AD2F4551682B7C0C2FDDD8106649B5430858AE5FAB8D2231E50FF98340CF3AE26F80C7
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_CN.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>.#.# $XdotOrg: lib/X11/nls/zh_CN.UTF-8/XLC_LOCALE.pre,v 1.3 2004-10-18 17:29:03 eich Exp $.# $XFree86$..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Chinese Han Character).fs2 {. charset {. name GB2312.1980-0:GL. }. font {. primary GB2312.

C:\Program Files (x86)\Xming\locale\zh_CN.UTF-8\is-2UDQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	4.393649385279863
Encrypted:	false
SSDEEP:	48:eU3WgNGVf5dLpdI26uUr7118fYb/hMd44Id6xEw3K:sd5dpd96uUrRaOb
MD5:	2DC59701A8BE86F82E45363CCDA8108B
SHA1:	DCAA0D08272BC10CAD14330EBC5B7BC9EC19CA99
SHA-256:	55DE26186C4EC2D892A9824E5B4CD559CD67D262FEF5044DEA6FD05E94B815C2
SHA-512:	C2EA51D073B65B5EDBCE871212EA3EA1B0DD82B63F9DF2D09FCA4F7AA9AD2F4551682B7C0C2FDDD8106649B5430858AE5FAB8D2231E50FF98340CF3AE26F80C7
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_CN.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>.#.# $XdotOrg: lib/X11/nls/zh_CN.UTF-8/XLC_LOCALE.pre,v 1.3 2004-10-18 17:29:03 eich Exp $.# $XFree86$..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Chinese Han Character).fs2 {. charset {. name GB2312.1980-0:GL. }. font {. primary GB2312.

C:\Program Files (x86)\Xming\locale\zh_CN.gb18030\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.050258372932807
Encrypted:	false
SSDEEP:	6:LqmsqfL5kc/OetdtmACF+RJvEFhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmxRvt4sYe6ldo0+62XdUmhn
MD5:	3A16060363E6948C98F18DF759C559EE
SHA1:	511AD6E7BB54D1489E93F909550E3FCA8525BEEF
SHA-256:	D8C2823D7EEFF11E5522922905D9E7535771A0AA39F515A757316DD158CDAE51
SHA-512:	43B6D0000C2734575B89BFE452B626A6F317C84B817164D12CF5CAA1937D7E91CEE0A9F232A4F71C65E86C0D1BE7B92378BE3543A33A0A443328B1B4573DC17A
Malicious:	false
Preview:	#.# zh_CN.GB18030 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_CN.gb18030,v 1.2 2001/04/26 21:09:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN.gb18030\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.335445897210391
Encrypted:	false
SSDEEP:	24:neIKC3/FkWehpaPJrdXLEpuZ17RaEl7hSIKiXC2wbIiDJ7KQmmt7tWFtMwC:e3C3SNaP5dXwcZ17RaEl8InXviADzMn
MD5:	19935373D530F9C9F73B87F63204217A
SHA1:	524582C9C800959D13E1C23C4EF312D00377D4C3
SHA-256:	BF46FAF4AF56D4944A4AE47C6AE71E33D8A9AC7DCCFFE99C19317DD54B8507A0
SHA-512:	CF830C804301ACA0C04FB62EDEA55DACAE90D35BC9373382B8252EE780B5CBF92D3DABAB251A062325FD786467BA696970CF71BEB3CBBB8BB7AA4E9AB23E06B9
Malicious:	false
Preview:	# XFree86 NLS for Chinese encoding GB18030.#..Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# .by James Su <suzhe@turbolinux.com.cn>..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}..#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}..#.fs2 class (Chinese Han Character).fs2.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}..#.fs3 class (Chinese Han Character GBK).fs3.{..charset.{...name GBK-0:GLGR..}..font.{...primary GBK-0:GLGR...substitute GB13000.1993-1:GLGR..}.}..#.fs4 class.fs4.{..charset.{...name.ISO10646-1..}..font.{...primary.GB18030-0...substitute GBK2K-0..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\zh_CN.gb18030\is-A4Q10.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.335445897210391
Encrypted:	false
SSDEEP:	24:neIKC3/FkWehpaPJrdXLEpuZ17RaEl7hSIKiXC2wbIiDJ7KQmmt7tWFtMwC:e3C3SNaP5dXwcZ17RaEl8InXviADzMn
MD5:	19935373D530F9C9F73B87F63204217A
SHA1:	524582C9C800959D13E1C23C4EF312D00377D4C3
SHA-256:	BF46FAF4AF56D4944A4AE47C6AE71E33D8A9AC7DCCFFE99C19317DD54B8507A0
SHA-512:	CF830C804301ACA0C04FB62EDEA55DACAE90D35BC9373382B8252EE780B5CBF92D3DABAB251A062325FD786467BA696970CF71BEB3CBBB8BB7AA4E9AB23E06B9
Malicious:	false
Preview:	# XFree86 NLS for Chinese encoding GB18030.#..Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# .by James Su <suzhe@turbolinux.com.cn>..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}..#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}..#.fs2 class (Chinese Han Character).fs2.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}..#.fs3 class (Chinese Han Character GBK).fs3.{..charset.{...name GBK-0:GLGR..}..font.{...primary GBK-0:GLGR...substitute GB13000.1993-1:GLGR..}.}..#.fs4 class.fs4.{..charset.{...name.ISO10646-1..}..font.{...primary.GB18030-0...substitute GBK2K-0..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\zh_CN.gb18030\is-ERD5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.050258372932807
Encrypted:	false
SSDEEP:	6:LqmsqfL5kc/OetdtmACF+RJvEFhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmxRvt4sYe6ldo0+62XdUmhn
MD5:	3A16060363E6948C98F18DF759C559EE
SHA1:	511AD6E7BB54D1489E93F909550E3FCA8525BEEF
SHA-256:	D8C2823D7EEFF11E5522922905D9E7535771A0AA39F515A757316DD158CDAE51
SHA-512:	43B6D0000C2734575B89BFE452B626A6F317C84B817164D12CF5CAA1937D7E91CEE0A9F232A4F71C65E86C0D1BE7B92378BE3543A33A0A443328B1B4573DC17A
Malicious:	false
Preview:	#.# zh_CN.GB18030 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_CN.gb18030,v 1.2 2001/04/26 21:09:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN.gbk\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.0150503008742735
Encrypted:	false
SSDEEP:	6:LqmAL5kc/OetdtmkSihz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmGRvtXSMe6ldo0+62XdUmhn
MD5:	85E3FB07971FD94177F4D3E6F344FC5C
SHA1:	668F9C41F485CD23A29A3B0E4C5D344C18D6E45C
SHA-256:	01375328D5779560E94942D95C0BF803FDFE09A57B0B754F9E698BDE671A80D8
SHA-512:	0E99F1C7781A7ADE94761A69FAC916D353AA9FBDFDE37E7CE079C71217FEA10BFC1D064660490971F4D6AFF7657143E3D14376507862FD39AC9B70F82B5A67B8
Malicious:	false
Preview:	#.# zh_CN.GBK Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_CN.gbk,v 1.1 2001/03/06 18:03:17 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN.gbk\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	5.072196047078951
Encrypted:	false
SSDEEP:	24:fFMC3I2ybUH0BWjiVK1WGaVMwFQwmDJ7/tfGmzcsA8eORGQvt:f2C3I29UV+PFNskcsA8xGGt
MD5:	4CD5691978A2F610C2F990C6544E7809
SHA1:	A8BE4F0D29A72815A730B403187F1C1C80F18443
SHA-256:	FFBCE0F209F946F9397A2A20F7504BB0B3800EF3A9E792C24B22731082514081
SHA-512:	BB1FF494A47CC3840B17794A73E8DAD7C4E18EEFA8024262674152A022FF55C24E2F6994CBBA3BC4E0A4D34FCA75B76F0BD83896C53B2B1E43678DC80AC93E2A
Malicious:	false
Preview:	# .# X11R6 L10N for Chinese GBK Encoding..# modified from xc/nls/XLC_LOCALE/zh_TW.Big5.# by Sean Chen <seanc@turbolinux.com>.# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name GBK-0:GLGR. }. font {. primary GBK-0:GLGR. substitute GB13000.1993-1:GLGR. }.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_CN.GBK.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\x81,\xfe..byte

C:\Program Files (x86)\Xming\locale\zh_CN.gbk\is-0DG7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	5.072196047078951
Encrypted:	false
SSDEEP:	24:fFMC3I2ybUH0BWjiVK1WGaVMwFQwmDJ7/tfGmzcsA8eORGQvt:f2C3I29UV+PFNskcsA8xGGt
MD5:	4CD5691978A2F610C2F990C6544E7809
SHA1:	A8BE4F0D29A72815A730B403187F1C1C80F18443
SHA-256:	FFBCE0F209F946F9397A2A20F7504BB0B3800EF3A9E792C24B22731082514081
SHA-512:	BB1FF494A47CC3840B17794A73E8DAD7C4E18EEFA8024262674152A022FF55C24E2F6994CBBA3BC4E0A4D34FCA75B76F0BD83896C53B2B1E43678DC80AC93E2A
Malicious:	false
Preview:	# .# X11R6 L10N for Chinese GBK Encoding..# modified from xc/nls/XLC_LOCALE/zh_TW.Big5.# by Sean Chen <seanc@turbolinux.com>.# .# $XFree86$..# .# .XLC_FONTSET category.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name GBK-0:GLGR. }. font {. primary GBK-0:GLGR. substitute GB13000.1993-1:GLGR. }.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_CN.GBK.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\x81,\xfe..byte

C:\Program Files (x86)\Xming\locale\zh_CN.gbk\is-JF72E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.0150503008742735
Encrypted:	false
SSDEEP:	6:LqmAL5kc/OetdtmkSihz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmGRvtXSMe6ldo0+62XdUmhn
MD5:	85E3FB07971FD94177F4D3E6F344FC5C
SHA1:	668F9C41F485CD23A29A3B0E4C5D344C18D6E45C
SHA-256:	01375328D5779560E94942D95C0BF803FDFE09A57B0B754F9E698BDE671A80D8
SHA-512:	0E99F1C7781A7ADE94761A69FAC916D353AA9FBDFDE37E7CE079C71217FEA10BFC1D064660490971F4D6AFF7657143E3D14376507862FD39AC9B70F82B5A67B8
Malicious:	false
Preview:	#.# zh_CN.GBK Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_CN.gbk,v 1.1 2001/03/06 18:03:17 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.899623596201551
Encrypted:	false
SSDEEP:	6:LIL5kc/OetdtmfFMF+RJvEFhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeRvtlsYe6ldo0+62XdUmhn
MD5:	E14DCFB14F7F9B09ED04C46E8A45B591
SHA1:	89663B851A324445352C55833E57630E2FF171A4
SHA-256:	52DB8F87B1313DE4E3D8CE0324489BE5C04BF17790812238A07F4A7086210A07
SHA-512:	F0869404866B84767A8C6DE8B87468499C7EE61531C628751E5F952BB19704345B9907C44365141F28CF0319B1FF8BF101A4650BB0E5AAB8457D13797D30AC70
Malicious:	false
Preview:	#.# zh Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh,v 1.2 2001/04/26 21:09:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.481272211261854
Encrypted:	false
SSDEEP:	24:qUe11LEIN3K1Mn24y1QQwqfDJ7/tfGm/7hF:q111w0UMn5E1NsOF
MD5:	DB3675F436DF9E47815DD509FAF35441
SHA1:	9CC91F6FC6857E87D2A4D0B72AD1888CF9146159
SHA-256:	E04EA6F5A0DD7C7E05BCD373ADFFE70BCACA55B50E51BAE0BA5F230D6956BA48
SHA-512:	96CF4DD367D471EDA2AC3117FFD66DAAD93734EF6D3345C0012E0CD1333EEA351E77110135237966476AF67DA4E1E12076EECA2D6D00D51067C1C0AA06621AA8
Malicious:	false
Preview:	# $Xorg: zh,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for zh (eucCN)..#.# $XFree86: xc/nls/XLC_LOCALE/zh,v 1.2 2001/04/23 21:41:43 dawes Exp $..#.# .XLC_FONTSET category.#.XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL...substitute.GB2312.1980-0:GLGR..}.}.END XLC_FONTSET..#.# .XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh.euc.mb_cur_max..2.state_depend_encoding.False.wc_encoding_mask.\x30000000.wc_shift_bits..7...use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2..wc_encoding.\x30000000..ct_encoding.GB2312.1980-0:GL; GB2312.1980-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\zh_CN\is-1SET2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.899623596201551
Encrypted:	false
SSDEEP:	6:LIL5kc/OetdtmfFMF+RJvEFhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeRvtlsYe6ldo0+62XdUmhn
MD5:	E14DCFB14F7F9B09ED04C46E8A45B591
SHA1:	89663B851A324445352C55833E57630E2FF171A4
SHA-256:	52DB8F87B1313DE4E3D8CE0324489BE5C04BF17790812238A07F4A7086210A07
SHA-512:	F0869404866B84767A8C6DE8B87468499C7EE61531C628751E5F952BB19704345B9907C44365141F28CF0319B1FF8BF101A4650BB0E5AAB8457D13797D30AC70
Malicious:	false
Preview:	#.# zh Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh,v 1.2 2001/04/26 21:09:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_CN\is-910HV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.481272211261854
Encrypted:	false
SSDEEP:	24:qUe11LEIN3K1Mn24y1QQwqfDJ7/tfGm/7hF:q111w0UMn5E1NsOF
MD5:	DB3675F436DF9E47815DD509FAF35441
SHA1:	9CC91F6FC6857E87D2A4D0B72AD1888CF9146159
SHA-256:	E04EA6F5A0DD7C7E05BCD373ADFFE70BCACA55B50E51BAE0BA5F230D6956BA48
SHA-512:	96CF4DD367D471EDA2AC3117FFD66DAAD93734EF6D3345C0012E0CD1333EEA351E77110135237966476AF67DA4E1E12076EECA2D6D00D51067C1C0AA06621AA8
Malicious:	false
Preview:	# $Xorg: zh,v 1.3 2000/08/17 19:47:00 cpqbld Exp $.# XLocale Database Sample for zh (eucCN)..#.# $XFree86: xc/nls/XLC_LOCALE/zh,v 1.2 2001/04/23 21:41:43 dawes Exp $..#.# .XLC_FONTSET category.#.XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL...substitute.GB2312.1980-0:GLGR..}.}.END XLC_FONTSET..#.# .XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh.euc.mb_cur_max..2.state_depend_encoding.False.wc_encoding_mask.\x30000000.wc_shift_bits..7...use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2..wc_encoding.\x30000000..ct_encoding.GB2312.1980-0:GL; GB2312.1980-0:GR.}..END XLC_XLOCALE.

C:\Program Files (x86)\Xming\locale\zh_HK.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.2785402385165785
Encrypted:	false
SSDEEP:	48:enY3WgN55dLp9I2jOYFi8fYb/hMd44IjFFxw3K:KS5dp99aiOdd
MD5:	82DF61B0964B2CCB5E94BC8E4A4831D0
SHA1:	148C66DC15A5ACFBE0CC5C25434435C6531E51D8
SHA-256:	0EC8952B41DC92786A4AE8380FD5F62521B7D68984DEA6A387D2896717C5D658
SHA-512:	5E7254DA7E08AA4DF65EE400410720BDE675C1D39EF517E232CB8782F75F4547936052741739A493618233EB70736748B8908DF2D761882047B162DFFCD9E684
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_HK.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class.fs2 {. charset {. name BIG5HKSCS-0:GLGR. }. font {. primary BIG5HKSCS-0:GLGR. substitute BIG5-0:GLGR. }.}..# fs3 class.fs3 {. charset {. name ISO10646-1.

C:\Program Files (x86)\Xming\locale\zh_HK.UTF-8\is-6BE2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.2785402385165785
Encrypted:	false
SSDEEP:	48:enY3WgN55dLp9I2jOYFi8fYb/hMd44IjFFxw3K:KS5dp99aiOdd
MD5:	82DF61B0964B2CCB5E94BC8E4A4831D0
SHA1:	148C66DC15A5ACFBE0CC5C25434435C6531E51D8
SHA-256:	0EC8952B41DC92786A4AE8380FD5F62521B7D68984DEA6A387D2896717C5D658
SHA-512:	5E7254DA7E08AA4DF65EE400410720BDE675C1D39EF517E232CB8782F75F4547936052741739A493618233EB70736748B8908DF2D761882047B162DFFCD9E684
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_HK.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class.fs2 {. charset {. name BIG5HKSCS-0:GLGR. }. font {. primary BIG5HKSCS-0:GLGR. substitute BIG5-0:GLGR. }.}..# fs3 class.fs3 {. charset {. name ISO10646-1.

C:\Program Files (x86)\Xming\locale\zh_HK.big5\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.638703785875134
Encrypted:	false
SSDEEP:	6:LqSfL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqS9le6ldo0+62XdUmhn
MD5:	EB7A3ED832ECDD0C5FDD43E0AA006CD8
SHA1:	64D24218B1AE25433D4D88BDDBAB382742EEC543
SHA-256:	D50752F41483B4FCCC322617436B9B776D8042DCC9DACA5AEA14D777D49DE29B
SHA-512:	76F7331A2ADAC278C3594ECFC97DFFE2451C3894FA92E1649A4581C282AD1C4A380A5071ED8C22846FEC61FBEA67CBDB912BE0D7C75F8E528969A8B47EBC333B
Malicious:	false
Preview:	#.# zh_HK.big5 Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_HK.big5\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.5158266667662765
Encrypted:	false
SSDEEP:	24:XSFlDOcjP/zDVK21x7rXC5wFQwmDJ7/tfGmzMlhQAZDNa2M6Gxv:X0DOqpTx/XIFNsk0hQ52M6Gd
MD5:	7EBE70B1105F2BE4B4BC39C998BDE71E
SHA1:	4B179D5A4453A6536A6AA7D759C59DF6C4EC0041
SHA-256:	09EEB0874C4153D02FBF208975CAB33E145D33F76A0B62FC8F7BBB0D18F772EE
SHA-512:	121ADFD1E57D691CBD53240648A81320135AD80038ED414EF5366A0359E83AD4FB6B70C87727246D9B90EE311044C1E449426981D1B9B84CCE4BACDF8F8C2240
Malicious:	false
Preview:	# .# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.# .# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# .# .XLC_FONTSET category.#.# $XFree86$.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {..charset {...name.ISO8859-1:GL..}..font {...primary.ISO8859-1:GL...vertical_rotate all..}.}.# fs1 class.fs1 {..charset {...name.BIG5-0:GLGR..}..font {...primary.BIG5-0:GLGR...substitute BIG5-0:GLGR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_HK.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5-0:GLGR:\x1b\x25\x2f\x32\x80\x89\x42\x49\x47\x35\x2d\x30\x02...mb_conversion.[\xa140,

C:\Program Files (x86)\Xming\locale\zh_HK.big5\is-985QO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.5158266667662765
Encrypted:	false
SSDEEP:	24:XSFlDOcjP/zDVK21x7rXC5wFQwmDJ7/tfGmzMlhQAZDNa2M6Gxv:X0DOqpTx/XIFNsk0hQ52M6Gd
MD5:	7EBE70B1105F2BE4B4BC39C998BDE71E
SHA1:	4B179D5A4453A6536A6AA7D759C59DF6C4EC0041
SHA-256:	09EEB0874C4153D02FBF208975CAB33E145D33F76A0B62FC8F7BBB0D18F772EE
SHA-512:	121ADFD1E57D691CBD53240648A81320135AD80038ED414EF5366A0359E83AD4FB6B70C87727246D9B90EE311044C1E449426981D1B9B84CCE4BACDF8F8C2240
Malicious:	false
Preview:	# .# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.# .# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# .# .XLC_FONTSET category.#.# $XFree86$.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {..charset {...name.ISO8859-1:GL..}..font {...primary.ISO8859-1:GL...vertical_rotate all..}.}.# fs1 class.fs1 {..charset {...name.BIG5-0:GLGR..}..font {...primary.BIG5-0:GLGR...substitute BIG5-0:GLGR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_HK.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5-0:GLGR:\x1b\x25\x2f\x32\x80\x89\x42\x49\x47\x35\x2d\x30\x02...mb_conversion.[\xa140,

C:\Program Files (x86)\Xming\locale\zh_HK.big5\is-JHO98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.638703785875134
Encrypted:	false
SSDEEP:	6:LqSfL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqS9le6ldo0+62XdUmhn
MD5:	EB7A3ED832ECDD0C5FDD43E0AA006CD8
SHA1:	64D24218B1AE25433D4D88BDDBAB382742EEC543
SHA-256:	D50752F41483B4FCCC322617436B9B776D8042DCC9DACA5AEA14D777D49DE29B
SHA-512:	76F7331A2ADAC278C3594ECFC97DFFE2451C3894FA92E1649A4581C282AD1C4A380A5071ED8C22846FEC61FBEA67CBDB912BE0D7C75F8E528969A8B47EBC333B
Malicious:	false
Preview:	#.# zh_HK.big5 Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_HK.big5hkscs\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.647529879323954
Encrypted:	false
SSDEEP:	6:LqQVhL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqQVTle6ldo0+62XdUmhn
MD5:	3F3C9C9CC9C4A9E2DF7039755C66BDB0
SHA1:	CA7FBD871DFFFE24FFC881990F840957B7C146E0
SHA-256:	651BC042F62077ECCD73E52005961D913B191413001EF0AF6F8152B043F280B3
SHA-512:	3167809B6AC537A0C95C6327A7546F4E5715515D575CA9DFE70C1EAEC9D2509E7BD60DE60C49275DC48A813F4874A8CF4C7C35AF7D90F2908CDCB78E41F24D09
Malicious:	false
Preview:	#.# zh_HK.big5hkscs Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_HK.big5hkscs\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	5.635313982343343
Encrypted:	false
SSDEEP:	24:wFlh2kWy17zLEIm/EI7+/0twFQwWnDJ7/tmmz5lhQqbyB:+hOy1Pwl/EIq/eVnNok5lhQkyB
MD5:	0C73C22C6A2845ED697A2DECE43358B6
SHA1:	23408EFEEA065EC946F17F71D506F5A3ABC6D0F9
SHA-256:	E7E69DA6C136648012DE1F0254A4C81292782E5324774FD64A5D2C58461F6E20
SHA-512:	31F9AA1CA6F162EBC369B6BA7119107744962988671F98A23FD485D4FC96479980E765B8EF96C1D0F0B95F7DA7E8DFBA9BA2B9A05F05FA4AFB9AEED17AD0022A
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# modified for Big5HKSCS by Roger So <roger.so@sw-linux.com> .#.# $XFree86: xc/nls/XLC_LOCALE/zh_HK.big5hkscs,v 1.1 2001/03/06 18:54:46 dawes Exp $.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all. }.}..# fs1 class (HKSCS extensions).fs1.{..charset.{...name.BIG5HKSCS-0:GLGR..}..font.{...primary..BIG5HKSCS-0:GLGR...substitute.BIG5HKSCS-0:GLGR..}.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_HK.big5hkscs.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..+XCOMM.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\x85,\xfe..byte2.

C:\Program Files (x86)\Xming\locale\zh_HK.big5hkscs\is-LIFCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.647529879323954
Encrypted:	false
SSDEEP:	6:LqQVhL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqQVTle6ldo0+62XdUmhn
MD5:	3F3C9C9CC9C4A9E2DF7039755C66BDB0
SHA1:	CA7FBD871DFFFE24FFC881990F840957B7C146E0
SHA-256:	651BC042F62077ECCD73E52005961D913B191413001EF0AF6F8152B043F280B3
SHA-512:	3167809B6AC537A0C95C6327A7546F4E5715515D575CA9DFE70C1EAEC9D2509E7BD60DE60C49275DC48A813F4874A8CF4C7C35AF7D90F2908CDCB78E41F24D09
Malicious:	false
Preview:	#.# zh_HK.big5hkscs Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_HK.big5hkscs\is-MB483.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	5.635313982343343
Encrypted:	false
SSDEEP:	24:wFlh2kWy17zLEIm/EI7+/0twFQwWnDJ7/tmmz5lhQqbyB:+hOy1Pwl/EIq/eVnNok5lhQkyB
MD5:	0C73C22C6A2845ED697A2DECE43358B6
SHA1:	23408EFEEA065EC946F17F71D506F5A3ABC6D0F9
SHA-256:	E7E69DA6C136648012DE1F0254A4C81292782E5324774FD64A5D2C58461F6E20
SHA-512:	31F9AA1CA6F162EBC369B6BA7119107744962988671F98A23FD485D4FC96479980E765B8EF96C1D0F0B95F7DA7E8DFBA9BA2B9A05F05FA4AFB9AEED17AD0022A
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# modified for Big5HKSCS by Roger So <roger.so@sw-linux.com> .#.# $XFree86: xc/nls/XLC_LOCALE/zh_HK.big5hkscs,v 1.1 2001/03/06 18:54:46 dawes Exp $.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all. }.}..# fs1 class (HKSCS extensions).fs1.{..charset.{...name.BIG5HKSCS-0:GLGR..}..font.{...primary..BIG5HKSCS-0:GLGR...substitute.BIG5HKSCS-0:GLGR..}.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_HK.big5hkscs.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..+XCOMM.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\x85,\xfe..byte2.

C:\Program Files (x86)\Xming\locale\zh_TW.UTF-8\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.211362192544638
Encrypted:	false
SSDEEP:	24:a1544a2jPJrdXLEI2ZXp2TcbRrIKzAluDJ7KQm4z8SWFtv3wC:a1pP5dXwdZ5ic1IuGuAD44Fv3n
MD5:	F56B895316F9022148706AD7435B68D2
SHA1:	156C9302C204088042AB5BE3986AB43E52223F2A
SHA-256:	387AE3F9DCF29013E89E2B73E82D58186CC4A813BC6D0610F27C002BE86CFDB1
SHA-512:	D57E06FFCDAAABBF0730EB14070E1DF754630A670CDD3D2C4682C54FD80D78BF603234EBFD8131428E22B0F8519F1DCCD484F2463EBFD49B19D09C4B74044BF2
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/zh_TW.UTF-8,v 1.2 2000/02/29 03:09:07 dawes Exp $.# XLocale Database Sample for zh_TW.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Chinese Han Character (Traditional)).fs2.{. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.#.fs3 class.fs3.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..UTF-8.mb_cur_max..6.state_depend_encoding.False..#.cs0 class.cs0.{..side

C:\Program Files (x86)\Xming\locale\zh_TW.UTF-8\is-AU338.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.211362192544638
Encrypted:	false
SSDEEP:	24:a1544a2jPJrdXLEI2ZXp2TcbRrIKzAluDJ7KQm4z8SWFtv3wC:a1pP5dXwdZ5ic1IuGuAD44Fv3n
MD5:	F56B895316F9022148706AD7435B68D2
SHA1:	156C9302C204088042AB5BE3986AB43E52223F2A
SHA-256:	387AE3F9DCF29013E89E2B73E82D58186CC4A813BC6D0610F27C002BE86CFDB1
SHA-512:	D57E06FFCDAAABBF0730EB14070E1DF754630A670CDD3D2C4682C54FD80D78BF603234EBFD8131428E22B0F8519F1DCCD484F2463EBFD49B19D09C4B74044BF2
Malicious:	false
Preview:	# $XFree86: xc/nls/XLC_LOCALE/zh_TW.UTF-8,v 1.2 2000/02/29 03:09:07 dawes Exp $.# XLocale Database Sample for zh_TW.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Chinese Han Character (Traditional)).fs2.{. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.#.fs3 class.fs3.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..UTF-8.mb_cur_max..6.state_depend_encoding.False..#.cs0 class.cs0.{..side

C:\Program Files (x86)\Xming\locale\zh_TW.big5\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.010203714622434
Encrypted:	false
SSDEEP:	6:Lq6fL5kc/Oetdtmxvr/uhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:Lq69RvtoMe6ldo0+62XdUmhn
MD5:	E076CC539EC55224071891CC1A9B0E9E
SHA1:	082D5B5AFF96D8577C0D77E2FB7348997F3BC365
SHA-256:	9D5F8D6B36C35AD5891F90102B29AFB8999490D87C844FF7A7F1FB902BE0B574
SHA-512:	682C4FC86F6D9422E858E3880E112E7225ADC6BD8A4258944859077B67B1AD87D6206A1B27A268C68A0989C3BCF6AB7C372BD81D08C88DE2CB798A3D6835B876
Malicious:	false
Preview:	#.# zh_TW.big5 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_TW.big5,v 1.1 1999/08/28 09:00:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_TW.big5\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (4488)
Category:	dropped
Size (bytes):	9611
Entropy (8bit):	4.824239460270698
Encrypted:	false
SSDEEP:	192:+17lDz5C5B9DFxBIr/XPI+QD32x2MT+gr9rY/PpzyqE2TabNJKX:K9MrDFUrXA332BKgr9OPYx2IJKX
MD5:	EB2007696F8782444E319D944EF0738E
SHA1:	D4D1A37C25322C3C2D4C30ED39787A447CEB4D7F
SHA-256:	F65987DFDF31748C905CA53CAEFE5185D21159594B8A34BCDC50E207BA838431
SHA-512:	AD2D7B258FD20E006C16A77914413A2F4A6EE45B1347D62B9D7C991BE2EDEF6924FB801C62FF280ED712D0F9ED5BC31FCF17B98231887BD57AE8DEE6602BB9F7
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.#.# $XFree86: xc/nls/XLC_LOCALE/zh_TW.big5,v 1.2 2000/10/27 18:30:57 dawes Exp $.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_TW.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00038000.wc_shift_bits..8...use_stdc_env..True.force_convert_to_mb.True...#.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{

C:\Program Files (x86)\Xming\locale\zh_TW.big5\is-513KV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text, with very long lines (4488)
Category:	dropped
Size (bytes):	9611
Entropy (8bit):	4.824239460270698
Encrypted:	false
SSDEEP:	192:+17lDz5C5B9DFxBIr/XPI+QD32x2MT+gr9rY/PpzyqE2TabNJKX:K9MrDFUrXA332BKgr9OPYx2IJKX
MD5:	EB2007696F8782444E319D944EF0738E
SHA1:	D4D1A37C25322C3C2D4C30ED39787A447CEB4D7F
SHA-256:	F65987DFDF31748C905CA53CAEFE5185D21159594B8A34BCDC50E207BA838431
SHA-512:	AD2D7B258FD20E006C16A77914413A2F4A6EE45B1347D62B9D7C991BE2EDEF6924FB801C62FF280ED712D0F9ED5BC31FCF17B98231887BD57AE8DEE6602BB9F7
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.#.# $XFree86: xc/nls/XLC_LOCALE/zh_TW.big5,v 1.2 2000/10/27 18:30:57 dawes Exp $.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_TW.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00038000.wc_shift_bits..8...use_stdc_env..True.force_convert_to_mb.True...#.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{

C:\Program Files (x86)\Xming\locale\zh_TW.big5\is-7EQ4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.010203714622434
Encrypted:	false
SSDEEP:	6:Lq6fL5kc/Oetdtmxvr/uhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:Lq69RvtoMe6ldo0+62XdUmhn
MD5:	E076CC539EC55224071891CC1A9B0E9E
SHA1:	082D5B5AFF96D8577C0D77E2FB7348997F3BC365
SHA-256:	9D5F8D6B36C35AD5891F90102B29AFB8999490D87C844FF7A7F1FB902BE0B574
SHA-512:	682C4FC86F6D9422E858E3880E112E7225ADC6BD8A4258944859077B67B1AD87D6206A1B27A268C68A0989C3BCF6AB7C372BD81D08C88DE2CB798A3D6835B876
Malicious:	false
Preview:	#.# zh_TW.big5 Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_TW.big5,v 1.1 1999/08/28 09:00:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_TW\Compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.948300933328009
Encrypted:	false
SSDEEP:	6:LqzL5kc/Oetdtmzuvr/uhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqBRvtm8Me6ldo0+62XdUmhn
MD5:	8C60171481DE8381C451F296997341A3
SHA1:	F10B943532C13E1DBC54D06D82719BDF3352C3A7
SHA-256:	44DA35893326C8CD3E8458C2899AB548FA5BF4B03CBB8A7C1AFB9F81A7602CF9
SHA-512:	AEA94E7FB0665E0E0A6E305E215862E3F1503366C2809BC4914C043D0680F55A474F28FCD1F2F4DAAF4C57CDA2B221AFB685841F37EC9EE60DEC25ED03E24158
Malicious:	false
Preview:	#.# zh_TW Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_TW,v 1.1 1999/08/28 09:00:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\locale\zh_TW\XLC_LOCALE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	5.452970481943433
Encrypted:	false
SSDEEP:	48:5fi/ayCeim2Me6w0UcOjwmHjOwjxTjDyKjX1NUTO5id5y5xv2dV5ydHf5WdtC58:5fWayCb9cg3DOmxvDyMEm+5ep6vOHhaf
MD5:	4FE4CAA0AA636A64C27E33EE9781DC93
SHA1:	58F6B57BBB0A3225CE9901E729FEE25CC86CACF0
SHA-256:	CC477AF9AF0522F964777ECFA9D8AA98459A09CF074E5544A925B95B4052CCF2
SHA-512:	EAA307B8713D9A43029CB9AFB6F2EC0F08DEB1026755094986F8BB42A3F1DC738618217E9F9851AB3142E85EA76B3C3692069F2EE2290D2A8BC8B498DEA8A571
Malicious:	false
Preview:	# $Xorg: zh_TW,v 1.3 2000/08/17 19:47:01 cpqbld Exp $.# XLocale Database Sample for zh_TW.# .# Note: In lib/X11/lcCT.c, charset names for CNS11643 coded character.# sets are defined as CNS11643.1986-1 and -2. In the ECMA Registry,.# CNS coded character sets 1-7 are registered as CNS 11643-1992..# CJK.INF Version 1.7 (August 15, 1995) written by Ken Lunde says.# plane 14 of CNS 11643-1983 now became plane 3 of CNS 11643-1992..# I do not know how Taiwanese EUC is organized currently, so I left the.# X11R6 organization of fsN/csN as it is and only changed "CNS11643-".# to "CNS11643.1986-"..#.1995-10-24.T. Numata (numa@rp.open.cs.fujitsu.co.jp)..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.CNS11643.1986-1:GL..}..font.{...primary.CNS11643.1986-1:GL..}.}.# .fs2 class.fs2.{..charset.{...name.CNS11643.1986-2:GL..}..font.{...primary

C:\Program Files (x86)\Xming\locale\zh_TW\is-7E7TI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	5.452970481943433
Encrypted:	false
SSDEEP:	48:5fi/ayCeim2Me6w0UcOjwmHjOwjxTjDyKjX1NUTO5id5y5xv2dV5ydHf5WdtC58:5fWayCb9cg3DOmxvDyMEm+5ep6vOHhaf
MD5:	4FE4CAA0AA636A64C27E33EE9781DC93
SHA1:	58F6B57BBB0A3225CE9901E729FEE25CC86CACF0
SHA-256:	CC477AF9AF0522F964777ECFA9D8AA98459A09CF074E5544A925B95B4052CCF2
SHA-512:	EAA307B8713D9A43029CB9AFB6F2EC0F08DEB1026755094986F8BB42A3F1DC738618217E9F9851AB3142E85EA76B3C3692069F2EE2290D2A8BC8B498DEA8A571
Malicious:	false
Preview:	# $Xorg: zh_TW,v 1.3 2000/08/17 19:47:01 cpqbld Exp $.# XLocale Database Sample for zh_TW.# .# Note: In lib/X11/lcCT.c, charset names for CNS11643 coded character.# sets are defined as CNS11643.1986-1 and -2. In the ECMA Registry,.# CNS coded character sets 1-7 are registered as CNS 11643-1992..# CJK.INF Version 1.7 (August 15, 1995) written by Ken Lunde says.# plane 14 of CNS 11643-1983 now became plane 3 of CNS 11643-1992..# I do not know how Taiwanese EUC is organized currently, so I left the.# X11R6 organization of fsN/csN as it is and only changed "CNS11643-".# to "CNS11643.1986-"..#.1995-10-24.T. Numata (numa@rp.open.cs.fujitsu.co.jp)..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.CNS11643.1986-1:GL..}..font.{...primary.CNS11643.1986-1:GL..}.}.# .fs2 class.fs2.{..charset.{...name.CNS11643.1986-2:GL..}..font.{...primary

C:\Program Files (x86)\Xming\locale\zh_TW\is-8UEOP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.948300933328009
Encrypted:	false
SSDEEP:	6:LqzL5kc/Oetdtmzuvr/uhz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqBRvtm8Me6ldo0+62XdUmhn
MD5:	8C60171481DE8381C451F296997341A3
SHA1:	F10B943532C13E1DBC54D06D82719BDF3352C3A7
SHA-256:	44DA35893326C8CD3E8458C2899AB548FA5BF4B03CBB8A7C1AFB9F81A7602CF9
SHA-512:	AEA94E7FB0665E0E0A6E305E215862E3F1503366C2809BC4914C043D0680F55A474F28FCD1F2F4DAAF4C57CDA2B221AFB685841F37EC9EE60DEC25ED03E24158
Malicious:	false
Preview:	#.# zh_TW Compose Sequence.#.# Sequence Definition.#.# $XFree86: xc/nls/Compose/zh_TW,v 1.1 1999/08/28 09:00:40 dawes Exp $.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Program Files (x86)\Xming\plink.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	299008
Entropy (8bit):	6.592965073031339
Encrypted:	false
SSDEEP:	6144:jpqg3aFy1R6UAUHMfN/ydVt448GKlZF3jWM8602z6Sq991xnxrwc:ITy/6T/fEVt4s3U6f1vV
MD5:	A873014ED92F2B618D24A7DD6296E484
SHA1:	2BE625EF787DD5666477B3DF81C7E88BCCCB3175
SHA-256:	EAC13EB482B2E50B626B280DA4AF678DAB19DAF46F0C01BE8276D60DFC1CD8AD
SHA-512:	11305C6B9BD4C3720D329129E3B28582550A9D7208DFFBFFC1D3A5236DF2B89C257779D1DCF7E5FAA63CD163D218E99E5B2A771194F5B97504878AAAA463C1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,8F...............8.".......:...........@....@.................................4T........ .................................`.......Pl...........................................................................................................text....!......."..................`..`.data...P....@.......&..............@....rdata..`....P.......*..............@..@.bss.....8...@...........................idata..`...........................@....rsrc...Pl.......n..."..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\pthreadGC2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	6.007853549593218
Encrypted:	false
SSDEEP:	384:mEpbJJMT+oIlhXIXFCPZUx25aEKRAV+F/vmw65wN6fsQn1n7a2iH32JuRXge6Zbw:mEpVJeonYXFCRUxJnqNfDn7XiH3Yau
MD5:	89C46CB0E159B34E4F19C47CA2D49A8C
SHA1:	D6BE559E20E9078610FF38B3C08977331141AECA
SHA-256:	210286E517AD62130C967E7E686E290487D77FEB51E4E9B275A2620CA9450E38
SHA-512:	D4A973929C95F88580924E529FC8C7C81FC7DDD3A66649016089404ABAF6B4A683ADCE29B540FA48F319C82AE93D295AFCABC6F4AF796B9C93016F7AA53B35B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+..F...........#...8.N...t......`........`....Hb.......................................... .................................d.......\............................................................................................................text....M.......N..................`..`.data...`....`.......R..............@....rdata..0....p.......T..............@..@.bss.....................................edata...............V..............@..@.idata..d............f..............@....rsrc...\............n..............@....reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\rgb.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	17371
Entropy (8bit):	4.708589475815843
Encrypted:	false
SSDEEP:	384:49jf0Kv7lpt3oQiJoGiW1pfdVzg5jdmK9RABxCyPhccrsiq4wCoOmAMbA:4BdbGiWvUTqzPqcrslA
MD5:	4896B3E3380A6A2AF1920709BC31B140
SHA1:	6EE6212C18619D4B0EDD54B7D259314FC4170D8A
SHA-256:	9B7B5F0B798A4A8AEB27F7E040E6FB05830E95BCFB7F6E53CC4710D0B2680FC0
SHA-512:	992ECE273EE78647A53169134363D185A58B0E583F977757970E341CF6D64C8D0C71C9057935523BDE062C8E6A4B4BA637E43BA5792409C869194E651D0C3C77
Malicious:	false
Preview:	! $Xorg: rgb.txt,v 1.3 2000/08/17 19:54:00 cpqbld Exp $.255 250 250..snow.248 248 255..ghost white.248 248 255..GhostWhite.245 245 245..white smoke.245 245 245..WhiteSmoke.220 220 220..gainsboro.255 250 240..floral white.255 250 240..FloralWhite.253 245 230..old lace.253 245 230..OldLace.250 240 230..linen.250 235 215..antique white.250 235 215..AntiqueWhite.255 239 213..papaya whip.255 239 213..PapayaWhip.255 235 205..blanched almond.255 235 205..BlanchedAlmond.255 228 196..bisque.255 218 185..peach puff.255 218 185..PeachPuff.255 222 173..navajo white.255 222 173..NavajoWhite.255 228 181..moccasin.255 248 220..cornsilk.255 255 240..ivory.255 250 205..lemon chiffon.255 250 205..LemonChiffon.255 245 238..seashell.240 255 240..honeydew.245 255 250..mint cream.245 255 250..MintCream.240 255 255..azure.240 248 255..alice blue.240 248 255..AliceBlue.230 230 250..lavender.255 240 245..lavender blush.255 240 245..LavenderBlush.255 228 225..misty rose.255 228 225..MistyRose.255 255 255..white

C:\Program Files (x86)\Xming\run.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	5.12909801577702
Encrypted:	false
SSDEEP:	768:xwXEBpShpq9KB5dr4zs0lM2Jsn+o5dJB4FYlmR+iz/rrXCxDz:xwUB8hF5o+asn+o5d/4FYl27jGxDz
MD5:	DDA147704A1EE890A38646A67E115B09
SHA1:	B0AA55221C73B4EE2A975AACC879643C64C1E7FD
SHA-256:	8B8699CEC8D47F0B02182EC56B6E3ADEA84E7096256114B1E63B400AF3711463
SHA-512:	29435D7EE96C3B89D7C4B6D5B29A67484953CEC4EBAD0D3DC01482166EFA0685F0B620BCE66C1CB3D480F26519DFA4C9A55172E7ED474FC98C94743D5C8E1C4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......F...............8. ...................0....@.................................\i........ ..............................`.......p...t...........................................................................................................text............ ..................`..`.data...`....0.......$..............@....rdata.......@.......&..............@..@.bss.........P...........................idata.......`.......,..............@....rsrc....t...p...v...4..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Xming\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	InnoSetup Log Xming, version 0x2d, 32210 bytes, 138727\user, "C:\Program Files (x86)\Xming"
Category:	dropped
Size (bytes):	32210
Entropy (8bit):	5.03540529275385
Encrypted:	false
SSDEEP:	96:uy06HqMWAXz9ufhPgQEMYXzl+lX7Z6huR6IQhS7pWOUNcmI2wJreVjW0ebg9luxq:pZVgR6+lLQc9vHYFis7
MD5:	3E8DF323A014877A7339AB9A2C8B2FFF
SHA1:	26C3D9B9865E47A722255FFA68EEE040367CECE2
SHA-256:	545A1D33DD5E050A3D2FF64B8576DD905E2EF4D6F9F4A7D8886BA7CD22843BB1
SHA-512:	FF36CD0D3537B23FCBB43736EC8169E1FB2436BAEF66D5372324BD844F5F1CB6B4878B95D682EFE3CE1701513BE201E4956936E838E4A97A8D2E7469AB2A7125
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Xming...........................................................................................................................Xming...........................................................................................................................-........}..%............................................................................................................................%........=....138727.user.C:\Program Files (x86)\Xming...............O.. .......... .................................C:\Program Files (x86)\Xming:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming.Xming.default...................(...&C:\Program Files (x86)\Xming\Xming.url............C:\Program Files (x86)\Xming.......+...&C:\Program Files (x86)\Xming\Xming.exe..........)...$C:\Program Files (x86)\Xming\rgb.txt..........+...&C:\Program Files (x86)\Xming\XKeysymDB..........*...%C:\Program Files (x86)\Xming\XErrorDB..........0...+

C:\Program Files (x86)\Xming\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704793
Entropy (8bit):	6.439623157307891
Encrypted:	false
SSDEEP:	12288:xkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWoVphKvV2xgd:uFRCUn4rP/37YzHXA6QJsoPtdpQ0xgd
MD5:	23E1E052242979A9C8BC0FB1ACCBDA56
SHA1:	00CA7A223DE7955A6EDF58A2BCF27EB750F043B5
SHA-256:	AF4F9E45F56F896D4797C183DB860C0D040A9A403FCF6E1AE11D69CFD31F475A
SHA-512:	55079E3389DE9516D361135B42B90DDA70130EDBAD9DFDCEF12B85B8426D08F2935CEF586706757F9981D1860D4C1652AE51234A381F73400F32020B72F0E3C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@..............................<%......p....................`...............................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc...p...........................@..P.............0......................@..P........................................................................................................................................

C:\Program Files (x86)\Xming\xkb\compat.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	974
Entropy (8bit):	3.629871346219524
Encrypted:	false
SSDEEP:	12:86CH/OI6YjSfS7R6Eb/NIRTpDh13AvEy5S5ky5OT79DI6tmBn:86CfnZoV7w8yoX2a6tk
MD5:	707D56AE06760224357E203FDE2E9922
SHA1:	F63B2EAE4B8C60BA320E45E006092B75CD3CB1FD
SHA-256:	A515CCF0B6A0C19D88437F037BBBFB732E126A17D9C7AD14FCDD6253919D9AF0
SHA-512:	25F0BDB8EE550BC5836657CB1AE247E58A0A58E107BE34F3CD1D6BAB675B8CEB7467ED9FAF4C09668EBD4F27149381ADB265C980165A7BF18A9CA095166A7676
Malicious:	false
Preview:	-dp----- -------- pc(pc).-dp----- -------- misc(misc).-d------ -------- pc98(basic).-d------ -------- default(default).-dp----- -------- ledscroll(scroll_lock).--p----- -------- ledscroll(group_lock).--p----- -------- ledscroll(shift_lock).-dp----- -------- mousekeys(mousekeys).-dp----- -------- norepeat(norepeat).-d------ -------- basic(basic).-dp----- -------- japan(japan).--p----- -------- japan(kana_lock).-d------ -------- xtest(xtest).-dp----- -------- ledcaps(caps_lock).--p----- -------- ledcaps(group_lock).--p----- -------- ledcaps(shift_lock).-d------ -------- complete(complete).h-p----- -------- keypad(overlay).h-p----- -------- keypad(overlay1).h-p----- -------- keypad(overlay2).-dp----- -------- lednum(num_lock).--p----- -------- lednum(group_lock).--p----- -------- lednum(shift_lock).-dp----- -------- level5(default).-dp----- -------- accessx(basic).--p----- -------- accessx(full).-dp----- -------- iso9995(default).-dp----- -------- xfree86(basic).

C:\Program Files (x86)\Xming\xkb\compat\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	4.4190005713980804
Encrypted:	false
SSDEEP:	24:rX7zrXVROZzrb4+yCS0DaTbQ2jhCwQajpHMhrF/awflKEqzK6q++C4LdHhyDgXYU:rX3LV2fBSqD8CZ6Mn1fdv7UgIU
MD5:	497F4F853E094E136A710BB65A40076F
SHA1:	0F6D8F7C2FAEA8C05099E9150C252EBC752BDE5A
SHA-256:	2A8264B3CBE98D37BA874AAA145C71E3764A11716359F81EEF0A90F72AB281C2
SHA-512:	02741E7214FA36AB67242A371A546C85F79B13C452526ACFCDAA61E1BDBBE3A54929DEAFF5F456EA077138139B79BA6DD17CF51602CFD1277A090A10C45CBA6A
Malicious:	false
Preview:	The core protocol interpretation of keyboard modifiers does not include direct.support for multiple keyboard groups, so XKB reports the effective keyboard.group to XKB-aware clients using some of reserved bits in the state field of.some core protocol events. This modified state field would not be interpreted.correctly by XKB-unaware clients, so XKB provides a group compatibility mapping.which remaps the keyboard group into a core modifier mask that has similar.effects, when possible...XKB maintains three compatibility state components that are used to make.XKB-unaware clients(*) work as well as possible:.- The compatibility state which corresponds to the effective modifier and. effective group state..- The compatibility lookup state which is the core-protocol equivalent of the. lookup state..- The compatibility grab state which is the nearest core-protocol equivalent. of the grab state...Compatibility state are essentially the corresponding XKB states, but with.keyboard group possib

C:\Program Files (x86)\Xming\xkb\compat\accessx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.8490526335312
Encrypted:	false
SSDEEP:	24:MQ5+BOllSx1FTSAv3J8+cDG0GkuAq9ALizuhE7m8:KObSx11SAv3J8+cDGt7h9oizKE68
MD5:	42B36540C33130E489DAC8EB8036C421
SHA1:	1D77985159F11EA80801980A6C733E2404E29FC0
SHA-256:	B2F58DDE4DD6D66F509417B4CCA64810D8269DF9DFBAF61AD0EDB5DBA66FB8CF
SHA-512:	70C2C65C757D43B9301EAE62CA259BF96F8000D304D0AF7B145BB1D729DF081E03FC04935E6384622DA4D11A7C6BC48618277779F66222228E5F0E7888D7BF82
Malicious:	false
Preview:	// $Xorg: accessx,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..default partial xkb_compatibility "basic" {. interpret AccessX_Enable { ..action= LockControls(controls=AccessXKeys); . };.};..partial xkb_compatibility "full" {.. interpret AccessX_Enable {..action= LockControls(controls=AccessXKeys); . };.. interpret AccessX_Feedback_Enable { ..action= LockControls(controls=AccessXFeedback); . };.. interpret RepeatKeys_Enable {..action= LockControls(controls=RepeatKeys);. };.. interpret SlowKeys_Enable {..action= LockControls(controls=SlowKeys);. };.. interpret BounceKeys_Enable {..action= LockControls(controls=BounceKeys);. };.. interpret StickyKeys_Enable {..action= LockControls(controls=StickyKeys);. };.. interpret MouseKeys_Enable {..action= LockControls(controls=MouseKeys);. };.. interpret MouseKeys_Accel_Enable {..action= LockControls(controls=MouseKeysAccel);. };.. interpret Overlay1_Enable {..action= LockControls(controls=Overlay

C:\Program Files (x86)\Xming\xkb\compat\basic (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	5.068467994229273
Encrypted:	false
SSDEEP:	24:MFEhSNI2xG6bBbO5Wn0Ed5HQnmrO2uakWcueCgA7:FaI0G6bJO5Wn75wnmrwakWjGA7
MD5:	4B4CD14DB2F8DF42B3808004E1657A34
SHA1:	0436BB3E96D0D6DADB4CF5D90C68DC87D90B31F8
SHA-256:	EEF4A88A47262664E9B51872D6682780A028140505D7359F06F177D34F96F120
SHA-512:	05621F666EC9C63EBDD3EE9DE9FF9F56126CD3E2F25EBFA34E1BEA4C0CEE37FF7D42070B5B1988C104B22CC2882DE8BF8FA0A102416178F6D3542661D04017B6
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...// $XFree86: xc/programs/xkbcomp/compat/basic,v 1.2 2000/11/06 19:24:10 dawes Exp $..default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };.. interpret Any+Lock {..action= LockMods(modifiers=Lock);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=+1);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2

C:\Program Files (x86)\Xming\xkb\compat\complete (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.007444091892622
Encrypted:	false
SSDEEP:	6:jLmtdTZa3BxUNqF0w+Cp+xo6G66xAJs5DWM5fAPs5B+5055bFW5STZ:jLsZaRkquw+CUxnG6xJsYMEsWyjbUSZ
MD5:	F440C7A2D944908C3C77FC2BDF02B906
SHA1:	B9E8E4D2116FF2D10C0890FB309A071527B73E60
SHA-256:	1D5E34E6A518FE9D97A4B194FC707B86D0B17C45E8A039F8E5E0692B1DC41E44
SHA-512:	DA09717FEA357EB869F2EF7E16B5E01B953F0EF0C1833ADA8D33FD76266A6E56397CB8C72BE49F599F5FC39824EB89F039737F45C3496BB00B0100BDF137FB3D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/complete,v 1.3 2005-10-17 00:42:11 svu Exp $.// $Xorg: complete,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "complete" {. include "basic". augment "iso9995". augment "mousekeys". augment "accessx(full)". augment "misc". augment "xfree86". augment "level5".};..

C:\Program Files (x86)\Xming\xkb\compat\default (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.011330531154495
Encrypted:	false
SSDEEP:	12:jLsZaRXzWHqc3CUxnG6GYQsJsEsRyYMSuYeo4bU3:YatzWKcPG6GYQo3kuY0k
MD5:	5FACAD4B98FE76D8238B764DC42DE646
SHA1:	E887E2246E19FA7C3747394F52FCA20079D5D123
SHA-256:	E39DAC647EB454FCB1607BDC1EDB248016914FDCC0B58709F635AF5A67914C2E
SHA-512:	30523B8728DA4EA8200AE95DE22C157EC93DE7ABD448BDBA1CE32A5D4A34D9BEBF3E0B812CC48BB0731BAF45589CEE7BC5A8BAE37DC0C181B6D6E400F488B60D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/default,v 1.3 2005-10-17 00:42:11 svu Exp $.// $Xorg: default,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "default" {. include "basic". augment "mousekeys". augment "accessx(basic)". augment "misc". augment "iso9995". augment "level5".// ??should be changed/renamed/removed.// augment "xfree86". augment "japan".};.

C:\Program Files (x86)\Xming\xkb\compat\is-02CPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.99380964580968
Encrypted:	false
SSDEEP:	12:jLKCU5+B6rSekfnXNBD/tKHzwFmeYoHzwF9:C+B6rSD35yzGzg
MD5:	27D8C3E67830FC5DB376C1959706C8DB
SHA1:	ADB107E229AF2FEC15D747A5A0753E73BF564889
SHA-256:	8FF8BEBB79C91AE5F5872F256AB7CDD54D7B76BEEC065A731DA7998FA423D181
SHA-512:	A1305C03D214BD0D7FB609278B9599775D6E957AD25B64C081D8F42C813701B22C5525E5A7D562BBB737706B9CA82E462833D1041D19CB51EECE2BD7F4A7FF7B
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default partial xkb_compatibility "pc" {.. // Sets the "Alt" virtual modifier.. virtual_modifiers.Alt;.. setMods.clearLocks= True;. interpret Alt_L+Any { ..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R+Any.{..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.};.

C:\Program Files (x86)\Xming\xkb\compat\is-5CFD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.509291799318713
Encrypted:	false
SSDEEP:	6:j5Tlpq4b5+wn+RrjYQ/A65LVMYv/zkrEsANQ/A6RakHFtzkr6CQ/A6LMfIzv:j/bzn+Bh4KvuB4Pkls6r4Q
MD5:	A155109EA7C9CD0466E79F1CADD3A18F
SHA1:	41772C2C5BC7039ECDCBF2279D6F0879BAC1D562
SHA-256:	0AA3FE2C1158D60AD8F2FDAD5C3F369C3112B8184B4FEC7E84117AF62E3AA57D
SHA-512:	60F986F2D6B3AE6D80E5584B404535A011C9167BD1668A415CEDAC827EFD601D3A5011507EEB3A6C752010F3F0EFA1223549BFB6034F6502F2F12B4851C40587
Malicious:	false
Preview:	// Use Scroll Lock LED to show either Scroll Lock, Group, or Shift Lock state..default partial xkb_compatibility "scroll_lock" {. indicator "Scroll Lock" {. allowExplicit;. whichModState= Locked;. modifiers= ScrollLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Scroll Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Scroll Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\is-7494R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.805283814735198
Encrypted:	false
SSDEEP:	96:PG5SP6tEtx/cgUr2POXvV0U5O8fK+zqqV0a+XFuwzkeMk/FaLmBkOG01lIB0j0BP:OvMx/cgUrV1KoqG0a+XFLPFd+mFPPjj2
MD5:	AD49534517F1762DFDDA32DD3959CA06
SHA1:	C2D4327ACF4D3DE96571AB4664EAAFDA596B055A
SHA-256:	07F49010B6E44D5FD7647E5B499243EA797778AAEF29F671A2442C200F90DEBD
SHA-512:	2526C9E1713907338611EB37C98628D1A3E59886C0E6AD794B4EA7A559284E454DF2E29EDB0E0E40AD530FE20209EBEE6762BE356696822510F601E95C80D436
Malicious:	false
Preview:	.// $Xorg: mousekeys,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations for arrow keys and a bunch of other .// common keysyms which make it possible to bind "mouse" .// keys using xmodmap and activate or deactivate them .// from the keyboard...default partial xkb_compatibility "mousekeys" {.. // Keypad actions.. //. interpret.repeat= True;.. interpret KP_1 { ..action = MovePtr(x=-1,y= +1); . };. interpret KP_End { ..action = MovePtr(x=-1,y= +1); . };.. interpret KP_2 { ..action = MovePtr(x=+0,y= +1); . };. interpret KP_Down { ..action = MovePtr(x=+0,y= +1); . };.. interpret KP_3 { ..action = MovePtr(x=+1,y=+1); . };. interpret KP_Next { . .action = MovePtr(x=+1,y=+1); . };.. interpret KP_4 { ..action = MovePtr(x=-1,y=+0); . };. interpret KP_Left { ..action = MovePtr(x=-1,y=+0); . };.. interpret KP_6 { ..action = MovePtr(x=+1,y=+0); . };. interpret KP_Right { . .action = MovePtr(x=+1,y=+0); . };.. interpret

C:\Program Files (x86)\Xming\xkb\compat\is-7V1SI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	4.4190005713980804
Encrypted:	false
SSDEEP:	24:rX7zrXVROZzrb4+yCS0DaTbQ2jhCwQajpHMhrF/awflKEqzK6q++C4LdHhyDgXYU:rX3LV2fBSqD8CZ6Mn1fdv7UgIU
MD5:	497F4F853E094E136A710BB65A40076F
SHA1:	0F6D8F7C2FAEA8C05099E9150C252EBC752BDE5A
SHA-256:	2A8264B3CBE98D37BA874AAA145C71E3764A11716359F81EEF0A90F72AB281C2
SHA-512:	02741E7214FA36AB67242A371A546C85F79B13C452526ACFCDAA61E1BDBBE3A54929DEAFF5F456EA077138139B79BA6DD17CF51602CFD1277A090A10C45CBA6A
Malicious:	false
Preview:	The core protocol interpretation of keyboard modifiers does not include direct.support for multiple keyboard groups, so XKB reports the effective keyboard.group to XKB-aware clients using some of reserved bits in the state field of.some core protocol events. This modified state field would not be interpreted.correctly by XKB-unaware clients, so XKB provides a group compatibility mapping.which remaps the keyboard group into a core modifier mask that has similar.effects, when possible...XKB maintains three compatibility state components that are used to make.XKB-unaware clients(*) work as well as possible:.- The compatibility state which corresponds to the effective modifier and. effective group state..- The compatibility lookup state which is the core-protocol equivalent of the. lookup state..- The compatibility grab state which is the nearest core-protocol equivalent. of the grab state...Compatibility state are essentially the corresponding XKB states, but with.keyboard group possib

C:\Program Files (x86)\Xming\xkb\compat\is-9HKU8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.011330531154495
Encrypted:	false
SSDEEP:	12:jLsZaRXzWHqc3CUxnG6GYQsJsEsRyYMSuYeo4bU3:YatzWKcPG6GYQo3kuY0k
MD5:	5FACAD4B98FE76D8238B764DC42DE646
SHA1:	E887E2246E19FA7C3747394F52FCA20079D5D123
SHA-256:	E39DAC647EB454FCB1607BDC1EDB248016914FDCC0B58709F635AF5A67914C2E
SHA-512:	30523B8728DA4EA8200AE95DE22C157EC93DE7ABD448BDBA1CE32A5D4A34D9BEBF3E0B812CC48BB0731BAF45589CEE7BC5A8BAE37DC0C181B6D6E400F488B60D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/default,v 1.3 2005-10-17 00:42:11 svu Exp $.// $Xorg: default,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "default" {. include "basic". augment "mousekeys". augment "accessx(basic)". augment "misc". augment "iso9995". augment "level5".// ??should be changed/renamed/removed.// augment "xfree86". augment "japan".};.

C:\Program Files (x86)\Xming\xkb\compat\is-AHRCN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.929769222813912
Encrypted:	false
SSDEEP:	24:YnB3PovpYBbO5Wn0EdxaZXrBjXsDj0TerXrKQBbO5Wn0EdxaZPOrBjXsDj0TeYXO:g3GpYJO5Wn7xaZXrBjXsDjgyXrRJO5Wu
MD5:	6A5C56D44F81A20765419773C40CCCD1
SHA1:	77EABF25F910028543BE242FEB5C0351AAD087B4
SHA-256:	81A834933F1D81F75187F2718BAE5054B911104C41442109B733ED1CD0A7BDDD
SHA-512:	0C9A030565A5606F87A3CE76951E31C6EB941FAF8E2E67148A00F3DE1EFC7A3CBC2B46896BFD30A9CAA46BECC69AF968428E4FDF51FF63DA00A18861FE482452
Malicious:	false
Preview:	// $Xorg: keypad,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations needed to implement the numeric keypad.// as an overlay instead of a modifier...partial hidden xkb_compatibility "overlay" {. include "keypad(overlay1)".};.partial hidden xkb_compatibility "overlay1" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Num_Lock {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };.. indicator.allowExplicit= True;. indicator.driveskbd= True;. replace indicator "Num Lock" {..whichModState= Locked;..modifiers= NumLock;..controls= Overlay1;. };. indicator.allowExplicit= True;.};.partial hidden xkb_compatibility "overlay2" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= Tru

C:\Program Files (x86)\Xming\xkb\compat\is-ASBO7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.561809515469401
Encrypted:	false
SSDEEP:	6:jQsTlpqFWb5+wn+RrwQvzMAALVMb/zkrEsANQvzMiakHFtzkr6CQvzMWMfIzv:jQVWbzn+BNbMFPBbMvkls6rbMw
MD5:	B7EF413066C430D6409D3F347E3433DD
SHA1:	91CDCCA14EEA2F8887C0CD8187FCBCE3844E146F
SHA-256:	393FDE9BD47ECAD0595A56FDB8339F57613783A142DB77CA7159B0D9CCF31543
SHA-512:	0A07ECDFDB97DEE6445C4645A447B775B23FB71EBF9BC8BC21AE1902C1F81322CE12CA64415DAA39CECF179F85DDEB5D9BE10F3401A76532D3B455A27FA04483
Malicious:	false
Preview:	// Use Caps Lock LED to show either Caps Lock, Group, or Shift Lock state..default partial xkb_compatibility "caps_lock" {. indicator "Caps Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= Lock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Caps Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Caps Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\is-DE4SV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.572895731334902
Encrypted:	false
SSDEEP:	6:jDIosTlpqrH2Wb5+wn+RrRTtQM2AALVMlP/zkrEsANQM2iakHFtzkr6CQM2WMfID:jDIoj2Wbzn+B5mM2FW2BM2vkls6rM2w
MD5:	1F09E95CBAADB5A49D7F18DEC7071419
SHA1:	165DCE67E90BE16766E8620738ED7AE05D5006CC
SHA-256:	0687FECC3AFA78DA3089FB6C4538EFFAD64F0AC29CC8828C1BED60B2A7E59A41
SHA-512:	F7F1494636217B0099D948EC8D3DB7CFF85B4DC866B0997A418DC42C5C595819095A683DE9808BA2879ABDA0AC5CE14DFA36DED95AF23EA96C5E67A0BBF97473
Malicious:	false
Preview:	// Use Num Lock LED to show either Num Lock, Group, or Shift Lock state..default partial xkb_compatibility "num_lock" {. indicator "Num Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= NumLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Num Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Num Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\is-I7856.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2571
Entropy (8bit):	4.836141015325103
Encrypted:	false
SSDEEP:	48:SIct14K+KOV+zqAGRG1+GT+1+kyLsLtsw+cVe0:6tWKrOV+Qo1D+1MQLywQ0
MD5:	1EFC3737ADF770ED337B2A4B50309F9D
SHA1:	F7588270E8380F8EEAE56A7C4399D0F1633B5275
SHA-256:	E445C8E9AC3C14082CDFC8F48C46E0451DEA9BB98289AD53C172E00B1ED34176
SHA-512:	9035B205A26D9B3E39A04CEEEDDA647E38D8C901837051008811D0EE3D50FEBB294FE94E1CBB37C03359AA50A2EB212FFF61A27D3077CB7F17ABD44634B5C8D4
Malicious:	false
Preview:	// $XdotOrg: xc/programs/xkbcomp/compat/misc,v 1.1.4.4 2004/03/05 13:41:28 eich Exp $.// $Xorg: misc,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.//.//.//.// $XFree86: xc/programs/xkbcomp/compat/misc,v 1.4 2003/05/15 13:31:57 pascal Exp $..default partial xkb_compatibility "misc" {.. virtual_modifiers.Alt,Meta,Super,Hyper,ScrollLock;.. // Interpretations for some other useful keys.. interpret Terminate_Server {. action = Terminate();. };.. setMods.clearLocks= True;.. // Sets the "Alt" virtual modifier.. interpret Alt_L+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_L.{..action = SetMods(modifiers=Alt);. };.. interpret Alt_R+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R.{..action = SetMods(modifiers=Alt);. };.. // Sets the "Meta" virtual modifier.. interpret Meta_L+Any {.//

C:\Program Files (x86)\Xming\xkb\compat\is-LLQST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.007444091892622
Encrypted:	false
SSDEEP:	6:jLmtdTZa3BxUNqF0w+Cp+xo6G66xAJs5DWM5fAPs5B+5055bFW5STZ:jLsZaRkquw+CUxnG6xJsYMEsWyjbUSZ
MD5:	F440C7A2D944908C3C77FC2BDF02B906
SHA1:	B9E8E4D2116FF2D10C0890FB309A071527B73E60
SHA-256:	1D5E34E6A518FE9D97A4B194FC707B86D0B17C45E8A039F8E5E0692B1DC41E44
SHA-512:	DA09717FEA357EB869F2EF7E16B5E01B953F0EF0C1833ADA8D33FD76266A6E56397CB8C72BE49F599F5FC39824EB89F039737F45C3496BB00B0100BDF137FB3D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/complete,v 1.3 2005-10-17 00:42:11 svu Exp $.// $Xorg: complete,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "complete" {. include "basic". augment "iso9995". augment "mousekeys". augment "accessx(full)". augment "misc". augment "xfree86". augment "level5".};..

C:\Program Files (x86)\Xming\xkb\compat\is-NU90V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1626
Entropy (8bit):	4.618148151698682
Encrypted:	false
SSDEEP:	48:XdlkEpOpkpm9pspmpcp6pkp4pIpy1hYA53:/kqwKmDC4SkKWGSYA53
MD5:	0B5E75E2344FF705F44557BCC0BE72EB
SHA1:	276194338F7E2AB9BCA47A31EC1735B265925CB5
SHA-256:	765E20E54268CD15131373335571C8C93126D9AB56C3A95539019FAF3C9AF17D
SHA-512:	9F5CD17470A840461EC76BF05D87D27678C39C1F5F3973CB8870F7C00CC6FBDA6E1D2EA73B8B17C59DA455643D2AB9BAD31039446F98163906105B6240D2916F
Malicious:	false
Preview:	// $XFree86$.// XFree86 special keysyms..default partial xkb_compatibility "basic" {.. interpret.repeat= True;.. interpret XF86_Switch_VT_1 {. action = SwitchScreen(Screen=1, !SameServer);. };. interpret XF86_Switch_VT_2 {. action = SwitchScreen(Screen=2, !SameServer);. };. interpret XF86_Switch_VT_3 {. action = SwitchScreen(Screen=3, !SameServer);. };. interpret XF86_Switch_VT_4 {. action = SwitchScreen(Screen=4, !SameServer);. };. interpret XF86_Switch_VT_5 {. action = SwitchScreen(Screen=5, !SameServer);. };. interpret XF86_Switch_VT_6 {. action = SwitchScreen(Screen=6, !SameServer);. };. interpret XF86_Switch_VT_7 {. action = SwitchScreen(Screen=7, !SameServer);. };. interpret XF86_Switch_VT_8 {. action = SwitchScreen(Screen=8, !SameServer);. };. interpret XF86_Switch_VT_9 {. action = SwitchScreen(Screen=9, !SameServer);. };. interpret XF86_Switch_V

C:\Program Files (x86)\Xming\xkb\compat\is-P54AM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	5.068467994229273
Encrypted:	false
SSDEEP:	24:MFEhSNI2xG6bBbO5Wn0Ed5HQnmrO2uakWcueCgA7:FaI0G6bJO5Wn75wnmrwakWjGA7
MD5:	4B4CD14DB2F8DF42B3808004E1657A34
SHA1:	0436BB3E96D0D6DADB4CF5D90C68DC87D90B31F8
SHA-256:	EEF4A88A47262664E9B51872D6682780A028140505D7359F06F177D34F96F120
SHA-512:	05621F666EC9C63EBDD3EE9DE9FF9F56126CD3E2F25EBFA34E1BEA4C0CEE37FF7D42070B5B1988C104B22CC2882DE8BF8FA0A102416178F6D3542661D04017B6
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...// $XFree86: xc/programs/xkbcomp/compat/basic,v 1.2 2000/11/06 19:24:10 dawes Exp $..default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };.. interpret Any+Lock {..action= LockMods(modifiers=Lock);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=+1);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2

C:\Program Files (x86)\Xming\xkb\compat\is-QKD46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.100872908222551
Encrypted:	false
SSDEEP:	24:GRXAXA5+BGYQbf5Wn0EdSsC+iDPRF9RZRH3RJR+tFiR+kXdB5Z2M+oRA0:6XAXldaf5Wn7SjrLAtFpkhA0
MD5:	A1949E3F1C98BF6AA3D7C31EE0BF0084
SHA1:	2E00745E1319F49E696BA5193113A1D92DA3C3F9
SHA-256:	187D6BF617B710B619600E94FD479ED2C0718C3173E06A58430C48E407785071
SHA-512:	4C75860F4B7A0C251A6C714617E393168E5C1F3ECF0D0B63B14F11CC7F899EDD0B262644F0F9A35BBB803F3D93958400CD31E4F889D93A9405336ABC4C30C950
Malicious:	false
Preview:	// $Xorg: iso9995,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..// $XFree86: xc/programs/xkbcomp/compat/iso9995,v 1.3 2003/02/21 03:16:34 dawes Exp $..default partial xkb_compatibility "default" {. virtual_modifiers LevelThree,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Lock+Any {..action= ISOLock(affect= all,modifiers=modMapMods);. };.. interpret ISO_Level2_Latch+Shift {..useModMapMods= level1;..action= LatchMods(modifiers=Shift);. };.. interpret ISO_Level3_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Shift {..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LatchMods(modifiers=LevelThree);

C:\Program Files (x86)\Xming\xkb\compat\is-RT6UU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	5.0572246282466375
Encrypted:	false
SSDEEP:	24:PeTBGFEhfG6bBbO5Wn0Ed5HuFq5rauakWKXjMV/XO:PeTJfG6bJO5Wn75OFq5r1akWKXjM/XO
MD5:	F627356CD7AA8A70719D6F0E7A496191
SHA1:	258E92972F2C8C6F2E7CC8DF22E53BAAFB9633EB
SHA-256:	A38588C0A9719F8B49B3ED7F4DBFA1B32596722D98B309271201B843907AA1FC
SHA-512:	3CAE23DD78FE051BCEA500DF5AAEBE48FB9592C3330ADCA8698B896DA145BF07D283077FA8A5D303A641AB0C5906531046390CB39672A9D6823A6C24570189F8
Malicious:	false
Preview:	// $Xorg: pc98,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/compat/pc98,v 3.1 1997/10/26 13:25:33 dawes Exp $..// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };..// interpret Any+Lock {.//.action= LockMods(modifiers=Lock);.// }; .. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=2,clearLocks);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);.

C:\Program Files (x86)\Xming\xkb\compat\is-S0JNE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.945900900046251
Encrypted:	false
SSDEEP:	6:jLDUhW3CpTo/cJChuQWn+RrfwZALGGy47OIwzv:jLAA3ChoFhuQWn+BfsmGGwP
MD5:	36C74B22E483F61E36007A234F2D55A1
SHA1:	84D137BFAAA0D9699AFA9425400325CC4D38D3C4
SHA-256:	2CB916CDA769679FA622E178F4B36F0C9B11B79348580E9012B97A58F751AAA4
SHA-512:	719993449CC31D87D6A63DA4940071758BD9B9B3E7EBB3B1A2F9B47476BD558310B42FECFD00FD5C95F63F8B6C481CCFD11500822CE68DF74FCCB3762DC1702F
Malicious:	false
Preview:	// $Xorg: norepeat,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Put any otherwise normal keys that you don't want to repeat in.// this file..default partial xkb_compatibility "norepeat" {. interpret Return {..action= NoAction();..repeat= False;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\is-TQ2DM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.8490526335312
Encrypted:	false
SSDEEP:	24:MQ5+BOllSx1FTSAv3J8+cDG0GkuAq9ALizuhE7m8:KObSx11SAv3J8+cDGt7h9oizKE68
MD5:	42B36540C33130E489DAC8EB8036C421
SHA1:	1D77985159F11EA80801980A6C733E2404E29FC0
SHA-256:	B2F58DDE4DD6D66F509417B4CCA64810D8269DF9DFBAF61AD0EDB5DBA66FB8CF
SHA-512:	70C2C65C757D43B9301EAE62CA259BF96F8000D304D0AF7B145BB1D729DF081E03FC04935E6384622DA4D11A7C6BC48618277779F66222228E5F0E7888D7BF82
Malicious:	false
Preview:	// $Xorg: accessx,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..default partial xkb_compatibility "basic" {. interpret AccessX_Enable { ..action= LockControls(controls=AccessXKeys); . };.};..partial xkb_compatibility "full" {.. interpret AccessX_Enable {..action= LockControls(controls=AccessXKeys); . };.. interpret AccessX_Feedback_Enable { ..action= LockControls(controls=AccessXFeedback); . };.. interpret RepeatKeys_Enable {..action= LockControls(controls=RepeatKeys);. };.. interpret SlowKeys_Enable {..action= LockControls(controls=SlowKeys);. };.. interpret BounceKeys_Enable {..action= LockControls(controls=BounceKeys);. };.. interpret StickyKeys_Enable {..action= LockControls(controls=StickyKeys);. };.. interpret MouseKeys_Enable {..action= LockControls(controls=MouseKeys);. };.. interpret MouseKeys_Accel_Enable {..action= LockControls(controls=MouseKeysAccel);. };.. interpret Overlay1_Enable {..action= LockControls(controls=Overlay

C:\Program Files (x86)\Xming\xkb\compat\is-TVBMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.136575580934825
Encrypted:	false
SSDEEP:	24:Yal2RkRXAXA5+BGYQbHWn0EdYRmmwwRx6V5wRxlH3C:CRwXAXldaHWn7Ypr6krlS
MD5:	6F1B69F09355871BC77587AAC5F686F9
SHA1:	97CDD4316B809CB726596EF406EADE5F3C6B67F7
SHA-256:	D550C3CF1E34546DBDDC290F7100585686C9373D45C28A0DED786A7AC482ACFE
SHA-512:	5E571BC03EA427CE31C2A061DBB3B810D871ECFD0F8D5B00B0498C4795604F59976F6B35C7D01D65FAEAAEE805062306820216E717DDF676213D57987C04AC1D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/level5,v 1.5 2006-06-13 21:16:52 svu Exp $.// $Xorg: level5,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..// $XFree86: xc/programs/xkbcomp/compat/iso9995,v 1.3 2003/02/21 03:16:34 dawes Exp $..default partial xkb_compatibility "default" {. virtual_modifiers LevelFive;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. //ISO_Level5_Shift. interpret 0xfe11+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= SetMods(modifiers=LevelFive);. };.. interpret 0xfe11 {..action= SetMods(modifiers=LevelFive);. };.. //ISO_Level5_Latch. interpret 0xfe12+Any {..virtualModifier= LevelFive;..action= LatchMods(modifiers=LevelFive);. };.. interpret 0xfe12 {..action= LatchMods(modifiers=LevelFive);. };.. //ISO_Level5_Lock. interpret 0xfe1

C:\Program Files (x86)\Xming\xkb\compat\is-TVRU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.916025749616957
Encrypted:	false
SSDEEP:	24:KnHfSMcZ4+B9c6mOQhBXOpOQOe4xxS4OR9V5SW:KXcp9ZmLX6drgS4ObCW
MD5:	0A8AE12FB59B93EBD72A540A4AF6768D
SHA1:	8E6D498ADAC19F834787400E605B6B3BEC15213D
SHA-256:	002A5561BF01B0C32C876092C2C1E878B8EE28AB51327D606413FA7731F7B0FB
SHA-512:	12B457DFFD155DCDE963A2363CB0E6C957EC3604A6AEDF71EE9E9F7DF020FCD278D2DFEB2984DB638E6239D27E3481369B24217838025D1568FD3A653746AF62
Malicious:	false
Preview:	// $Xorg: japan,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Japanese keyboards need Eisu and Kana shift and .// lock keys, which are typically bound to the.// second shift level for some other modifier key..// These interpretations disable the default.// interpretation (which would have these keys set.// the same modifier as the level one symbol)...default partial xkb_compatibility "japan" {.. interpret.repeat= False;.. interpret Eisu_Shift+Lock {..action= NoAction();. };.. interpret Eisu_toggle+Lock {..action= NoAction();. };.. interpret Kana_Shift+Lock {..action= NoAction();. };.. interpret Kana_Lock+Lock {..action= NoAction();. };.};..// Some Japanese keyboards have an explict Kana Lock key & matching LED..partial xkb_compatibility "kana_lock" {.. virtual_modifiers Kana_Lock;.. interpret Kana_Lock+AnyOfOrNone(all) {. virtualModifier= Kana_Lock;. useModMapMods=level1;. action= LockGroup(group=+1);. };.. indicator "Kana" {.

C:\Program Files (x86)\Xming\xkb\compat\is-V0N8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.848046718604472
Encrypted:	false
SSDEEP:	24:ZPG6UeM+C6+XMzBQUWjFLBMQDBbO5Wn0EdEAKHwrkuakWKXjMUKXO:ZG6LC6RPWjFLBM4JO5Wn7nKQrHakWKXv
MD5:	2A686B8AFFA181AD08024812653F892D
SHA1:	0BB63AAE705E07CAF3C288433E20ABE5DFB8D25F
SHA-256:	A04E47806EC4A2993A6D1F0538070E38CB5AD1AA269616460626F30B58BDF8E1
SHA-512:	E92A535878412C1A64F49F09AB9DF784950C8AC4F3B9DE5EA1B9054C58707E1A68DBCA5701339EEAB5CD2E3DE3E9B5C6AC61A8309152A9B21E833F686EC61137
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "xtest" {.. // Minimal set of symbol interpretations to provide. // reasonable behavior for testing. The X Test . // Suite assumes that it can set any modifier by . // simulating a KeyPress and clear it by simulating . // a KeyRelease. Because of the way that XKB . // implements locking/latching modifiers, this . // approach fails in some cases (typically the . // lock or num lock modifiers). These symbol. // interpretations make all modifier keys just. // set the corresponding modifier so that xtest. // will see the behavior it expects... virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= False;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= SetMods(modifiers=Shift);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= SetMods(modifiers=N

C:\Program Files (x86)\Xming\xkb\compat\iso9995 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.100872908222551
Encrypted:	false
SSDEEP:	24:GRXAXA5+BGYQbf5Wn0EdSsC+iDPRF9RZRH3RJR+tFiR+kXdB5Z2M+oRA0:6XAXldaf5Wn7SjrLAtFpkhA0
MD5:	A1949E3F1C98BF6AA3D7C31EE0BF0084
SHA1:	2E00745E1319F49E696BA5193113A1D92DA3C3F9
SHA-256:	187D6BF617B710B619600E94FD479ED2C0718C3173E06A58430C48E407785071
SHA-512:	4C75860F4B7A0C251A6C714617E393168E5C1F3ECF0D0B63B14F11CC7F899EDD0B262644F0F9A35BBB803F3D93958400CD31E4F889D93A9405336ABC4C30C950
Malicious:	false
Preview:	// $Xorg: iso9995,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..// $XFree86: xc/programs/xkbcomp/compat/iso9995,v 1.3 2003/02/21 03:16:34 dawes Exp $..default partial xkb_compatibility "default" {. virtual_modifiers LevelThree,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Lock+Any {..action= ISOLock(affect= all,modifiers=modMapMods);. };.. interpret ISO_Level2_Latch+Shift {..useModMapMods= level1;..action= LatchMods(modifiers=Shift);. };.. interpret ISO_Level3_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Shift {..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LatchMods(modifiers=LevelThree);

C:\Program Files (x86)\Xming\xkb\compat\japan (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.916025749616957
Encrypted:	false
SSDEEP:	24:KnHfSMcZ4+B9c6mOQhBXOpOQOe4xxS4OR9V5SW:KXcp9ZmLX6drgS4ObCW
MD5:	0A8AE12FB59B93EBD72A540A4AF6768D
SHA1:	8E6D498ADAC19F834787400E605B6B3BEC15213D
SHA-256:	002A5561BF01B0C32C876092C2C1E878B8EE28AB51327D606413FA7731F7B0FB
SHA-512:	12B457DFFD155DCDE963A2363CB0E6C957EC3604A6AEDF71EE9E9F7DF020FCD278D2DFEB2984DB638E6239D27E3481369B24217838025D1568FD3A653746AF62
Malicious:	false
Preview:	// $Xorg: japan,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Japanese keyboards need Eisu and Kana shift and .// lock keys, which are typically bound to the.// second shift level for some other modifier key..// These interpretations disable the default.// interpretation (which would have these keys set.// the same modifier as the level one symbol)...default partial xkb_compatibility "japan" {.. interpret.repeat= False;.. interpret Eisu_Shift+Lock {..action= NoAction();. };.. interpret Eisu_toggle+Lock {..action= NoAction();. };.. interpret Kana_Shift+Lock {..action= NoAction();. };.. interpret Kana_Lock+Lock {..action= NoAction();. };.};..// Some Japanese keyboards have an explict Kana Lock key & matching LED..partial xkb_compatibility "kana_lock" {.. virtual_modifiers Kana_Lock;.. interpret Kana_Lock+AnyOfOrNone(all) {. virtualModifier= Kana_Lock;. useModMapMods=level1;. action= LockGroup(group=+1);. };.. indicator "Kana" {.

C:\Program Files (x86)\Xming\xkb\compat\keypad (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.929769222813912
Encrypted:	false
SSDEEP:	24:YnB3PovpYBbO5Wn0EdxaZXrBjXsDj0TerXrKQBbO5Wn0EdxaZPOrBjXsDj0TeYXO:g3GpYJO5Wn7xaZXrBjXsDjgyXrRJO5Wu
MD5:	6A5C56D44F81A20765419773C40CCCD1
SHA1:	77EABF25F910028543BE242FEB5C0351AAD087B4
SHA-256:	81A834933F1D81F75187F2718BAE5054B911104C41442109B733ED1CD0A7BDDD
SHA-512:	0C9A030565A5606F87A3CE76951E31C6EB941FAF8E2E67148A00F3DE1EFC7A3CBC2B46896BFD30A9CAA46BECC69AF968428E4FDF51FF63DA00A18861FE482452
Malicious:	false
Preview:	// $Xorg: keypad,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations needed to implement the numeric keypad.// as an overlay instead of a modifier...partial hidden xkb_compatibility "overlay" {. include "keypad(overlay1)".};.partial hidden xkb_compatibility "overlay1" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Num_Lock {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };.. indicator.allowExplicit= True;. indicator.driveskbd= True;. replace indicator "Num Lock" {..whichModState= Locked;..modifiers= NumLock;..controls= Overlay1;. };. indicator.allowExplicit= True;.};.partial hidden xkb_compatibility "overlay2" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= Tru

C:\Program Files (x86)\Xming\xkb\compat\ledcaps (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.561809515469401
Encrypted:	false
SSDEEP:	6:jQsTlpqFWb5+wn+RrwQvzMAALVMb/zkrEsANQvzMiakHFtzkr6CQvzMWMfIzv:jQVWbzn+BNbMFPBbMvkls6rbMw
MD5:	B7EF413066C430D6409D3F347E3433DD
SHA1:	91CDCCA14EEA2F8887C0CD8187FCBCE3844E146F
SHA-256:	393FDE9BD47ECAD0595A56FDB8339F57613783A142DB77CA7159B0D9CCF31543
SHA-512:	0A07ECDFDB97DEE6445C4645A447B775B23FB71EBF9BC8BC21AE1902C1F81322CE12CA64415DAA39CECF179F85DDEB5D9BE10F3401A76532D3B455A27FA04483
Malicious:	false
Preview:	// Use Caps Lock LED to show either Caps Lock, Group, or Shift Lock state..default partial xkb_compatibility "caps_lock" {. indicator "Caps Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= Lock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Caps Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Caps Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\lednum (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.572895731334902
Encrypted:	false
SSDEEP:	6:jDIosTlpqrH2Wb5+wn+RrRTtQM2AALVMlP/zkrEsANQM2iakHFtzkr6CQM2WMfID:jDIoj2Wbzn+B5mM2FW2BM2vkls6rM2w
MD5:	1F09E95CBAADB5A49D7F18DEC7071419
SHA1:	165DCE67E90BE16766E8620738ED7AE05D5006CC
SHA-256:	0687FECC3AFA78DA3089FB6C4538EFFAD64F0AC29CC8828C1BED60B2A7E59A41
SHA-512:	F7F1494636217B0099D948EC8D3DB7CFF85B4DC866B0997A418DC42C5C595819095A683DE9808BA2879ABDA0AC5CE14DFA36DED95AF23EA96C5E67A0BBF97473
Malicious:	false
Preview:	// Use Num Lock LED to show either Num Lock, Group, or Shift Lock state..default partial xkb_compatibility "num_lock" {. indicator "Num Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= NumLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Num Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Num Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\ledscroll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.509291799318713
Encrypted:	false
SSDEEP:	6:j5Tlpq4b5+wn+RrjYQ/A65LVMYv/zkrEsANQ/A6RakHFtzkr6CQ/A6LMfIzv:j/bzn+Bh4KvuB4Pkls6r4Q
MD5:	A155109EA7C9CD0466E79F1CADD3A18F
SHA1:	41772C2C5BC7039ECDCBF2279D6F0879BAC1D562
SHA-256:	0AA3FE2C1158D60AD8F2FDAD5C3F369C3112B8184B4FEC7E84117AF62E3AA57D
SHA-512:	60F986F2D6B3AE6D80E5584B404535A011C9167BD1668A415CEDAC827EFD601D3A5011507EEB3A6C752010F3F0EFA1223549BFB6034F6502F2F12B4851C40587
Malicious:	false
Preview:	// Use Scroll Lock LED to show either Scroll Lock, Group, or Shift Lock state..default partial xkb_compatibility "scroll_lock" {. indicator "Scroll Lock" {. allowExplicit;. whichModState= Locked;. modifiers= ScrollLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Scroll Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Scroll Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\level5 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	5.136575580934825
Encrypted:	false
SSDEEP:	24:Yal2RkRXAXA5+BGYQbHWn0EdYRmmwwRx6V5wRxlH3C:CRwXAXldaHWn7Ypr6krlS
MD5:	6F1B69F09355871BC77587AAC5F686F9
SHA1:	97CDD4316B809CB726596EF406EADE5F3C6B67F7
SHA-256:	D550C3CF1E34546DBDDC290F7100585686C9373D45C28A0DED786A7AC482ACFE
SHA-512:	5E571BC03EA427CE31C2A061DBB3B810D871ECFD0F8D5B00B0498C4795604F59976F6B35C7D01D65FAEAAEE805062306820216E717DDF676213D57987C04AC1D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/compat/level5,v 1.5 2006-06-13 21:16:52 svu Exp $.// $Xorg: level5,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..// $XFree86: xc/programs/xkbcomp/compat/iso9995,v 1.3 2003/02/21 03:16:34 dawes Exp $..default partial xkb_compatibility "default" {. virtual_modifiers LevelFive;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. //ISO_Level5_Shift. interpret 0xfe11+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= SetMods(modifiers=LevelFive);. };.. interpret 0xfe11 {..action= SetMods(modifiers=LevelFive);. };.. //ISO_Level5_Latch. interpret 0xfe12+Any {..virtualModifier= LevelFive;..action= LatchMods(modifiers=LevelFive);. };.. interpret 0xfe12 {..action= LatchMods(modifiers=LevelFive);. };.. //ISO_Level5_Lock. interpret 0xfe1

C:\Program Files (x86)\Xming\xkb\compat\misc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2571
Entropy (8bit):	4.836141015325103
Encrypted:	false
SSDEEP:	48:SIct14K+KOV+zqAGRG1+GT+1+kyLsLtsw+cVe0:6tWKrOV+Qo1D+1MQLywQ0
MD5:	1EFC3737ADF770ED337B2A4B50309F9D
SHA1:	F7588270E8380F8EEAE56A7C4399D0F1633B5275
SHA-256:	E445C8E9AC3C14082CDFC8F48C46E0451DEA9BB98289AD53C172E00B1ED34176
SHA-512:	9035B205A26D9B3E39A04CEEEDDA647E38D8C901837051008811D0EE3D50FEBB294FE94E1CBB37C03359AA50A2EB212FFF61A27D3077CB7F17ABD44634B5C8D4
Malicious:	false
Preview:	// $XdotOrg: xc/programs/xkbcomp/compat/misc,v 1.1.4.4 2004/03/05 13:41:28 eich Exp $.// $Xorg: misc,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.//.//.//.// $XFree86: xc/programs/xkbcomp/compat/misc,v 1.4 2003/05/15 13:31:57 pascal Exp $..default partial xkb_compatibility "misc" {.. virtual_modifiers.Alt,Meta,Super,Hyper,ScrollLock;.. // Interpretations for some other useful keys.. interpret Terminate_Server {. action = Terminate();. };.. setMods.clearLocks= True;.. // Sets the "Alt" virtual modifier.. interpret Alt_L+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_L.{..action = SetMods(modifiers=Alt);. };.. interpret Alt_R+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R.{..action = SetMods(modifiers=Alt);. };.. // Sets the "Meta" virtual modifier.. interpret Meta_L+Any {.//

C:\Program Files (x86)\Xming\xkb\compat\mousekeys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.805283814735198
Encrypted:	false
SSDEEP:	96:PG5SP6tEtx/cgUr2POXvV0U5O8fK+zqqV0a+XFuwzkeMk/FaLmBkOG01lIB0j0BP:OvMx/cgUrV1KoqG0a+XFLPFd+mFPPjj2
MD5:	AD49534517F1762DFDDA32DD3959CA06
SHA1:	C2D4327ACF4D3DE96571AB4664EAAFDA596B055A
SHA-256:	07F49010B6E44D5FD7647E5B499243EA797778AAEF29F671A2442C200F90DEBD
SHA-512:	2526C9E1713907338611EB37C98628D1A3E59886C0E6AD794B4EA7A559284E454DF2E29EDB0E0E40AD530FE20209EBEE6762BE356696822510F601E95C80D436
Malicious:	false
Preview:	.// $Xorg: mousekeys,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations for arrow keys and a bunch of other .// common keysyms which make it possible to bind "mouse" .// keys using xmodmap and activate or deactivate them .// from the keyboard...default partial xkb_compatibility "mousekeys" {.. // Keypad actions.. //. interpret.repeat= True;.. interpret KP_1 { ..action = MovePtr(x=-1,y= +1); . };. interpret KP_End { ..action = MovePtr(x=-1,y= +1); . };.. interpret KP_2 { ..action = MovePtr(x=+0,y= +1); . };. interpret KP_Down { ..action = MovePtr(x=+0,y= +1); . };.. interpret KP_3 { ..action = MovePtr(x=+1,y=+1); . };. interpret KP_Next { . .action = MovePtr(x=+1,y=+1); . };.. interpret KP_4 { ..action = MovePtr(x=-1,y=+0); . };. interpret KP_Left { ..action = MovePtr(x=-1,y=+0); . };.. interpret KP_6 { ..action = MovePtr(x=+1,y=+0); . };. interpret KP_Right { . .action = MovePtr(x=+1,y=+0); . };.. interpret

C:\Program Files (x86)\Xming\xkb\compat\norepeat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.945900900046251
Encrypted:	false
SSDEEP:	6:jLDUhW3CpTo/cJChuQWn+RrfwZALGGy47OIwzv:jLAA3ChoFhuQWn+BfsmGGwP
MD5:	36C74B22E483F61E36007A234F2D55A1
SHA1:	84D137BFAAA0D9699AFA9425400325CC4D38D3C4
SHA-256:	2CB916CDA769679FA622E178F4B36F0C9B11B79348580E9012B97A58F751AAA4
SHA-512:	719993449CC31D87D6A63DA4940071758BD9B9B3E7EBB3B1A2F9B47476BD558310B42FECFD00FD5C95F63F8B6C481CCFD11500822CE68DF74FCCB3762DC1702F
Malicious:	false
Preview:	// $Xorg: norepeat,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Put any otherwise normal keys that you don't want to repeat in.// this file..default partial xkb_compatibility "norepeat" {. interpret Return {..action= NoAction();..repeat= False;. };.};.

C:\Program Files (x86)\Xming\xkb\compat\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.99380964580968
Encrypted:	false
SSDEEP:	12:jLKCU5+B6rSekfnXNBD/tKHzwFmeYoHzwF9:C+B6rSD35yzGzg
MD5:	27D8C3E67830FC5DB376C1959706C8DB
SHA1:	ADB107E229AF2FEC15D747A5A0753E73BF564889
SHA-256:	8FF8BEBB79C91AE5F5872F256AB7CDD54D7B76BEEC065A731DA7998FA423D181
SHA-512:	A1305C03D214BD0D7FB609278B9599775D6E957AD25B64C081D8F42C813701B22C5525E5A7D562BBB737706B9CA82E462833D1041D19CB51EECE2BD7F4A7FF7B
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default partial xkb_compatibility "pc" {.. // Sets the "Alt" virtual modifier.. virtual_modifiers.Alt;.. setMods.clearLocks= True;. interpret Alt_L+Any { ..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R+Any.{..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.};.

C:\Program Files (x86)\Xming\xkb\compat\pc98 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	5.0572246282466375
Encrypted:	false
SSDEEP:	24:PeTBGFEhfG6bBbO5Wn0Ed5HuFq5rauakWKXjMV/XO:PeTJfG6bJO5Wn75OFq5r1akWKXjM/XO
MD5:	F627356CD7AA8A70719D6F0E7A496191
SHA1:	258E92972F2C8C6F2E7CC8DF22E53BAAFB9633EB
SHA-256:	A38588C0A9719F8B49B3ED7F4DBFA1B32596722D98B309271201B843907AA1FC
SHA-512:	3CAE23DD78FE051BCEA500DF5AAEBE48FB9592C3330ADCA8698B896DA145BF07D283077FA8A5D303A641AB0C5906531046390CB39672A9D6823A6C24570189F8
Malicious:	false
Preview:	// $Xorg: pc98,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/compat/pc98,v 3.1 1997/10/26 13:25:33 dawes Exp $..// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };..// interpret Any+Lock {.//.action= LockMods(modifiers=Lock);.// }; .. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=2,clearLocks);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);.

C:\Program Files (x86)\Xming\xkb\compat\xfree86 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1626
Entropy (8bit):	4.618148151698682
Encrypted:	false
SSDEEP:	48:XdlkEpOpkpm9pspmpcp6pkp4pIpy1hYA53:/kqwKmDC4SkKWGSYA53
MD5:	0B5E75E2344FF705F44557BCC0BE72EB
SHA1:	276194338F7E2AB9BCA47A31EC1735B265925CB5
SHA-256:	765E20E54268CD15131373335571C8C93126D9AB56C3A95539019FAF3C9AF17D
SHA-512:	9F5CD17470A840461EC76BF05D87D27678C39C1F5F3973CB8870F7C00CC6FBDA6E1D2EA73B8B17C59DA455643D2AB9BAD31039446F98163906105B6240D2916F
Malicious:	false
Preview:	// $XFree86$.// XFree86 special keysyms..default partial xkb_compatibility "basic" {.. interpret.repeat= True;.. interpret XF86_Switch_VT_1 {. action = SwitchScreen(Screen=1, !SameServer);. };. interpret XF86_Switch_VT_2 {. action = SwitchScreen(Screen=2, !SameServer);. };. interpret XF86_Switch_VT_3 {. action = SwitchScreen(Screen=3, !SameServer);. };. interpret XF86_Switch_VT_4 {. action = SwitchScreen(Screen=4, !SameServer);. };. interpret XF86_Switch_VT_5 {. action = SwitchScreen(Screen=5, !SameServer);. };. interpret XF86_Switch_VT_6 {. action = SwitchScreen(Screen=6, !SameServer);. };. interpret XF86_Switch_VT_7 {. action = SwitchScreen(Screen=7, !SameServer);. };. interpret XF86_Switch_VT_8 {. action = SwitchScreen(Screen=8, !SameServer);. };. interpret XF86_Switch_VT_9 {. action = SwitchScreen(Screen=9, !SameServer);. };. interpret XF86_Switch_V

C:\Program Files (x86)\Xming\xkb\compat\xtest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.848046718604472
Encrypted:	false
SSDEEP:	24:ZPG6UeM+C6+XMzBQUWjFLBMQDBbO5Wn0EdEAKHwrkuakWKXjMUKXO:ZG6LC6RPWjFLBM4JO5Wn7nKQrHakWKXv
MD5:	2A686B8AFFA181AD08024812653F892D
SHA1:	0BB63AAE705E07CAF3C288433E20ABE5DFB8D25F
SHA-256:	A04E47806EC4A2993A6D1F0538070E38CB5AD1AA269616460626F30B58BDF8E1
SHA-512:	E92A535878412C1A64F49F09AB9DF784950C8AC4F3B9DE5EA1B9054C58707E1A68DBCA5701339EEAB5CD2E3DE3E9B5C6AC61A8309152A9B21E833F686EC61137
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "xtest" {.. // Minimal set of symbol interpretations to provide. // reasonable behavior for testing. The X Test . // Suite assumes that it can set any modifier by . // simulating a KeyPress and clear it by simulating . // a KeyRelease. Because of the way that XKB . // implements locking/latching modifiers, this . // approach fails in some cases (typically the . // lock or num lock modifiers). These symbol. // interpretations make all modifier keys just. // set the corresponding modifier so that xtest. // will see the behavior it expects... virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= False;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= SetMods(modifiers=Shift);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= SetMods(modifiers=N

C:\Program Files (x86)\Xming\xkb\geometry.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3028
Entropy (8bit):	3.581094534025991
Encrypted:	false
SSDEEP:	48:8SR+xn094Xzj2PJqrjojD+Kd3YsTDWvCISDqY7mllcErLAFzRnMDuCfhDC42H3lx:8SZsiErLAFzRnMtfi9
MD5:	7464977B7E7999F249B2E9793D972106
SHA1:	230666E7929C1B595A615182F69920EC0D60EC7A
SHA-256:	A2065C2E289B8783D25DB6A6E34807EEBACA017DF799D6A603E3FAF3CA8A4B34
SHA-512:	BC1D5E784A787A5CA3FE6DA3960F904C7DE94B659449C4B783365B68BE23BA7325A81E3F5E2DEC5CAA47693F975018892BA448539B43A1C4188077F5EB95E3B5
Malicious:	false
Preview:	-d------ -------- hp(pc101).-------- -------- hp(hil).-------- -------- hp(omnibook).-------- -------- hp(omnibook_intl).-d------ -------- pc(pc101).-------- -------- pc(pc102).-------- -------- pc(pc104).-------- -------- pc(pc105).-------- -------- pc(jp106).-------- -------- pc(abnt2).-------- -------- pc(pc86).-------- -------- pc(kr106).-------- -------- pc(latitude).-d------ -------- nec(pc98).-------- -------- sun(type4).-------- -------- sun(type4tuv).-------- -------- sun(type4_ca).-------- -------- sun(type4jp).-------- -------- sun(t5).-------- -------- sun(t5tuv).-------- -------- sun(t5jp).-------- -------- sun(t5unix).-------- -------- sun(t5hobo).-------- -------- sun(t5tuvhobo).-------- -------- sun(t5jphobo).-------- -------- sun(type5_se).-------- -------- sun(type5c_se).-------- -------- sun(type4_se).-------- -------- sun(t6).-------- -------- sun(t6tuv).-------- -------- sun(t6jp).-------- -------- sun(t6unix).-------- -------- sun(type5).-------- -------- sun(type

C:\Program Files (x86)\Xming\xkb\geometry\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.188471924661877
Encrypted:	false
SSDEEP:	12:CoILAy4mC1g0AIAzo/+xetbUQuTYNrFxIEtonOx:CJzoe0A7/EUQu0RvICB
MD5:	A0373DFF2E35D1D0BBBB7652A6854D62
SHA1:	A6689BCA71C88519B11D68B0823535D9A86149A2
SHA-256:	F0D444A24488CCC5E905FF5FC0E8190A613C3938851CB14641660C466A983297
SHA-512:	F99CA7DC7E4EFF54B7258B5F5E358B5B290B9DDD51E0911DEFDD4E283BA22B62FBECAFAF3C162DAC4F0D8E8A481E816D4E80B879472D776573CAEA541F1C47DA
Malicious:	false
Preview:	The geometry component of a keyboard mapping specifies primarily the geometry of.the keyboard. It contains the geometry symbolic name and the keyboard geometry.description. The geometry component might also contain aliases for some keys or.symbolic names for some indicators and might affect the set of indicators that.are physically present. Key aliases defined in the geometry component of a.keyboard mapping override those defined in the keycodes component..

C:\Program Files (x86)\Xming\xkb\geometry\amiga (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6373
Entropy (8bit):	4.9696571173155855
Encrypted:	false
SSDEEP:	96:5bzFbLrX8L2oqmgLqzKNOvnr9JC3xzfFq9TDzpnXi4zEzhzFbLuX8L2rk2admgLn:xfFAbNkvSy5Mba
MD5:	C5A6D66F878EF91928CC1C390F939527
SHA1:	1D3C6585BF5844DBC31DA1E17FEE6D480DF3CC7F
SHA-256:	EB4031E4E6E104A79D12B17B3697FFCE085EA6A67C136F5A1D3A02D905A73231
SHA-512:	9260BA2EABA2BD25F7D723FCD17B9A1E3237DE065937716DD591466CD9F6DF0D1950D3351EFB976E96ABA376239056725BD26FB01CF12826B0A48405CF297457
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:35 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/geometry/amiga,v 3.2 1997/10/26 13:25:34 dawes Exp $..default xkb_geometry "usa1" {.. description= "Amiga (usa1)";. width= 490;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "FCTS" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "TLDE" { { [ 28,18] }, { [2,1], [ 21,17] } };. shape "TABK" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "CTRL" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "CAPS" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "RTRN" {..approx = { [ 16, 0], [42,37] },..{ [16, 0], [42, 0], [42,37],.. [ 0,37], [ 0,19], [16,19] },..{ [18, 1], [40, 1], [40,36],.. [ 2,36], [ 2,20], [18,20] } };. shape "LFSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 23,18] }, { [2,1], [ 21,1

C:\Program Files (x86)\Xming\xkb\geometry\ataritt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5924
Entropy (8bit):	4.985579575596486
Encrypted:	false
SSDEEP:	96:wzXDEOXC3kmEqEK/kO4M7c9JCXozfFqOdYW3Xi4zEzazxxEOXC30LUENRK/kO4Mz:pz2fFVwd2fX7a
MD5:	3ECEE21B1C1536A5AE08722DD1380F9C
SHA1:	3BBCC536F85926B15DA82A8F2516576AB42E3F8D
SHA-256:	0BD8FFAB33F3190C90876E7C90342A2B5E6A505D2B1CA678F9767395739BF505
SHA-512:	C25617F8F1298534EBF07F5BE01F11B90D197FEE115888C2D5FD437B02C2C9C65E48534A0D1613CCF6FBDABBCE737375E6081746747A80A715263024C7713DD5
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:35 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/geometry/ataritt,v 3.2 1997/10/26 13:25:34 dawes Exp $..default xkb_geometry "us" {.. description= "Atari TT (us)";. width= 480;. height= 173;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "TABK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "RTRN" { approx = { [0,19], [32,37] },... { [ 14, 0], [32, 0], [32,37], [0,37], [0,19], [14,19] },... { [ 16, 1], [30, 1], [30,36], [2,36], [2,20], [16,20] } };. shape "CTRL" { { [ 32,18] }, { [2,1], [ 30,17] } };. shape "LFSH" { { [ 42,18] }, { [2,1], [ 40,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "FCTS" { { [ 28,10] }, { [2,1], [ 26,9] } };. shape "KP0" { { [ 37,18] }, { [2,1], [ 35,17

C:\Program Files (x86)\Xming\xkb\geometry\chicony (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.883609924613904
Encrypted:	false
SSDEEP:	96:M5ChQDi1jBFG/4QS1XQRFaoHZ8wwRXIJuXz5a2oIkpyMFLv6CpazCP7Zn6Fl9:zsaBFvvwe/W+QTBHTn6Fl9
MD5:	BA734A8FA90F2EAC41A307C1D9927E10
SHA1:	6182731DF1B975BDB71E0A13682FC44A47BAF684
SHA-256:	5091A62121C4469B6E49DBFC8C0E0EDE878C0E6AC6B46BDE924E6ED029613CC4
SHA-512:	94652527F7AE84FB96BF3209CADD0E7315FFD48442C2059E9B1784406A2FD682799064601F833B75DEB7C5F1B346337AD0F00687081EC0BC09C4F2371A1FFA98
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --.// $XFree86: xc/programs/xkbcomp/geometry/chicony,v 1.1 2003/05/29 12:41:57 pascal Exp $..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for Chicony KB-9820 keyboard...// 86 keys.default xkb_geometry "us" {. description = "Chicony KB-9820 infra-red keyboard";. width = 350;. height = 180;. //baseColor = "grey60";. labelColor = "white";.. shape "EDGE" { cornerRadius = 25,. { [0, 8], [142.5, 0], [202.5, 0], [347, 8],. [347, 60], [327, 100], [322, 160],. [202.5, 165], [142.5, 165],. [25, 160], [20, 100], [0, 60] } };. shape "KEYS" { cornerRadius = 2, { [271, 109] } };. shape "MOUS" { cornerRadius = 12, { [24, 24] } };. shape "MOUS2" { cornerRadius = 9, { [18, 18] } };. shape "BTNS" { cornerRadius = 5, { [10, 10] } };.. solid "Edges" {. top = 0;. left = 0;. shape = "EDGE";..color = "grey60

C:\Program Files (x86)\Xming\xkb\geometry\dell (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5164
Entropy (8bit):	5.2731184995525515
Encrypted:	false
SSDEEP:	96:yCzUqYQHKQgrTLWlCAS2ktU1Hj44bpAI8Fsa6pZQKc9OCoBz0FvTIzwIm+uIztzN:TYQHHgrTpX+DH0FYTL
MD5:	EF1BC7C973862E2E508B717AA2C65637
SHA1:	2D5514AC007AFA2D394BCB20365C2197AF36034C
SHA-256:	7FADF9776484320C69539D90F4EC728EDD7A4E6A14FDB4F28B0F8206896C51A0
SHA-512:	F2E525E1D89AEBAAFAEEB99B39172795AF35255EDA4DD9CFF3674C34F0EE9EE5370835F574C97DCD8DE69E5AA23E3C8740113A1F1DDFA40CD15881FAFA6EA4B9
Malicious:	false
Preview:	// $Xorg: dell,v 1.4 2001/02/09 02:05:49 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\is-7O6VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10916
Entropy (8bit):	5.060214278624588
Encrypted:	false
SSDEEP:	192:lYQHbYrCasK2GcWXdyB80AUDYfmNBin0AUauYOB00AUTYOmYu:lYEYrCaOGXNR/SG
MD5:	BE20570946ACE2604F2A09D40E164739
SHA1:	6F18357EABEEFB71D7A1CE694155A9F690E9407A
SHA-256:	A4BB0AE6BA0F3A462AB3DF11FB7137772405297E47EF9077CAE0BF809414F53D
SHA-512:	2024B661D79665DDF2AE171EEE0E353C21005D8C6C7F54DAD814074D9454B77791BBD7EABF6E42CF4AFC7D050D92D1E57FBDB76B1844932723216953FD3518BA
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\is-K4CP6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7225
Entropy (8bit):	5.169020874007988
Encrypted:	false
SSDEEP:	192:uYQHbYrCHR0BJmD0AUoYd0Yesg0FI0ZFUasYBF3Ttt:uYEYrCHa3g/6vt
MD5:	5799263CAF4FC2FCE303F3821297D64F
SHA1:	BBE8907503E3C92CEE90EB05DB5C2BE99E46E8CF
SHA-256:	A9A87C63665BBD069DB8E3B45BBABFFAD7D864B01BA29A04838972E2A54CAB9C
SHA-512:	FF81C373CFFB0473B5E5FD0E39CE4451775BEBECB72DD84269026FCC8280F11F5474D94E5D6B9E9FA69D7028AF9820B869C67722DC7231D778BF6E742592BBE4
Malicious:	false
Preview:	// $Xorg: unix,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABI

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\is-KNU9B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20689
Entropy (8bit):	4.9077223133796535
Encrypted:	false
SSDEEP:	192:xYQHbYrCeg42Kx6Ox2c0imUatYdquv5xYbm0HGUa9YIqAO5xYbm0HGUa9YIqAOQ7:xYEYrCewKx6+SEvPYO2PYO2EY1I9eRC
MD5:	78EF97F351DF97483EF4FC873D872ADA
SHA1:	1228C2B93335260180E78A000CDFD2A427BF26AE
SHA-256:	512C7F8F19C723E17B0FF2B5444B7924B14173C49A0E4545434C0DDBCB8A01B5
SHA-512:	87288D9121D55A50B40A5532DC16CD6C2C605D62417BD714D7F9FA24060FAF7E51A284DC0BEAEDCD664D42DFAB3B1F71327D3361F1D24451941F5D4B3ED48677
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\lk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20689
Entropy (8bit):	4.9077223133796535
Encrypted:	false
SSDEEP:	192:xYQHbYrCeg42Kx6Ox2c0imUatYdquv5xYbm0HGUa9YIqAO5xYbm0HGUa9YIqAOQ7:xYEYrCewKx6+SEvPYO2PYO2EY1I9eRC
MD5:	78EF97F351DF97483EF4FC873D872ADA
SHA1:	1228C2B93335260180E78A000CDFD2A427BF26AE
SHA-256:	512C7F8F19C723E17B0FF2B5444B7924B14173C49A0E4545434C0DDBCB8A01B5
SHA-512:	87288D9121D55A50B40A5532DC16CD6C2C605D62417BD714D7F9FA24060FAF7E51A284DC0BEAEDCD664D42DFAB3B1F71327D3361F1D24451941F5D4B3ED48677
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10916
Entropy (8bit):	5.060214278624588
Encrypted:	false
SSDEEP:	192:lYQHbYrCasK2GcWXdyB80AUDYfmNBin0AUauYOB00AUTYOmYu:lYEYrCaOGXNR/SG
MD5:	BE20570946ACE2604F2A09D40E164739
SHA1:	6F18357EABEEFB71D7A1CE694155A9F690E9407A
SHA-256:	A4BB0AE6BA0F3A462AB3DF11FB7137772405297E47EF9077CAE0BF809414F53D
SHA-512:	2024B661D79665DDF2AE171EEE0E353C21005D8C6C7F54DAD814074D9454B77791BBD7EABF6E42CF4AFC7D050D92D1E57FBDB76B1844932723216953FD3518BA
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\geometry\digital_vndr\unix (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7225
Entropy (8bit):	5.169020874007988
Encrypted:	false
SSDEEP:	192:uYQHbYrCHR0BJmD0AUoYd0Yesg0FI0ZFUasYBF3Ttt:uYEYrCHa3g/6vt
MD5:	5799263CAF4FC2FCE303F3821297D64F
SHA1:	BBE8907503E3C92CEE90EB05DB5C2BE99E46E8CF
SHA-256:	A9A87C63665BBD069DB8E3B45BBABFFAD7D864B01BA29A04838972E2A54CAB9C
SHA-512:	FF81C373CFFB0473B5E5FD0E39CE4451775BEBECB72DD84269026FCC8280F11F5474D94E5D6B9E9FA69D7028AF9820B869C67722DC7231D778BF6E742592BBE4
Malicious:	false
Preview:	// $Xorg: unix,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABI

C:\Program Files (x86)\Xming\xkb\geometry\everex (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.10407741253863
Encrypted:	false
SSDEEP:	96:ai68n687i6n76t26r6nD6Bo6h6U6pS6NF61Yqo4n+lTinsLVWue6vinFqyJerB9Y:aivntic7+2mGD/+puSUFUXGAsJWKqFdF
MD5:	CEE860E63B6CA9454177170A945A4AD7
SHA1:	DFFADDF80D3BCD459A29EA8792539218BF6E567A
SHA-256:	883E3181F3424DC0321A9EA83EE40E624E8E5B37D3EBFC76E2E1D65C20F0413C
SHA-512:	35B6FC915FA44F49FD5877CB293E53D1D390795475F5C8E2081BE1973EA3611DC4CBE38E270056DCE985693BBB710CEFC98EC438DB17D0305F3E895391F4BDAA
Malicious:	false
Preview:	// $Xorg: everex,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "STEPnote" {.. description= "Everex STEPnote";. width= 281;. height= 150;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "NARR" {..{ [ 15, 17 ] },..{ [ 2, 1 ], [ 13, 15 ] }. };. shape "FKEY" {..{ [ 15.1, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "ESC" {..{ [ 16.4, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "WIDE" {.// backspace, tab and Fn..{ [ 25, 17 ] },..{ [ 2, 1 ], [ 23, 15 ] }. };. shape "RTRN" {..{ [ 27.5, 17 ] },..{ [ 2, 1 ], [ 25.5, 15 ] }. };. shape "CAPS" {..{ [ 30, 17 ] },..{ [ 2, 1 ], [ 28, 15 ] }. };. shape "LFSH" {..{ [ 38.5, 17 ] },..{ [ 2, 1 ], [ 36.5, 15 ] }. };. shape "RTSH" {..{ [ 21, 17 ] },..{ [ 2, 1 ], [ 19, 15 ] }. };. shape "SPCE" {..{ [ 88.8, 17 ] },..{ [ 2, 1 ], [ 86.8, 15 ] }. };. shape "WELL" { ..{ [ 269, 105 ] }.

C:\Program Files (x86)\Xming\xkb\geometry\fujitsu (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7839
Entropy (8bit):	5.137384649088839
Encrypted:	false
SSDEEP:	192:GYQHHgrTE/zIjXei/4szNjrXBHQIjXei/Esz0jrXY5:GYGgrTEEt/vrxdt/Uro5
MD5:	331D7F579FAA9943E512C0D004B264DA
SHA1:	C1F15103437E6645A374ED3F1B9F59F5F3288BBE
SHA-256:	9A3EDD71D88CE300845A82F21747F75F51B04438CF9DB94B307B5475F6DAFB4C
SHA-512:	4A33E201CE88EC92174309BD0877E2518FB561FA831545744CEFD53FA0DD128D303E902F7311C10A33CCE75881DC531BAED4F16FE5CF0A3E91305B13F6E1EB38
Malicious:	false
Preview:	// $Xorg: fujitsu,v 1.4 2001/02/09 02:05:49 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\geometry\hp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11914
Entropy (8bit):	5.103094638736637
Encrypted:	false
SSDEEP:	192:eYQHHgrTXFH0Fck1R9E/p80FSSg4Ow4V77g8cYRWLJR0Gg:eYGgrTXFHVk1R9E/p8zSgXchgGg
MD5:	D91DB44B779EEE1ACB5A82DBCC1C9CFD
SHA1:	60FED2573C0681E2EE4541D308B3E4570C5DEC2A
SHA-256:	73B54F3D38305BDA0B76C63D0CEA13F517E74643A3C459E748788CF86DFD2295
SHA-512:	92C1DA8247C6ABF92EFCB7BA564F9E669DC70E7313B8F314D630EA971C915DAC3B98EC29ECD2FDDFC570D3E0914E11F7784061C1CAEF691D49B758AC11C3CF4A
Malicious:	false
Preview:	// $Xorg: hp,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\geometry\is-0QIKF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11914
Entropy (8bit):	5.103094638736637
Encrypted:	false
SSDEEP:	192:eYQHHgrTXFH0Fck1R9E/p80FSSg4Ow4V77g8cYRWLJR0Gg:eYGgrTXFHVk1R9E/p8zSgXchgGg
MD5:	D91DB44B779EEE1ACB5A82DBCC1C9CFD
SHA1:	60FED2573C0681E2EE4541D308B3E4570C5DEC2A
SHA-256:	73B54F3D38305BDA0B76C63D0CEA13F517E74643A3C459E748788CF86DFD2295
SHA-512:	92C1DA8247C6ABF92EFCB7BA564F9E669DC70E7313B8F314D630EA971C915DAC3B98EC29ECD2FDDFC570D3E0914E11F7784061C1CAEF691D49B758AC11C3CF4A
Malicious:	false
Preview:	// $Xorg: hp,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\geometry\is-3SOHD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.883609924613904
Encrypted:	false
SSDEEP:	96:M5ChQDi1jBFG/4QS1XQRFaoHZ8wwRXIJuXz5a2oIkpyMFLv6CpazCP7Zn6Fl9:zsaBFvvwe/W+QTBHTn6Fl9
MD5:	BA734A8FA90F2EAC41A307C1D9927E10
SHA1:	6182731DF1B975BDB71E0A13682FC44A47BAF684
SHA-256:	5091A62121C4469B6E49DBFC8C0E0EDE878C0E6AC6B46BDE924E6ED029613CC4
SHA-512:	94652527F7AE84FB96BF3209CADD0E7315FFD48442C2059E9B1784406A2FD682799064601F833B75DEB7C5F1B346337AD0F00687081EC0BC09C4F2371A1FFA98
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --.// $XFree86: xc/programs/xkbcomp/geometry/chicony,v 1.1 2003/05/29 12:41:57 pascal Exp $..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for Chicony KB-9820 keyboard...// 86 keys.default xkb_geometry "us" {. description = "Chicony KB-9820 infra-red keyboard";. width = 350;. height = 180;. //baseColor = "grey60";. labelColor = "white";.. shape "EDGE" { cornerRadius = 25,. { [0, 8], [142.5, 0], [202.5, 0], [347, 8],. [347, 60], [327, 100], [322, 160],. [202.5, 165], [142.5, 165],. [25, 160], [20, 100], [0, 60] } };. shape "KEYS" { cornerRadius = 2, { [271, 109] } };. shape "MOUS" { cornerRadius = 12, { [24, 24] } };. shape "MOUS2" { cornerRadius = 9, { [18, 18] } };. shape "BTNS" { cornerRadius = 5, { [10, 10] } };.. solid "Edges" {. top = 0;. left = 0;. shape = "EDGE";..color = "grey60

C:\Program Files (x86)\Xming\xkb\geometry\is-65R36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6373
Entropy (8bit):	4.9696571173155855
Encrypted:	false
SSDEEP:	96:5bzFbLrX8L2oqmgLqzKNOvnr9JC3xzfFq9TDzpnXi4zEzhzFbLuX8L2rk2admgLn:xfFAbNkvSy5Mba
MD5:	C5A6D66F878EF91928CC1C390F939527
SHA1:	1D3C6585BF5844DBC31DA1E17FEE6D480DF3CC7F
SHA-256:	EB4031E4E6E104A79D12B17B3697FFCE085EA6A67C136F5A1D3A02D905A73231
SHA-512:	9260BA2EABA2BD25F7D723FCD17B9A1E3237DE065937716DD591466CD9F6DF0D1950D3351EFB976E96ABA376239056725BD26FB01CF12826B0A48405CF297457
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:35 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/geometry/amiga,v 3.2 1997/10/26 13:25:34 dawes Exp $..default xkb_geometry "usa1" {.. description= "Amiga (usa1)";. width= 490;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "FCTS" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "TLDE" { { [ 28,18] }, { [2,1], [ 21,17] } };. shape "TABK" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "CTRL" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "CAPS" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "RTRN" {..approx = { [ 16, 0], [42,37] },..{ [16, 0], [42, 0], [42,37],.. [ 0,37], [ 0,19], [16,19] },..{ [18, 1], [40, 1], [40,36],.. [ 2,36], [ 2,20], [18,20] } };. shape "LFSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 23,18] }, { [2,1], [ 21,1

C:\Program Files (x86)\Xming\xkb\geometry\is-98L1V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4290
Entropy (8bit):	5.283195038939677
Encrypted:	false
SSDEEP:	96:NCzUqYQHKQgrTLaeRXkPEUwbFr2WUbSi7H9JCIgzfF/n0g6ztGmfE4zFO:yYQHHgrTyYfFb+XM
MD5:	A99F74B737904431BF63C88DE1E278BA
SHA1:	0B4554ACDE26C85DE8E32552D521806D58B88D90
SHA-256:	7435D5A16D28E606F9309FCE2B0A9A26CA76CB987E89F42FAB6F62BDBF331DDF
SHA-512:	69108635130000D465499DA43FCEF9589C82540840BB027D018A5E150BBCB2A4FB1AE9B69EBD10FFAFEC759774A3E66AE6C81A67CE5DD0EF324644B2A7176242
Malicious:	false
Preview:	// $Xorg: nec,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE.

C:\Program Files (x86)\Xming\xkb\geometry\is-9SVLG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.188471924661877
Encrypted:	false
SSDEEP:	12:CoILAy4mC1g0AIAzo/+xetbUQuTYNrFxIEtonOx:CJzoe0A7/EUQu0RvICB
MD5:	A0373DFF2E35D1D0BBBB7652A6854D62
SHA1:	A6689BCA71C88519B11D68B0823535D9A86149A2
SHA-256:	F0D444A24488CCC5E905FF5FC0E8190A613C3938851CB14641660C466A983297
SHA-512:	F99CA7DC7E4EFF54B7258B5F5E358B5B290B9DDD51E0911DEFDD4E283BA22B62FBECAFAF3C162DAC4F0D8E8A481E816D4E80B879472D776573CAEA541F1C47DA
Malicious:	false
Preview:	The geometry component of a keyboard mapping specifies primarily the geometry of.the keyboard. It contains the geometry symbolic name and the keyboard geometry.description. The geometry component might also contain aliases for some keys or.symbolic names for some indicators and might affect the set of indicators that.are physically present. Key aliases defined in the geometry component of a.keyboard mapping override those defined in the keycodes component..

C:\Program Files (x86)\Xming\xkb\geometry\is-9UG4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	38854
Entropy (8bit):	5.110160887426922
Encrypted:	false
SSDEEP:	768:HgHyq+DH9TpVw4bTXvDHBTJnDHhTA6R5FVRz6Y5wJRD9TUnCsMctDHoTK3WDd:HgH8H9Tc4bTrHBTBHhTA6RLVRz6VJRDX
MD5:	AC25ABD772A48C130A847A213F3C3CEE
SHA1:	C5F213123E41017BB1BC824C8D381FEB908ECDE9
SHA-256:	D09FBC86E76A443F23EAF29FD8A47E8A58F1AA88F5164834AFF5C6002F3A8A9F
SHA-512:	484F894E8CB7FD2C73E2ED2D5A5284B87742AA69BEE9FF39B2A58B6C528BC258A65CBC89C9141C5917B9EA7E2977A7FF0C57D62CDC2BD28EEFD152A284F0F7C1
Malicious:	false
Preview:	// $Xorg: pc,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\geometry\is-CBPIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7361
Entropy (8bit):	5.147217485272048
Encrypted:	false
SSDEEP:	192:4d0wSy5pcXqAvDqSQkHNqRhQIVRLin/1kvIW:zByqiVRfvIW
MD5:	318D1439DF90E6DA0266B34B2A56E736
SHA1:	49A647E5B1CDED614499659C4281E3BB1526C1A7
SHA-256:	D5B55A82DBDAAC9B2BDEA0012C7D318B4949C36803550ACBA0CE352CD97EF756
SHA-512:	B3609DA51EE89D8B8D172CAF5A4C96316D045804AFC5ECC9F976C772019D445CA796B39F65E1BD7FE9A9AF74577064FD00B3E73A22988CE6785135D876A819C9
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --.// $XFree86: xc/programs/xkbcomp/geometry/ibm/thinkpad,v 1.3 2003/08/09 14:30:48 pascal Exp $..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for IBM ThinkPad keyboard..// Compatible Models: THINKPAD 560Z 2640-90U, THINKPAD 560Z 2640-91U,.// THINKPAD 560Z 2640-B0U, THINKPAD 560Z 2640-B1U, THINKPAD 560Z 2640-RR3,.// THINKPAD 600 2645-31U, THINKPAD 600 2645-35U, THINKPAD 600 2645-41U,.// THINKPAD 600 2645-42U, THINKPAD 600 2645-45U, THINKPAD 600 2645-48U,.// THINKPAD 600 2645-51U, THINKPAD 600 2645-85U, THINKPAD 600 2645-A1U,.// THINKPAD 600 2645-RR1, THINKPAD 600 2645-RR2, THINKPAD 600E 2645-3AU,.// THINKPAD 600E 2645-4AU, THINKPAD 600E 2645-4BU, THINKPAD 600E 2645-55U,.// THINKPAD 600E 2645-5AU, THINKPAD 600E 2645-5BU, THINKPAD 600E 2645-5JU,.// THINKPAD 600E 2645-8AO, THINKPAD 600E 2645-8AU, THINKPAD 600E 2645-8BU,.// THINKPAD 600E 2645-AAU, THINKPAD 600E 2645-RRB, THINKPAD 600E 2645-RRD

C:\Program Files (x86)\Xming\xkb\geometry\is-D8CPT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6019
Entropy (8bit):	4.885700130900332
Encrypted:	false
SSDEEP:	96:tVetqt0wkuoWwa8MU1FR1e6S1IS+1rY3blvCcjbZL3jDuotlMQbSg32tqlpAsRji:+G0r7aoxetIwxjFlUCgzk7jstVXZ
MD5:	D1C89C86B612A81C0647AD198F71E26F
SHA1:	F8BD0E69491DFCE621228FBE21279E6CCF088241
SHA-256:	5AFFE09BDE50127F95DA9D430C71FB83ADAE370879264C0F049C9ADF1B5005C9
SHA-512:	BA5C546AD960F1B1A0082AA8F61D7AA6C3704E648D2428C24BED7F35E988625CBC303079531F89FF4F708865E39DFEBDAA7B26A5FD7C6DF4ED55AB8882A6901A
Malicious:	false
Preview:	// $Xorg: microsoft,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "natural" {.. // Approximate layout for a Microsoft Natural Keyboard. description= "Microsoft Natural Keyboard";. width= 550;. height= 190;.. shape.cornerRadius= 1;. shape "LDEF" { { [ 18,18] }, { [2,1], [15,15] } };. shape "TABK" { { [ 26,18] }, { [2,1], [23,15] } }; . shape "CAPS" { { [ 30,18] }, { [2,1], [23,15] } }; . shape "LFSH" { { [ 41,18] }, { [2,1], [38,15] } };. shape "KEY6" { { [ 22,18] }, { [2,1], [15,15] } };. shape "KEYT" { { [ 33,18] }, { [2,1], [15,15] } };. shape "KEYG" { { [ 29,18] }, { [2,1], [15,15] } };. shape "LCTL" { ..approx= { [ 32, 22 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 23 ], [ 0, 22 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 17 ], [ 2, 15 ] } . };. shape "LWIN" { ..approx= { [ 32, 23 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 24 ], [ 0, 23 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 18 ], [ 2, 17 ] } . };. shape "LALT" { ..approx= { [ 32, 24 ] },..{ [

C:\Program Files (x86)\Xming\xkb\geometry\is-FL6KH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4079
Entropy (8bit):	5.081004347358721
Encrypted:	false
SSDEEP:	96:esRDbzEN6G9/h2akz2681qHZvghKc9OCJiz0FNL79/IF+uIztzN:eckN/GVx70F/L
MD5:	EB46FFBC358014CD4AC3F1A96128A820
SHA1:	B4CCFEF5CCB54A95FF686AFCF49719A4EE93342B
SHA-256:	B38E6F8BAB5215D40D58767B987F7A6B4F7570BA23F1057F9755E7C71F8E7770
SHA-512:	6A619263E88C7198CEDEAE6440E2298850CA20201D97E02700BF24753B16A1E3B3CD967D6484EFC50725A54A4F328BA5A0D3ACEA3CAC3F197A3F329FDC2E0199
Malicious:	false
Preview:	// $Xorg: northgate,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.default xkb_geometry "omnikey101" {.. description= "North Gate Omnikey 101";. width= 470;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [18,18] }, { [2,1], [16,17] } };. shape "BKSP" { { [34,18] }, { [2,1], [32,17] } };. shape "TABK" { { [27,18] }, { [2,1], [25,17] } };. shape "RTRN" {..approx = { [15, 0], [40,37] },..{ [15, 0], [40, 0], [40,37],.. [ 0,37], [ 0,19], [15,19] },..{ [17, 1], [38, 1], [38,36],.. [ 2,36], [ 2,20], [17,20] }. };. shape "CAPS" { { [ 32,18] }, { [2,1], [30,17] } };. shape "LFSH" { { [ 41,18] }, { [2,1], [39,17] } };. shape "RTSH" { { [ 30,18] }, { [2,1], [28,17] } };. shape "MODK" { { [ 26,18] }, { [2,1], [24,17] } };. shape "SPCE" { { [129,18] }, { [2,1], [127,17] } };. shape "KP0" { { [ 37,18] }, { [2,1], [35,17] } };. shape "KPAD" { { [ 18,37] }, { [2,1], [16,36] } };.. shape "LEDS" { cornerRadius= 0, { [ 76 ,20 ] } };. shape "LE

C:\Program Files (x86)\Xming\xkb\geometry\is-FQHM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4103
Entropy (8bit):	5.145120661046688
Encrypted:	false
SSDEEP:	96:JLuMro0hxK873EuVeFyLXyD7WIgZNNe6eBEiK5St6Jcmqo6WSFHOuS9HHRKmxfIK:hHo0cqX+8qo6bFHxStncq
MD5:	C9E8CE8050106D92C4F154DA56A08200
SHA1:	7E6767686190901D2FE82917075A8EBA9C5EB297
SHA-256:	D719AAE26B421CE05A2D51F8B9B59C687BAC8A79C098EAD57F1E3C04402430C6
SHA-512:	3B01E23C9BB904043E032F3A6263B91F214BF5460D397688F4CBE2E37281729C8CF533FBC77B2CAD08203398F6520AE3B92F16A3B25017817C3EC5279E2F1323
Malicious:	false
Preview:	// $Xorg: kinesis,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "model100" {.. // This is an approximate layout for a Kinesis Ergonomic keyboard. // Generated completely by eye. I didn't actually measure a real . // keyboard... description= "Kinesis Ergonomic Keyboard";. width= 421;. height= 185;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [16,17] } };. shape "WIDE" { { [ 21,18] }, { [2,1], [19,17] } };. shape "TALL" { { [ 18,37] }, { [2,1], [16,36] } };. shape "FKEY" { cornerRadius=0, { [ 10,13] } };. shape "LED" { cornerRadius= 1.5, { [ 3, 3] } };. shape "LOGO" { { [ 40, 10 ] } };. shape "EDGE" { cornerRadius=5, { [ 421, 185 ] } };.. outline "Edges" {..top= 0;..left= 0;..shape= "EDGE";. };.. section "LeftFunction" {..left= 15;..top= 11;..key.shape= "FKEY";..key.gap= 3;..row {.. left= 1;.. top= 1;.. keys { .. .<ESC>, <FK01>, <FK02>, <FK03>, <FK04>,...<FK05>, <FK06>, <FK07>, <FK08

C:\Program Files (x86)\Xming\xkb\geometry\is-JQ5OR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5924
Entropy (8bit):	4.985579575596486
Encrypted:	false
SSDEEP:	96:wzXDEOXC3kmEqEK/kO4M7c9JCXozfFqOdYW3Xi4zEzazxxEOXC30LUENRK/kO4Mz:pz2fFVwd2fX7a
MD5:	3ECEE21B1C1536A5AE08722DD1380F9C
SHA1:	3BBCC536F85926B15DA82A8F2516576AB42E3F8D
SHA-256:	0BD8FFAB33F3190C90876E7C90342A2B5E6A505D2B1CA678F9767395739BF505
SHA-512:	C25617F8F1298534EBF07F5BE01F11B90D197FEE115888C2D5FD437B02C2C9C65E48534A0D1613CCF6FBDABBCE737375E6081746747A80A715263024C7713DD5
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:35 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/geometry/ataritt,v 3.2 1997/10/26 13:25:34 dawes Exp $..default xkb_geometry "us" {.. description= "Atari TT (us)";. width= 480;. height= 173;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "TABK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "RTRN" { approx = { [0,19], [32,37] },... { [ 14, 0], [32, 0], [32,37], [0,37], [0,19], [14,19] },... { [ 16, 1], [30, 1], [30,36], [2,36], [2,20], [16,20] } };. shape "CTRL" { { [ 32,18] }, { [2,1], [ 30,17] } };. shape "LFSH" { { [ 42,18] }, { [2,1], [ 40,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "FCTS" { { [ 28,10] }, { [2,1], [ 26,9] } };. shape "KP0" { { [ 37,18] }, { [2,1], [ 35,17

C:\Program Files (x86)\Xming\xkb\geometry\is-K3HSC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	84483
Entropy (8bit):	4.924182627199796
Encrypted:	false
SSDEEP:	1536:QgHy5Ylzh7n+l7erl/lLevh/qMkrxV9WJj5G9GIkHhFYokmUloRqIrUhoRqeVYnC:VHy2lHCFpDb4RYuCgQmouCgRzApQdpQ
MD5:	0DE6E800C95FEF5F43ADD539024D4E2D
SHA1:	6A19F0501739BA378148577C2EF81F3D9705C4C6
SHA-256:	A4B09C8F9B21A9B76B439C80B39FA34188FEF4ED4BBBE307B0A897B8DDAF72E5
SHA-512:	FDAB5D2BBF81FD971C9B4A129AC0B3DBEE8AC246CF88290A1B318B8A29770D11D5461A67C81B39433AD487798E9709905A1D03ACBD6B34CDC88DDB6E0A5FF5A0
Malicious:	false
Preview:	// $Xorg: sun,v 1.4 2001/02/09 02:05:51 xorgcvs Exp $.// $XdotOrg: $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS I

C:\Program Files (x86)\Xming\xkb\geometry\is-MLMM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	16372
Entropy (8bit):	4.741874068890294
Encrypted:	false
SSDEEP:	192:VynDLDdbKiJuBzlHczfLfqROE1mRYfQkmFYb:QDn9KiJuBZHwz0mRYlmFYb
MD5:	E4B05D4098984FE46489AF7FF181ACCF
SHA1:	D6E12880B855E34F2FF7DD753C1322EAB8271F53
SHA-256:	9F14C24126D318EEE49B5FB4596D7FD913D486DAB97E0AD316CDACE312373420
SHA-512:	3CB4C9D1477A01BA7C50DF61B0ADED53B4E11FD4D8B693AC80D7C13B584D2181A3D50A6910A21553AE7DFDDD5F3E51A33D63799A730CEAC6FAF0729F9F8E3958
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/geometry/macintosh,v 1.3 2003/08/09 14:30:47 pascal Exp $.//.// Some modifications (<eqdar@castalie.org>) :.// - Added a <LSGT> key.// - Fixed the shape of the <RTRN> key.// - Moved <BKSL> to the 'AC' row.// - Added a special Macintosh sysctl key.// - Minor changes (Function keys shape, LED position...)..// Minor changes.// - Mail address above is no longer valid.// - Changed {L,R}MTA to {L,R}WIN, which are defined.// 2005/10 -- Simon Vallet <svallet@gmail.com>..default xkb_geometry "macintosh" {.. description= "Apple Extended Keyboard II";. width = 475;. height = 194;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "TLDE" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "BKSP" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "TAB" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "RTRN" { . { [0,0],[23,0],[23,37],[4,37],[4,18],[0,18] }, . { [2,1],[21,1],[21,36],[6,36],[6,17],[2,17] }

C:\Program Files (x86)\Xming\xkb\geometry\is-N4RJN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.10407741253863
Encrypted:	false
SSDEEP:	96:ai68n687i6n76t26r6nD6Bo6h6U6pS6NF61Yqo4n+lTinsLVWue6vinFqyJerB9Y:aivntic7+2mGD/+puSUFUXGAsJWKqFdF
MD5:	CEE860E63B6CA9454177170A945A4AD7
SHA1:	DFFADDF80D3BCD459A29EA8792539218BF6E567A
SHA-256:	883E3181F3424DC0321A9EA83EE40E624E8E5B37D3EBFC76E2E1D65C20F0413C
SHA-512:	35B6FC915FA44F49FD5877CB293E53D1D390795475F5C8E2081BE1973EA3611DC4CBE38E270056DCE985693BBB710CEFC98EC438DB17D0305F3E895391F4BDAA
Malicious:	false
Preview:	// $Xorg: everex,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "STEPnote" {.. description= "Everex STEPnote";. width= 281;. height= 150;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "NARR" {..{ [ 15, 17 ] },..{ [ 2, 1 ], [ 13, 15 ] }. };. shape "FKEY" {..{ [ 15.1, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "ESC" {..{ [ 16.4, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "WIDE" {.// backspace, tab and Fn..{ [ 25, 17 ] },..{ [ 2, 1 ], [ 23, 15 ] }. };. shape "RTRN" {..{ [ 27.5, 17 ] },..{ [ 2, 1 ], [ 25.5, 15 ] }. };. shape "CAPS" {..{ [ 30, 17 ] },..{ [ 2, 1 ], [ 28, 15 ] }. };. shape "LFSH" {..{ [ 38.5, 17 ] },..{ [ 2, 1 ], [ 36.5, 15 ] }. };. shape "RTSH" {..{ [ 21, 17 ] },..{ [ 2, 1 ], [ 19, 15 ] }. };. shape "SPCE" {..{ [ 88.8, 17 ] },..{ [ 2, 1 ], [ 86.8, 15 ] }. };. shape "WELL" { ..{ [ 269, 105 ] }.

C:\Program Files (x86)\Xming\xkb\geometry\is-O84NN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6560
Entropy (8bit):	5.286939725072135
Encrypted:	false
SSDEEP:	96:/CzUqYQHKQgrTL3L1v46Ehh9h9BFyIArEmGLQLBihUbKNPZme2qo27WhizGrZc7W:AYQHHgrTbRiz0gekDFd2g2Ve0
MD5:	FD377DBD1D708DD6BAE35C2046E378C7
SHA1:	90C6E3E7DB01BEEC173F3A2B03CF1066C2F6FACD
SHA-256:	151F5FCD555D7E2255D7748371DB5B41ADB6FABE222B949911FE994A9869B9A5
SHA-512:	A14926843C9CD51734ACDC8599925843F59247AA63CF235AD18375022597CA9AF29E78F440756EF52A5EC709AB486AB3DFE13BCBF32683BBF895F1F1BA95920A
Malicious:	false
Preview:	// $Xorg: keytronic,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOF

C:\Program Files (x86)\Xming\xkb\geometry\is-R24UV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	5.027555984385265
Encrypted:	false
SSDEEP:	48:MKMv7i687N6X863h6/bGce616V6X6ogXojlvq0RIvAGnljq2zd+R3PDRvZjSh9PG:3+i687N6X86x6Ve616V6X6ogXoY0S9lg
MD5:	FBCAE0DFD34AA59C950059BE681598F9
SHA1:	D5C81C13BDC1A60731FA13F191AA335D0CC358AC
SHA-256:	3E5FA27C3FF8834FE18FA40100E81368B07A2FAC59E0F71D71E2AE874CBB68EF
SHA-512:	47BD48372DBA962FE49D2884FD173DECEECA0112719DAAFED94864236614439D6B9984806DA11A7B97B06131AE932C7DB925D3BDE93E2BE6E87B58B62A9462BA
Malicious:	false
Preview:	// $Xorg: winbook,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.default xkb_geometry "XP5" {.. description= "WinBook XP5";. width= 281;. height= 180;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "FKEY" {..{ [ 15, 10 ] },..{ [ 1, 0 ], [ 14, 9.5 ] }. };. shape "ONE" {..{ [ 28, 17 ] },..{ [ 11, 0 ], [ 28, 17 ] },..{ [ 13, 1 ], [ 26, 15 ] }. };. shape "WIDE" {.// backspace, caps lock, ctrl alt ?..{ [ 24.5, 17 ] },..{ [ 2, 1 ], [ 22.5, 15 ] }. };. shape "WIDR" { // backslash, left shift..{ [ 35, 17 ] },..{ [ 2, 1 ], [ 33, 15 ] }. };. shape "RTRN" {..{ [ 45, 17 ] },..{ [ 2, 1 ], [ 43, 15 ] }. };. shape "SPCE" {..{ [ 90, 17 ] },..{ [ 2, 1 ], [ 88, 15 ] }. };. shape "STIK" {..cornerRadius= 4,..{ [ 8, 8 ] }. };. shape "BTN" {..{ [ 31, 6 ] }. };.. section.left= 2;. row.left= 1;. key.shape= "NORM";. key.gap= 0.5;.. key.color= "grey10";. labelColor= "white";.

C:\Program Files (x86)\Xming\xkb\geometry\is-SDLAU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5016
Entropy (8bit):	5.244256689363828
Encrypted:	false
SSDEEP:	96:BCzUqYQHKQgrTLrSwRTTnb6ANgCrQezbjw/Q87kk2ZvAn29OCoBzgFuVRzBPQ8ty:eYQHHgrTfSKd2G+YqDgFclI
MD5:	71AEF4B7A3018698A16C242C30524212
SHA1:	26576281DD60D833760F3B578DDE92EC394A1F33
SHA-256:	6C3CC34C758A03FD00727DED729613F61DB31BB04ED612ADFE41EF213E862865
SHA-512:	38D1E122F7EE955648061292B87C056DD2DCE6949187FE35CE8BBC63009DDF9B907EF82DE30EA752A8733DD61D2EDB23C936DFFFA47A9C50171FEDCB1FE16272
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:51 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\geometry\is-TEH9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5164
Entropy (8bit):	5.2731184995525515
Encrypted:	false
SSDEEP:	96:yCzUqYQHKQgrTLWlCAS2ktU1Hj44bpAI8Fsa6pZQKc9OCoBz0FvTIzwIm+uIztzN:TYQHHgrTpX+DH0FYTL
MD5:	EF1BC7C973862E2E508B717AA2C65637
SHA1:	2D5514AC007AFA2D394BCB20365C2197AF36034C
SHA-256:	7FADF9776484320C69539D90F4EC728EDD7A4E6A14FDB4F28B0F8206896C51A0
SHA-512:	F2E525E1D89AEBAAFAEEB99B39172795AF35255EDA4DD9CFF3674C34F0EE9EE5370835F574C97DCD8DE69E5AA23E3C8740113A1F1DDFA40CD15881FAFA6EA4B9
Malicious:	false
Preview:	// $Xorg: dell,v 1.4 2001/02/09 02:05:49 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\geometry\is-U202F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7839
Entropy (8bit):	5.137384649088839
Encrypted:	false
SSDEEP:	192:GYQHHgrTE/zIjXei/4szNjrXBHQIjXei/Esz0jrXY5:GYGgrTEEt/vrxdt/Uro5
MD5:	331D7F579FAA9943E512C0D004B264DA
SHA1:	C1F15103437E6645A374ED3F1B9F59F5F3288BBE
SHA-256:	9A3EDD71D88CE300845A82F21747F75F51B04438CF9DB94B307B5475F6DAFB4C
SHA-512:	4A33E201CE88EC92174309BD0877E2518FB561FA831545744CEFD53FA0DD128D303E902F7311C10A33CCE75881DC531BAED4F16FE5CF0A3E91305B13F6E1EB38
Malicious:	false
Preview:	// $Xorg: fujitsu,v 1.4 2001/02/09 02:05:49 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\geometry\keytronic (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6560
Entropy (8bit):	5.286939725072135
Encrypted:	false
SSDEEP:	96:/CzUqYQHKQgrTL3L1v46Ehh9h9BFyIArEmGLQLBihUbKNPZme2qo27WhizGrZc7W:AYQHHgrTbRiz0gekDFd2g2Ve0
MD5:	FD377DBD1D708DD6BAE35C2046E378C7
SHA1:	90C6E3E7DB01BEEC173F3A2B03CF1066C2F6FACD
SHA-256:	151F5FCD555D7E2255D7748371DB5B41ADB6FABE222B949911FE994A9869B9A5
SHA-512:	A14926843C9CD51734ACDC8599925843F59247AA63CF235AD18375022597CA9AF29E78F440756EF52A5EC709AB486AB3DFE13BCBF32683BBF895F1F1BA95920A
Malicious:	false
Preview:	// $Xorg: keytronic,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOF

C:\Program Files (x86)\Xming\xkb\geometry\kinesis (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4103
Entropy (8bit):	5.145120661046688
Encrypted:	false
SSDEEP:	96:JLuMro0hxK873EuVeFyLXyD7WIgZNNe6eBEiK5St6Jcmqo6WSFHOuS9HHRKmxfIK:hHo0cqX+8qo6bFHxStncq
MD5:	C9E8CE8050106D92C4F154DA56A08200
SHA1:	7E6767686190901D2FE82917075A8EBA9C5EB297
SHA-256:	D719AAE26B421CE05A2D51F8B9B59C687BAC8A79C098EAD57F1E3C04402430C6
SHA-512:	3B01E23C9BB904043E032F3A6263B91F214BF5460D397688F4CBE2E37281729C8CF533FBC77B2CAD08203398F6520AE3B92F16A3B25017817C3EC5279E2F1323
Malicious:	false
Preview:	// $Xorg: kinesis,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "model100" {.. // This is an approximate layout for a Kinesis Ergonomic keyboard. // Generated completely by eye. I didn't actually measure a real . // keyboard... description= "Kinesis Ergonomic Keyboard";. width= 421;. height= 185;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [16,17] } };. shape "WIDE" { { [ 21,18] }, { [2,1], [19,17] } };. shape "TALL" { { [ 18,37] }, { [2,1], [16,36] } };. shape "FKEY" { cornerRadius=0, { [ 10,13] } };. shape "LED" { cornerRadius= 1.5, { [ 3, 3] } };. shape "LOGO" { { [ 40, 10 ] } };. shape "EDGE" { cornerRadius=5, { [ 421, 185 ] } };.. outline "Edges" {..top= 0;..left= 0;..shape= "EDGE";. };.. section "LeftFunction" {..left= 15;..top= 11;..key.shape= "FKEY";..key.gap= 3;..row {.. left= 1;.. top= 1;.. keys { .. .<ESC>, <FK01>, <FK02>, <FK03>, <FK04>,...<FK05>, <FK06>, <FK07>, <FK08

C:\Program Files (x86)\Xming\xkb\geometry\macintosh (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	16372
Entropy (8bit):	4.741874068890294
Encrypted:	false
SSDEEP:	192:VynDLDdbKiJuBzlHczfLfqROE1mRYfQkmFYb:QDn9KiJuBZHwz0mRYlmFYb
MD5:	E4B05D4098984FE46489AF7FF181ACCF
SHA1:	D6E12880B855E34F2FF7DD753C1322EAB8271F53
SHA-256:	9F14C24126D318EEE49B5FB4596D7FD913D486DAB97E0AD316CDACE312373420
SHA-512:	3CB4C9D1477A01BA7C50DF61B0ADED53B4E11FD4D8B693AC80D7C13B584D2181A3D50A6910A21553AE7DFDDD5F3E51A33D63799A730CEAC6FAF0729F9F8E3958
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/geometry/macintosh,v 1.3 2003/08/09 14:30:47 pascal Exp $.//.// Some modifications (<eqdar@castalie.org>) :.// - Added a <LSGT> key.// - Fixed the shape of the <RTRN> key.// - Moved <BKSL> to the 'AC' row.// - Added a special Macintosh sysctl key.// - Minor changes (Function keys shape, LED position...)..// Minor changes.// - Mail address above is no longer valid.// - Changed {L,R}MTA to {L,R}WIN, which are defined.// 2005/10 -- Simon Vallet <svallet@gmail.com>..default xkb_geometry "macintosh" {.. description= "Apple Extended Keyboard II";. width = 475;. height = 194;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "TLDE" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "BKSP" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "TAB" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "RTRN" { . { [0,0],[23,0],[23,37],[4,37],[4,18],[0,18] }, . { [2,1],[21,1],[21,36],[6,36],[6,17],[2,17] }

C:\Program Files (x86)\Xming\xkb\geometry\microsoft (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6019
Entropy (8bit):	4.885700130900332
Encrypted:	false
SSDEEP:	96:tVetqt0wkuoWwa8MU1FR1e6S1IS+1rY3blvCcjbZL3jDuotlMQbSg32tqlpAsRji:+G0r7aoxetIwxjFlUCgzk7jstVXZ
MD5:	D1C89C86B612A81C0647AD198F71E26F
SHA1:	F8BD0E69491DFCE621228FBE21279E6CCF088241
SHA-256:	5AFFE09BDE50127F95DA9D430C71FB83ADAE370879264C0F049C9ADF1B5005C9
SHA-512:	BA5C546AD960F1B1A0082AA8F61D7AA6C3704E648D2428C24BED7F35E988625CBC303079531F89FF4F708865E39DFEBDAA7B26A5FD7C6DF4ED55AB8882A6901A
Malicious:	false
Preview:	// $Xorg: microsoft,v 1.3 2000/08/17 19:54:35 cpqbld Exp $.//.default xkb_geometry "natural" {.. // Approximate layout for a Microsoft Natural Keyboard. description= "Microsoft Natural Keyboard";. width= 550;. height= 190;.. shape.cornerRadius= 1;. shape "LDEF" { { [ 18,18] }, { [2,1], [15,15] } };. shape "TABK" { { [ 26,18] }, { [2,1], [23,15] } }; . shape "CAPS" { { [ 30,18] }, { [2,1], [23,15] } }; . shape "LFSH" { { [ 41,18] }, { [2,1], [38,15] } };. shape "KEY6" { { [ 22,18] }, { [2,1], [15,15] } };. shape "KEYT" { { [ 33,18] }, { [2,1], [15,15] } };. shape "KEYG" { { [ 29,18] }, { [2,1], [15,15] } };. shape "LCTL" { ..approx= { [ 32, 22 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 23 ], [ 0, 22 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 17 ], [ 2, 15 ] } . };. shape "LWIN" { ..approx= { [ 32, 23 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 24 ], [ 0, 23 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 18 ], [ 2, 17 ] } . };. shape "LALT" { ..approx= { [ 32, 24 ] },..{ [

C:\Program Files (x86)\Xming\xkb\geometry\nec (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4290
Entropy (8bit):	5.283195038939677
Encrypted:	false
SSDEEP:	96:NCzUqYQHKQgrTLaeRXkPEUwbFr2WUbSi7H9JCIgzfF/n0g6ztGmfE4zFO:yYQHHgrTyYfFb+XM
MD5:	A99F74B737904431BF63C88DE1E278BA
SHA1:	0B4554ACDE26C85DE8E32552D521806D58B88D90
SHA-256:	7435D5A16D28E606F9309FCE2B0A9A26CA76CB987E89F42FAB6F62BDBF331DDF
SHA-512:	69108635130000D465499DA43FCEF9589C82540840BB027D018A5E150BBCB2A4FB1AE9B69EBD10FFAFEC759774A3E66AE6C81A67CE5DD0EF324644B2A7176242
Malicious:	false
Preview:	// $Xorg: nec,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE.

C:\Program Files (x86)\Xming\xkb\geometry\northgate (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4079
Entropy (8bit):	5.081004347358721
Encrypted:	false
SSDEEP:	96:esRDbzEN6G9/h2akz2681qHZvghKc9OCJiz0FNL79/IF+uIztzN:eckN/GVx70F/L
MD5:	EB46FFBC358014CD4AC3F1A96128A820
SHA1:	B4CCFEF5CCB54A95FF686AFCF49719A4EE93342B
SHA-256:	B38E6F8BAB5215D40D58767B987F7A6B4F7570BA23F1057F9755E7C71F8E7770
SHA-512:	6A619263E88C7198CEDEAE6440E2298850CA20201D97E02700BF24753B16A1E3B3CD967D6484EFC50725A54A4F328BA5A0D3ACEA3CAC3F197A3F329FDC2E0199
Malicious:	false
Preview:	// $Xorg: northgate,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.default xkb_geometry "omnikey101" {.. description= "North Gate Omnikey 101";. width= 470;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [18,18] }, { [2,1], [16,17] } };. shape "BKSP" { { [34,18] }, { [2,1], [32,17] } };. shape "TABK" { { [27,18] }, { [2,1], [25,17] } };. shape "RTRN" {..approx = { [15, 0], [40,37] },..{ [15, 0], [40, 0], [40,37],.. [ 0,37], [ 0,19], [15,19] },..{ [17, 1], [38, 1], [38,36],.. [ 2,36], [ 2,20], [17,20] }. };. shape "CAPS" { { [ 32,18] }, { [2,1], [30,17] } };. shape "LFSH" { { [ 41,18] }, { [2,1], [39,17] } };. shape "RTSH" { { [ 30,18] }, { [2,1], [28,17] } };. shape "MODK" { { [ 26,18] }, { [2,1], [24,17] } };. shape "SPCE" { { [129,18] }, { [2,1], [127,17] } };. shape "KP0" { { [ 37,18] }, { [2,1], [35,17] } };. shape "KPAD" { { [ 18,37] }, { [2,1], [16,36] } };.. shape "LEDS" { cornerRadius= 0, { [ 76 ,20 ] } };. shape "LE

C:\Program Files (x86)\Xming\xkb\geometry\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	38854
Entropy (8bit):	5.110160887426922
Encrypted:	false
SSDEEP:	768:HgHyq+DH9TpVw4bTXvDHBTJnDHhTA6R5FVRz6Y5wJRD9TUnCsMctDHoTK3WDd:HgH8H9Tc4bTrHBTBHhTA6RLVRz6VJRDX
MD5:	AC25ABD772A48C130A847A213F3C3CEE
SHA1:	C5F213123E41017BB1BC824C8D381FEB908ECDE9
SHA-256:	D09FBC86E76A443F23EAF29FD8A47E8A58F1AA88F5164834AFF5C6002F3A8A9F
SHA-512:	484F894E8CB7FD2C73E2ED2D5A5284B87742AA69BEE9FF39B2A58B6C528BC258A65CBC89C9141C5917B9EA7E2977A7FF0C57D62CDC2BD28EEFD152A284F0F7C1
Malicious:	false
Preview:	// $Xorg: pc,v 1.4 2001/02/09 02:05:50 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\O2 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15376
Entropy (8bit):	5.213668392324437
Encrypted:	false
SSDEEP:	192:Zx1lH+RqtQEQ1iADm1TSh6d/nk/2N9ZqWN6RHNCsW0FjVy9:VlmEQ1i+m12KY2N/tN6REtOy9
MD5:	FBFE673869F90DDFC8417C858D5F5F27
SHA1:	40F08DF3D4BA7C2373BE478A495173204766046E
SHA-256:	F3FEB70DE11EA86B657A00E42B05B1D8C59AC606EDE92E6A243A41E393070077
SHA-512:	70EFC393F9A9D9291C3E355BD6E62D8B1C59AB76B6C1266B3C4A139EDC822C8B8CA55759EF9E39F14C3AFC75F6342794A5FE105317F371687AB2B238BA348B4C
Malicious:	false
Preview:	// $Xorg: O2,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LI

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\indigo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10457
Entropy (8bit):	5.269396494927573
Encrypted:	false
SSDEEP:	192:tx1lH+RBa9Q1iGNajBSh6d/nk/2N9ZqWS:hlWKQ1i28EKY2N/tS
MD5:	9F0009E4D9A72316B7CAEA43D42F43CB
SHA1:	BA9EF08D43E4A4A7612865FBDDD43B97A8A9C2A8
SHA-256:	ABA745CE6398AB54923CF1B7EFCBF0C03BBA32D9933675CC017A819D9FE81D2B
SHA-512:	B17ACFBE9CFC3EFF8565169B294622B78D4861ADEAC1264A41840B01470643B09601C90C0242434CB0E274B18237FC45AA3B588B6E94F117A28E356C31D0230F
Malicious:	false
Preview:	// $Xorg: indigo,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS B

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\indy (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15030
Entropy (8bit):	5.220112553332607
Encrypted:	false
SSDEEP:	192:3x1lH+RBa9Q1iGNajTSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:LlWKQ1i282KY2N/tN6REtOyN
MD5:	B05BCE816AD2428A1A190D94296B5AE9
SHA1:	3FAAAC92FA68CF429F98CC556C6159F462E4AC4A
SHA-256:	F85F2A54D55025003BD48A64C882ABB57290511003C557FF01B2F7DF92170B99
SHA-512:	3608FA70F32F254E1BDCD9539591EFDE3EBFC6EA250381A6FF8F7FA2D65F44481D2D6E344F8F0E679B0C347DE4D73E94E12666F7367D0B5D674BD7230DBF2778
Malicious:	false
Preview:	// $Xorg: indy,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\is-6P47V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15030
Entropy (8bit):	5.220112553332607
Encrypted:	false
SSDEEP:	192:3x1lH+RBa9Q1iGNajTSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:LlWKQ1i282KY2N/tN6REtOyN
MD5:	B05BCE816AD2428A1A190D94296B5AE9
SHA1:	3FAAAC92FA68CF429F98CC556C6159F462E4AC4A
SHA-256:	F85F2A54D55025003BD48A64C882ABB57290511003C557FF01B2F7DF92170B99
SHA-512:	3608FA70F32F254E1BDCD9539591EFDE3EBFC6EA250381A6FF8F7FA2D65F44481D2D6E344F8F0E679B0C347DE4D73E94E12666F7367D0B5D674BD7230DBF2778
Malicious:	false
Preview:	// $Xorg: indy,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\is-EALI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10457
Entropy (8bit):	5.269396494927573
Encrypted:	false
SSDEEP:	192:tx1lH+RBa9Q1iGNajBSh6d/nk/2N9ZqWS:hlWKQ1i28EKY2N/tS
MD5:	9F0009E4D9A72316B7CAEA43D42F43CB
SHA1:	BA9EF08D43E4A4A7612865FBDDD43B97A8A9C2A8
SHA-256:	ABA745CE6398AB54923CF1B7EFCBF0C03BBA32D9933675CC017A819D9FE81D2B
SHA-512:	B17ACFBE9CFC3EFF8565169B294622B78D4861ADEAC1264A41840B01470643B09601C90C0242434CB0E274B18237FC45AA3B588B6E94F117A28E356C31D0230F
Malicious:	false
Preview:	// $Xorg: indigo,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS B

C:\Program Files (x86)\Xming\xkb\geometry\sgi_vndr\is-SE3JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15376
Entropy (8bit):	5.213668392324437
Encrypted:	false
SSDEEP:	192:Zx1lH+RqtQEQ1iADm1TSh6d/nk/2N9ZqWN6RHNCsW0FjVy9:VlmEQ1i+m12KY2N/tN6REtOy9
MD5:	FBFE673869F90DDFC8417C858D5F5F27
SHA1:	40F08DF3D4BA7C2373BE478A495173204766046E
SHA-256:	F3FEB70DE11EA86B657A00E42B05B1D8C59AC606EDE92E6A243A41E393070077
SHA-512:	70EFC393F9A9D9291C3E355BD6E62D8B1C59AB76B6C1266B3C4A139EDC822C8B8CA55759EF9E39F14C3AFC75F6342794A5FE105317F371687AB2B238BA348B4C
Malicious:	false
Preview:	// $Xorg: O2,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LI

C:\Program Files (x86)\Xming\xkb\geometry\sony (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5016
Entropy (8bit):	5.244256689363828
Encrypted:	false
SSDEEP:	96:BCzUqYQHKQgrTLrSwRTTnb6ANgCrQezbjw/Q87kk2ZvAn29OCoBzgFuVRzBPQ8ty:eYQHHgrTfSKd2G+YqDgFclI
MD5:	71AEF4B7A3018698A16C242C30524212
SHA1:	26576281DD60D833760F3B578DDE92EC394A1F33
SHA-256:	6C3CC34C758A03FD00727DED729613F61DB31BB04ED612ADFE41EF213E862865
SHA-512:	38D1E122F7EE955648061292B87C056DD2DCE6949187FE35CE8BBC63009DDF9B907EF82DE30EA752A8733DD61D2EDB23C936DFFFA47A9C50171FEDCB1FE16272
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:51 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\geometry\sun (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	84483
Entropy (8bit):	4.924182627199796
Encrypted:	false
SSDEEP:	1536:QgHy5Ylzh7n+l7erl/lLevh/qMkrxV9WJj5G9GIkHhFYokmUloRqIrUhoRqeVYnC:VHy2lHCFpDb4RYuCgQmouCgRzApQdpQ
MD5:	0DE6E800C95FEF5F43ADD539024D4E2D
SHA1:	6A19F0501739BA378148577C2EF81F3D9705C4C6
SHA-256:	A4B09C8F9B21A9B76B439C80B39FA34188FEF4ED4BBBE307B0A897B8DDAF72E5
SHA-512:	FDAB5D2BBF81FD971C9B4A129AC0B3DBEE8AC246CF88290A1B318B8A29770D11D5461A67C81B39433AD487798E9709905A1D03ACBD6B34CDC88DDB6E0A5FF5A0
Malicious:	false
Preview:	// $Xorg: sun,v 1.4 2001/02/09 02:05:51 xorgcvs Exp $.// $XdotOrg: $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS I

C:\Program Files (x86)\Xming\xkb\geometry\thinkpad (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7361
Entropy (8bit):	5.147217485272048
Encrypted:	false
SSDEEP:	192:4d0wSy5pcXqAvDqSQkHNqRhQIVRLin/1kvIW:zByqiVRfvIW
MD5:	318D1439DF90E6DA0266B34B2A56E736
SHA1:	49A647E5B1CDED614499659C4281E3BB1526C1A7
SHA-256:	D5B55A82DBDAAC9B2BDEA0012C7D318B4949C36803550ACBA0CE352CD97EF756
SHA-512:	B3609DA51EE89D8B8D172CAF5A4C96316D045804AFC5ECC9F976C772019D445CA796B39F65E1BD7FE9A9AF74577064FD00B3E73A22988CE6785135D876A819C9
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --.// $XFree86: xc/programs/xkbcomp/geometry/ibm/thinkpad,v 1.3 2003/08/09 14:30:48 pascal Exp $..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for IBM ThinkPad keyboard..// Compatible Models: THINKPAD 560Z 2640-90U, THINKPAD 560Z 2640-91U,.// THINKPAD 560Z 2640-B0U, THINKPAD 560Z 2640-B1U, THINKPAD 560Z 2640-RR3,.// THINKPAD 600 2645-31U, THINKPAD 600 2645-35U, THINKPAD 600 2645-41U,.// THINKPAD 600 2645-42U, THINKPAD 600 2645-45U, THINKPAD 600 2645-48U,.// THINKPAD 600 2645-51U, THINKPAD 600 2645-85U, THINKPAD 600 2645-A1U,.// THINKPAD 600 2645-RR1, THINKPAD 600 2645-RR2, THINKPAD 600E 2645-3AU,.// THINKPAD 600E 2645-4AU, THINKPAD 600E 2645-4BU, THINKPAD 600E 2645-55U,.// THINKPAD 600E 2645-5AU, THINKPAD 600E 2645-5BU, THINKPAD 600E 2645-5JU,.// THINKPAD 600E 2645-8AO, THINKPAD 600E 2645-8AU, THINKPAD 600E 2645-8BU,.// THINKPAD 600E 2645-AAU, THINKPAD 600E 2645-RRB, THINKPAD 600E 2645-RRD

C:\Program Files (x86)\Xming\xkb\geometry\winbook (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	5.027555984385265
Encrypted:	false
SSDEEP:	48:MKMv7i687N6X863h6/bGce616V6X6ogXojlvq0RIvAGnljq2zd+R3PDRvZjSh9PG:3+i687N6X86x6Ve616V6X6ogXoY0S9lg
MD5:	FBCAE0DFD34AA59C950059BE681598F9
SHA1:	D5C81C13BDC1A60731FA13F191AA335D0CC358AC
SHA-256:	3E5FA27C3FF8834FE18FA40100E81368B07A2FAC59E0F71D71E2AE874CBB68EF
SHA-512:	47BD48372DBA962FE49D2884FD173DECEECA0112719DAAFED94864236614439D6B9984806DA11A7B97B06131AE932C7DB925D3BDE93E2BE6E87B58B62A9462BA
Malicious:	false
Preview:	// $Xorg: winbook,v 1.3 2000/08/17 19:54:36 cpqbld Exp $.default xkb_geometry "XP5" {.. description= "WinBook XP5";. width= 281;. height= 180;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "FKEY" {..{ [ 15, 10 ] },..{ [ 1, 0 ], [ 14, 9.5 ] }. };. shape "ONE" {..{ [ 28, 17 ] },..{ [ 11, 0 ], [ 28, 17 ] },..{ [ 13, 1 ], [ 26, 15 ] }. };. shape "WIDE" {.// backspace, caps lock, ctrl alt ?..{ [ 24.5, 17 ] },..{ [ 2, 1 ], [ 22.5, 15 ] }. };. shape "WIDR" { // backslash, left shift..{ [ 35, 17 ] },..{ [ 2, 1 ], [ 33, 15 ] }. };. shape "RTRN" {..{ [ 45, 17 ] },..{ [ 2, 1 ], [ 43, 15 ] }. };. shape "SPCE" {..{ [ 90, 17 ] },..{ [ 2, 1 ], [ 88, 15 ] }. };. shape "STIK" {..cornerRadius= 4,..{ [ 8, 8 ] }. };. shape "BTN" {..{ [ 31, 6 ] }. };.. section.left= 2;. row.left= 1;. key.shape= "NORM";. key.gap= 0.5;.. key.color= "grey10";. labelColor= "white";.

C:\Program Files (x86)\Xming\xkb\is-0PASI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	24536
Entropy (8bit):	3.739492948005294
Encrypted:	false
SSDEEP:	384:NO3IuUNIhOh/hOh/2H2H8O8/8O8jKI1qkfREF3dv16UGsIp6JvII0PnlR+yUOs5e:NO4uUNIQx8d2H2HrWTC1qkfREF3h16Uy
MD5:	FA02747C8C61B364B131879E52D88334
SHA1:	B7BC3AD1915733FB15ED679EBAC4BCD4FD59F2E5
SHA-256:	EA1B7514A3D95DDBFF9742C1EA098B2F005E1F9629D0661C585E84298A1EDBFA
SHA-512:	7D6B8EBAFC39A3C15496053D4B6901207A467E5CA6CFCE48F22EC92A1CA012526E50D814EE55DB8866249AF0E22809CB74BC450E3605DF544332D2FACEC6D898
Malicious:	false
Preview:	-dp----- a------- ad(basic).-dp----- a------- af(basic).--p----- a------- af(ps).--p----- a------- af(uz).-dp----- a------- al(basic).-dp----- a------- ba(basic).--p----- a------- ba(us).--p----- a------- ba(alternatequotes).--p----- a------- ba(unicode).--p----- a------- ba(unicodeus).-dp----- a------- am(basic).-------- -------- am(phonetic).--p----- a------- am(phonetic-alt).--p----- a------- am(eastern).--p----- a------- am(western).--p----- a------- am(eastern-alt).-dp----- a------- bd(basic).-------- -------- bd(probhat).-dp----- a------- be(basic).--p----- a------- be(iso-alternate).--p----- a------- be(sundeadkeys).--p----- a------- be(Sundeadkeys).--p----- a------- be(nodeadkeys).--p----- a------- be(wang).-dp----- a------- bg(bds).--p----- a------- bg(phonetic).-dp----- -------- ca(fr).-------- -------- ca(fr-dvorak).--p----- -------- ca(fr-legacy).--p----- -------- ca(multi).--p----- -------- ca(multi-2gr).-------- a------- ca(ike).--p----- -------- ca(multix).-dp----- a----

C:\Program Files (x86)\Xming\xkb\is-KAVGC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	3.7489475490133586
Encrypted:	false
SSDEEP:	48:8c+dxntOYw3DWeIDqvjvwvVivCqrAjg4EXBmXFxzuN6k1nM8cYCrlI2HRxo3Czdg:8rEXBmXFxzuN6k1nMVgL
MD5:	C381F7D239B89B0EDD949CF008A67CAF
SHA1:	93EAFC285D2919D5FFB948EF6E9F32A01470DD87
SHA-256:	92785F666081F497FABFEE747AB399BD2A0AE9FAD18A86C188F3DD3A54F02C8D
SHA-512:	02A6F62DFE16A9488B9DC90D3BC2043707837F90D47A5258B3604F2E67BDCA16A62FBF7E3CD431E1F7070C072138E4E6A4EE854B9D95934816700061BB28F043
Malicious:	false
Preview:	-d------ -------- hp(hp-101).-------- -------- hp(hil).-------- -------- ibm(rs6k-101).-------- -------- ibm(rs6k-102).-d------ -------- sun(type4).-------- -------- sun(type5).-------- -------- sun(type4tuv).-------- -------- sun(type4_ca).-------- -------- sun(type4_jp).-------- -------- sun(type4_euro).-------- -------- sun(type5tuv).-------- -------- sun(type5_jp).-------- -------- sun(type5_euro).-------- -------- sun(type5hobo).-------- -------- sun(type5tuvhobo).-------- -------- sun(type5_jphobo).-------- -------- sun(type6).-------- -------- sun(type6tuv).-------- -------- sun(type6unix).-------- -------- sun(type6_jp).-------- -------- sun(type6_euro).-------- -------- sun(type6_usb).-------- -------- sun(type6tuv_usb).-------- -------- sun(type6_jp_usb).-------- -------- sun(type5_se).-------- -------- sun(type5c_se).-------- -------- sun(type4__se).-------- -------- sun(type4_se).-------- -------- sun(type4_se_swapctl).-------- -------- sony(nwp5461).-d------ -------- amiga

C:\Program Files (x86)\Xming\xkb\is-N30N7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	134
Entropy (8bit):	3.2308413491082346
Encrypted:	false
SSDEEP:	3:81IfIF8TzcRu8MIDtELbvIeIZHvMUMIC3A6OEv:81OdzcMDLbvIeevhMl3AvEv
MD5:	423052E69ED62990C5BFCFA1A09127EB
SHA1:	9B318258568EDF4B17838F187564CB9DAE21F1FB
SHA-256:	A937D8E5FDD55B27BA5CC8BB97F4905F6230589823703624933DC6D16EF03D9F
SHA-512:	81699A6B39F7B3503BF5B6B36065F11FD00AE2BB6E458CAC1D9CFDCB755DCE2BBF96F4CBBC966CAB20A86C5BACCCDB2BBF7A65E9D592C45CA7F277ADEF6186AF
Malicious:	false
Preview:	-d------ -------- default(default).-d------ -------- basic(basic).-d------ -------- xtest(xtest).-d------ -------- complete(complete).

C:\Program Files (x86)\Xming\xkb\is-NA80Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15034
Entropy (8bit):	3.9512209002786007
Encrypted:	false
SSDEEP:	96:L2gXyly2adKG8NA0WVEuWrgs0F/DsIC8GpA45U57ursB6fRuOzuO:VXyly2RuWrgsY/DsIC8GQCYNO
MD5:	7B3F6D092410DB75F2C39634B6F95B63
SHA1:	79CFF6D1A51F92B9EE461DDA437958CB42EA2238
SHA-256:	815EDA1E5373CE9F70B0A2EAA62A268A0F1C56A7929D939FE26207F18EEA98C1
SHA-512:	252C134E7D58337FDB7604125CA1732D24F57C704014B67377D454D92CDB642A13B7594DAC5B11A8B6AD0535BEFE71E4A97183CBAC97071F110839F7BAE617C0
Malicious:	false
Preview:	-------- -------- sun_vndr/de(type4_de).-------- -------- sun_vndr/de(type4_de_nodeadkeys).-------- -------- sun_vndr/de(type4_de_openlook).-d------ -------- sun_vndr/de(type5_de).-------- -------- sun_vndr/de(type5_de_nodeadkeys).-------- -------- sun_vndr/de(type5_de_openlook).-------- -------- sun_vndr/es(type4_es).-------- -------- sun_vndr/es(type4_es_openlook).-d------ -------- sun_vndr/es(type5_es).-------- -------- sun_vndr/es(type5_es_openlook).-------- -------- sun_vndr/fi(type4_fi).-------- -------- sun_vndr/fi(type4_fi_openlook).-d------ -------- sun_vndr/fi(type5_fi).-------- -------- sun_vndr/fi(type5_fi_openlook).-------- -------- sun_vndr/fr(type4_fr).-------- -------- sun_vndr/fr(type4_fr_openlook).-d------ -------- sun_vndr/fr(type5_fr).-------- -------- sun_vndr/fr(type5_fr_openlook).-------- -------- sun_vndr/no(type4_no).-------- -------- sun_vndr/no(type4_no_openlook).-d------ -------- sun_vndr/no(type5_no).-------- -------- sun_vndr/no(type5_no_openlook).--------

C:\Program Files (x86)\Xming\xkb\is-NLOBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	974
Entropy (8bit):	3.629871346219524
Encrypted:	false
SSDEEP:	12:86CH/OI6YjSfS7R6Eb/NIRTpDh13AvEy5S5ky5OT79DI6tmBn:86CfnZoV7w8yoX2a6tk
MD5:	707D56AE06760224357E203FDE2E9922
SHA1:	F63B2EAE4B8C60BA320E45E006092B75CD3CB1FD
SHA-256:	A515CCF0B6A0C19D88437F037BBBFB732E126A17D9C7AD14FCDD6253919D9AF0
SHA-512:	25F0BDB8EE550BC5836657CB1AE247E58A0A58E107BE34F3CD1D6BAB675B8CEB7467ED9FAF4C09668EBD4F27149381ADB265C980165A7BF18A9CA095166A7676
Malicious:	false
Preview:	-dp----- -------- pc(pc).-dp----- -------- misc(misc).-d------ -------- pc98(basic).-d------ -------- default(default).-dp----- -------- ledscroll(scroll_lock).--p----- -------- ledscroll(group_lock).--p----- -------- ledscroll(shift_lock).-dp----- -------- mousekeys(mousekeys).-dp----- -------- norepeat(norepeat).-d------ -------- basic(basic).-dp----- -------- japan(japan).--p----- -------- japan(kana_lock).-d------ -------- xtest(xtest).-dp----- -------- ledcaps(caps_lock).--p----- -------- ledcaps(group_lock).--p----- -------- ledcaps(shift_lock).-d------ -------- complete(complete).h-p----- -------- keypad(overlay).h-p----- -------- keypad(overlay1).h-p----- -------- keypad(overlay2).-dp----- -------- lednum(num_lock).--p----- -------- lednum(group_lock).--p----- -------- lednum(shift_lock).-dp----- -------- level5(default).-dp----- -------- accessx(basic).--p----- -------- accessx(full).-dp----- -------- iso9995(default).-dp----- -------- xfree86(basic).

C:\Program Files (x86)\Xming\xkb\is-UPNKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3028
Entropy (8bit):	3.581094534025991
Encrypted:	false
SSDEEP:	48:8SR+xn094Xzj2PJqrjojD+Kd3YsTDWvCISDqY7mllcErLAFzRnMDuCfhDC42H3lx:8SZsiErLAFzRnMtfi9
MD5:	7464977B7E7999F249B2E9793D972106
SHA1:	230666E7929C1B595A615182F69920EC0D60EC7A
SHA-256:	A2065C2E289B8783D25DB6A6E34807EEBACA017DF799D6A603E3FAF3CA8A4B34
SHA-512:	BC1D5E784A787A5CA3FE6DA3960F904C7DE94B659449C4B783365B68BE23BA7325A81E3F5E2DEC5CAA47693F975018892BA448539B43A1C4188077F5EB95E3B5
Malicious:	false
Preview:	-d------ -------- hp(pc101).-------- -------- hp(hil).-------- -------- hp(omnibook).-------- -------- hp(omnibook_intl).-d------ -------- pc(pc101).-------- -------- pc(pc102).-------- -------- pc(pc104).-------- -------- pc(pc105).-------- -------- pc(jp106).-------- -------- pc(abnt2).-------- -------- pc(pc86).-------- -------- pc(kr106).-------- -------- pc(latitude).-d------ -------- nec(pc98).-------- -------- sun(type4).-------- -------- sun(type4tuv).-------- -------- sun(type4_ca).-------- -------- sun(type4jp).-------- -------- sun(t5).-------- -------- sun(t5tuv).-------- -------- sun(t5jp).-------- -------- sun(t5unix).-------- -------- sun(t5hobo).-------- -------- sun(t5tuvhobo).-------- -------- sun(t5jphobo).-------- -------- sun(type5_se).-------- -------- sun(type5c_se).-------- -------- sun(type4_se).-------- -------- sun(t6).-------- -------- sun(t6tuv).-------- -------- sun(t6jp).-------- -------- sun(t6unix).-------- -------- sun(type5).-------- -------- sun(type

C:\Program Files (x86)\Xming\xkb\is-VAF1I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	624
Entropy (8bit):	3.547599649282927
Encrypted:	false
SSDEEP:	12:8CuZdqYdtggYI6IDu/q9lbCy3AvETzBtmU:81ZQYLgEqS9dzw8PBtr
MD5:	BEF9BC0CD11B23C275FFF948AA72D662
SHA1:	E4F0AF78F56D11BE4611D050FD85C025BEC5A00B
SHA-256:	18FC7C7FE8502FF45738DD2811EBFA217B97C4D0F2D2055984F130EC614DEBD1
SHA-512:	04DDFC563A7B041CD6B8647063D85B79C89C5489440DE97B29F71970EAF37ECC9777FB9A66BAD5CC6961EB86F6A30BA6D2DC5B7AC02DC14E06A5B61057D64ECE
Malicious:	false
Preview:	-dp----- -------- pc(default).--p----- -------- caps(internal).--p----- -------- caps(internal_nocancel).--p----- -------- caps(shift).--p----- -------- caps(shift_nocancel).-d------ -------- default(default).-dp----- -------- mousekeys(default).-d------ -------- basic(basic).-dp----- -------- extra(default).--p----- -------- extra(keypad).--p----- -------- extra(mac_keypad).-dp----- -------- cancel(Shift_Cancels_Caps).-d------ -------- complete(complete).-dp----- -------- level5(default).-dp----- -------- numpad(pc).--p----- -------- numpad(mac).--p----- -------- numpad(microsoft).-dp----- -------- iso9995(default).

C:\Program Files (x86)\Xming\xkb\keycodes.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	3.7489475490133586
Encrypted:	false
SSDEEP:	48:8c+dxntOYw3DWeIDqvjvwvVivCqrAjg4EXBmXFxzuN6k1nM8cYCrlI2HRxo3Czdg:8rEXBmXFxzuN6k1nMVgL
MD5:	C381F7D239B89B0EDD949CF008A67CAF
SHA1:	93EAFC285D2919D5FFB948EF6E9F32A01470DD87
SHA-256:	92785F666081F497FABFEE747AB399BD2A0AE9FAD18A86C188F3DD3A54F02C8D
SHA-512:	02A6F62DFE16A9488B9DC90D3BC2043707837F90D47A5258B3604F2E67BDCA16A62FBF7E3CD431E1F7070C072138E4E6A4EE854B9D95934816700061BB28F043
Malicious:	false
Preview:	-d------ -------- hp(hp-101).-------- -------- hp(hil).-------- -------- ibm(rs6k-101).-------- -------- ibm(rs6k-102).-d------ -------- sun(type4).-------- -------- sun(type5).-------- -------- sun(type4tuv).-------- -------- sun(type4_ca).-------- -------- sun(type4_jp).-------- -------- sun(type4_euro).-------- -------- sun(type5tuv).-------- -------- sun(type5_jp).-------- -------- sun(type5_euro).-------- -------- sun(type5hobo).-------- -------- sun(type5tuvhobo).-------- -------- sun(type5_jphobo).-------- -------- sun(type6).-------- -------- sun(type6tuv).-------- -------- sun(type6unix).-------- -------- sun(type6_jp).-------- -------- sun(type6_euro).-------- -------- sun(type6_usb).-------- -------- sun(type6tuv_usb).-------- -------- sun(type6_jp_usb).-------- -------- sun(type5_se).-------- -------- sun(type5c_se).-------- -------- sun(type4__se).-------- -------- sun(type4_se).-------- -------- sun(type4_se_swapctl).-------- -------- sony(nwp5461).-d------ -------- amiga

C:\Program Files (x86)\Xming\xkb\keycodes\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.271394928176801
Encrypted:	false
SSDEEP:	12:FXeRIdIVlczA7LvAOzQvJvz+xetbIzuTYjr5J:FbCVlcz4zQ9SE4u0P5J
MD5:	9B71AC20A2DCD2B0DD108B3030F243E7
SHA1:	41A2D0270D68AF3C993358B70F164A86D37056CB
SHA-256:	E074717DDF8DBFDA1E911EFB80CF22EBAD64E30C74766C0DA24A084B1261056B
SHA-512:	4C849E4856913369BCF2626865DEE2DA7E51BB02D724EF432B61863CC34D421DCEFF6BED3D834F3691F1113C254BEF8579574D23E79A698D70FCB8E6ED8CC113
Malicious:	false
Preview:	The keycodes component of a keyboard mapping specifies the range and.interpretation of the raw keycodes reported by the device. It sets the keycodes.symbolic name, the minimum and maximum legal codes for the keyboard, and the.symbolic name for each key. The keycodes component might also contain aliases.for some keys, symbolic names for some indicators and a description of which.indicators are physically present..

C:\Program Files (x86)\Xming\xkb\keycodes\aliases (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	4.338433884832246
Encrypted:	false
SSDEEP:	24:/UNW0jlL/fmXW0W5Aa+d0v02dq7L/PmXojaW5Aa+d0v0CPjlC1/fmX6W5Aa+d0vp:/UNdlj+XNjuX0bl6+Xj
MD5:	E01F2CFD7B4E39AF4AC38EEAC76146A4
SHA1:	20C6EF1E08A73F32AF68BFCBB22F0777B0E9FF1F
SHA-256:	85F774170FC1526E8A909A1E2952423DAE3891B721ABC293A27DC450818DCC6D
SHA-512:	474F136666F26B9AC511371A723BC82872E10EB97C852141BC9B0739A38A6608D3F0F32F9D3F87D590A44174FA043F938404EE4B7898508BFB1973D44D28625F
Malicious:	false
Preview:	.// keycode aliases for phonetic keyboard maps..default.xkb_keycodes "qwerty" {.. alias <LatQ> = <AD01>;. alias <LatW> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. alias <LatO> = <AD09>;. alias <LatP> = <AD10>;.. alias <LatA> = <AC01>;. alias <LatS> = <AC02>;. alias <LatD> = <AC03>;. alias <LatF> = <AC04>;. alias <LatG> = <AC05>;. alias <LatH> = <AC06>;. alias <LatJ> = <AC07>;. alias <LatK> = <AC08>;. alias <LatL> = <AC09>;.. alias <LatZ> = <AB01>;. alias <LatX> = <AB02>;. alias <LatC> = <AB03>;. alias <LatV> = <AB04>;. alias <LatB> = <AB05>;. alias <LatN> = <AB06>;. alias <LatM> = <AB07>;.};..xkb_keycodes "azerty" {.. alias <LatA> = <AD01>;. alias <LatZ> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. a

C:\Program Files (x86)\Xming\xkb\keycodes\amiga (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3546
Entropy (8bit):	4.092479162632965
Encrypted:	false
SSDEEP:	96:2ifrjU82BtXbFqidcRSGxRBRaxifrjU82BtXbFqTMcRSGxRBRar:z8/T+B8/TiW
MD5:	9F7408D4ECD30B1A12B928074995EA8C
SHA1:	25966294005C54D3B75AFA199F6CDB89A4946A4E
SHA-256:	8D2D3152A4914F3D5344D995D25F149090BE40C7F4F8EB576C186747832C180A
SHA-512:	DEDB6DFC04717FB2DE17D71B5863E3025F5AA429D3E9A487C82BA4E00D05E82EFDC0A8F75AFDBCD955D6415B3708812958B49A8165F0CB190C00A13B049D2872
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:37 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/keycodes/amiga,v 3.2 1997/10/26 13:25:35 dawes Exp $..default xkb_keycodes "usa1" {.. minimum= 8;. maximum= 111;.. <ESC> = 77;. <FK01> = 88;. <FK02> = 89;. <FK03> = 90;. <FK04> = 91;. <FK05> = 92;. <FK06> = 93;. <FK07> = 94;. <FK08> = 95;. <FK09> = 96;. <FK10> = 97;.. <TLDE> = 8;. <AE01> = 9;. <AE02> = 10;. <AE03> = 11;. <AE04> = 12;. <AE05> = 13;. <AE06> = 14;. <AE07> = 15;. <AE08> = 16;. <AE09> = 17;. <AE10> = 18;. <AE11> = 19;. <AE12> = 20;. <BKSL> = 21;. <BKSP> = 73;.. <TAB> = 74;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 76;.. <LCTL> = 107;. <CAPS> = 106;. <AC01> = 40;. <AC02> = 41;. <AC03> = 42;. <AC04> = 43;.

C:\Program Files (x86)\Xming\xkb\keycodes\ataritt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	4.200194742963781
Encrypted:	false
SSDEEP:	48:neTxMq3k+9kcSQ7vYSFuI6B7k58H4vvOjQk5qwyr2un:Rq35m0fF+B4DHvk5qwC2un
MD5:	D2D8463864D64094DA9C8170433FEDFB
SHA1:	53842F8A60108E6AE8407BED4724368660ECB835
SHA-256:	026DC90520493436A5FC7726FF964B52AC6A638CC65896AC8FF1CA3A48C742D6
SHA-512:	8328A7FCD3E26327A50C18F135FD394799EA88A11A1DAC54ACD3CE0E008F2F68C06AD43E463E7B9353A347FF89F91C552C837372F8575F70711927DF043CEFA1
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:37 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/keycodes/ataritt,v 3.1 1997/10/26 13:25:35 dawes Exp $..default xkb_keycodes "us" {.. minimum= 8;. maximum= 134;.. <ESC> = 9;. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <TLDE> = 49;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;. <DELE> = 91;.. <LCTL> = 37;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08> = 45;. <AC09> = 46;. <AC10> = 47;. <AC11> = 48;. <BKSL> = 51;.. <LFSH>

C:\Program Files (x86)\Xming\xkb\keycodes\digital_vndr\is-N0BM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	5.351381525277182
Encrypted:	false
SSDEEP:	96:y+PQ4YQHqKoTrCvbgM3MepBK0P11NhqIoMGazLcp/7F1rSzyFTFuh76AKoAhLuKM:rYQHbYrCjgIRrXL9AD622rVeVW
MD5:	AA72857A00ADD36E59A8955040C0B46B
SHA1:	9A5D43BE9FC9FA1A0A7CE275A1C4B55BB63B366F
SHA-256:	0AA8CF0844C78E5D2468F66AAEB0F3A47AEBBA299905AA64071250ED005870EE
SHA-512:	BFA768A444381E77023D98FBDCFCED0B26DA6470AD0461FB8634C6D789DADB6908BE887769975D15D1F484654A2294ED38F132B3EB5037143B0592D7A5C1FE81
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:38 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keycodes\digital_vndr\is-QKBNF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	5.330903887954281
Encrypted:	false
SSDEEP:	96:u+PQ4YQHqKoTrCvbBjU3MePZI4zXa/lTBwIfURZMgFXRvgMKCuQAmASW14niA7pk:HYQHbYrCjBjwRo/gA4Bvq92pFB8
MD5:	5A0C7E187167BB1CE0C09C6EAD491AF9
SHA1:	57AF5B1F51109FA06176E94263209AB338149D62
SHA-256:	FCDAC4FDEF649D220C4E42F0545832DC5D6924FE0694D15BDC0DC4CF3717BD6D
SHA-512:	2C39DBF565AF5C40BD28B05CEC0AE650C0C3EB44F8E6D409DF360206A09B6F9013645574D2B8F58C5E47A825162BB36CC109485F0D847D4F3FDC801EDB06A672
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:38 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keycodes\digital_vndr\lk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	5.351381525277182
Encrypted:	false
SSDEEP:	96:y+PQ4YQHqKoTrCvbgM3MepBK0P11NhqIoMGazLcp/7F1rSzyFTFuh76AKoAhLuKM:rYQHbYrCjgIRrXL9AD622rVeVW
MD5:	AA72857A00ADD36E59A8955040C0B46B
SHA1:	9A5D43BE9FC9FA1A0A7CE275A1C4B55BB63B366F
SHA-256:	0AA8CF0844C78E5D2468F66AAEB0F3A47AEBBA299905AA64071250ED005870EE
SHA-512:	BFA768A444381E77023D98FBDCFCED0B26DA6470AD0461FB8634C6D789DADB6908BE887769975D15D1F484654A2294ED38F132B3EB5037143B0592D7A5C1FE81
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:38 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keycodes\digital_vndr\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	5.330903887954281
Encrypted:	false
SSDEEP:	96:u+PQ4YQHqKoTrCvbBjU3MePZI4zXa/lTBwIfURZMgFXRvgMKCuQAmASW14niA7pk:HYQHbYrCjBjwRo/gA4Bvq92pFB8
MD5:	5A0C7E187167BB1CE0C09C6EAD491AF9
SHA1:	57AF5B1F51109FA06176E94263209AB338149D62
SHA-256:	FCDAC4FDEF649D220C4E42F0545832DC5D6924FE0694D15BDC0DC4CF3717BD6D
SHA-512:	2C39DBF565AF5C40BD28B05CEC0AE650C0C3EB44F8E6D409DF360206A09B6F9013645574D2B8F58C5E47A825162BB36CC109485F0D847D4F3FDC801EDB06A672
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:38 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keycodes\evdev (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7539
Entropy (8bit):	4.904773927982649
Encrypted:	false
SSDEEP:	96:IYMuLAhmDVldXYpWEOXZ3GkEdzsW2zzx+mQzZCIsh2hzuJ4v36d2+JfcZ1t:IYMuy6kpM6slzd+R1PYu8BJfc9
MD5:	7B23EE9B77E22E2CA73900E86A2F439C
SHA1:	C4E02A659F0F513BBB5074AAD068EA98E5E56024
SHA-256:	2810286D5AF318A6C63008828147AA0FC4DDBAB94C36E4D94639A2C7481870EE
SHA-512:	D55CECDA909906CC847C347234523F5C0EDDCB0F3149F7B241EFE54DA82C85A3CC0C49B85789A19474938494EB6DD6C8764ABF73521F19652DF5149B040DFD99
Malicious:	false
Preview:	// translation from evdev scancodes to something resembling xfree86 keycodes...default xkb_keycodes "evdev" {..minimum = 8;..maximum = 255;.. # Added for pc105 compatibility. <LSGT> = 94;...<TLDE> = 49;..<AE01> = 10;..<AE02> = 11;..<AE03> = 12;..<AE04> = 13;..<AE05> = 14;..<AE06> = 15;..<AE07> = 16;..<AE08> = 17;..<AE09> = 18;..<AE10> = 19;..<AE11> = 20;..<AE12> = 21;..<BKSP> = 22;...<TAB> = 23;..<AD01> = 24;..<AD02> = 25;..<AD03> = 26;..<AD04> = 27;..<AD05> = 28;..<AD06> = 29;..<AD07> = 30;..<AD08> = 31;..<AD09> = 32;..<AD10> = 33;..<AD11> = 34;..<AD12> = 35;..<BKSL> = 51;..<RTRN> = 36;...<CAPS> = 66;..<AC01> = 38;..<AC02> = 39;..<AC03> = 40;..<AC04> = 41;..<AC05> = 42;..<AC06> = 43;..<AC07> = 44;..<AC08> = 45;..<AC09> = 46;..<AC10> = 47;..<AC11> = 48;...<LFSH> = 50;..<AB01> = 52;..<AB02> = 53;..<AB03> = 54;..<AB04> = 55;..<AB05> = 56;..<AB06> = 57;..<AB07> = 58;..<AB08> = 59;..<AB09> = 60;..<AB10> = 61;..<RTSH> = 62;...<LALT> = 64;..<LCTL> = 37;..<SPCE> = 65;..<RCTL> =

C:\Program Files (x86)\Xming\xkb\keycodes\fujitsu (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.839125121579518
Encrypted:	false
SSDEEP:	96:1CzUqYQHKQgrTLCU7nFimBWT7TlBH+UcKKuC7F2f3l3Bfd2aMKQ30RLqMjqwS:KYQHHgrTj4y2mD
MD5:	88866719957644D6A8BEDF3F4AFB7AF3
SHA1:	3F3A25D2DAECE8A3A23823FF1393292F9DF3661C
SHA-256:	C98148857BD745FF1CA97EC1D205D0FCFC5D24301F79A51EBFED4385A27EABD3
SHA-512:	166319C2CE5C743A5739074B5E959612ECE38CB6C751561AAF92C6DC3821ACD88FDB87F95DE476C4DFDB030C4F42F99095A22FB14484DDD90BFE7738513C28B0
Malicious:	false
Preview:	// $Xorg: fujitsu,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\keycodes\hp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5024
Entropy (8bit):	4.6853370441951325
Encrypted:	false
SSDEEP:	96:TCzUqYQHKQgrTL3hfWnhnkP0hnBFU2ohNsnwOsDwLdIGda2fEVhq+hz7D+3w+3Lj:cYQHHgrTThWlInHM/TNCejmM9
MD5:	A34D7AC08ABA97C702A161E89D66ACD5
SHA1:	577C383B31EC197C2D81F635587CD68DFCEB50C7
SHA-256:	E914EAB23F2A2212DC6AE2A3756CDD2D907534D211A98AFCC73292D0795E9E4B
SHA-512:	5C13803D44500E2384001FF7A3B1A14A824F8DF7F1C98A9DD10E746886935DABC91C19F955ACDA46C2F4A5BEC097B09453C926F5FB4A8A49A03B638357BE11C3
Malicious:	false
Preview:	// $Xorg: hp,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keycodes\ibm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3200
Entropy (8bit):	4.985326679137337
Encrypted:	false
SSDEEP:	96:rCzUqYQHKQgrTLSz3StAUUFo/ygwy1nU/0C0pdbjIbG:EYQHHgrTemnWSpv
MD5:	AEBD101684A9F12C95E144D77DA45EB5
SHA1:	6A01EC42A4CAD8E81548DFCE4C3373EC5D7ED079
SHA-256:	6BA3CAD61315939EB73668460636F6B9689C6D41084D6CD2D7EF1AD5FCEB9199
SHA-512:	5D2F83809513A33A47B428C6B9D47F6E5620C20112B601FECC627B203382FDE507B736969456AA115E723E8D76A367E52F64052912B2F103BD61D5695CE21467
Malicious:	false
Preview:	// $Xorg: ibm,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE.

C:\Program Files (x86)\Xming\xkb\keycodes\is-21QM1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.839125121579518
Encrypted:	false
SSDEEP:	96:1CzUqYQHKQgrTLCU7nFimBWT7TlBH+UcKKuC7F2f3l3Bfd2aMKQ30RLqMjqwS:KYQHHgrTj4y2mD
MD5:	88866719957644D6A8BEDF3F4AFB7AF3
SHA1:	3F3A25D2DAECE8A3A23823FF1393292F9DF3661C
SHA-256:	C98148857BD745FF1CA97EC1D205D0FCFC5D24301F79A51EBFED4385A27EABD3
SHA-512:	166319C2CE5C743A5739074B5E959612ECE38CB6C751561AAF92C6DC3821ACD88FDB87F95DE476C4DFDB030C4F42F99095A22FB14484DDD90BFE7738513C28B0
Malicious:	false
Preview:	// $Xorg: fujitsu,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\keycodes\is-2KGPQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3891
Entropy (8bit):	5.056829495793215
Encrypted:	false
SSDEEP:	96:RhPQ+UqYQHKigrhL3Lgh2/39FV0ED60X+FINbvwGCsdHtS5e:9YQHdgrhrcQX7+yb1IA
MD5:	2C23AFCDC3FAA3FF32D266E33EC56294
SHA1:	643F2389061B7CCC694D24AF5D54B07DC4154E1A
SHA-256:	228D9E4C95B13D5816ED28B7F5EA45C5BD51D28BC545538B0876A69CFEA5D35E
SHA-512:	DE865479D3AEAB7B3FFA13888B23A69922E027C6C26962E1E0DE8D2F70E0FCF1DB48A6211F14F7F8608C8860C2B514119FF7386F4B5DC6F5F60916B9EFAC1CED
Malicious:	false
Preview:	// $XConsortium: macintosh /main/10 1996/01/24 12:17:35 kaleb $.//.//Copyright (c) 1996 X Consortium.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and/or sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN

C:\Program Files (x86)\Xming\xkb\keycodes\is-40BO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5024
Entropy (8bit):	4.6853370441951325
Encrypted:	false
SSDEEP:	96:TCzUqYQHKQgrTL3hfWnhnkP0hnBFU2ohNsnwOsDwLdIGda2fEVhq+hz7D+3w+3Lj:cYQHHgrTThWlInHM/TNCejmM9
MD5:	A34D7AC08ABA97C702A161E89D66ACD5
SHA1:	577C383B31EC197C2D81F635587CD68DFCEB50C7
SHA-256:	E914EAB23F2A2212DC6AE2A3756CDD2D907534D211A98AFCC73292D0795E9E4B
SHA-512:	5C13803D44500E2384001FF7A3B1A14A824F8DF7F1C98A9DD10E746886935DABC91C19F955ACDA46C2F4A5BEC097B09453C926F5FB4A8A49A03B638357BE11C3
Malicious:	false
Preview:	// $Xorg: hp,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keycodes\is-9SM4M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	4.338433884832246
Encrypted:	false
SSDEEP:	24:/UNW0jlL/fmXW0W5Aa+d0v02dq7L/PmXojaW5Aa+d0v0CPjlC1/fmX6W5Aa+d0vp:/UNdlj+XNjuX0bl6+Xj
MD5:	E01F2CFD7B4E39AF4AC38EEAC76146A4
SHA1:	20C6EF1E08A73F32AF68BFCBB22F0777B0E9FF1F
SHA-256:	85F774170FC1526E8A909A1E2952423DAE3891B721ABC293A27DC450818DCC6D
SHA-512:	474F136666F26B9AC511371A723BC82872E10EB97C852141BC9B0739A38A6608D3F0F32F9D3F87D590A44174FA043F938404EE4B7898508BFB1973D44D28625F
Malicious:	false
Preview:	.// keycode aliases for phonetic keyboard maps..default.xkb_keycodes "qwerty" {.. alias <LatQ> = <AD01>;. alias <LatW> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. alias <LatO> = <AD09>;. alias <LatP> = <AD10>;.. alias <LatA> = <AC01>;. alias <LatS> = <AC02>;. alias <LatD> = <AC03>;. alias <LatF> = <AC04>;. alias <LatG> = <AC05>;. alias <LatH> = <AC06>;. alias <LatJ> = <AC07>;. alias <LatK> = <AC08>;. alias <LatL> = <AC09>;.. alias <LatZ> = <AB01>;. alias <LatX> = <AB02>;. alias <LatC> = <AB03>;. alias <LatV> = <AB04>;. alias <LatB> = <AB05>;. alias <LatN> = <AB06>;. alias <LatM> = <AB07>;.};..xkb_keycodes "azerty" {.. alias <LatA> = <AD01>;. alias <LatZ> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. a

C:\Program Files (x86)\Xming\xkb\keycodes\is-A86KQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3200
Entropy (8bit):	4.985326679137337
Encrypted:	false
SSDEEP:	96:rCzUqYQHKQgrTLSz3StAUUFo/ygwy1nU/0C0pdbjIbG:EYQHHgrTemnWSpv
MD5:	AEBD101684A9F12C95E144D77DA45EB5
SHA1:	6A01EC42A4CAD8E81548DFCE4C3373EC5D7ED079
SHA-256:	6BA3CAD61315939EB73668460636F6B9689C6D41084D6CD2D7EF1AD5FCEB9199
SHA-512:	5D2F83809513A33A47B428C6B9D47F6E5620C20112B601FECC627B203382FDE507B736969456AA115E723E8D76A367E52F64052912B2F103BD61D5695CE21467
Malicious:	false
Preview:	// $Xorg: ibm,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE.

C:\Program Files (x86)\Xming\xkb\keycodes\is-D3CMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3009
Entropy (8bit):	4.942853985210451
Encrypted:	false
SSDEEP:	48:AcjritctUOUqYQHEssz4INW3Z2rmUaOYCFkzY3MOuYaFmwI6hH8B0ncbjv0DortB:+CzUqYQHKQgrTLaY3VuYaFAecB0n2/Z5
MD5:	C273393E9E919AC67D2CE5F6B7E29A17
SHA1:	4DFB6C69DB81FEA4A9974A597269DD0E4C7533B6
SHA-256:	43B089C1C351B5DEC860DC7D930D220FCCCE34242436835CF8BD297ED9FA473A
SHA-512:	3E7122FD1256F5B329CEB9D2D34F08C6A917C2A916C01EDDF28478D6D052DADB17884CE490D013E6A1E2A3F5CFC4BCEE5498CB06C5D68A67631AC326AEDF9D22
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\keycodes\is-EP8H5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	4.90315003584438
Encrypted:	false
SSDEEP:	96:gCzUqYQHKQgrTLuU9zr90wa0FW8ww214dxb7+yHb:FYQHHgrTJAo7b
MD5:	9943156A29F7A4DF0E17263EECFF0842
SHA1:	1DBC7164B88D8AC0796BCCBE683A61F907A7D99E
SHA-256:	FF2C1B705B22EAEB989106A4D7BB855FDA0A7A81FE4CFF52AD42085D70A5F689
SHA-512:	1AE6653A1652DB9976E6B06782E5315574672CC34D41A55D15BCCC1FE8C8CCCF939A36CAE1BFC8AFDECF25C3D0DAEC23E3802F9643F233DE6B8B3BBA918F957A
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\keycodes\is-JTTID.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7539
Entropy (8bit):	4.904773927982649
Encrypted:	false
SSDEEP:	96:IYMuLAhmDVldXYpWEOXZ3GkEdzsW2zzx+mQzZCIsh2hzuJ4v36d2+JfcZ1t:IYMuy6kpM6slzd+R1PYu8BJfc9
MD5:	7B23EE9B77E22E2CA73900E86A2F439C
SHA1:	C4E02A659F0F513BBB5074AAD068EA98E5E56024
SHA-256:	2810286D5AF318A6C63008828147AA0FC4DDBAB94C36E4D94639A2C7481870EE
SHA-512:	D55CECDA909906CC847C347234523F5C0EDDCB0F3149F7B241EFE54DA82C85A3CC0C49B85789A19474938494EB6DD6C8764ABF73521F19652DF5149B040DFD99
Malicious:	false
Preview:	// translation from evdev scancodes to something resembling xfree86 keycodes...default xkb_keycodes "evdev" {..minimum = 8;..maximum = 255;.. # Added for pc105 compatibility. <LSGT> = 94;...<TLDE> = 49;..<AE01> = 10;..<AE02> = 11;..<AE03> = 12;..<AE04> = 13;..<AE05> = 14;..<AE06> = 15;..<AE07> = 16;..<AE08> = 17;..<AE09> = 18;..<AE10> = 19;..<AE11> = 20;..<AE12> = 21;..<BKSP> = 22;...<TAB> = 23;..<AD01> = 24;..<AD02> = 25;..<AD03> = 26;..<AD04> = 27;..<AD05> = 28;..<AD06> = 29;..<AD07> = 30;..<AD08> = 31;..<AD09> = 32;..<AD10> = 33;..<AD11> = 34;..<AD12> = 35;..<BKSL> = 51;..<RTRN> = 36;...<CAPS> = 66;..<AC01> = 38;..<AC02> = 39;..<AC03> = 40;..<AC04> = 41;..<AC05> = 42;..<AC06> = 43;..<AC07> = 44;..<AC08> = 45;..<AC09> = 46;..<AC10> = 47;..<AC11> = 48;...<LFSH> = 50;..<AB01> = 52;..<AB02> = 53;..<AB03> = 54;..<AB04> = 55;..<AB05> = 56;..<AB06> = 57;..<AB07> = 58;..<AB08> = 59;..<AB09> = 60;..<AB10> = 61;..<RTSH> = 62;...<LALT> = 64;..<LCTL> = 37;..<SPCE> = 65;..<RCTL> =

C:\Program Files (x86)\Xming\xkb\keycodes\is-K17EK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3546
Entropy (8bit):	4.092479162632965
Encrypted:	false
SSDEEP:	96:2ifrjU82BtXbFqidcRSGxRBRaxifrjU82BtXbFqTMcRSGxRBRar:z8/T+B8/TiW
MD5:	9F7408D4ECD30B1A12B928074995EA8C
SHA1:	25966294005C54D3B75AFA199F6CDB89A4946A4E
SHA-256:	8D2D3152A4914F3D5344D995D25F149090BE40C7F4F8EB576C186747832C180A
SHA-512:	DEDB6DFC04717FB2DE17D71B5863E3025F5AA429D3E9A487C82BA4E00D05E82EFDC0A8F75AFDBCD955D6415B3708812958B49A8165F0CB190C00A13B049D2872
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:37 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/keycodes/amiga,v 3.2 1997/10/26 13:25:35 dawes Exp $..default xkb_keycodes "usa1" {.. minimum= 8;. maximum= 111;.. <ESC> = 77;. <FK01> = 88;. <FK02> = 89;. <FK03> = 90;. <FK04> = 91;. <FK05> = 92;. <FK06> = 93;. <FK07> = 94;. <FK08> = 95;. <FK09> = 96;. <FK10> = 97;.. <TLDE> = 8;. <AE01> = 9;. <AE02> = 10;. <AE03> = 11;. <AE04> = 12;. <AE05> = 13;. <AE06> = 14;. <AE07> = 15;. <AE08> = 16;. <AE09> = 17;. <AE10> = 18;. <AE11> = 19;. <AE12> = 20;. <BKSL> = 21;. <BKSP> = 73;.. <TAB> = 74;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 76;.. <LCTL> = 107;. <CAPS> = 106;. <AC01> = 40;. <AC02> = 41;. <AC03> = 42;. <AC04> = 43;.

C:\Program Files (x86)\Xming\xkb\keycodes\is-LUD5H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	4.200194742963781
Encrypted:	false
SSDEEP:	48:neTxMq3k+9kcSQ7vYSFuI6B7k58H4vvOjQk5qwyr2un:Rq35m0fF+B4DHvk5qwC2un
MD5:	D2D8463864D64094DA9C8170433FEDFB
SHA1:	53842F8A60108E6AE8407BED4724368660ECB835
SHA-256:	026DC90520493436A5FC7726FF964B52AC6A638CC65896AC8FF1CA3A48C742D6
SHA-512:	8328A7FCD3E26327A50C18F135FD394799EA88A11A1DAC54ACD3CE0E008F2F68C06AD43E463E7B9353A347FF89F91C552C837372F8575F70711927DF043CEFA1
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:37 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/keycodes/ataritt,v 3.1 1997/10/26 13:25:35 dawes Exp $..default xkb_keycodes "us" {.. minimum= 8;. maximum= 134;.. <ESC> = 9;. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <TLDE> = 49;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;. <DELE> = 91;.. <LCTL> = 37;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08> = 45;. <AC09> = 46;. <AC10> = 47;. <AC11> = 48;. <BKSL> = 51;.. <LFSH>

C:\Program Files (x86)\Xming\xkb\keycodes\is-O9U1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.271394928176801
Encrypted:	false
SSDEEP:	12:FXeRIdIVlczA7LvAOzQvJvz+xetbIzuTYjr5J:FbCVlcz4zQ9SE4u0P5J
MD5:	9B71AC20A2DCD2B0DD108B3030F243E7
SHA1:	41A2D0270D68AF3C993358B70F164A86D37056CB
SHA-256:	E074717DDF8DBFDA1E911EFB80CF22EBAD64E30C74766C0DA24A084B1261056B
SHA-512:	4C849E4856913369BCF2626865DEE2DA7E51BB02D724EF432B61863CC34D421DCEFF6BED3D834F3691F1113C254BEF8579574D23E79A698D70FCB8E6ED8CC113
Malicious:	false
Preview:	The keycodes component of a keyboard mapping specifies the range and.interpretation of the raw keycodes reported by the device. It sets the keycodes.symbolic name, the minimum and maximum legal codes for the keyboard, and the.symbolic name for each key. The keycodes component might also contain aliases.for some keys, symbolic names for some indicators and a description of which.indicators are physically present..

C:\Program Files (x86)\Xming\xkb\keycodes\is-RURSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	16930
Entropy (8bit):	4.810988165214908
Encrypted:	false
SSDEEP:	384:xYGgrTCB5Yrx71Kwq1+I7BX1+q90+ggviGrHCjI:ZgHy5Yl71Kwq1+I7BX1+q90+RviGrHCE
MD5:	4D1DC94F10B0C48F25F35DF6F2C63CAD
SHA1:	FE3C51FB15BCB350BC7B9652678CB2C21FD2E545
SHA-256:	F9A5AAFCD198558EE7F1C0E673BBC9C19A295D8A4554A04C2F6496411C821952
SHA-512:	AA32BC5924C7918D2605BB9F4F71432CA8956B769974403D4E24586619DD34833D63C50A8235EDD64ED8944D8AE405F2BE4093D49785C43D11937B5959CD80E0
Malicious:	false
Preview:	// $XdotOrg: $.// $Xorg: sun,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS I

C:\Program Files (x86)\Xming\xkb\keycodes\is-VQDBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	4.58852487411281
Encrypted:	false
SSDEEP:	96:xvp35w0OSF+Lofrl2HlFU75+VBQo7fQ9SgHYBjFroODlHNA0qGt5rOyDHFnNdzC5:n4RuSv/BiKydrrsIFJUY/
MD5:	E599F1FCDEFC6466B6E6E7B81A0447D4
SHA1:	1F196E6AE2C1F02C3FB519B5E5AF70FA5D6DE2FF
SHA-256:	E21B5655F77A17E557C3C24CB7B17425E2BBB25618B5DE7EA7FE9627064F3638
SHA-512:	935606F957F9DD7443A5F0F5C78E393812768D1C0C73CAA9E349FBC385326CCA62B45E0E2A8F7D383E658341109A18CE6EF3882D55F28EFF66F302E1156F70BF
Malicious:	false
Preview:	// $XdotOrg: xc/programs/xkbcomp/keycodes/xfree86,v 1.1.4.4 2004/03/05 13:41:30 eich Exp $.// $Xorg: xfree86,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keycodes/xfree86,v 3.28 2003/11/21 04:46:42 dawes Exp $..// "standard" XFree86 codes.// It seems that the "default" must be the first entry in the file...default xkb_keycodes "xfree86" {. include "xfree86(basic)". <BKSL> = 51;. <LSGT> = 94;.};..xkb_keycodes "basic" {.. minimum= 8;. maximum= 255;.. <TLDE> = 49;. alias <AE00> = <TLDE>;.// Some geometries use AE00. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> =

C:\Program Files (x86)\Xming\xkb\keycodes\macintosh (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3891
Entropy (8bit):	5.056829495793215
Encrypted:	false
SSDEEP:	96:RhPQ+UqYQHKigrhL3Lgh2/39FV0ED60X+FINbvwGCsdHtS5e:9YQHdgrhrcQX7+yb1IA
MD5:	2C23AFCDC3FAA3FF32D266E33EC56294
SHA1:	643F2389061B7CCC694D24AF5D54B07DC4154E1A
SHA-256:	228D9E4C95B13D5816ED28B7F5EA45C5BD51D28BC545538B0876A69CFEA5D35E
SHA-512:	DE865479D3AEAB7B3FFA13888B23A69922E027C6C26962E1E0DE8D2F70E0FCF1DB48A6211F14F7F8608C8860C2B514119FF7386F4B5DC6F5F60916B9EFAC1CED
Malicious:	false
Preview:	// $XConsortium: macintosh /main/10 1996/01/24 12:17:35 kaleb $.//.//Copyright (c) 1996 X Consortium.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and/or sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\indigo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.371414923985239
Encrypted:	false
SSDEEP:	48:GtIu/y8vMFbK1XDawiFg4YXCTha039wg05/B4t9DKnp4xxpBhIFWUQ:gIeyOSbK1zziFiA39wl4t9DScpBhIFW3
MD5:	DD1A3586C64008A7BB6689AC603A6A89
SHA1:	7DC29F71E0E31A90474C2DD9E0D7A14161D97B78
SHA-256:	CEF6EE8552B18D9144E6A4545D82AC7E475B809733312FC89D91B2F0F2A4EFBC
SHA-512:	A404E27BB2705C4A2ECCF7D4EE6CFC1ED94A4495CEA35A0E50E7483FD27F5FA61C534C0D6B499F5BA735D48B498C341AA75F556441808FD66E330DE1D0A53EF2
Malicious:	false
Preview:	// $Xorg: indigo,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "pc101" {. minimum= 10;. maximum= 118;.. <TLDE> = 62;. <AE01> = 15;. <AE02> = 21;. <AE03> = 22;. <AE04> = 29;. <AE05> = 30;. <AE06> = 37;. <AE07> = 38;. <AE08> = 45;. <AE09> = 46;. <AE10> = 53;. <AE11> = 54;. <AE12> = 61;. <BKSP> = 68;.. <TAB> = 16;. <AD01> = 17;. <AD02> = 23;. <AD03> = 24;. <AD04> = 31;. <AD05> = 32;. <AD06> = 39;. <AD07> = 40;. <AD08> = 47;. <AD09> = 48;. <AD10> = 55;. <AD11> = 56;. <AD12> = 63;. <RTRN> = 58;.. <CAPS> = 11;. <AC01> = 18;. <AC02> = 19;. <AC03> = 25;. <AC04> = 26;. <AC05> = 33;. <AC06> = 34;. <AC07> = 41;. <AC08> = 42;. <AC09> = 49;. <AC10> = 50;. <AC11> = 57;.. <LFSH> = 13;. <AB01> = 27;. <AB02> = 28;. <AB03> = 35;. <AB04> = 36;. <AB05> = 43;. <AB06> = 44;. <AB07> = 51;. <AB08> = 52;. <AB09> = 59;. <AB10> = 60;. <RT

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\indy (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	4.747428035292875
Encrypted:	false
SSDEEP:	96:04+/E4De/nqywFGt86LbvnF2acMpdTYAVv+PpBhIFWUxpo40N/14T9EsFL4BtYQu:me9983pBhIFyB+
MD5:	E0B277FDC382E824417010707AC5C8CE
SHA1:	25139D2E2C87F79285BDB527C41F50C74FA6C0CD
SHA-256:	1570F09BD8B243E65493426753AC767A4E9B0112EBE56C253DE6DD0460CF61BA
SHA-512:	C7CA70F93F5C0E99E90365C015303954CF623642F511C186E8E0F4687593C3AB18C8E5838371332918ED78A432C19B5C2E5A1F98D0B8B28C3A94A3A72A013C45
Malicious:	false
Preview:	// $Xorg: indy,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "universal" {. minimum= 15;. maximum= 149;. include "sgi_vndr/indy(pc105)". alternate <BKSL> = 91;. alternate <BKSL> = 100;. alternate <BKSL> = 101;.};.xkb_keycodes "pc101" {. minimum= 15;. maximum= 149;.. <TLDE> = 22;. <AE01> = 30;. <AE02> = 38;. <AE03> = 46;. <AE04> = 45;. <AE05> = 54;. <AE06> = 62;. <AE07> = 69;. <AE08> = 70;. <AE09> = 78;. <AE10> = 77;. <AE11> = 86;. <AE12> = 93;. <BKSP> = 110;.. <TAB> = 21;. <AD01> = 29;. <AD02> = 37;. <AD03> = 44;. <AD04> = 53;. <AD05> = 52;. <AD06> = 61;. <AD07> = 68;. <AD08> = 75;. <AD09> = 76;. <AD10> = 85;. <AD11> = 92;. <AD12> = 99;. <RTRN> = 98;.. <CAPS> = 28;. <AC01> = 36;. <AC02> = 35;. <AC03> = 43;. <AC04> = 51;. <AC05> = 60;. <AC06> = 59;. <AC07> = 67;. <AC08> = 74;. <AC09> = 83;. <AC10> = 84;. <AC11> = 90;.. <LFSH> =

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\iris (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.73180336022442
Encrypted:	false
SSDEEP:	6:jLD+t+xo6OYVxA0aBWnEi3+Mim/Mi1+fMiUvXMizTzMQNMi3LWQNMixbN:jLlxnOY8pBWEiG+1wU7bMwbWwxh
MD5:	3A156961A9FC5EC7F5DE5AA293E70325
SHA1:	C5D71F3EB9E0284427850AA0EAFEB006E29CF40C
SHA-256:	345D4610AFED2D91A8C49ABB49AC5C48B510A1036728F34C218727876E712D3B
SHA-512:	21EE0EB384CDAAFAAB910FF978A593E4180FECD54B0A618C682E76D5FC96EB12B940A444E078217C27267F0171DCDF674207C38508CCD7FD363E72767157838A
Malicious:	false
Preview:	// $Xorg: iris,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "iris" {. include "sgi_vndr/indigo(pc101)". indicator 1 = "L1";. indicator 2 = "L2";. indicator 3 = "L3";. indicator 4 = "L4";. indicator 5 = "Caps Lock";. indicator 6 = "Num Lock";. indicator 7 = "Scroll Lock";.};.

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\is-5QV5J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.73180336022442
Encrypted:	false
SSDEEP:	6:jLD+t+xo6OYVxA0aBWnEi3+Mim/Mi1+fMiUvXMizTzMQNMi3LWQNMixbN:jLlxnOY8pBWEiG+1wU7bMwbWwxh
MD5:	3A156961A9FC5EC7F5DE5AA293E70325
SHA1:	C5D71F3EB9E0284427850AA0EAFEB006E29CF40C
SHA-256:	345D4610AFED2D91A8C49ABB49AC5C48B510A1036728F34C218727876E712D3B
SHA-512:	21EE0EB384CDAAFAAB910FF978A593E4180FECD54B0A618C682E76D5FC96EB12B940A444E078217C27267F0171DCDF674207C38508CCD7FD363E72767157838A
Malicious:	false
Preview:	// $Xorg: iris,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "iris" {. include "sgi_vndr/indigo(pc101)". indicator 1 = "L1";. indicator 2 = "L2";. indicator 3 = "L3";. indicator 4 = "L4";. indicator 5 = "Caps Lock";. indicator 6 = "Num Lock";. indicator 7 = "Scroll Lock";.};.

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\is-QCD0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	4.747428035292875
Encrypted:	false
SSDEEP:	96:04+/E4De/nqywFGt86LbvnF2acMpdTYAVv+PpBhIFWUxpo40N/14T9EsFL4BtYQu:me9983pBhIFyB+
MD5:	E0B277FDC382E824417010707AC5C8CE
SHA1:	25139D2E2C87F79285BDB527C41F50C74FA6C0CD
SHA-256:	1570F09BD8B243E65493426753AC767A4E9B0112EBE56C253DE6DD0460CF61BA
SHA-512:	C7CA70F93F5C0E99E90365C015303954CF623642F511C186E8E0F4687593C3AB18C8E5838371332918ED78A432C19B5C2E5A1F98D0B8B28C3A94A3A72A013C45
Malicious:	false
Preview:	// $Xorg: indy,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "universal" {. minimum= 15;. maximum= 149;. include "sgi_vndr/indy(pc105)". alternate <BKSL> = 91;. alternate <BKSL> = 100;. alternate <BKSL> = 101;.};.xkb_keycodes "pc101" {. minimum= 15;. maximum= 149;.. <TLDE> = 22;. <AE01> = 30;. <AE02> = 38;. <AE03> = 46;. <AE04> = 45;. <AE05> = 54;. <AE06> = 62;. <AE07> = 69;. <AE08> = 70;. <AE09> = 78;. <AE10> = 77;. <AE11> = 86;. <AE12> = 93;. <BKSP> = 110;.. <TAB> = 21;. <AD01> = 29;. <AD02> = 37;. <AD03> = 44;. <AD04> = 53;. <AD05> = 52;. <AD06> = 61;. <AD07> = 68;. <AD08> = 75;. <AD09> = 76;. <AD10> = 85;. <AD11> = 92;. <AD12> = 99;. <RTRN> = 98;.. <CAPS> = 28;. <AC01> = 36;. <AC02> = 35;. <AC03> = 43;. <AC04> = 51;. <AC05> = 60;. <AC06> = 59;. <AC07> = 67;. <AC08> = 74;. <AC09> = 83;. <AC10> = 84;. <AC11> = 90;.. <LFSH> =

C:\Program Files (x86)\Xming\xkb\keycodes\sgi_vndr\is-US5D3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.371414923985239
Encrypted:	false
SSDEEP:	48:GtIu/y8vMFbK1XDawiFg4YXCTha039wg05/B4t9DKnp4xxpBhIFWUQ:gIeyOSbK1zziFiA39wl4t9DScpBhIFW3
MD5:	DD1A3586C64008A7BB6689AC603A6A89
SHA1:	7DC29F71E0E31A90474C2DD9E0D7A14161D97B78
SHA-256:	CEF6EE8552B18D9144E6A4545D82AC7E475B809733312FC89D91B2F0F2A4EFBC
SHA-512:	A404E27BB2705C4A2ECCF7D4EE6CFC1ED94A4495CEA35A0E50E7483FD27F5FA61C534C0D6B499F5BA735D48B498C341AA75F556441808FD66E330DE1D0A53EF2
Malicious:	false
Preview:	// $Xorg: indigo,v 1.3 2000/08/17 19:54:39 cpqbld Exp $.default xkb_keycodes "pc101" {. minimum= 10;. maximum= 118;.. <TLDE> = 62;. <AE01> = 15;. <AE02> = 21;. <AE03> = 22;. <AE04> = 29;. <AE05> = 30;. <AE06> = 37;. <AE07> = 38;. <AE08> = 45;. <AE09> = 46;. <AE10> = 53;. <AE11> = 54;. <AE12> = 61;. <BKSP> = 68;.. <TAB> = 16;. <AD01> = 17;. <AD02> = 23;. <AD03> = 24;. <AD04> = 31;. <AD05> = 32;. <AD06> = 39;. <AD07> = 40;. <AD08> = 47;. <AD09> = 48;. <AD10> = 55;. <AD11> = 56;. <AD12> = 63;. <RTRN> = 58;.. <CAPS> = 11;. <AC01> = 18;. <AC02> = 19;. <AC03> = 25;. <AC04> = 26;. <AC05> = 33;. <AC06> = 34;. <AC07> = 41;. <AC08> = 42;. <AC09> = 49;. <AC10> = 50;. <AC11> = 57;.. <LFSH> = 13;. <AB01> = 27;. <AB02> = 28;. <AB03> = 35;. <AB04> = 36;. <AB05> = 43;. <AB06> = 44;. <AB07> = 51;. <AB08> = 52;. <AB09> = 59;. <AB10> = 60;. <RT

C:\Program Files (x86)\Xming\xkb\keycodes\sony (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3009
Entropy (8bit):	4.942853985210451
Encrypted:	false
SSDEEP:	48:AcjritctUOUqYQHEssz4INW3Z2rmUaOYCFkzY3MOuYaFmwI6hH8B0ncbjv0DortB:+CzUqYQHKQgrTLaY3VuYaFAecB0n2/Z5
MD5:	C273393E9E919AC67D2CE5F6B7E29A17
SHA1:	4DFB6C69DB81FEA4A9974A597269DD0E4C7533B6
SHA-256:	43B089C1C351B5DEC860DC7D930D220FCCCE34242436835CF8BD297ED9FA473A
SHA-512:	3E7122FD1256F5B329CEB9D2D34F08C6A917C2A916C01EDDF28478D6D052DADB17884CE490D013E6A1E2A3F5CFC4BCEE5498CB06C5D68A67631AC326AEDF9D22
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\keycodes\sun (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	16930
Entropy (8bit):	4.810988165214908
Encrypted:	false
SSDEEP:	384:xYGgrTCB5Yrx71Kwq1+I7BX1+q90+ggviGrHCjI:ZgHy5Yl71Kwq1+I7BX1+q90+RviGrHCE
MD5:	4D1DC94F10B0C48F25F35DF6F2C63CAD
SHA1:	FE3C51FB15BCB350BC7B9652678CB2C21FD2E545
SHA-256:	F9A5AAFCD198558EE7F1C0E673BBC9C19A295D8A4554A04C2F6496411C821952
SHA-512:	AA32BC5924C7918D2605BB9F4F71432CA8956B769974403D4E24586619DD34833D63C50A8235EDD64ED8944D8AE405F2BE4093D49785C43D11937B5959CD80E0
Malicious:	false
Preview:	// $XdotOrg: $.// $Xorg: sun,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS I

C:\Program Files (x86)\Xming\xkb\keycodes\xfree86 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	4.58852487411281
Encrypted:	false
SSDEEP:	96:xvp35w0OSF+Lofrl2HlFU75+VBQo7fQ9SgHYBjFroODlHNA0qGt5rOyDHFnNdzC5:n4RuSv/BiKydrrsIFJUY/
MD5:	E599F1FCDEFC6466B6E6E7B81A0447D4
SHA1:	1F196E6AE2C1F02C3FB519B5E5AF70FA5D6DE2FF
SHA-256:	E21B5655F77A17E557C3C24CB7B17425E2BBB25618B5DE7EA7FE9627064F3638
SHA-512:	935606F957F9DD7443A5F0F5C78E393812768D1C0C73CAA9E349FBC385326CCA62B45E0E2A8F7D383E658341109A18CE6EF3882D55F28EFF66F302E1156F70BF
Malicious:	false
Preview:	// $XdotOrg: xc/programs/xkbcomp/keycodes/xfree86,v 1.1.4.4 2004/03/05 13:41:30 eich Exp $.// $Xorg: xfree86,v 1.3 2000/08/17 19:54:37 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keycodes/xfree86,v 3.28 2003/11/21 04:46:42 dawes Exp $..// "standard" XFree86 codes.// It seems that the "default" must be the first entry in the file...default xkb_keycodes "xfree86" {. include "xfree86(basic)". <BKSL> = 51;. <LSGT> = 94;.};..xkb_keycodes "basic" {.. minimum= 8;. maximum= 255;.. <TLDE> = 49;. alias <AE00> = <TLDE>;.// Some geometries use AE00. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> =

C:\Program Files (x86)\Xming\xkb\keycodes\xfree98 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	4.90315003584438
Encrypted:	false
SSDEEP:	96:gCzUqYQHKQgrTLuU9zr90wa0FW8ww214dxb7+yHb:FYQHHgrTJAo7b
MD5:	9943156A29F7A4DF0E17263EECFF0842
SHA1:	1DBC7164B88D8AC0796BCCBE683A61F907A7D99E
SHA-256:	FF2C1B705B22EAEB989106A4D7BB855FDA0A7A81FE4CFF52AD42085D70A5F689
SHA-512:	1AE6653A1652DB9976E6B06782E5315574672CC34D41A55D15BCCC1FE8C8CCCF939A36CAE1BFC8AFDECF25C3D0DAEC23E3802F9643F233DE6B8B3BBA918F957A
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\keymap.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	15034
Entropy (8bit):	3.9512209002786007
Encrypted:	false
SSDEEP:	96:L2gXyly2adKG8NA0WVEuWrgs0F/DsIC8GpA45U57ursB6fRuOzuO:VXyly2RuWrgsY/DsIC8GQCYNO
MD5:	7B3F6D092410DB75F2C39634B6F95B63
SHA1:	79CFF6D1A51F92B9EE461DDA437958CB42EA2238
SHA-256:	815EDA1E5373CE9F70B0A2EAA62A268A0F1C56A7929D939FE26207F18EEA98C1
SHA-512:	252C134E7D58337FDB7604125CA1732D24F57C704014B67377D454D92CDB642A13B7594DAC5B11A8B6AD0535BEFE71E4A97183CBAC97071F110839F7BAE617C0
Malicious:	false
Preview:	-------- -------- sun_vndr/de(type4_de).-------- -------- sun_vndr/de(type4_de_nodeadkeys).-------- -------- sun_vndr/de(type4_de_openlook).-d------ -------- sun_vndr/de(type5_de).-------- -------- sun_vndr/de(type5_de_nodeadkeys).-------- -------- sun_vndr/de(type5_de_openlook).-------- -------- sun_vndr/es(type4_es).-------- -------- sun_vndr/es(type4_es_openlook).-d------ -------- sun_vndr/es(type5_es).-------- -------- sun_vndr/es(type5_es_openlook).-------- -------- sun_vndr/fi(type4_fi).-------- -------- sun_vndr/fi(type4_fi_openlook).-d------ -------- sun_vndr/fi(type5_fi).-------- -------- sun_vndr/fi(type5_fi_openlook).-------- -------- sun_vndr/fr(type4_fr).-------- -------- sun_vndr/fr(type4_fr_openlook).-d------ -------- sun_vndr/fr(type5_fr).-------- -------- sun_vndr/fr(type5_fr_openlook).-------- -------- sun_vndr/no(type4_no).-------- -------- sun_vndr/no(type4_no_openlook).-d------ -------- sun_vndr/no(type5_no).-------- -------- sun_vndr/no(type5_no_openlook).--------

C:\Program Files (x86)\Xming\xkb\keymap\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.360645245908676
Encrypted:	false
SSDEEP:	6:fJ8Kb4cRJINb0TjSAasKOQsCWmXptHf8QCYq62DuET:RX7INbkziONCW0XXCH62Dj
MD5:	92D6F9D5D4B69D50B2402FFF9906CCF0
SHA1:	6651FFB3CCF45A3DD96876E63A7F2D048ECA8420
SHA-256:	D5033FAC50DD48FF6D220652FE0DA42A8E22FB5BD293724C3DD9C0EC1947761C
SHA-512:	56FCA5051EEB250232588600DD6A04F69F78AEBFFC4AF1FA8D93FF51E1F2DF506C9A2C7C3BFB0B52457B4DBA4D7030BE3562C05EAAFCC4116F077ECD46E25A3A
Malicious:	false
Preview:	The keymap component provides a way how to set up one pre-defined keyboard.mapping from a given set. It has been obsoleted by 'rules' component which.is simplier and more flexible. The directory is preserved for compatibility.reasons. Avoid using it if it is possible..

C:\Program Files (x86)\Xming\xkb\keymap\amiga (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.061353658264361
Encrypted:	false
SSDEEP:	12:jLeU+XXzvaxdRTSLEQvnOH2HOlYP6mtZaCa89gt6Z89g98mtZpQbmtqlYP6mtNo8:CT+dBAxOHzlYP5baCx9gt6C9g9bbyiIA
MD5:	7F9160F711F4DE37398C74C8F4DC766C
SHA1:	B9C0C3617C547C38DB32C610DDEC280F7B627192
SHA-256:	CB8B415BFE3539E8B18D6AECCF3909BA86340C154F8EE8D0D424DB3EBFAF6187
SHA-512:	1F9F4D4173FE01A6DDB46158DFB5877CDE021B032535FFC1ABDC3B3427A60DB3FE687F052EF98EA30029EA24BEA7304720F166A363990037E48B18D01FB4CBDF
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keymap/amiga,v 3.2 1997/10/26 13:25:36 dawes Exp $..default xkb_keymap "usa1" {. xkb_keycodes.{ include "amiga(usa1)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "amiga(usa1)"..};. xkb_geometry.{ include "amiga(usa1)"..};.};..xkb_keymap "de" {. xkb_keycodes.{ include "amiga(de)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "amiga(de)"..};. xkb_geometry.{ include "amiga(de)"..};.};.

C:\Program Files (x86)\Xming\xkb\keymap\ataritt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.034944013607093
Encrypted:	false
SSDEEP:	12:jLzWdU+XXzvaxd2BLEQvnOHNlYP6mRLaCa89gt6Z89g98mRLpQbmRqlYP6msaCaV:LWxT+ELxOHNlYP5haCx9gt6C9g9bhyif
MD5:	F31B574FFFFEBCDCA78C673BD9EB79B1
SHA1:	3A5481ECA6B15218220E4CD5DAAF6AD68120C903
SHA-256:	CD1ACCFC430E521F5738C195E1B5A600EFDA625ACD5C68D3E41EED19565FFF2C
SHA-512:	CB07C3302ECA60376CBBF747EBBAF3D963CB550B0AFF5FDF4052DFAFA5CDE6AF2913793EA74F0642614D6870B0E44E16E3B40FC34CDB67AB45BA4FE55754E7D9
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keymap/ataritt,v 3.1 1997/10/26 13:25:37 dawes Exp $..default xkb_keymap "us" {. xkb_keycodes.{ include "ataritt(us)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "ataritt(us)"..};. xkb_geometry.{ include "ataritt(us)"..};.};.xkb_keymap "de" {. xkb_keycodes.{ include "ataritt(de)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "ataritt(de)"..};. xkb_geometry.{ include "ataritt(de)"..};.};.

C:\Program Files (x86)\Xming\xkb\keymap\digital_vndr\is-MSR8T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7571
Entropy (8bit):	5.1641210524481425
Encrypted:	false
SSDEEP:	96:xPQ4YQHqKoTrCvCJVWtUI+CJVEaUS+CJ6wvVI+CJ6bKUG+CJKDSUw+CJ8qUw+CJ0:ZYQHbYrCaJVWpCqYf7xw
MD5:	7A71802150507B571EB32C82DB28A22E
SHA1:	180157A341E9FDBC150BB47A5C2461CF0B021A0E
SHA-256:	5155DD44CC1AE9E954795114D297012AAE94B23C32A7BFE4B67A6FE0AB746B60
SHA-512:	CC7955298ABEBDC710FE9AB599E0AD61094781A9EE3514431805D3C0A2BBADEE17A0A632EB8A186F6B3F67E111281F1AA2F7AD42E2006E3DAD58EB3A774FE588
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keymap\digital_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7571
Entropy (8bit):	5.1641210524481425
Encrypted:	false
SSDEEP:	96:xPQ4YQHqKoTrCvCJVWtUI+CJVEaUS+CJ6wvVI+CJ6bKUG+CJKDSUw+CJ8qUw+CJ0:ZYQHbYrCaJVWpCqYf7xw
MD5:	7A71802150507B571EB32C82DB28A22E
SHA1:	180157A341E9FDBC150BB47A5C2461CF0B021A0E
SHA-256:	5155DD44CC1AE9E954795114D297012AAE94B23C32A7BFE4B67A6FE0AB746B60
SHA-512:	CC7955298ABEBDC710FE9AB599E0AD61094781A9EE3514431805D3C0A2BBADEE17A0A632EB8A186F6B3F67E111281F1AA2F7AD42E2006E3DAD58EB3A774FE588
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\keymap\is-DNF0K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.025954586701593
Encrypted:	false
SSDEEP:	12:jLpNOWXzvaxceQmVxnOVlYP6qjaCa89Gt6Z89G98qPUBepQbq+2lYP6qHaCa89Gp:RNOk+ZZHOVlYPpaCx9Gt6C9G9Qey4lYy
MD5:	5E3645BA5FE39A6E3F950F3BEC96598F
SHA1:	F53F9C5ABB642685BF15ED63E0F96B8B947AC624
SHA-256:	83D01DFC82E7D73015A825D5E5EDD4166E05E850995B5FAE2D23EB6429C4BB53
SHA-512:	BE050B4E3A231973C744F8B12F465402B36F71A7FB49B4939C2B1C23758FE2A061465A60EC66FD958D12087369FDCB0B461AD759DA62E5F7C06BD8C15F4E032E
Malicious:	false
Preview:	// $XConsortium: macintosh /main/11 1996/03/07 13:42:13 kaleb $.// $XFree86: xc/programs/xkbcomp/keymap/macintosh,v 1.1 1999/05/23 05:27:51 dawes Exp $.default xkb_keymap "macintosh" {. xkb_keycodes.{ include "macintosh"....};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols..{ include "macintosh_vndr/us(extended)"..};. xkb_geometry.{ include "macintosh"....};.};..xkb_keymap "macintosh_old" {. xkb_keycodes.{ include "macintosh(old)"....};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols..{ include "macintosh_vndr/us(extended)"..};. xkb_geometry.{ include "macintosh"....};.};.

C:\Program Files (x86)\Xming\xkb\keymap\is-FOSLV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1508
Entropy (8bit):	5.362194604499087
Encrypted:	false
SSDEEP:	24:AcikFvjHHCq6kWRmq6U14Uqq9QHEsUbz48Ok4uv8dYo3TdQlTr3WUawRYCFl2lYb:AcjritctUOUqYQHEssz4INW3Z2rmUaOv
MD5:	45B0FCF0AA95E1CEC7686BE48754C6C6
SHA1:	70A764ABCA1CB5833BD3AA95F2E84D1A974B0CF6
SHA-256:	5DCA51A75EE353AC555AD7A82676B44C777E3B34875F1EED18C78F74E07A02FB
SHA-512:	383D993A1A1790295BA6D0C087919F2DDEA50E87B11A7E0F8AA7382B3AF6D5F4F6907AB479C4A05AD4E56F9F8702FCEE9637EEEB41807C2747C26AFD49F04BAD
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\keymap\is-L3R8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.034944013607093
Encrypted:	false
SSDEEP:	12:jLzWdU+XXzvaxd2BLEQvnOHNlYP6mRLaCa89gt6Z89g98mRLpQbmRqlYP6msaCaV:LWxT+ELxOHNlYP5haCx9gt6C9g9bhyif
MD5:	F31B574FFFFEBCDCA78C673BD9EB79B1
SHA1:	3A5481ECA6B15218220E4CD5DAAF6AD68120C903
SHA-256:	CD1ACCFC430E521F5738C195E1B5A600EFDA625ACD5C68D3E41EED19565FFF2C
SHA-512:	CB07C3302ECA60376CBBF747EBBAF3D963CB550B0AFF5FDF4052DFAFA5CDE6AF2913793EA74F0642614D6870B0E44E16E3B40FC34CDB67AB45BA4FE55754E7D9
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keymap/ataritt,v 3.1 1997/10/26 13:25:37 dawes Exp $..default xkb_keymap "us" {. xkb_keycodes.{ include "ataritt(us)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "ataritt(us)"..};. xkb_geometry.{ include "ataritt(us)"..};.};.xkb_keymap "de" {. xkb_keycodes.{ include "ataritt(de)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "ataritt(de)"..};. xkb_geometry.{ include "ataritt(de)"..};.};.

C:\Program Files (x86)\Xming\xkb\keymap\is-N0GPA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.360645245908676
Encrypted:	false
SSDEEP:	6:fJ8Kb4cRJINb0TjSAasKOQsCWmXptHf8QCYq62DuET:RX7INbkziONCW0XXCH62Dj
MD5:	92D6F9D5D4B69D50B2402FFF9906CCF0
SHA1:	6651FFB3CCF45A3DD96876E63A7F2D048ECA8420
SHA-256:	D5033FAC50DD48FF6D220652FE0DA42A8E22FB5BD293724C3DD9C0EC1947761C
SHA-512:	56FCA5051EEB250232588600DD6A04F69F78AEBFFC4AF1FA8D93FF51E1F2DF506C9A2C7C3BFB0B52457B4DBA4D7030BE3562C05EAAFCC4116F077ECD46E25A3A
Malicious:	false
Preview:	The keymap component provides a way how to set up one pre-defined keyboard.mapping from a given set. It has been obsoleted by 'rules' component which.is simplier and more flexible. The directory is preserved for compatibility.reasons. Avoid using it if it is possible..

C:\Program Files (x86)\Xming\xkb\keymap\is-NJFBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	13334
Entropy (8bit):	4.887790905214669
Encrypted:	false
SSDEEP:	384:3pamaeaYSvihaiaaafala5aa9va8a03aJabavaLtaWagaRaoayaqoacaNBgBSafR:3pamaeaYThaiaaafala5aa9va8a03aJe
MD5:	D4EFCE24EAE7BA7BB9C1ABF5C5A607D8
SHA1:	79FFF43AC33D9DF6AB50F16587ED41B66DD6F5A3
SHA-256:	4BCC1063B461DB6CBD21AB341EF19FC93966A255C043C566E139EEB4AC71FF27
SHA-512:	8445A7E679BFBD3AD080CE3F7EBE75B906C75011E2C1B167441A0067BE7B463FBC6D313BAA3F60242AE1C615AE63FC94F094B4A3D041BEB8761BEEDE2CD0AF94
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/xfree86,v 3.30 2003/04/03 16:34:49 dawes Exp $...default xkb_keymap "us" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "us(pc105)"..};. xkb_geometry.{ include "pc"...};.};..// "ar" addition by Arabeyes Team, <support@arabeyes.org>.xkb_keymap "ar" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+ar".};. xkb_geometry.{ include "pc(pc102)"..};.};.xkb_keymap "be".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+be".};. xkb_geometry .{ include "pc(pc102)"..};.};.xkb_keymap "bg".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default".

C:\Program Files (x86)\Xming\xkb\keymap\is-SA8MB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.392151624523476
Encrypted:	false
SSDEEP:	48:ZjritctUOUqYQHEssz4INW3Z2rmUaOYCFv+5BmlqGaoecCeP7l:gCzUqYQHKQgrTLisqSdCG
MD5:	46E587B1E1464BD881D2D062507EC325
SHA1:	76EF529D9CF6052BCCFA0CB4602B5C6C7701B34D
SHA-256:	3FDDA7D7671DD24DC62CC3BCCB2631A2CA29C4EA79A5DD6BA02618EFEBEC1E0D
SHA-512:	36325F4531797EA4383DD3B2ED5E6FD3CD18E5B52A3A3919122982BE0A452D572ADCD1A9A6C1A3B9B6EABD93EB310FD33EB2EFF90C9B7547E8BFBED69F920CB6
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\keymap\is-T2UKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.061353658264361
Encrypted:	false
SSDEEP:	12:jLeU+XXzvaxdRTSLEQvnOH2HOlYP6mtZaCa89gt6Z89g98mtZpQbmtqlYP6mtNo8:CT+dBAxOHzlYP5baCx9gt6C9g9bbyiIA
MD5:	7F9160F711F4DE37398C74C8F4DC766C
SHA1:	B9C0C3617C547C38DB32C610DDEC280F7B627192
SHA-256:	CB8B415BFE3539E8B18D6AECCF3909BA86340C154F8EE8D0D424DB3EBFAF6187
SHA-512:	1F9F4D4173FE01A6DDB46158DFB5877CDE021B032535FFC1ABDC3B3427A60DB3FE687F052EF98EA30029EA24BEA7304720F166A363990037E48B18D01FB4CBDF
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.....// $XFree86: xc/programs/xkbcomp/keymap/amiga,v 3.2 1997/10/26 13:25:36 dawes Exp $..default xkb_keymap "usa1" {. xkb_keycodes.{ include "amiga(usa1)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "amiga(usa1)"..};. xkb_geometry.{ include "amiga(usa1)"..};.};..xkb_keymap "de" {. xkb_keycodes.{ include "amiga(de)"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "amiga(de)"..};. xkb_geometry.{ include "amiga(de)"..};.};.

C:\Program Files (x86)\Xming\xkb\keymap\macintosh (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.025954586701593
Encrypted:	false
SSDEEP:	12:jLpNOWXzvaxceQmVxnOVlYP6qjaCa89Gt6Z89G98qPUBepQbq+2lYP6qHaCa89Gp:RNOk+ZZHOVlYPpaCx9Gt6C9G9Qey4lYy
MD5:	5E3645BA5FE39A6E3F950F3BEC96598F
SHA1:	F53F9C5ABB642685BF15ED63E0F96B8B947AC624
SHA-256:	83D01DFC82E7D73015A825D5E5EDD4166E05E850995B5FAE2D23EB6429C4BB53
SHA-512:	BE050B4E3A231973C744F8B12F465402B36F71A7FB49B4939C2B1C23758FE2A061465A60EC66FD958D12087369FDCB0B461AD759DA62E5F7C06BD8C15F4E032E
Malicious:	false
Preview:	// $XConsortium: macintosh /main/11 1996/03/07 13:42:13 kaleb $.// $XFree86: xc/programs/xkbcomp/keymap/macintosh,v 1.1 1999/05/23 05:27:51 dawes Exp $.default xkb_keymap "macintosh" {. xkb_keycodes.{ include "macintosh"....};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols..{ include "macintosh_vndr/us(extended)"..};. xkb_geometry.{ include "macintosh"....};.};..xkb_keymap "macintosh_old" {. xkb_keycodes.{ include "macintosh(old)"....};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols..{ include "macintosh_vndr/us(extended)"..};. xkb_geometry.{ include "macintosh"....};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\be (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.9438587311708115
Encrypted:	false
SSDEEP:	24:k+OxLlYPGBPtaCx9Dt6C9D9ExaytBFulYPGBPGaCx9gt6C9g9NxbLytBSOlYPGBe:tSLlqWaolcClJrlqzaoecCe5SlqGaoeZ
MD5:	CC55B84C69DFB8AD3CB3FE394A19803D
SHA1:	1C7E295CFEFFF8AC7E67FBD2E93B117C98F303F9
SHA-256:	88071D194BAB5482144285A9623B8A7C3FBA1C7E29C65CE8744D3ED4D2C2AE56
SHA-512:	2C675DF333E2C4F00DC2D66784BA19DCC0C974C882A9854247BCFB2C6F55AA8E3B69C252412D48DEDB092EAFB338712CA906B665073BDD48A89755830CE5BD95
Malicious:	false
Preview:	// $Xorg: be,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+be".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+be(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+be".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\bg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.026068424357165
Encrypted:	false
SSDEEP:	12:jLcjU9xnOxwOlYP6pBPGaCa89gt6Z89g9jyUQtPDiLpQbpBGFOlYP6pBWgaCa89m:keOxLlYPGBPGaCx9gt6C9g9eriLytBSL
MD5:	7B2B29BBB33BC2B5BEAB9E60B314B6BD
SHA1:	EC588969D50FC78A51546866839CA679484AF820
SHA-256:	06EB0D0121F609AEC18F606B6CC3BE14765967E8A54AFBC9E0CBF7A142393679
SHA-512:	2D7921F8AFD9074F9E9C2C33744CC2865AFE3493A41BAD66122FF9C5BB337557B902AE6B22B7CE957B115D8D5D4292C4B8D27FE9A4CD65E6CBC6415717771C41
Malicious:	false
Preview:	// $Xorg: bg,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "us(pc_universal)+bg+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "us(pc102)+bg+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949823352388467
Encrypted:	false
SSDEEP:	24:QrOxLlYPGBPtaCx9Dt6C9D9ExlytBFulYPGBPGaCx9gt6C9g9Nx2LytBSOlYPGBQ:QrSLlqWaolcClerlqzaoecCe+SlqGaoe
MD5:	B9E18A012F69AA5B57793DC3BE6FD0BB
SHA1:	D59206FCDA4C77F434769C562C79FD4FADFCFA5D
SHA-256:	FA4D183BD91169C9F94D1D473EB5C99192094D57721A6C8D4C90AFEFB88E5D0B
SHA-512:	2C53C32B2DE1EEEA691DCD0B0A79C4C76D653A0F9F950D61561E93EEDFDCC5DCEAB577D775A2120258AF7890291701050DA54996B3EC35BED5868F5EDFB882E6
Malicious:	false
Preview:	// $Xorg: ca,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+ca".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+ca(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+ca".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\ch (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2457
Entropy (8bit):	4.933916783965993
Encrypted:	false
SSDEEP:	48:5MlqWaolcCltsglqzaoecCeHelqGaoecCeHwElqGaoecCecEaGOlqWaolcCl/63c:wqi2CvqRdC9qSdCmdqSdCprqi2CtqRdW
MD5:	BD47E2BF739007CC470615C7CE075A8B
SHA1:	FA5B11566987D286DA40ABBE2D39080F0F1E77B1
SHA-256:	2A54567A57F7A1655A393F8E3ED6960D24C4ED0D23FD333988C583E8872204E9
SHA-512:	3BC70F458EA1256C6E5514B056FBFEB6794310434A9E20A1FF4E87196570C17DC1DCC36CFC5FDC349E463F61B283601FC96F368AD35C5BAE47B6856D3339F985
Malicious:	false
Preview:	// $Xorg: de_CH,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "de_indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+ch(de)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "de_indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+ch(de_nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "de_indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+ch(de)".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "de_indigo_nodeadkeys" {. xkb_keycodes.{ incl

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\cz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	4.9783673071183605
Encrypted:	false
SSDEEP:	24:Q8WOxLlYPGBPtaCx9Dt6C9D9kgoytBXOlYPGBaaCx9Dt6C9D9jytBCOCNlYPGBPF:QbSLlqWaolcClanlqtaolcClBl/NlqWL
MD5:	9C07984F24D9F2E06B3A9CA108A31C5F
SHA1:	8120082848BEA4C9D1FCBED7CF051850A8BE671F
SHA-256:	AB07A02C3F31AB17008D219462A6A70E6307DFF6A5B53D3900A063C01DD04F0B
SHA-512:	A59BDD8A073B4DC98464E14F2ACE2ECA39207F8BF42EFFE0A7755848A32E0B2DB89971EC3CB2F312780563D45417F6CF293E8D86662B017DA2059BE31AFAAEBA
Malicious:	false
Preview:	// $Xorg: cs,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//..default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+cz"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc102)+cz"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};..default xkb_keymap "indy_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+cz(qwerty)" };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\de (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	4.932251205010505
Encrypted:	false
SSDEEP:	24:HOxLlYPGBPkaCx9Gt6C9G9ExfytBCulYPGBPtaCx9Dt6C9D9NxLtLytBXOlYPGBY:HSLlqdaoccCc+alqWaolcClRlnlqtaod
MD5:	D8712D060EEEE880F92182759F3DEE40
SHA1:	324DFB5CD24568E8AF08BE0645735E8F81C9816A
SHA-256:	5ECFB34E4925DD85159DE7838263E91AC7991BD5FC5D16D3CC6779348CFF40CD
SHA-512:	F7DF1A98A6A8194A2DAF0B72F62C8DE1C340DFE341EFBDB078EBC0D3F74201AD4CAE3B8F2461E3383DE76F6815CED3639A99719A5F094BA4BA1FE91328A770C0
Malicious:	false
Preview:	// $Xorg: de,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+de"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+de(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc102)+de"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vnd

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\dk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	4.933680203033694
Encrypted:	false
SSDEEP:	24:lOxLlYPGBPkaCx9Gt6C9G9ExQoytBCulYPGBPtaCx9Dt6C9D9NxZtLytBXOlYPGN:lSLlqdaoccCcMalqWaolcClhnlqtaolU
MD5:	2373C02A9EBD3281AE05EA3E22D63343
SHA1:	4A2E3B33DB74141DBD5E352E87A0F40BCE891240
SHA-256:	91A19A580901D49D5422F6315535A097AF9DCCD78A5FCE5422197C851C039A9E
SHA-512:	D74D7779133861EA7F20D235094AE341808DB2E07DEB86CF93DA22F8952E257E0153E978C3406B0A282578D72F68768E09DB573CFED3F3948346F782B0BC392E
Malicious:	false
Preview:	// $Xorg: dk,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+dk"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+dk(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc102)+dk"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vnd

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\dvorak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	605
Entropy (8bit):	4.987705831533287
Encrypted:	false
SSDEEP:	12:jLKU9xnOxwOlYP6pBPtaCa89PLt6Z89PL9y6yUQtPRYLpQbpBBqFOlYP6pBWqLaP:fOxLlYPGBPtaCx9Dt6C9D9kJYLytBwOi
MD5:	1C016BB7B4A73ADD562E630816DE7643
SHA1:	CDF90DD2705DD8D73B3E69597CC8958EFF8D1044
SHA-256:	1EDE8D2BBD68A3C7B6A5936188904B47E64142186823ABE48FEE92BB2B3BC137
SHA-512:	A0639EC4265957B8E9E67FF2913619CA15771918DF7CE014EB2E6C375D6745CF6E33FF7E55F0B188C684BEE9F181F8F605130D88D33FADF5DD1ACBA5089B6CE0
Malicious:	false
Preview:	// $Xorg: dvorak,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+dvorak".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc101)+dvorak".};. xkb_geometry.{ include "sgi_vndr/indigo(pc101)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\es (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.946786409268733
Encrypted:	false
SSDEEP:	24:AOxLlYPGBPtaCx9Dt6C9D9ExFytBFulYPGBPGaCx9gt6C9g93xWLytBSOlYPGB/q:ASLlqWaolcClSrlqzaoecCeASlqGaoe7
MD5:	9EA004CB4D0E2D9D74FA3DBF70D635A9
SHA1:	46C912DE0167ADF3EF05D2834C3259A0972F4B5F
SHA-256:	61249804A4A89D905AD3F9CEF9998C855DDA288F66D54C20ED6291805A1A03E0
SHA-512:	493F8A2884F09D86FF923BD0EE55A29795F7FC2C7BD6FC402EE350D30A49245491F2A0A197F3EDC19BCEB21D9577C0A418D07EFC8F8EA5F127B11FF1E95F98D3
Malicious:	false
Preview:	// $Xorg: es,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+es".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+es(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+es".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\fi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954557578079852
Encrypted:	false
SSDEEP:	24:tOxLlYPGBPtaCx9Dt6C9D9ExaytBFulYPGBPGaCx9gt6C9g93xrLytBSOlYPGB/Y:tSLlqWaolcClhrlqzaoecCeLSlqGaoe9
MD5:	F25355C6118BE9219F61B3E7757F7ED2
SHA1:	CAE13A5D2B9128F69ABA6B90C41FA27A1D2358E7
SHA-256:	9AB7F8F9FE65B2C7830D577E22C703F0F678E5DE02B314C8B14C40C32BA31E5E
SHA-512:	E6EB976CCC3408C4EE90CC78D10AAAF058072E7D19599FEC4E90FE28CF4C476E8577EA8938EFE5C1B9AEF2E0E401AA347539370F505B427067F578B1B05A0A9D
Malicious:	false
Preview:	// $Xorg: fi,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+fi".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+fi(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+fi".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\fr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.957335948779859
Encrypted:	false
SSDEEP:	24:rYOxLlYPGBPtaCx9Dt6C9D9ExigytBFulYPGBPGaCx9gt6C9g9WxyLytBSOlYPGs:rYSLlqWaolcClurlqzaoecCeXSlqGaos
MD5:	76ADCB6535714657A407BA6BE6109DF5
SHA1:	78C8C36B4D47D8EF1260AB7B4FF73460CC8E60D0
SHA-256:	4372E86814FDFF16FCCC1B42C169386FAB2717F558D56248A9C90CD3E215C909
SHA-512:	C9C4ECB64E4EF5EF3854A962A6721D722B95448A9C15B4BC69860BBD9EC6F1FE20A21802441FCD17DE3D0009B38CFB7DD274657477CAEAF2CBDAEC59D291D152
Malicious:	false
Preview:	// $Xorg: fr,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+fr".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "en_US(pc_universal_nodeadkeys)+fr(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+fr".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\gb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954358991613406
Encrypted:	false
SSDEEP:	24:lOxLlYPGBPtaCx9Dt6C9D9ExmytBFulYPGBPGaCx9gt6C9g93xDLytBSOlYPGB/Y:lSLlqWaolcClFrlqzaoecCeTSlqGaoeR
MD5:	F1CBD2148B89572EECB08C3CC2EB64BB
SHA1:	EC2180B92FCF8895164DA0F470450DFD9DF8914E
SHA-256:	8A946D7B0BBD04A63DF870BD621B95BD9D5A592B0D6E6E47E115C09B332C6FB8
SHA-512:	86869935DA977F14FADB79C78A9C587CF1A063AECFEDD354C7E234D9EC7FB5EFF8528E9E06A0FEC611F50ED9A343E1FC28916379608AA29369352933554D1137
Malicious:	false
Preview:	// $Xorg: gb,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+gb".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+gb(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+gb".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\hu (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.941190061655961
Encrypted:	false
SSDEEP:	96:dqPXCTqi2Cqqi2CEqi2Cotqi2Cosqi2C2qf2CJqqf2CR5qf2CRXqf2CR91qf2CRm:kRSAgNe5ThQhahChrhk
MD5:	33D83986FA3073238B5F7E4A2420FEFD
SHA1:	223BCFE34F7E8CB3B5438842FA9F0504A847D211
SHA-256:	CBA540A38C14E1BB54BDF2B9DC7CA73814081E12178820746380CB042C0024DB
SHA-512:	F811F0356F57D8F3C9410F3672250A766FE848F18574CB50E55FF0DBEC3592F7A30B0D2B6F53729F882F6B47BA16196969B5C5B9F1581A5ACAEC7CF1D6DF8B88
Malicious:	false
Preview:	// $Xorg: hu,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+hu(basic)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+hu(basic)+group(toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_shift_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+hu(basic)+group(shifts_toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-2OSM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	4.9783673071183605
Encrypted:	false
SSDEEP:	24:Q8WOxLlYPGBPtaCx9Dt6C9D9kgoytBXOlYPGBaaCx9Dt6C9D9jytBCOCNlYPGBPF:QbSLlqWaolcClanlqtaolcClBl/NlqWL
MD5:	9C07984F24D9F2E06B3A9CA108A31C5F
SHA1:	8120082848BEA4C9D1FCBED7CF051850A8BE671F
SHA-256:	AB07A02C3F31AB17008D219462A6A70E6307DFF6A5B53D3900A063C01DD04F0B
SHA-512:	A59BDD8A073B4DC98464E14F2ACE2ECA39207F8BF42EFFE0A7755848A32E0B2DB89971EC3CB2F312780563D45417F6CF293E8D86662B017DA2059BE31AFAAEBA
Malicious:	false
Preview:	// $Xorg: cs,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//..default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+cz"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc102)+cz"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};..default xkb_keymap "indy_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+cz(qwerty)" };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-3NF00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.108833516361834
Encrypted:	false
SSDEEP:	6:jLDiU9++xo6OW8xFwOlYP6UA0aBKUvuaT2aUA89cLt6nUA89cL90xaMaUAyjRyVW:jLuO9xnOxwOlYP6pBKjaCa89Gt6Z89G0
MD5:	77C70AA643287710BBFBED6A317505E8
SHA1:	ED057EB7CB3327BDDF9076969532D81BB8565B90
SHA-256:	0D50CCF319C17ED7BA051ABD83E3728374486CFAA1FB84AA7562D0BCDC18CE95
SHA-512:	C00E72A1079967CFDAB6532255B6CE26B07A9C99BC94870A647A85DCECA55B940E84DB78A135BF550D2ACD7574DFA4AAB47826535C83F5E3FE3DD30AE9C26C71
Malicious:	false
Preview:	// $Xorg: jp,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(jp106)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "us(pc101)+sgi_vndr/jp"...};. xkb_geometry.{ include "sgi_vndr/indy(jp106)"...};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-4GE7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.026068424357165
Encrypted:	false
SSDEEP:	12:jLcjU9xnOxwOlYP6pBPGaCa89gt6Z89g9jyUQtPDiLpQbpBGFOlYP6pBWgaCa89m:keOxLlYPGBPGaCx9gt6C9g9eriLytBSL
MD5:	7B2B29BBB33BC2B5BEAB9E60B314B6BD
SHA1:	EC588969D50FC78A51546866839CA679484AF820
SHA-256:	06EB0D0121F609AEC18F606B6CC3BE14765967E8A54AFBC9E0CBF7A142393679
SHA-512:	2D7921F8AFD9074F9E9C2C33744CC2865AFE3493A41BAD66122FF9C5BB337557B902AE6B22B7CE957B115D8D5D4292C4B8D27FE9A4CD65E6CBC6415717771C41
Malicious:	false
Preview:	// $Xorg: bg,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "us(pc_universal)+bg+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "us(pc102)+bg+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-558UB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.941190061655961
Encrypted:	false
SSDEEP:	96:dqPXCTqi2Cqqi2CEqi2Cotqi2Cosqi2C2qf2CJqqf2CR5qf2CRXqf2CR91qf2CRm:kRSAgNe5ThQhahChrhk
MD5:	33D83986FA3073238B5F7E4A2420FEFD
SHA1:	223BCFE34F7E8CB3B5438842FA9F0504A847D211
SHA-256:	CBA540A38C14E1BB54BDF2B9DC7CA73814081E12178820746380CB042C0024DB
SHA-512:	F811F0356F57D8F3C9410F3672250A766FE848F18574CB50E55FF0DBEC3592F7A30B0D2B6F53729F882F6B47BA16196969B5C5B9F1581A5ACAEC7CF1D6DF8B88
Malicious:	false
Preview:	// $Xorg: hu,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+hu(basic)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+hu(basic)+group(toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_shift_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+hu(basic)+group(shifts_toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-9RMVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	4.8857413572203106
Encrypted:	false
SSDEEP:	48:LvSLlqWaolcClIglqzaoecCeZQlqzaoecCeZVlq7aoecCeOQlq7aoecCe3+lq7aa:Kqi2CdqRdCLqRdCeqpdC8qpdCpqpdCy
MD5:	93A06BBC759CF55B3CA666A0CF080735
SHA1:	B5956F7ADED400117F7C6151B0FD2998A5C89073
SHA-256:	3744E42F54A33683825726ADC34A8246244329BACD4867F235BB65FA8682999F
SHA-512:	908DC3767F90AA7C9C51DB16A7CEAB994C78FC3BC41D8FC9EC0890C10361617B1FCF82C118832706C5F299CAD88DBEE52276EBE49AC9BB7F397C4D540CBFE2D3
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)"..};. xkb_geometry.{ include "sgi_vndr/indy(pc101)"..};.};.xkb_keymap "indy101_euro" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)".};.};.xkb_keymap "indy_compose" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc101)".};. xkb_types..{ include "default"..};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-A5MKV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.080991095866439
Encrypted:	false
SSDEEP:	12:jLMW39xnOxwOlYP6pBPGaCa89gt6Z89g9yrfix7tP2iLpQbpBGFOlYP6pBWgaCal:v3vOxLlYPGBPGaCx9gt6C9g93xuiLytY
MD5:	954A6FDA260E2EF597D8AB438B0DFEB3
SHA1:	F413C2AE12AC577F71DA70413AE9A9A7C7E4E948
SHA-256:	278668A7409A50F8607F0F5533CD0F4467220741FE08F932F29150BD754E1AA4
SHA-512:	38F1A4AB823FB00FEE7D4187446198FD41500B1B0C2914C980EC57CED7028C0A5310664D8D81055171AD8185870B7D25634183FB100A1324ECB79020A36A1FE6
Malicious:	false
Preview:	// $Xorg: th,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal)+th+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+th+group(shifts_toggle)".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-A7VGI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	4.945341192353447
Encrypted:	false
SSDEEP:	24:AuvOxLlYPGBPtaCx9Dt6C9D9ExhytBFulYPGBPGaCx9gt6C9g93xqLytBSOlYPGY:AuvSLlqWaolcClirlqzaoecCe8SlqGa3
MD5:	F6159E8D3486635B0A64CC5971F9D525
SHA1:	464B3DBAF46529D75D1405B1060EED1492FE3549
SHA-256:	1A16BDE77448CF3BAA166524D7760736781C8480ECB698D0BDB74C684AF7837E
SHA-512:	8FFAF069DAAB14485FAB5E5DF557146217B26EF405904976E58B9502231215975B30B6DF98EB0BB579637F526E8EE44C185B77C45353952CA2C7920AAE91112A
Malicious:	false
Preview:	// $Xorg: se,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+se".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+se(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+se".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-DC51D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949483043300648
Encrypted:	false
SSDEEP:	24:03vOxLlYPGBPtaCx9Dt6C9D9Ex6ytBFulYPGBPGaCx9gt6C9g93xCqLytBSOlYPl:IvSLlqWaolcClNrlqzaoecCeXSlqGaoa
MD5:	DD82F34746AD010592C8B9192FA02C5C
SHA1:	5DFDDB6D1C37BF9AEE3E55ED138F3A0EFB002968
SHA-256:	CEC4BF2E817446F8D9B008CF4BB70778E229B4A2A10484083D9A3DB66ACC68AB
SHA-512:	A50328115B7F52AC9D9BEE683D9960EA34EE8BCE4287718A88C461D6F43565C3358A735390306B3D7318A9A55C59CF838151765BFA28BE72FDD976941DF94FD1
Malicious:	false
Preview:	// $Xorg: it,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+it".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+it(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+it".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-DD0PH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	4.933680203033694
Encrypted:	false
SSDEEP:	24:lOxLlYPGBPkaCx9Gt6C9G9ExQoytBCulYPGBPtaCx9Dt6C9D9NxZtLytBXOlYPGN:lSLlqdaoccCcMalqWaolcClhnlqtaolU
MD5:	2373C02A9EBD3281AE05EA3E22D63343
SHA1:	4A2E3B33DB74141DBD5E352E87A0F40BCE891240
SHA-256:	91A19A580901D49D5422F6315535A097AF9DCCD78A5FCE5422197C851C039A9E
SHA-512:	D74D7779133861EA7F20D235094AE341808DB2E07DEB86CF93DA22F8952E257E0153E978C3406B0A282578D72F68768E09DB573CFED3F3948346F782B0BC392E
Malicious:	false
Preview:	// $Xorg: dk,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+dk"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+dk(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc102)+dk"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vnd

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-G9ESM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.932242923034038
Encrypted:	false
SSDEEP:	24:MOvOxLlYPGBPGaCx9gt6C9g9kDZytBculYPGBPkaCx9Gt6C9G9kaYytBgOlYPGBD:nvSLlqzaoecCewslqdaoccCc4IlqGao1
MD5:	E667B7B7B17B35E99229EFCA6346643F
SHA1:	C093FA559DF9F732C12FE8A2EDD7BFEC7D2DAB6B
SHA-256:	F89F5BBE6C412C10B3B72C86F24DBD8174F95CD2FFA77FF4A728AB80D479A69B
SHA-512:	2291A761EB7EAFDC2086672F2D8A0E1FA45B4EACC2F190491956CE469AFE9DF336CAC50FD672622156F877979E00EAE2B5A954AAFE80F29AA3260AAC338C5114
Malicious:	false
Preview:	// $Xorg: pl,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)+pl".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "us(pc_universal)+pl(nodeadkeys)" .};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc102)+pl".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-GKF6T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954557578079852
Encrypted:	false
SSDEEP:	24:tOxLlYPGBPtaCx9Dt6C9D9ExaytBFulYPGBPGaCx9gt6C9g93xrLytBSOlYPGB/Y:tSLlqWaolcClhrlqzaoecCeLSlqGaoe9
MD5:	F25355C6118BE9219F61B3E7757F7ED2
SHA1:	CAE13A5D2B9128F69ABA6B90C41FA27A1D2358E7
SHA-256:	9AB7F8F9FE65B2C7830D577E22C703F0F678E5DE02B314C8B14C40C32BA31E5E
SHA-512:	E6EB976CCC3408C4EE90CC78D10AAAF058072E7D19599FEC4E90FE28CF4C476E8577EA8938EFE5C1B9AEF2E0E401AA347539370F505B427067F578B1B05A0A9D
Malicious:	false
Preview:	// $Xorg: fi,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+fi".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+fi(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+fi".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-I2OK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	4.96652603568489
Encrypted:	false
SSDEEP:	24:Q8WOxLlYPGBPtaCx9Dt6C9D9kKytBXOlYPGBaaCx9Dt6C9D90ytBCOCNlYPGBPtW:QbSLlqWaolcClhnlqtaolcCl6l/NlqWW
MD5:	98E6949BF59187E7CFA7415A52DD9E65
SHA1:	7FB724219D53698268682F41954318CA3E05D6A1
SHA-256:	E580EA5437717C391264204F17F735CE52B6E398151271532E2617BA261B553B
SHA-512:	6C79D80AF8C69C75D4860AA40E28A05D43CE79C485DBCF48D1590266C6737E49708D7CF068128EAFFA44EB9ECC8DA6E1D0B484A9E22B309BD805BEC37441A2D7
Malicious:	false
Preview:	// $Xorg: cs,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//..default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+sk"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc102)+sk"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};..default xkb_keymap "indy_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+sk(qwerty)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-IEFEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	605
Entropy (8bit):	4.987705831533287
Encrypted:	false
SSDEEP:	12:jLKU9xnOxwOlYP6pBPtaCa89PLt6Z89PL9y6yUQtPRYLpQbpBBqFOlYP6pBWqLaP:fOxLlYPGBPtaCx9Dt6C9D9kJYLytBwOi
MD5:	1C016BB7B4A73ADD562E630816DE7643
SHA1:	CDF90DD2705DD8D73B3E69597CC8958EFF8D1044
SHA-256:	1EDE8D2BBD68A3C7B6A5936188904B47E64142186823ABE48FEE92BB2B3BC137
SHA-512:	A0639EC4265957B8E9E67FF2913619CA15771918DF7CE014EB2E6C375D6745CF6E33FF7E55F0B188C684BEE9F181F8F605130D88D33FADF5DD1ACBA5089B6CE0
Malicious:	false
Preview:	// $Xorg: dvorak,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+dvorak".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc101)+dvorak".};. xkb_geometry.{ include "sgi_vndr/indigo(pc101)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-JFUIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	4.932251205010505
Encrypted:	false
SSDEEP:	24:HOxLlYPGBPkaCx9Gt6C9G9ExfytBCulYPGBPtaCx9Dt6C9D9NxLtLytBXOlYPGBY:HSLlqdaoccCc+alqWaolcClRlnlqtaod
MD5:	D8712D060EEEE880F92182759F3DEE40
SHA1:	324DFB5CD24568E8AF08BE0645735E8F81C9816A
SHA-256:	5ECFB34E4925DD85159DE7838263E91AC7991BD5FC5D16D3CC6779348CFF40CD
SHA-512:	F7DF1A98A6A8194A2DAF0B72F62C8DE1C340DFE341EFBDB078EBC0D3F74201AD4CAE3B8F2461E3383DE76F6815CED3639A99719A5F094BA4BA1FE91328A770C0
Malicious:	false
Preview:	// $Xorg: de,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+de"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+de(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc102)+de"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vnd

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-MJS58.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949461667873088
Encrypted:	false
SSDEEP:	24:WvOxLlYPGBPtaCx9Dt6C9D9ExcytBFulYPGBPGaCx9gt6C9g93xRLytBSOlYPGB4:WvSLlqWaolcCl/rlqzaoecCedSlqGaoG
MD5:	475834E5732D8F706C8925AA35974108
SHA1:	67D3145C1FF3A3969D75176548412D830966BDE8
SHA-256:	CD84E007E9CFDFFB74D05A61CE2E28CED9384ABB06786D9D84AE29D729CEE6C5
SHA-512:	6773BC405E2F1EE3D9362CD2C2E52EAA1D026148DE7BEACEAD7449D0D9F20F116858414E2F910475EB2B688372B343E788D00C64BB7A8E2344BE9AA2ECE36B39
Malicious:	false
Preview:	// $Xorg: no,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+no".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+no(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+no".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-MO8G5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2457
Entropy (8bit):	4.933916783965993
Encrypted:	false
SSDEEP:	48:5MlqWaolcCltsglqzaoecCeHelqGaoecCeHwElqGaoecCecEaGOlqWaolcCl/63c:wqi2CvqRdC9qSdCmdqSdCprqi2CtqRdW
MD5:	BD47E2BF739007CC470615C7CE075A8B
SHA1:	FA5B11566987D286DA40ABBE2D39080F0F1E77B1
SHA-256:	2A54567A57F7A1655A393F8E3ED6960D24C4ED0D23FD333988C583E8872204E9
SHA-512:	3BC70F458EA1256C6E5514B056FBFEB6794310434A9E20A1FF4E87196570C17DC1DCC36CFC5FDC349E463F61B283601FC96F368AD35C5BAE47B6856D3339F985
Malicious:	false
Preview:	// $Xorg: de_CH,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "de_indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+ch(de)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "de_indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+ch(de_nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "de_indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+ch(de)".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "de_indigo_nodeadkeys" {. xkb_keycodes.{ incl

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-N334S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.933090112215638
Encrypted:	false
SSDEEP:	96:TqPXCVqi2Cwqi2Cuqi2C+tqi2C+sqi2CEqf2CJ4qf2CR3qf2CRBqf2CRr1qf2CR2:mf4yCDU5Vh6hIhghVhq
MD5:	E8AF21AB0B1EE87983B117D777116CD0
SHA1:	BF5E2FF5A570612273C81AC2D8ECA9D24B274C8F
SHA-256:	BAE90BF76AF0820564D70BF7283A55932075582ABDFDBA43ECA123F9C5FA9008
SHA-512:	0762ADA63E74294868920F4E2A6DE8FBE7AA563E96A2FBD4791B3DA6505D8E04631283FC5949E1372CBDA33B1A4672FF1749D1685FAA96E5E20A29F561E8D201
Malicious:	false
Preview:	// $Xorg: ru,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+ru(basic)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+ru(basic)+group(toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_shift_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+ru(basic)+group(shifts_toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-N9GQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949823352388467
Encrypted:	false
SSDEEP:	24:QrOxLlYPGBPtaCx9Dt6C9D9ExlytBFulYPGBPGaCx9gt6C9g9Nx2LytBSOlYPGBQ:QrSLlqWaolcClerlqzaoecCe+SlqGaoe
MD5:	B9E18A012F69AA5B57793DC3BE6FD0BB
SHA1:	D59206FCDA4C77F434769C562C79FD4FADFCFA5D
SHA-256:	FA4D183BD91169C9F94D1D473EB5C99192094D57721A6C8D4C90AFEFB88E5D0B
SHA-512:	2C53C32B2DE1EEEA691DCD0B0A79C4C76D653A0F9F950D61561E93EEDFDCC5DCEAB577D775A2120258AF7890291701050DA54996B3EC35BED5868F5EDFB882E6
Malicious:	false
Preview:	// $Xorg: ca,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+ca".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+ca(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+ca".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-P2IUE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.946786409268733
Encrypted:	false
SSDEEP:	24:AOxLlYPGBPtaCx9Dt6C9D9ExFytBFulYPGBPGaCx9gt6C9g93xWLytBSOlYPGB/q:ASLlqWaolcClSrlqzaoecCeASlqGaoe7
MD5:	9EA004CB4D0E2D9D74FA3DBF70D635A9
SHA1:	46C912DE0167ADF3EF05D2834C3259A0972F4B5F
SHA-256:	61249804A4A89D905AD3F9CEF9998C855DDA288F66D54C20ED6291805A1A03E0
SHA-512:	493F8A2884F09D86FF923BD0EE55A29795F7FC2C7BD6FC402EE350D30A49245491F2A0A197F3EDC19BCEB21D9577C0A418D07EFC8F8EA5F127B11FF1E95F98D3
Malicious:	false
Preview:	// $Xorg: es,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+es".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+es(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+es".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-R0946.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954728313239662
Encrypted:	false
SSDEEP:	24:P3vOxLlYPGBPtaCx9Dt6C9D9Ex7ZytBFulYPGBPGaCx9gt6C9g93xCLytBSOlYPz:/vSLlqWaolcCl6ZrlqzaoecCeESlqGad
MD5:	5DF2F45A3A90AFE13A9552444DE51C31
SHA1:	9A3D55FD038FDEC99A132080DC2D91829D678649
SHA-256:	45CAF9548567E4B9B69C049DC6F03E9DF68BA155421E4D6C5612FD76EA6B36F2
SHA-512:	5B5E727CE45AFCAFC22F90D971571F540D4C3AC65DE5082246438D6301C406A030356021FE4D1137CE5B9FB54912CC632B00F7EFF5A5716D407B02B03ABC7DC7
Malicious:	false
Preview:	// $Xorg: pt,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+pt".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+pt(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+pt".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-TEI8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954358991613406
Encrypted:	false
SSDEEP:	24:lOxLlYPGBPtaCx9Dt6C9D9ExmytBFulYPGBPGaCx9gt6C9g93xDLytBSOlYPGB/Y:lSLlqWaolcClFrlqzaoecCeTSlqGaoeR
MD5:	F1CBD2148B89572EECB08C3CC2EB64BB
SHA1:	EC2180B92FCF8895164DA0F470450DFD9DF8914E
SHA-256:	8A946D7B0BBD04A63DF870BD621B95BD9D5A592B0D6E6E47E115C09B332C6FB8
SHA-512:	86869935DA977F14FADB79C78A9C587CF1A063AECFEDD354C7E234D9EC7FB5EFF8528E9E06A0FEC611F50ED9A343E1FC28916379608AA29369352933554D1137
Malicious:	false
Preview:	// $Xorg: gb,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+gb".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+gb(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+gb".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-V13J0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.9438587311708115
Encrypted:	false
SSDEEP:	24:k+OxLlYPGBPtaCx9Dt6C9D9ExaytBFulYPGBPGaCx9gt6C9g9NxbLytBSOlYPGBe:tSLlqWaolcClJrlqzaoecCe5SlqGaoeZ
MD5:	CC55B84C69DFB8AD3CB3FE394A19803D
SHA1:	1C7E295CFEFFF8AC7E67FBD2E93B117C98F303F9
SHA-256:	88071D194BAB5482144285A9623B8A7C3FBA1C7E29C65CE8744D3ED4D2C2AE56
SHA-512:	2C675DF333E2C4F00DC2D66784BA19DCC0C974C882A9854247BCFB2C6F55AA8E3B69C252412D48DEDB092EAFB338712CA906B665073BDD48A89755830CE5BD95
Malicious:	false
Preview:	// $Xorg: be,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+be".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "en_US(pc_universal_nodeadkeys)+be(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+be".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\is-VIQKF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.957335948779859
Encrypted:	false
SSDEEP:	24:rYOxLlYPGBPtaCx9Dt6C9D9ExigytBFulYPGBPGaCx9gt6C9g9WxyLytBSOlYPGs:rYSLlqWaolcClurlqzaoecCeXSlqGaos
MD5:	76ADCB6535714657A407BA6BE6109DF5
SHA1:	78C8C36B4D47D8EF1260AB7B4FF73460CC8E60D0
SHA-256:	4372E86814FDFF16FCCC1B42C169386FAB2717F558D56248A9C90CD3E215C909
SHA-512:	C9C4ECB64E4EF5EF3854A962A6721D722B95448A9C15B4BC69860BBD9EC6F1FE20A21802441FCD17DE3D0009B38CFB7DD274657477CAEAF2CBDAEC59D291D152
Malicious:	false
Preview:	// $Xorg: fr,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+fr".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols { ..include "en_US(pc_universal_nodeadkeys)+fr(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+fr".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\it (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949483043300648
Encrypted:	false
SSDEEP:	24:03vOxLlYPGBPtaCx9Dt6C9D9Ex6ytBFulYPGBPGaCx9gt6C9g93xCqLytBSOlYPl:IvSLlqWaolcClNrlqzaoecCeXSlqGaoa
MD5:	DD82F34746AD010592C8B9192FA02C5C
SHA1:	5DFDDB6D1C37BF9AEE3E55ED138F3A0EFB002968
SHA-256:	CEC4BF2E817446F8D9B008CF4BB70778E229B4A2A10484083D9A3DB66ACC68AB
SHA-512:	A50328115B7F52AC9D9BEE683D9960EA34EE8BCE4287718A88C461D6F43565C3358A735390306B3D7318A9A55C59CF838151765BFA28BE72FDD976941DF94FD1
Malicious:	false
Preview:	// $Xorg: it,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+it".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+it(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+it".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.108833516361834
Encrypted:	false
SSDEEP:	6:jLDiU9++xo6OW8xFwOlYP6UA0aBKUvuaT2aUA89cLt6nUA89cL90xaMaUAyjRyVW:jLuO9xnOxwOlYP6pBKjaCa89Gt6Z89G0
MD5:	77C70AA643287710BBFBED6A317505E8
SHA1:	ED057EB7CB3327BDDF9076969532D81BB8565B90
SHA-256:	0D50CCF319C17ED7BA051ABD83E3728374486CFAA1FB84AA7562D0BCDC18CE95
SHA-512:	C00E72A1079967CFDAB6532255B6CE26B07A9C99BC94870A647A85DCECA55B940E84DB78A135BF550D2ACD7574DFA4AAB47826535C83F5E3FE3DD30AE9C26C71
Malicious:	false
Preview:	// $Xorg: jp,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(jp106)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "us(pc101)+sgi_vndr/jp"...};. xkb_geometry.{ include "sgi_vndr/indy(jp106)"...};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\no (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.949461667873088
Encrypted:	false
SSDEEP:	24:WvOxLlYPGBPtaCx9Dt6C9D9ExcytBFulYPGBPGaCx9gt6C9g93xRLytBSOlYPGB4:WvSLlqWaolcCl/rlqzaoecCedSlqGaoG
MD5:	475834E5732D8F706C8925AA35974108
SHA1:	67D3145C1FF3A3969D75176548412D830966BDE8
SHA-256:	CD84E007E9CFDFFB74D05A61CE2E28CED9384ABB06786D9D84AE29D729CEE6C5
SHA-512:	6773BC405E2F1EE3D9362CD2C2E52EAA1D026148DE7BEACEAD7449D0D9F20F116858414E2F910475EB2B688372B343E788D00C64BB7A8E2344BE9AA2ECE36B39
Malicious:	false
Preview:	// $Xorg: no,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+no".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+no(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+no".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\pl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.932242923034038
Encrypted:	false
SSDEEP:	24:MOvOxLlYPGBPGaCx9gt6C9g9kDZytBculYPGBPkaCx9Gt6C9G9kaYytBgOlYPGBD:nvSLlqzaoecCewslqdaoccCc4IlqGao1
MD5:	E667B7B7B17B35E99229EFCA6346643F
SHA1:	C093FA559DF9F732C12FE8A2EDD7BFEC7D2DAB6B
SHA-256:	F89F5BBE6C412C10B3B72C86F24DBD8174F95CD2FFA77FF4A728AB80D479A69B
SHA-512:	2291A761EB7EAFDC2086672F2D8A0E1FA45B4EACC2F190491956CE469AFE9DF336CAC50FD672622156F877979E00EAE2B5A954AAFE80F29AA3260AAC338C5114
Malicious:	false
Preview:	// $Xorg: pl,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)+pl".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "us(pc_universal)+pl(nodeadkeys)" .};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc102)+pl".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\pt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.954728313239662
Encrypted:	false
SSDEEP:	24:P3vOxLlYPGBPtaCx9Dt6C9D9Ex7ZytBFulYPGBPGaCx9gt6C9g93xCLytBSOlYPz:/vSLlqWaolcCl6ZrlqzaoecCeESlqGad
MD5:	5DF2F45A3A90AFE13A9552444DE51C31
SHA1:	9A3D55FD038FDEC99A132080DC2D91829D678649
SHA-256:	45CAF9548567E4B9B69C049DC6F03E9DF68BA155421E4D6C5612FD76EA6B36F2
SHA-512:	5B5E727CE45AFCAFC22F90D971571F540D4C3AC65DE5082246438D6301C406A030356021FE4D1137CE5B9FB54912CC632B00F7EFF5A5716D407B02B03ABC7DC7
Malicious:	false
Preview:	// $Xorg: pt,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+pt".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+pt(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+pt".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\ru (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.933090112215638
Encrypted:	false
SSDEEP:	96:TqPXCVqi2Cwqi2Cuqi2C+tqi2C+sqi2CEqf2CJ4qf2CR3qf2CRBqf2CRr1qf2CR2:mf4yCDU5Vh6hIhghVhq
MD5:	E8AF21AB0B1EE87983B117D777116CD0
SHA1:	BF5E2FF5A570612273C81AC2D8ECA9D24B274C8F
SHA-256:	BAE90BF76AF0820564D70BF7283A55932075582ABDFDBA43ECA123F9C5FA9008
SHA-512:	0762ADA63E74294868920F4E2A6DE8FBE7AA563E96A2FBD4791B3DA6505D8E04631283FC5949E1372CBDA33B1A4672FF1749D1685FAA96E5E20A29F561E8D201
Malicious:	false
Preview:	// $Xorg: ru,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"...};. xkb_types..{ include "default"....};. xkb_compatibility.{ include "default"....};. xkb_symbols .{ include "en_US(pc_universal)+ru(basic)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"...};.};.xkb_keymap "indy_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+ru(basic)+group(toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_shift_toggle" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols { ..include "en_US(pc_universal)+ru(basic)+group(shifts_toggle)" . };. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\se (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	4.945341192353447
Encrypted:	false
SSDEEP:	24:AuvOxLlYPGBPtaCx9Dt6C9D9ExhytBFulYPGBPGaCx9gt6C9g93xqLytBSOlYPGY:AuvSLlqWaolcClirlqzaoecCe8SlqGa3
MD5:	F6159E8D3486635B0A64CC5971F9D525
SHA1:	464B3DBAF46529D75D1405B1060EED1492FE3549
SHA-256:	1A16BDE77448CF3BAA166524D7760736781C8480ECB698D0BDB74C684AF7837E
SHA-512:	8FFAF069DAAB14485FAB5E5DF557146217B26EF405904976E58B9502231215975B30B6DF98EB0BB579637F526E8EE44C185B77C45353952CA2C7920AAE91112A
Malicious:	false
Preview:	// $Xorg: se,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "en_US(pc_universal)+se".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indy_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal_nodeadkeys)+se(nodeadkeys)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+se".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.xkb_keymap "indigo_nodeadkeys" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\sk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	4.96652603568489
Encrypted:	false
SSDEEP:	24:Q8WOxLlYPGBPtaCx9Dt6C9D9kKytBXOlYPGBaaCx9Dt6C9D90ytBCOCNlYPGBPtW:QbSLlqWaolcClhnlqtaolcCl6l/NlqWW
MD5:	98E6949BF59187E7CFA7415A52DD9E65
SHA1:	7FB724219D53698268682F41954318CA3E05D6A1
SHA-256:	E580EA5437717C391264204F17F735CE52B6E398151271532E2617BA261B553B
SHA-512:	6C79D80AF8C69C75D4860AA40E28A05D43CE79C485DBCF48D1590266C6737E49708D7CF068128EAFFA44EB9ECC8DA6E1D0B484A9E22B309BD805BEC37441A2D7
Malicious:	false
Preview:	// $Xorg: cs,v 1.3 2000/08/17 19:54:40 cpqbld Exp $.//..default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+sk"..};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc102)+sk"..};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)"..};.};..default xkb_keymap "indy_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)+sk(qwerty)".};. xkb_geometry.{ include "sgi_vndr/indy(pc102)"..};.};.xkb_keymap "indigo_qwerty" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)"..};. xkb_

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\th (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.080991095866439
Encrypted:	false
SSDEEP:	12:jLMW39xnOxwOlYP6pBPGaCa89gt6Z89g9yrfix7tP2iLpQbpBGFOlYP6pBWgaCal:v3vOxLlYPGBPGaCx9gt6C9g93xuiLytY
MD5:	954A6FDA260E2EF597D8AB438B0DFEB3
SHA1:	F413C2AE12AC577F71DA70413AE9A9A7C7E4E948
SHA-256:	278668A7409A50F8607F0F5533CD0F4467220741FE08F932F29150BD754E1AA4
SHA-512:	38F1A4AB823FB00FEE7D4187446198FD41500B1B0C2914C980EC57CED7028C0A5310664D8D81055171AD8185870B7D25634183FB100A1324ECB79020A36A1FE6
Malicious:	false
Preview:	// $Xorg: th,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{..include "en_US(pc_universal)+th+group(shifts_toggle)". };. xkb_geometry.{ include "sgi_vndr/indy(pc102)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc102)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "en_US(pc102)+th+group(shifts_toggle)".};. xkb_geometry.{ include "sgi_vndr/indigo(pc102)".};.};.

C:\Program Files (x86)\Xming\xkb\keymap\sgi_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	4.8857413572203106
Encrypted:	false
SSDEEP:	48:LvSLlqWaolcClIglqzaoecCeZQlqzaoecCeZVlq7aoecCeOQlq7aoecCe3+lq7aa:Kqi2CdqRdCLqRdCeqpdC8qpdCpqpdCy
MD5:	93A06BBC759CF55B3CA666A0CF080735
SHA1:	B5956F7ADED400117F7C6151B0FD2998A5C89073
SHA-256:	3744E42F54A33683825726ADC34A8246244329BACD4867F235BB65FA8682999F
SHA-512:	908DC3767F90AA7C9C51DB16A7CEAB994C78FC3BC41D8FC9EC0890C10361617B1FCF82C118832706C5F299CAD88DBEE52276EBE49AC9BB7F397C4D540CBFE2D3
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:41 cpqbld Exp $.default xkb_keymap "indy" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)"..};. xkb_types..{ include "default"...};. xkb_compatibility.{ include "default"...};. xkb_symbols .{ include "us(pc_universal)"..};. xkb_geometry.{ include "sgi_vndr/indy(pc101)"..};.};.xkb_keymap "indy101_euro" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)".};.};.xkb_keymap "indy_compose" {. xkb_keycodes.{ include "sgi_vndr/indy(universal)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ include "us(pc_universal)".};. xkb_geometry.{ include "sgi_vndr/indy(pc101)".};.};.xkb_keymap "indigo" {. xkb_keycodes.{ include "sgi_vndr/indigo(pc101)".};. xkb_types..{ include "default"..};.

C:\Program Files (x86)\Xming\xkb\keymap\sony (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1508
Entropy (8bit):	5.362194604499087
Encrypted:	false
SSDEEP:	24:AcikFvjHHCq6kWRmq6U14Uqq9QHEsUbz48Ok4uv8dYo3TdQlTr3WUawRYCFl2lYb:AcjritctUOUqYQHEssz4INW3Z2rmUaOv
MD5:	45B0FCF0AA95E1CEC7686BE48754C6C6
SHA1:	70A764ABCA1CB5833BD3AA95F2E84D1A974B0CF6
SHA-256:	5DCA51A75EE353AC555AD7A82676B44C777E3B34875F1EED18C78F74E07A02FB
SHA-512:	383D993A1A1790295BA6D0C087919F2DDEA50E87B11A7E0F8AA7382B3AF6D5F4F6907AB479C4A05AD4E56F9F8702FCEE9637EEEB41807C2747C26AFD49F04BAD
Malicious:	false
Preview:	// $Xorg: sony,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\de (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3003
Entropy (8bit):	5.330417606561911
Encrypted:	false
SSDEEP:	48:TjritctUOUqYQHEssz4INW3Z2rmUaOYCFyA2lqFaoecCeRMRlqFaoecCeQlM00lp:+CzUqYQHKQgrTLmAMqndC//qndCna0Sp
MD5:	7775068E4C8FE1E542455641E81B284E
SHA1:	3BECDE6DEBC1129838D9980976C92C37A4A3F690
SHA-256:	99EDDF3FEAFDE7811C00180366EF03CBDBC04C6DF26143CAA6AD9B8172B17704
SHA-512:	EBFA69F24481534440052805A4749B738340B90A11E33BEBEEB31EC38A6F181BBB974FE73BB1EDC9EE943A811E6D158EE5FDC11490A93A982966C31BA4633C45
Malicious:	false
Preview:	// $Xorg: de,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\es (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.398667872967244
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+BStlqFaoecCe0M6lqFaoecCeDQcE:8CzUqYQHKQgrTLiBKqndCioqndCcHqEE
MD5:	D54342F310EA8BA5815DFC7E15DD9499
SHA1:	2BBB0261E535695E671893377ABA44BE2CBE9AEF
SHA-256:	15AAF81A99EFA4C7C5A9A5A389BB57F72BC834FA415B8511207F50CF0247F4A0
SHA-512:	38E5B3462A1AA8B8DD3E2D325133D6715BDCAA9DE10EF73B88B8D0AF4B76B820ECA67362807E400155A7C9890223FCDE1731FA7FAF763340A5C4BA5FD26D81CF
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\fi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.407566376667395
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+u1lqFaoecCeXMyGlqFaoecCeMQcg:8CzUqYQHKQgrTLiu7qndCp7qndCvSqEv
MD5:	CEA2C7A9CE18D0909A3D0D32D933488F
SHA1:	C876CDC8CD7888C05A57B59F16FCACF0E4A551DE
SHA-256:	B29DCD38040B879A1C4FA04E99640AF6D27CB6717D06D550A7AC46007A42ED2D
SHA-512:	6655E2ADD43D11228198C3A4DC4B5F1BCAAC240F47189EB3AB1E4EE3D5163117C6D670551864CC452BD324EEAE9A54ADC4B8D301CA7662A71028AD0701E54AE8
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\fr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.410290485387973
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+pIlqFaoecCe4MWlqFaoecCerQchC:8CzUqYQHKQgrTLipuqndCOsqndCkvqE8
MD5:	BBC10FDAC6EB396D2E0C1E3D067DBE94
SHA1:	5F01D84D72AFBF8ADBBF9FD48C9A9613E5B2C10F
SHA-256:	462446141463198EFD79E7F7727309E0E3C670FC91B3C445C76B0E9D8AA834B2
SHA-512:	E239B536891F1CBFFC45BC787B2761704C5BA444FC0716221E2C021515F1CB62C1571AA5FA9958F4181CA5B4A427D54D8CCA2E08C3B88DBCF93AC3B655286609
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-9KJM3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.400274248673338
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+TkPlqFaoecCeJMLlqFaoecCeqQc8:8CzUqYQHKQgrTLiTkNqndCThqndCxQqS
MD5:	B27B44B0360A72EAD5D61508EB8E533A
SHA1:	526436B1B050EC1A1C40BA6B43F1FF3F64FECA8C
SHA-256:	84C1A9EC39F5C697C4605580873A624F61841399B84FC35B8C17BCDE85D0AD31
SHA-512:	BFF3372E0726D0E8C25B01FE6FFEEF969129AA3388780B1AC5454AF44AFCAE9071A0A8D07C60303DFA40542DA2CFB515C375B3EA928C7E21D343ECE5A9FCCD45
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-DMJJP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.398667872967244
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+BStlqFaoecCe0M6lqFaoecCeDQcE:8CzUqYQHKQgrTLiBKqndCioqndCcHqEE
MD5:	D54342F310EA8BA5815DFC7E15DD9499
SHA1:	2BBB0261E535695E671893377ABA44BE2CBE9AEF
SHA-256:	15AAF81A99EFA4C7C5A9A5A389BB57F72BC834FA415B8511207F50CF0247F4A0
SHA-512:	38E5B3462A1AA8B8DD3E2D325133D6715BDCAA9DE10EF73B88B8D0AF4B76B820ECA67362807E400155A7C9890223FCDE1731FA7FAF763340A5C4BA5FD26D81CF
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-EFN9L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2791
Entropy (8bit):	5.298673117401633
Encrypted:	false
SSDEEP:	48:kjritctUOUqYQHEssz4INW3Z2rmUaOYCFyclq0aoecCeIMqlq0aoecCevQcJlqFl:jCzUqYQHKQgrTLm6q0dCO4q0dCA3qndl
MD5:	69F144ADDAEC7E000A013BA67D4CE066
SHA1:	D2D42E8BB46EB1483482AAA821A20EFF0A2F11E3
SHA-256:	3EF6EFF55FF08685930FB4F756650374D88D60C101BC1953A659624D1F6DD8F9
SHA-512:	C38FF0A04544C605A2024DF87B7F6C7BEF6EEADA31FFD50780E4DAC302E055830A2926DD598D259346DA23FF018E41ADBB3D8141E317EAC0E7DD84474C04E253
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-GR9BJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.403827540184673
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+uNlqFaoecCeHMtlqFaoecCecQc0B:8CzUqYQHKQgrTLiuTqndCxzqndCfSqEf
MD5:	CCF599A6AB426CA04E295495DA12F5F8
SHA1:	C246C5284CEF5328C20AFCACD376B8932541AD28
SHA-256:	A55FDFAB5A69FA0C82F443B05DED9048381DBC5B5E0CE16CC78FA31659EF28D5
SHA-512:	3AF79165D6F141E3E915D81C9CA9A96C4A190A7B7C5227A947888A00863411DD5A11ADCDFF8D0F2C0DD3D27F90113D2D477EEB59CCED28244927D11D97196EBF
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-HTJQ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3003
Entropy (8bit):	5.330417606561911
Encrypted:	false
SSDEEP:	48:TjritctUOUqYQHEssz4INW3Z2rmUaOYCFyA2lqFaoecCeRMRlqFaoecCeQlM00lp:+CzUqYQHKQgrTLmAMqndC//qndCna0Sp
MD5:	7775068E4C8FE1E542455641E81B284E
SHA1:	3BECDE6DEBC1129838D9980976C92C37A4A3F690
SHA-256:	99EDDF3FEAFDE7811C00180366EF03CBDBC04C6DF26143CAA6AD9B8172B17704
SHA-512:	EBFA69F24481534440052805A4749B738340B90A11E33BEBEEB31EC38A6F181BBB974FE73BB1EDC9EE943A811E6D158EE5FDC11490A93A982966C31BA4633C45
Malicious:	false
Preview:	// $Xorg: de,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-IU8TH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.407566376667395
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+u1lqFaoecCeXMyGlqFaoecCeMQcg:8CzUqYQHKQgrTLiu7qndCp7qndCvSqEv
MD5:	CEA2C7A9CE18D0909A3D0D32D933488F
SHA1:	C876CDC8CD7888C05A57B59F16FCACF0E4A551DE
SHA-256:	B29DCD38040B879A1C4FA04E99640AF6D27CB6717D06D550A7AC46007A42ED2D
SHA-512:	6655E2ADD43D11228198C3A4DC4B5F1BCAAC240F47189EB3AB1E4EE3D5163117C6D670551864CC452BD324EEAE9A54ADC4B8D301CA7662A71028AD0701E54AE8
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-LCB1J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.410290485387973
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+pIlqFaoecCe4MWlqFaoecCerQchC:8CzUqYQHKQgrTLipuqndCOsqndCkvqE8
MD5:	BBC10FDAC6EB396D2E0C1E3D067DBE94
SHA1:	5F01D84D72AFBF8ADBBF9FD48C9A9613E5B2C10F
SHA-256:	462446141463198EFD79E7F7727309E0E3C670FC91B3C445C76B0E9D8AA834B2
SHA-512:	E239B536891F1CBFFC45BC787B2761704C5BA444FC0716221E2C021515F1CB62C1571AA5FA9958F4181CA5B4A427D54D8CCA2E08C3B88DBCF93AC3B655286609
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-MH6EU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	4.846858001278014
Encrypted:	false
SSDEEP:	48:X+qcslq5aoecCeyYClq5aoecCeuwYllq5aoecCeuwdFlqfLaoecCedAOlqoaoecm:OfqqTdCsQqTdCt5LqTdCtKrqRdCvkqgE
MD5:	F188620468875BD1808DD2C4E9566BD5
SHA1:	5C35DA1C713A4F9F57298C728E7D078CA728AB38
SHA-256:	33F5C89B416AFE7326312DB154C0EE55C7278D7C8A0DCE3A0F1A99BF7A240AD9
SHA-512:	F9EBF042C568134AB381EDC688D18E459D5152C21CC32FABE0157D1F18159CB7E952804A0E37ED9916D386DE8C8667D95FF2F95B72AB11EC237D51D8C68190C8
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/sun_vndr/se,v 1.2 1998/12/20 09:34:42 dawes Exp $..default xkb_keymap "type5c_se_fixdollar" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)+se(fixdollar)". };. xkb_geometry.{ include "sun(type5c_se)".};.};.xkb_keymap "type5c_se" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)". };. xkb_geometry.{ include "sun(type5c_se)".};.};.xkb_keymap "type5_se" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)". };. xkb_geometry.{ include "sun(type5_se)".};.};.xkb_keymap "type4_se_fixdollar_swapctl" {. xkb_keycodes.{ include "sun(type4_se_swapctl)".

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-PFSTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.4046233827694765
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+hclqFaoecCeAMqlqFaoecCePQcZO:8CzUqYQHKQgrTLih6qndCS4qndCMnqEY
MD5:	3544159E5BDDE36D85C7906FA3C95138
SHA1:	2D028F8571A1C99145B781A0C54B4FEC1A54BDDC
SHA-256:	1AC470DF9C3DFD1C030F1F7E991304A43217EAECC3F6C633E46B4BA51F94C23E
SHA-512:	80F6096885369F0C1D8D015A583772F8C8CA4F897110970B8AA423A23799B0C4F3F8C2F86F9D20C565C163F74FC0618A7A470946A98CF0A1D1B189BCC2B19935
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\is-PMQRR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.4055459989875
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+J3ElqFaoecCesMylqFaoecCerQcU:8CzUqYQHKQgrTLiJ3CqndCagqndCEvqT
MD5:	18322F9CC65DE3B4E74F8033C7DF8FC6
SHA1:	C7AFC64533D1DF7F8E9A016141F70E0C9026A788
SHA-256:	F75873581F3953BB6A39BFDCB33D190AE295D65A7F61EA919E99627F393F201D
SHA-512:	13FCCE25EFB0A2ABF1F0A6084CC6E54E5C8414E7F5D83B557959B61CF766632F616FFD1E32DE8B721CE58090746AB9563B0843A1981F7D15EED41454A96E38B4
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\no (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.400274248673338
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+TkPlqFaoecCeJMLlqFaoecCeqQc8:8CzUqYQHKQgrTLiTkNqndCThqndCxQqS
MD5:	B27B44B0360A72EAD5D61508EB8E533A
SHA1:	526436B1B050EC1A1C40BA6B43F1FF3F64FECA8C
SHA-256:	84C1A9EC39F5C697C4605580873A624F61841399B84FC35B8C17BCDE85D0AD31
SHA-512:	BFF3372E0726D0E8C25B01FE6FFEEF969129AA3388780B1AC5454AF44AFCAE9071A0A8D07C60303DFA40542DA2CFB515C375B3EA928C7E21D343ECE5A9FCCD45
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\pl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.4046233827694765
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+hclqFaoecCeAMqlqFaoecCePQcZO:8CzUqYQHKQgrTLih6qndCS4qndCMnqEY
MD5:	3544159E5BDDE36D85C7906FA3C95138
SHA1:	2D028F8571A1C99145B781A0C54B4FEC1A54BDDC
SHA-256:	1AC470DF9C3DFD1C030F1F7E991304A43217EAECC3F6C633E46B4BA51F94C23E
SHA-512:	80F6096885369F0C1D8D015A583772F8C8CA4F897110970B8AA423A23799B0C4F3F8C2F86F9D20C565C163F74FC0618A7A470946A98CF0A1D1B189BCC2B19935
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\ru (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.403827540184673
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+uNlqFaoecCeHMtlqFaoecCecQc0B:8CzUqYQHKQgrTLiuTqndCxzqndCfSqEf
MD5:	CCF599A6AB426CA04E295495DA12F5F8
SHA1:	C246C5284CEF5328C20AFCACD376B8932541AD28
SHA-256:	A55FDFAB5A69FA0C82F443B05DED9048381DBC5B5E0CE16CC78FA31659EF28D5
SHA-512:	3AF79165D6F141E3E915D81C9CA9A96C4A190A7B7C5227A947888A00863411DD5A11ADCDFF8D0F2C0DD3D27F90113D2D477EEB59CCED28244927D11D97196EBF
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\se (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	4.846858001278014
Encrypted:	false
SSDEEP:	48:X+qcslq5aoecCeyYClq5aoecCeuwYllq5aoecCeuwdFlqfLaoecCedAOlqoaoecm:OfqqTdCsQqTdCt5LqTdCtKrqRdCvkqgE
MD5:	F188620468875BD1808DD2C4E9566BD5
SHA1:	5C35DA1C713A4F9F57298C728E7D078CA728AB38
SHA-256:	33F5C89B416AFE7326312DB154C0EE55C7278D7C8A0DCE3A0F1A99BF7A240AD9
SHA-512:	F9EBF042C568134AB381EDC688D18E459D5152C21CC32FABE0157D1F18159CB7E952804A0E37ED9916D386DE8C8667D95FF2F95B72AB11EC237D51D8C68190C8
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/sun_vndr/se,v 1.2 1998/12/20 09:34:42 dawes Exp $..default xkb_keymap "type5c_se_fixdollar" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)+se(fixdollar)". };. xkb_geometry.{ include "sun(type5c_se)".};.};.xkb_keymap "type5c_se" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)". };. xkb_geometry.{ include "sun(type5c_se)".};.};.xkb_keymap "type5_se" {. xkb_keycodes.{ include "sun(type5_se)".};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols .{ ..include "sun_vndr/se(sun5)". };. xkb_geometry.{ include "sun(type5_se)".};.};.xkb_keymap "type4_se_fixdollar_swapctl" {. xkb_keycodes.{ include "sun(type4_se_swapctl)".

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\uk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.4055459989875
Encrypted:	false
SSDEEP:	48:2RMritctUOUqYQHEssz4INW3Z2rmUaOYCFv+J3ElqFaoecCesMylqFaoecCerQcU:8CzUqYQHKQgrTLiJ3CqndCagqndCEvqT
MD5:	18322F9CC65DE3B4E74F8033C7DF8FC6
SHA1:	C7AFC64533D1DF7F8E9A016141F70E0C9026A788
SHA-256:	F75873581F3953BB6A39BFDCB33D190AE295D65A7F61EA919E99627F393F201D
SHA-512:	13FCCE25EFB0A2ABF1F0A6084CC6E54E5C8414E7F5D83B557959B61CF766632F616FFD1E32DE8B721CE58090746AB9563B0843A1981F7D15EED41454A96E38B4
Malicious:	false
Preview:	// $TOG: de /main/3 1998/02/10 13:44:36 kaleb $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//

C:\Program Files (x86)\Xming\xkb\keymap\sun_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2791
Entropy (8bit):	5.298673117401633
Encrypted:	false
SSDEEP:	48:kjritctUOUqYQHEssz4INW3Z2rmUaOYCFyclq0aoecCeIMqlq0aoecCevQcJlqFl:jCzUqYQHKQgrTLm6q0dCO4q0dCA3qndl
MD5:	69F144ADDAEC7E000A013BA67D4CE066
SHA1:	D2D42E8BB46EB1483482AAA821A20EFF0A2F11E3
SHA-256:	3EF6EFF55FF08685930FB4F756650374D88D60C101BC1953A659624D1F6DD8F9
SHA-512:	C38FF0A04544C605A2024DF87B7F6C7BEF6EEADA31FFD50780E4DAC302E055830A2926DD598D259346DA23FF018E41ADBB3D8141E317EAC0E7DD84474C04E253
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\keymap\xfree86 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	13334
Entropy (8bit):	4.887790905214669
Encrypted:	false
SSDEEP:	384:3pamaeaYSvihaiaaafala5aa9va8a03aJabavaLtaWagaRaoayaqoacaNBgBSafR:3pamaeaYThaiaaafala5aa9va8a03aJe
MD5:	D4EFCE24EAE7BA7BB9C1ABF5C5A607D8
SHA1:	79FFF43AC33D9DF6AB50F16587ED41B66DD6F5A3
SHA-256:	4BCC1063B461DB6CBD21AB341EF19FC93966A255C043C566E139EEB4AC71FF27
SHA-512:	8445A7E679BFBD3AD080CE3F7EBE75B906C75011E2C1B167441A0067BE7B463FBC6D313BAA3F60242AE1C615AE63FC94F094B4A3D041BEB8761BEEDE2CD0AF94
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/xfree86,v 3.30 2003/04/03 16:34:49 dawes Exp $...default xkb_keymap "us" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "us(pc105)"..};. xkb_geometry.{ include "pc"...};.};..// "ar" addition by Arabeyes Team, <support@arabeyes.org>.xkb_keymap "ar" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+ar".};. xkb_geometry.{ include "pc(pc102)"..};.};.xkb_keymap "be".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+be".};. xkb_geometry .{ include "pc(pc102)"..};.};.xkb_keymap "bg".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default".

C:\Program Files (x86)\Xming\xkb\keymap\xfree98 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.392151624523476
Encrypted:	false
SSDEEP:	48:ZjritctUOUqYQHEssz4INW3Z2rmUaOYCFv+5BmlqGaoecCeP7l:gCzUqYQHKQgrTLisqSdCG
MD5:	46E587B1E1464BD881D2D062507EC325
SHA1:	76EF529D9CF6052BCCFA0CB4602B5C6C7701B34D
SHA-256:	3FDDA7D7671DD24DC62CC3BCCB2631A2CA29C4EA79A5DD6BA02618EFEBEC1E0D
SHA-512:	36325F4531797EA4383DD3B2ED5E6FD3CD18E5B52A3A3919122982BE0A452D572ADCD1A9A6C1A3B9B6EABD93EB310FD33EB2EFF90C9B7547E8BFBED69F920CB6
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Program Files (x86)\Xming\xkb\rules\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.2482817972502644
Encrypted:	false
SSDEEP:	3:hBWtHCWws0CY2qNFG0BxidJGHuvdLAIMevn:hBmHCVN227UdsHlIzn
MD5:	1CB4B3E6D56889944AF101BA0122F103
SHA1:	EBD12151A1AB255156D88FBDDCE66B16337916F3
SHA-256:	808E2A1F26CBFD2E26830F26179365312D0A167BFC11365CD553C8670718279D
SHA-512:	BE425A0FB51B723010C26C41886BBB7EF3F12A9DC257AEA8398655FF9D4BA5937C8EBFE586480D8D009A904A52A9D9D9955E0EC4C78AD448167881681B69BF5A
Malicious:	false
Preview:	This directory lists sets of rules which can be used to obtain an exact XKB.configuration..

C:\Program Files (x86)\Xming\xkb\rules\is-4AL39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.050327097131242
Encrypted:	false
SSDEEP:	24:jLLQeHJxvcFRzfodseWooKw06U9oGQ6V3:fLjrvcFRcdseWooX06U9oGQ6V
MD5:	73944BC403BC61E32C4617D08877CB72
SHA1:	C746CEF03F3986162E1B01E2A7C8743DE785962D
SHA-256:	92B47D6C7704CB49FB69708B5975ABF341D78F217B98D75E779342EEF3DEB692
SHA-512:	E0D2119165C0E687383594B449C29278388EA9C95EE9DF02F91231ADF9FB1D9D6EB35FC6CC05C0765A4FF8A3C98D85BFBF475809C84D6737097560129D4FF7BC
Malicious:	false
Preview:	//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// $XFree86: xc/programs/xkbcomp/rules/xfree86,v 3.5 1996/12/17 21:03:59 dawes Exp $.//..! model .=.keycodes.geometry. pc98..=.xfree98(pc98).nec(pc98). jp106..=.xfree98(jp106).pc(jp106)..! model..layout.=.symbols. pc98..nec/jp.=.nec/jp(pc98). jp106..jp.=.jp..! model..layout.=.compat..types. ...=.complete.complete..! option..=.symbols. grp:switch..=.+group(switch). grp:toggle..=.+group(toggle). grp:shift_toggle.=.+group(shifts_toggle). grp:ctrl_shift_toggle.=.+group(ctrl_shift_toggle). grp:ctrl_alt_toggle.=.+group(ctrl_alt_toggle). ctrl:nocaps..=.+ctrl(nocaps). ctrl:swapcaps..=.+ctrl(swapcaps). ctrl:ctrl_ac..=.+ctrl(ctrl_ac). ctrl:ctrl_aa..=.+ctrl(ctrl_aa)..

C:\Program Files (x86)\Xming\xkb\rules\is-5B11H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	191728
Entropy (8bit):	5.242208366290925
Encrypted:	false
SSDEEP:	768:uGIniOv4qnq4wUlf47GuXRk8A7C8nuvqAgNVCdSJwuRe2H0dJN16YHjX:u/RVASCGHdYHjX
MD5:	3AC9AF00F9A1C5B4EB150546F653C675
SHA1:	967FB849821C8C30245E37C525294050E9345852
SHA-256:	503F1EE8B87C5135B692FFD9B8C4F070874AF85AD329962557DD62B606EA4AF0
SHA-512:	91A1490661843309CFC3CE31B0CCED2582E381C2BC36183616C6542247ABCC878940B5C733C5D024C185285E5F0732ED8FB392378ABFAC8230BCE63C1132C6B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList>. <model>. <configItem>. <name>type4</name>. <name xml:lang="ko">type4</name>. <name xml:lang="ru">type4</name>. <description>Sun Type 4</description>. <description xml:lang="ko">. .. 4</description>. <description xml:lang="ru">Sun Type 4</description>. </configItem>. </model>. <model>. <configItem>. <name>type5</name>. <description>Sun Type 5</description>. <description xml:lang="ko">. .. 5</description>. <description xml:lang="ru">Sun Type 5</description>. </configItem>. </model>. <model>. <configItem>. <name>type5_euro</name>. <description>Sun Type 5 European</description>. <description xml:lang="ko">. .. 5 ..</description>. <description xml:lang="ru">Sun Type 5 ...........</description>. </con

C:\Program Files (x86)\Xming\xkb\rules\is-6GTGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.2482817972502644
Encrypted:	false
SSDEEP:	3:hBWtHCWws0CY2qNFG0BxidJGHuvdLAIMevn:hBmHCVN227UdsHlIzn
MD5:	1CB4B3E6D56889944AF101BA0122F103
SHA1:	EBD12151A1AB255156D88FBDDCE66B16337916F3
SHA-256:	808E2A1F26CBFD2E26830F26179365312D0A167BFC11365CD553C8670718279D
SHA-512:	BE425A0FB51B723010C26C41886BBB7EF3F12A9DC257AEA8398655FF9D4BA5937C8EBFE586480D8D009A904A52A9D9D9955E0EC4C78AD448167881681B69BF5A
Malicious:	false
Preview:	This directory lists sets of rules which can be used to obtain an exact XKB.configuration..

C:\Program Files (x86)\Xming\xkb\rules\is-DOT0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	4.688147918393019
Encrypted:	false
SSDEEP:	96:GrffTNk2f9/TOV+aNbGF+Gdt0jmgb2+fHW2+fHt2rdFu2+fS318s0deS+GY12W5U:6/T4GqN/+JHeeayp
MD5:	03222C890E8211E613C4508C5B9DD7C0
SHA1:	60EB58D3FAA092C74B476E644FD92BDBA14CC617
SHA-256:	F8AF10CB727A593F673F5F9FB7CC61BEE9B7BFD630B7D797759B5EF8E696F5CD
SHA-512:	7CC7FAB7BEA8AC4665D19DD54146E4791D458F14B6BCC04DA6C77A6429A3B56043EC96B1CAFD05B3BE4541FC1E2C651A4D65D4A92DB4359F229A8302D0DD2A73
Malicious:	false
Preview:	// $Xorg: sgi,v 1.3 2000/08/17 19:54:41 cpqbld Exp $..! option = symbols. grp:switch = +group(switch). grp:toggle = +group(toggle). grp:shift_toggle = +group(shifts_toggle). grp:ctrl_shift_toggle = +group(ctrl_shift_toggle). grp:ctrl_alt_toggle = +group(ctrl_alt_toggle). grp:caps_toggle.= +group(caps_toggle). ctrl:nocaps = +ctrl(nocaps). ctrl:swapcaps = +ctrl(swapcaps). ctrl:ctrl_ac = +ctrl(ctrl_ac). ctrl:ctrl_aa = +ctrl(ctrl_aa). keypad:overlay.= +keypad(overlay). keypad:overlay1.= +keypad(overlay). keypad:overlay2.= +keypad(overlay). lock:shift..= +capslock(shiftlock). pc104:altmeta..= +pc104(altmeta). pc104:compose..= +pc104(compose)..! option..= keycodes. lock:shift..= +sgi_vndr/indy(shiftLock)..! option..= keycodes...compat. keypad:overlay.= +sgi_vndr/indy(overlayKeypad).+keypad(overlay). keypad:overlay1.= +sgi_vndr/indy(overlayKeypad).+key

C:\Program Files (x86)\Xming\xkb\rules\is-E5A4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	24562
Entropy (8bit):	4.438347463296873
Encrypted:	false
SSDEEP:	384:G0DrLhNgDZUlX5lQ/6f/B3/efYTi+/VMxUQq3mfFkuYG4Bh0vfOT6w1MRVucDQkM:G0Dr1NgDZeX5lQ/4B3/efYTiwGFknG4p
MD5:	7EA0844991561503BFE95B3248C486C6
SHA1:	CF5FFDD277A62B4244E52F53C104574015070A4F
SHA-256:	1FD83EAA09CB9C2B93D69AB2B36C9DEE078F502F8FDDC4BEAAE44D3A0B42C4F2
SHA-512:	97F3600FD2FE97ECB386C699176075ED2AA90D7647B6EBB9287CB0A8D58076DEBF1F9FE22E74FA1C3D60DA330E6067FD2FA815D3B34406DBAF86FDC523E2A2C9
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. jp106 Japanese 106-key. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. abnt2 Brazilian ABNT2. airkey Acer AirKey V. acpi ACPI Standard. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001A

C:\Program Files (x86)\Xming\xkb\rules\is-EAL3B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	5.260521417436348
Encrypted:	false
SSDEEP:	12:TMHdlRyENehfo0oSB32Nqqq8LibvLkmvjjxmjaykGGW/ynXQSFVLZyxbJpLpyxbT:2dHy1Z2NqZaiJm+K/wX5Zy71py7TAbY
MD5:	02FBD8C5B7C335F824B952214E66E6D8
SHA1:	F70F20EC59109F70A8DFD937A2685215D8BA3705
SHA-256:	997B175854DB2C9C6C72821D6ADF7732BA059AFB36DFDE15572E57E53C5888FD
SHA-512:	A60E2C0CD59462E456D89FC46340C3FEF5809869661EF575A79A0508D59C2D31A531BBBFD1D8A9E1D8E77A38BA6225517DE282ACB8FDA3C090C7F0C782CD1672
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Description: XKB configuration file DTD. Author: Sergey V. Udaltsov..-->..<!ELEMENT xkbConfigRegistry (modelList,layoutList,optionList)>..<!ATTLIST xkbConfigRegistry . version CDATA "1.0">..<!ELEMENT modelList (model)>..<!ELEMENT model (configItem)>..<!ELEMENT layoutList (layout)>..<!ELEMENT layout (configItem,variantList?)>..<!ELEMENT optionList (group)>..<!ELEMENT variantList (variant)>..<!ELEMENT variant (configItem)>..<!ELEMENT group (configItem,option)>.<!ATTLIST group. allowMultipleSelection (true\|false) "false">..<!ELEMENT option (configItem)>..<!ELEMENT configItem (name,shortDescription,description*,countryList?,languageList?)>..<!ATTLIST configItem. popularity (standard\|exotic) "standard">..<!ELEMENT name (#PCDATA)>..<!ELEMENT shortDescription (#PCDATA)>.<!ATTLIST shortDescription. xml:lang CDATA #IMPLIED>..<!ELEMENT description (#PCDATA)>.<!ATTLIST description. xml:lang CDATA #

C:\Program Files (x86)\Xming\xkb\rules\is-IJ7NV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	27786
Entropy (8bit):	5.0607951984167325
Encrypted:	false
SSDEEP:	384:hi9Nq5d/Vjdh/2ae7W8ItwYAzORCEx7Ocenw4txaWbqtvz9i8BT1V3m1lmoxCJ2N:hr5d/df7e7WDtozO7ynxUi43Q
MD5:	68608C91883DB5E460BB58026CDABDBD
SHA1:	3C60C955369E200B74EB34E2D11A29F32C8FB25D
SHA-256:	3D617F22C7A62E006021BE991CAF496ECAFD109540B01213F6168C8E5D5747D3
SHA-512:	577F03C11D391FB2D2A01997CBA1DEE2554503DB292490BFB5A01F30201732E3831B5E37BBE6A79811E0907D8A4AABF70D7F285205A4DF07FCD04800912212D1
Malicious:	false
Preview:	// $Xorg: xfree86,v 1.3 2000/08/17 19:54:42 cpqbld Exp $..//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.// $XFree86: xc/programs/xkbcomp/rules/xfree86,v 3.79 2004/01/09 00:16:01 dawes Exp $.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoftpro microsoftprousb microsoftprose..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = abnt2 latitude jp106 kr106..! $macbooks = macbook78 macbook79.! $maclaptop = ibook powerbook macbook78 macbook79.! $macs = macintosh macintosh_old ibook

C:\Program Files (x86)\Xming\xkb\rules\is-LGNSD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	946100
Entropy (8bit):	5.16598718390429
Encrypted:	false
SSDEEP:	24576:p2mafe2x4MZ783wgv8gUHyefgi6FPCVt5k5TiWjxUTMv0oTiIiz2KvI:omafe2x4MZ783wgv8gUHyefgi6FPCVtO
MD5:	1793EC657EB3B183D6A40E0D8354B0E8
SHA1:	8D539D20ABB4242C1EB3BE12D8FEEE531DACD775
SHA-256:	F7682896780D692B5F6EA6A735458A30648B9715C32D543B405521AE6253068B
SHA-512:	E9C81B5FB238DB542739AAB192CE622C8FDB7CDDF855A41EABF0D0622ADBB4F2A7AD3903EB51214E2F5F6A7A63958B43E36A18994D5263BA8E50500EC89B84A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <description xml:lang="af">Generies 101-sleutel PC</description>. <description xml:lang="az">Generic 101-key PC</description>. <description xml:lang="bg">.......... 101 ........ PC ..........</description>. <description xml:lang="cs">Obecn. PC 101 kl.ves</description>. <description xml:lang="da">Generisk 101-taster PC</description>. <description xml:lang="el">....... ..... ........... 101-........</description>. <description xml:lang="en_GB">Generic 101-key PC</description>. <description xml:lang="es">PC gen.rico 101 teclas</description>. <description xml:lang="fi">Yleinen 101-n.pp.iminen PC</description>. <description xml:lang

C:\Program Files (x86)\Xming\xkb\rules\is-SU477.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	4.737013782119671
Encrypted:	false
SSDEEP:	24:XIX9bM2PMLPfE+E3e7Ek+yaeYXJEkeYXJkLV9G9GRxrQnRCuYzRZ2zRWZzR7ZzRk:XIXWvYaY2JC4tht9rOPsGcTNCHG4G9G5
MD5:	D3FE054200C1F0773055FBBDE92714DD
SHA1:	4B29C0339B410A25BC75C85CB13212A0B434AC8E
SHA-256:	18722074F796F0031069D83414F1A32F3A31FC231BE37EB5938B4B6748586806
SHA-512:	4930DB6C4551078716EAD480ED8422CD6D0DE2FB1611D1848C75A727572A02848CF54D4AA0A483956F68BFF39616C45757915667F6511A49962D05E8AC1D69F7
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/rules/sun,v 3.1 2000/05/18 23:21:43 dawes Exp $..! model...= keycodes...geometry. type4...= sun(type4)...sun(type4). type5...= sun(type5)...sun. type5_euro..= sun(type5_euro)..sun(type5euro). type5_unix..= sun(type5)...sun(type5unix). type6...= sun(type6) sun(type5). type6_euro..= sun(type6_euro) sun(type5). type6_unix..= sun(type6) sun(type5unix). type6_usb..= sun(type6_usb) sun(type5). type6_unix_usb.= sun(type6_usb) sun(type5unix)..! model..layout.= symbols. type4..us.= sun_vndr/us(sun4). type5..us.= sun_vndr/us(sun5). type5_unix.us.= sun_vndr/us(sun5). type6..us = sun_vndr/us(sun6). type6_unix.us = sun_vndr/us(sun6). type6_usb.us = sun_vndr/us(sun6). type6_unix_usb.us = sun_vndr/us(sun6). type4..en_US.= sun_vndr/us(sun4)+iso9995-3(basic). type5..en_US.= sun_vndr/us(sun5)+iso9995-3(basic). type5_unix.en_US.

C:\Program Files (x86)\Xming\xkb\rules\sgi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	4.688147918393019
Encrypted:	false
SSDEEP:	96:GrffTNk2f9/TOV+aNbGF+Gdt0jmgb2+fHW2+fHt2rdFu2+fS318s0deS+GY12W5U:6/T4GqN/+JHeeayp
MD5:	03222C890E8211E613C4508C5B9DD7C0
SHA1:	60EB58D3FAA092C74B476E644FD92BDBA14CC617
SHA-256:	F8AF10CB727A593F673F5F9FB7CC61BEE9B7BFD630B7D797759B5EF8E696F5CD
SHA-512:	7CC7FAB7BEA8AC4665D19DD54146E4791D458F14B6BCC04DA6C77A6429A3B56043EC96B1CAFD05B3BE4541FC1E2C651A4D65D4A92DB4359F229A8302D0DD2A73
Malicious:	false
Preview:	// $Xorg: sgi,v 1.3 2000/08/17 19:54:41 cpqbld Exp $..! option = symbols. grp:switch = +group(switch). grp:toggle = +group(toggle). grp:shift_toggle = +group(shifts_toggle). grp:ctrl_shift_toggle = +group(ctrl_shift_toggle). grp:ctrl_alt_toggle = +group(ctrl_alt_toggle). grp:caps_toggle.= +group(caps_toggle). ctrl:nocaps = +ctrl(nocaps). ctrl:swapcaps = +ctrl(swapcaps). ctrl:ctrl_ac = +ctrl(ctrl_ac). ctrl:ctrl_aa = +ctrl(ctrl_aa). keypad:overlay.= +keypad(overlay). keypad:overlay1.= +keypad(overlay). keypad:overlay2.= +keypad(overlay). lock:shift..= +capslock(shiftlock). pc104:altmeta..= +pc104(altmeta). pc104:compose..= +pc104(compose)..! option..= keycodes. lock:shift..= +sgi_vndr/indy(shiftLock)..! option..= keycodes...compat. keypad:overlay.= +sgi_vndr/indy(overlayKeypad).+keypad(overlay). keypad:overlay1.= +sgi_vndr/indy(overlayKeypad).+key

C:\Program Files (x86)\Xming\xkb\rules\sun (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	4.737013782119671
Encrypted:	false
SSDEEP:	24:XIX9bM2PMLPfE+E3e7Ek+yaeYXJEkeYXJkLV9G9GRxrQnRCuYzRZ2zRWZzR7ZzRk:XIXWvYaY2JC4tht9rOPsGcTNCHG4G9G5
MD5:	D3FE054200C1F0773055FBBDE92714DD
SHA1:	4B29C0339B410A25BC75C85CB13212A0B434AC8E
SHA-256:	18722074F796F0031069D83414F1A32F3A31FC231BE37EB5938B4B6748586806
SHA-512:	4930DB6C4551078716EAD480ED8422CD6D0DE2FB1611D1848C75A727572A02848CF54D4AA0A483956F68BFF39616C45757915667F6511A49962D05E8AC1D69F7
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/rules/sun,v 3.1 2000/05/18 23:21:43 dawes Exp $..! model...= keycodes...geometry. type4...= sun(type4)...sun(type4). type5...= sun(type5)...sun. type5_euro..= sun(type5_euro)..sun(type5euro). type5_unix..= sun(type5)...sun(type5unix). type6...= sun(type6) sun(type5). type6_euro..= sun(type6_euro) sun(type5). type6_unix..= sun(type6) sun(type5unix). type6_usb..= sun(type6_usb) sun(type5). type6_unix_usb.= sun(type6_usb) sun(type5unix)..! model..layout.= symbols. type4..us.= sun_vndr/us(sun4). type5..us.= sun_vndr/us(sun5). type5_unix.us.= sun_vndr/us(sun5). type6..us = sun_vndr/us(sun6). type6_unix.us = sun_vndr/us(sun6). type6_usb.us = sun_vndr/us(sun6). type6_unix_usb.us = sun_vndr/us(sun6). type4..en_US.= sun_vndr/us(sun4)+iso9995-3(basic). type5..en_US.= sun_vndr/us(sun5)+iso9995-3(basic). type5_unix.en_US.

C:\Program Files (x86)\Xming\xkb\rules\sun.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	191728
Entropy (8bit):	5.242208366290925
Encrypted:	false
SSDEEP:	768:uGIniOv4qnq4wUlf47GuXRk8A7C8nuvqAgNVCdSJwuRe2H0dJN16YHjX:u/RVASCGHdYHjX
MD5:	3AC9AF00F9A1C5B4EB150546F653C675
SHA1:	967FB849821C8C30245E37C525294050E9345852
SHA-256:	503F1EE8B87C5135B692FFD9B8C4F070874AF85AD329962557DD62B606EA4AF0
SHA-512:	91A1490661843309CFC3CE31B0CCED2582E381C2BC36183616C6542247ABCC878940B5C733C5D024C185285E5F0732ED8FB392378ABFAC8230BCE63C1132C6B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList>. <model>. <configItem>. <name>type4</name>. <name xml:lang="ko">type4</name>. <name xml:lang="ru">type4</name>. <description>Sun Type 4</description>. <description xml:lang="ko">. .. 4</description>. <description xml:lang="ru">Sun Type 4</description>. </configItem>. </model>. <model>. <configItem>. <name>type5</name>. <description>Sun Type 5</description>. <description xml:lang="ko">. .. 5</description>. <description xml:lang="ru">Sun Type 5</description>. </configItem>. </model>. <model>. <configItem>. <name>type5_euro</name>. <description>Sun Type 5 European</description>. <description xml:lang="ko">. .. 5 ..</description>. <description xml:lang="ru">Sun Type 5 ...........</description>. </con

C:\Program Files (x86)\Xming\xkb\rules\xfree98 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.050327097131242
Encrypted:	false
SSDEEP:	24:jLLQeHJxvcFRzfodseWooKw06U9oGQ6V3:fLjrvcFRcdseWooX06U9oGQ6V
MD5:	73944BC403BC61E32C4617D08877CB72
SHA1:	C746CEF03F3986162E1B01E2A7C8743DE785962D
SHA-256:	92B47D6C7704CB49FB69708B5975ABF341D78F217B98D75E779342EEF3DEB692
SHA-512:	E0D2119165C0E687383594B449C29278388EA9C95EE9DF02F91231ADF9FB1D9D6EB35FC6CC05C0765A4FF8A3C98D85BFBF475809C84D6737097560129D4FF7BC
Malicious:	false
Preview:	//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// $XFree86: xc/programs/xkbcomp/rules/xfree86,v 3.5 1996/12/17 21:03:59 dawes Exp $.//..! model .=.keycodes.geometry. pc98..=.xfree98(pc98).nec(pc98). jp106..=.xfree98(jp106).pc(jp106)..! model..layout.=.symbols. pc98..nec/jp.=.nec/jp(pc98). jp106..jp.=.jp..! model..layout.=.compat..types. ...=.complete.complete..! option..=.symbols. grp:switch..=.+group(switch). grp:toggle..=.+group(toggle). grp:shift_toggle.=.+group(shifts_toggle). grp:ctrl_shift_toggle.=.+group(ctrl_shift_toggle). grp:ctrl_alt_toggle.=.+group(ctrl_alt_toggle). ctrl:nocaps..=.+ctrl(nocaps). ctrl:swapcaps..=.+ctrl(swapcaps). ctrl:ctrl_ac..=.+ctrl(ctrl_ac). ctrl:ctrl_aa..=.+ctrl(ctrl_aa)..

C:\Program Files (x86)\Xming\xkb\rules\xkb.dtd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	5.260521417436348
Encrypted:	false
SSDEEP:	12:TMHdlRyENehfo0oSB32Nqqq8LibvLkmvjjxmjaykGGW/ynXQSFVLZyxbJpLpyxbT:2dHy1Z2NqZaiJm+K/wX5Zy71py7TAbY
MD5:	02FBD8C5B7C335F824B952214E66E6D8
SHA1:	F70F20EC59109F70A8DFD937A2685215D8BA3705
SHA-256:	997B175854DB2C9C6C72821D6ADF7732BA059AFB36DFDE15572E57E53C5888FD
SHA-512:	A60E2C0CD59462E456D89FC46340C3FEF5809869661EF575A79A0508D59C2D31A531BBBFD1D8A9E1D8E77A38BA6225517DE282ACB8FDA3C090C7F0C782CD1672
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Description: XKB configuration file DTD. Author: Sergey V. Udaltsov..-->..<!ELEMENT xkbConfigRegistry (modelList,layoutList,optionList)>..<!ATTLIST xkbConfigRegistry . version CDATA "1.0">..<!ELEMENT modelList (model)>..<!ELEMENT model (configItem)>..<!ELEMENT layoutList (layout)>..<!ELEMENT layout (configItem,variantList?)>..<!ELEMENT optionList (group)>..<!ELEMENT variantList (variant)>..<!ELEMENT variant (configItem)>..<!ELEMENT group (configItem,option)>.<!ATTLIST group. allowMultipleSelection (true\|false) "false">..<!ELEMENT option (configItem)>..<!ELEMENT configItem (name,shortDescription,description*,countryList?,languageList?)>..<!ATTLIST configItem. popularity (standard\|exotic) "standard">..<!ELEMENT name (#PCDATA)>..<!ELEMENT shortDescription (#PCDATA)>.<!ATTLIST shortDescription. xml:lang CDATA #IMPLIED>..<!ELEMENT description (#PCDATA)>.<!ATTLIST description. xml:lang CDATA #

C:\Program Files (x86)\Xming\xkb\rules\xorg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	27786
Entropy (8bit):	5.0607951984167325
Encrypted:	false
SSDEEP:	384:hi9Nq5d/Vjdh/2ae7W8ItwYAzORCEx7Ocenw4txaWbqtvz9i8BT1V3m1lmoxCJ2N:hr5d/df7e7WDtozO7ynxUi43Q
MD5:	68608C91883DB5E460BB58026CDABDBD
SHA1:	3C60C955369E200B74EB34E2D11A29F32C8FB25D
SHA-256:	3D617F22C7A62E006021BE991CAF496ECAFD109540B01213F6168C8E5D5747D3
SHA-512:	577F03C11D391FB2D2A01997CBA1DEE2554503DB292490BFB5A01F30201732E3831B5E37BBE6A79811E0907D8A4AABF70D7F285205A4DF07FCD04800912212D1
Malicious:	false
Preview:	// $Xorg: xfree86,v 1.3 2000/08/17 19:54:42 cpqbld Exp $..//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.// $XFree86: xc/programs/xkbcomp/rules/xfree86,v 3.79 2004/01/09 00:16:01 dawes Exp $.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoftpro microsoftprousb microsoftprose..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = abnt2 latitude jp106 kr106..! $macbooks = macbook78 macbook79.! $maclaptop = ibook powerbook macbook78 macbook79.! $macs = macintosh macintosh_old ibook

C:\Program Files (x86)\Xming\xkb\rules\xorg.lst (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	24562
Entropy (8bit):	4.438347463296873
Encrypted:	false
SSDEEP:	384:G0DrLhNgDZUlX5lQ/6f/B3/efYTi+/VMxUQq3mfFkuYG4Bh0vfOT6w1MRVucDQkM:G0Dr1NgDZeX5lQ/4B3/efYTiwGFknG4p
MD5:	7EA0844991561503BFE95B3248C486C6
SHA1:	CF5FFDD277A62B4244E52F53C104574015070A4F
SHA-256:	1FD83EAA09CB9C2B93D69AB2B36C9DEE078F502F8FDDC4BEAAE44D3A0B42C4F2
SHA-512:	97F3600FD2FE97ECB386C699176075ED2AA90D7647B6EBB9287CB0A8D58076DEBF1F9FE22E74FA1C3D60DA330E6067FD2FA815D3B34406DBAF86FDC523E2A2C9
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. jp106 Japanese 106-key. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. abnt2 Brazilian ABNT2. airkey Acer AirKey V. acpi ACPI Standard. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001A

C:\Program Files (x86)\Xming\xkb\rules\xorg.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	946100
Entropy (8bit):	5.16598718390429
Encrypted:	false
SSDEEP:	24576:p2mafe2x4MZ783wgv8gUHyefgi6FPCVt5k5TiWjxUTMv0oTiIiz2KvI:omafe2x4MZ783wgv8gUHyefgi6FPCVtO
MD5:	1793EC657EB3B183D6A40E0D8354B0E8
SHA1:	8D539D20ABB4242C1EB3BE12D8FEEE531DACD775
SHA-256:	F7682896780D692B5F6EA6A735458A30648B9715C32D543B405521AE6253068B
SHA-512:	E9C81B5FB238DB542739AAB192CE622C8FDB7CDDF855A41EABF0D0622ADBB4F2A7AD3903EB51214E2F5F6A7A63958B43E36A18994D5263BA8E50500EC89B84A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <description xml:lang="af">Generies 101-sleutel PC</description>. <description xml:lang="az">Generic 101-key PC</description>. <description xml:lang="bg">.......... 101 ........ PC ..........</description>. <description xml:lang="cs">Obecn. PC 101 kl.ves</description>. <description xml:lang="da">Generisk 101-taster PC</description>. <description xml:lang="el">....... ..... ........... 101-........</description>. <description xml:lang="en_GB">Generic 101-key PC</description>. <description xml:lang="es">PC gen.rico 101 teclas</description>. <description xml:lang="fi">Yleinen 101-n.pp.iminen PC</description>. <description xml:lang

C:\Program Files (x86)\Xming\xkb\semantics.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	134
Entropy (8bit):	3.2308413491082346
Encrypted:	false
SSDEEP:	3:81IfIF8TzcRu8MIDtELbvIeIZHvMUMIC3A6OEv:81OdzcMDLbvIeevhMl3AvEv
MD5:	423052E69ED62990C5BFCFA1A09127EB
SHA1:	9B318258568EDF4B17838F187564CB9DAE21F1FB
SHA-256:	A937D8E5FDD55B27BA5CC8BB97F4905F6230589823703624933DC6D16EF03D9F
SHA-512:	81699A6B39F7B3503BF5B6B36065F11FD00AE2BB6E458CAC1D9CFDCB755DCE2BBF96F4CBBC966CAB20A86C5BACCCDB2BBF7A65E9D592C45CA7F277ADEF6186AF
Malicious:	false
Preview:	-d------ -------- default(default).-d------ -------- basic(basic).-d------ -------- xtest(xtest).-d------ -------- complete(complete).

C:\Program Files (x86)\Xming\xkb\semantics\basic (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.10160865852302
Encrypted:	false
SSDEEP:	3:RFLDtHELGdFUinVhUcIF/2B8Bno6WwHWFEcwvGaT2yJUA9H/FA+6ree2aUA9H/sv:jLDOyFau+xo6WYWaVT2aUAJ29nUAJsDr
MD5:	E8E825C4FE9E9CCDF3FD220746E52FFA
SHA1:	296953EFBDA2FAFD3C5E360B5E6FEFFA4E732F4C
SHA-256:	D54C1706D33F3F9B6093AD695505E5BD09C066B2AAF88C4AE9746BD91FD58DCB
SHA-512:	2AF0B89342BB3E8EABED490FDC50A308C10A27D176640FBCD70543227D0A57DA2CD39E45FE5CF7CBA1477EE0E4129487E833ECDD7F5399AD8363BC3CDB26E28A
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "basic" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "basic".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\complete (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.079276395232984
Encrypted:	false
SSDEEP:	3:RFLDtGZO+LVhUcIF/2B8Bno6WwHWFgYdoaT2yJUA9GKIdfevG6ree2aUA9GKId5c:jLD0wfu+xo6WYWNd/T2aUAkTg9nUAkTs
MD5:	DCF8F1CE1CC960168806A8A73D2B3110
SHA1:	E6A31A8D69366C239CB8115610FE5720B18329F0
SHA-256:	81954552382A36C417872C25F6ABBC0812DA4D6EBFB8ECDE608FD2DEC016ADB0
SHA-512:	723E451EC7BDD9B8DAEEACC8C31422D720234FCE43D3100578D83D0989D1041B37D36788886956AF1B066D94E9FB623DB0FCB8BFD5140CCA8FB2C69F3330DDB2
Malicious:	false
Preview:	// $Xorg: complete,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "complete" {..xkb_types..{ include "complete" .};.xkb_compatibility.{ include "complete".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\default (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.119319825469398
Encrypted:	false
SSDEEP:	3:RFLDtBzgd/nVhUcIF/2B8Bno6WwHWFiflaGaT2yJUA9BAD5fl5e+6ree2aUA9BAM:jLDnS/au+xo6WYWgd8T2aUA89dCnUA8M
MD5:	007D41E47CAC4115C50D49AF5E285759
SHA1:	AF0FFDB8C5A6CFB96EDA6F8734207E4BF8CCB957
SHA-256:	F52F19F52D3DA5E90C7258642787FA486C714B1EA9E4166673838D74974CF07D
SHA-512:	258AB779ECAFE346D8574DB23EB1CF6E27A6481B9C88B27D185389C39EB8D7145EAF44A26D5E5860499393D6D9FA6EAFD4C8A410C028F61FD66F01F0329B30ED
Malicious:	false
Preview:	// $Xorg: default,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "default" {..xkb_types..{ include "default" .};.xkb_compatibility.{ include "default".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\is-E1DNU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.10160865852302
Encrypted:	false
SSDEEP:	3:RFLDtHELGdFUinVhUcIF/2B8Bno6WwHWFEcwvGaT2yJUA9H/FA+6ree2aUA9H/sv:jLDOyFau+xo6WYWaVT2aUAJ29nUAJsDr
MD5:	E8E825C4FE9E9CCDF3FD220746E52FFA
SHA1:	296953EFBDA2FAFD3C5E360B5E6FEFFA4E732F4C
SHA-256:	D54C1706D33F3F9B6093AD695505E5BD09C066B2AAF88C4AE9746BD91FD58DCB
SHA-512:	2AF0B89342BB3E8EABED490FDC50A308C10A27D176640FBCD70543227D0A57DA2CD39E45FE5CF7CBA1477EE0E4129487E833ECDD7F5399AD8363BC3CDB26E28A
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "basic" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "basic".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\is-JLOHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.079276395232984
Encrypted:	false
SSDEEP:	3:RFLDtGZO+LVhUcIF/2B8Bno6WwHWFgYdoaT2yJUA9GKIdfevG6ree2aUA9GKId5c:jLD0wfu+xo6WYWNd/T2aUAkTg9nUAkTs
MD5:	DCF8F1CE1CC960168806A8A73D2B3110
SHA1:	E6A31A8D69366C239CB8115610FE5720B18329F0
SHA-256:	81954552382A36C417872C25F6ABBC0812DA4D6EBFB8ECDE608FD2DEC016ADB0
SHA-512:	723E451EC7BDD9B8DAEEACC8C31422D720234FCE43D3100578D83D0989D1041B37D36788886956AF1B066D94E9FB623DB0FCB8BFD5140CCA8FB2C69F3330DDB2
Malicious:	false
Preview:	// $Xorg: complete,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "complete" {..xkb_types..{ include "complete" .};.xkb_compatibility.{ include "complete".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\is-OOA4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.119319825469398
Encrypted:	false
SSDEEP:	3:RFLDtBzgd/nVhUcIF/2B8Bno6WwHWFiflaGaT2yJUA9BAD5fl5e+6ree2aUA9BAM:jLDnS/au+xo6WYWgd8T2aUA89dCnUA8M
MD5:	007D41E47CAC4115C50D49AF5E285759
SHA1:	AF0FFDB8C5A6CFB96EDA6F8734207E4BF8CCB957
SHA-256:	F52F19F52D3DA5E90C7258642787FA486C714B1EA9E4166673838D74974CF07D
SHA-512:	258AB779ECAFE346D8574DB23EB1CF6E27A6481B9C88B27D185389C39EB8D7145EAF44A26D5E5860499393D6D9FA6EAFD4C8A410C028F61FD66F01F0329B30ED
Malicious:	false
Preview:	// $Xorg: default,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "default" {..xkb_types..{ include "default" .};.xkb_compatibility.{ include "default".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\is-VEJQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.1063185954476635
Encrypted:	false
SSDEEP:	3:RFLDtdlnVhUcIF/2B8Bno6WwHWFlaT2yJUA9H/FA+6ree2aUA9dRAWcn:jLDNau+xo6WYWOT2aUAJ29nUABc
MD5:	FA06CCD652ECB15CAFF6C5F430E8204A
SHA1:	C2ACA4AEE15E3A9D8F8A653D4818C923BFB8395D
SHA-256:	DA362EE4A166C3912D060D691F639238B571D6C9A1666610FEEA13DCBEF7DFD7
SHA-512:	5AB737EA5DEF8E1A7DC24080324E33DEFD3B58B2E5365E1FADC11DEB390915C2BCD0ACD0F0F03FF6ACD870780914C3F87B8BA5753AE5C6C924D14909EC707B2B
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "xtest" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "xtest".};..};.

C:\Program Files (x86)\Xming\xkb\semantics\xtest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.1063185954476635
Encrypted:	false
SSDEEP:	3:RFLDtdlnVhUcIF/2B8Bno6WwHWFlaT2yJUA9H/FA+6ree2aUA9dRAWcn:jLDNau+xo6WYWOT2aUAJ29nUABc
MD5:	FA06CCD652ECB15CAFF6C5F430E8204A
SHA1:	C2ACA4AEE15E3A9D8F8A653D4818C923BFB8395D
SHA-256:	DA362EE4A166C3912D060D691F639238B571D6C9A1666610FEEA13DCBEF7DFD7
SHA-512:	5AB737EA5DEF8E1A7DC24080324E33DEFD3B58B2E5365E1FADC11DEB390915C2BCD0ACD0F0F03FF6ACD870780914C3F87B8BA5753AE5C6C924D14909EC707B2B
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "xtest" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "xtest".};..};.

C:\Program Files (x86)\Xming\xkb\symbols.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	24536
Entropy (8bit):	3.739492948005294
Encrypted:	false
SSDEEP:	384:NO3IuUNIhOh/hOh/2H2H8O8/8O8jKI1qkfREF3dv16UGsIp6JvII0PnlR+yUOs5e:NO4uUNIQx8d2H2HrWTC1qkfREF3h16Uy
MD5:	FA02747C8C61B364B131879E52D88334
SHA1:	B7BC3AD1915733FB15ED679EBAC4BCD4FD59F2E5
SHA-256:	EA1B7514A3D95DDBFF9742C1EA098B2F005E1F9629D0661C585E84298A1EDBFA
SHA-512:	7D6B8EBAFC39A3C15496053D4B6901207A467E5CA6CFCE48F22EC92A1CA012526E50D814EE55DB8866249AF0E22809CB74BC450E3605DF544332D2FACEC6D898
Malicious:	false
Preview:	-dp----- a------- ad(basic).-dp----- a------- af(basic).--p----- a------- af(ps).--p----- a------- af(uz).-dp----- a------- al(basic).-dp----- a------- ba(basic).--p----- a------- ba(us).--p----- a------- ba(alternatequotes).--p----- a------- ba(unicode).--p----- a------- ba(unicodeus).-dp----- a------- am(basic).-------- -------- am(phonetic).--p----- a------- am(phonetic-alt).--p----- a------- am(eastern).--p----- a------- am(western).--p----- a------- am(eastern-alt).-dp----- a------- bd(basic).-------- -------- bd(probhat).-dp----- a------- be(basic).--p----- a------- be(iso-alternate).--p----- a------- be(sundeadkeys).--p----- a------- be(Sundeadkeys).--p----- a------- be(nodeadkeys).--p----- a------- be(wang).-dp----- a------- bg(bds).--p----- a------- bg(phonetic).-dp----- -------- ca(fr).-------- -------- ca(fr-dvorak).--p----- -------- ca(fr-legacy).--p----- -------- ca(multi).--p----- -------- ca(multi-2gr).-------- a------- ca(ike).--p----- -------- ca(multix).-dp----- a----

C:\Program Files (x86)\Xming\xkb\symbols\ad (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	5.047212599322196
Encrypted:	false
SSDEEP:	24:YaVCK71EKBZb60WEx0triy2d8ALXE/uwewglx9cV4zN9q7Zq3vQqmVzFvO0C:3nEKBVWEuE3Vy4zzZeFvg
MD5:	4E7FB3124BC729A7475F636B2045C6F6
SHA1:	A9973B2172D7B79E52168E7ED3CDE1E552075DEA
SHA-256:	DE0D142687BAF943F1816A445BBD33D454547A0B7725CE5A3266997F6156281B
SHA-512:	47E156F4A4DF560CF477FB78D3FF1084B19479E35CBD10F24281179DC84D51F10364B9AB2AB9365FA89F2DEE76612577AE179B4BD53275956BD19DCCBC717993
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ad,v 1.1 2006-01-06 23:53:21 svu Exp $..//.// Catalan Keyboard, as manufactured by Large Format Computing, Inc..//.// For layout graphic, see http://www.language-keyboard.com/languages/catalan_layout.htm.//.// Contributed by Robert Millan..partial default alphanumeric_keys.xkb_symbols "basic" {. include "us".. name[Group1]="Andorra";.. key <AE02> { [ 2, at, dead_diaeresis ] };. key <AE07> { [ 7, ampersand, dead_acute ] };. key <AE09> { [ 9, parenleft, dead_grave ] };. key <AD02> { [ w, W, eacute, Eacute ] };. key <AD03> { [ e, E, egrave, Egrave ] };. key <AD06> { [ y, Y, udiaeresis, Udiaeresis ] };. key <AD07> { [ u, U, uacute, Uacute.] };. key <AD08> { [ i, I, iacute, Iacute.] };. key <AD09> { [ o, O, oacute, Oacute.] };. key <AD10> { [ p, P, ograve, Ograve.] };. key <AD12> { [ bracketright, braceright, EuroSign ] };. key <AC01> { [ a, A, agrave, Agrave ] };. key <AC08> { [ k, K, idiaere

C:\Program Files (x86)\Xming\xkb\symbols\af (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.0018769239056775
Encrypted:	false
SSDEEP:	192:wHombkQJ3v2sORZPhKznkpVh0cuoxQAX1wWxDRKMeEP8Z30c8/xQW3v2iORZPhKr:wHombkE3v2sORZPhKjkpVh0cuoxxX1wg
MD5:	678A77C157C8209348A02CCA15ECE3CB
SHA1:	7A6D1A7CA8CF0CA77C1FE376DB3127CD51E06B9F
SHA-256:	41EF6631CF2A6C2A582FEC458AA35A12ACFFBE920CAB84976C9CD3215AC79EAA
SHA-512:	B514E607B6375EE12BE28D6C11936D01D17F614210E1D7395E7E1ED0B85777D208A3C2D21BA64D059A170B1069457E8F43F63250F6FDC8A81F3716DA29A49011
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/af,v 1.2 2006-10-11 19:32:35 svu Exp $.//.// Keymap for the Afghan dari keybord layout.// Based on the specification "Computer Locale Requirements for .// Afghanstan" [1] from the "United Nations Development Programme.// Afghanistan" and the "Afghan Transitional Islamic .// Administration Ministry of Communications". .// [1] http://www.evertype.com/standards/af/.// For a MINI HOWTO see [2]..// [2] http://www.afghanischerKulturverein.de/en/afghanComputer_en.php.//.// 2006-02-15 file created by M. Emal Alekozai <memala@gmx.net>..partial default alphanumeric_keys .xkb_symbols "basic" {. //name[Group1]= "Afghanistan Dari";. name[Group1]= "Afghanistan";.. key <TLDE> { [ 0x100200d, 0x10000f7, dead_tilde ] };. key <AE01> { [ 0x10006f1, exclam, 0x1000060 ] };. key <AE02> { [ 0x10006f2, 0x100066c, 0x1000040 ] };. key <AE03> { [ 0x10006f3, 0x100066b, numbersign ] };. key <AE04> { [ 0x10006f4, 0x100e60b, 0x1000024] };. key <AE0

C:\Program Files (x86)\Xming\xkb\symbols\al (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	4.6864998639436495
Encrypted:	false
SSDEEP:	24:Ya8vZv6eDT60OPYc4gN9+aidY+vCSL6/wJgixaQ8q+kknyXE9VBNLlM4bLvGB23x:qtpDnOw4mYYJ6Wvalj3Nn+L/sT
MD5:	00008C2339024245EEA36AE060297B64
SHA1:	9F443149451DECC031EC3F3EAAAB1BD33BB0A8A0
SHA-256:	DED3E683A55D33D9B655F6A0F3AA0901E97A5D5132F6DFD2D25B2A0F1BE01A7F
SHA-512:	E449B6F158D4A88C88943E92F28E0DC7D64193A0BE327CC85A7B3344E8091126CBE343888815FF711BC222AEED066AA4A85EA6F2AED4AB14BADC60618B4BC436
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/al,v 1.5 2004-12-22 21:51:19 svu Exp $..// based on.// albanian keyboard layout.// done by Pablo Saratxaga <pablo@mandrakesoft.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/al,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type3)".. name[Group1]="Albania";.. key <AE01>.{ [ 1, exclam, asciitilde, dead_tilde ].};. key <AE02>.{ [ 2, quotedbl, dead_caron, oneeighth ].};. key <AE03>.{ [ 3, numbersign, dead_circumflex, sterling ].};. key <AE04>.{ [ 4, dollar, dead_breve, dollar ].};. key <AE05>.{ [ 5, percent, dead_abovering, threeeighths] };. key <AE06>.{ [ 6, asciicircum, dead_ogonek, fiveeighths ].};. key <AE07>.{ [ 7, ampersand, grave, dead_grave ].};. key <AE08>.{ [ 8, asterisk, dead_abovedot, trademark ].};. key <AE09>.{ [

C:\Program Files (x86)\Xming\xkb\symbols\altwin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2254
Entropy (8bit):	4.9939933941875205
Encrypted:	false
SSDEEP:	24:YaencxvXEKnKWyLVgznBIH5MUdn8sFc8Wxe7WYNS4R16K0pm4WcNtKOFA6nFA6pK:xvXElrqBIH+orQiBvAWx6/+D
MD5:	A01B3C58E803D89679C53C2B4309F33A
SHA1:	74617BD56F0E65EB2493A983D0CA6148338CD079
SHA-256:	34FC3587ED96C24859BAFA70B87FE382F5438919FBB539D61027AC4679EA9847
SHA-512:	23907A26447531138802E567975829EB57572ED2CA1E96D45EB156AD72148AD619DAA346E6F5DB893FD5C396E35064E7EEFECBF58FD2E33B2FA0ED9929C1F7E7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/altwin,v 1.10 2006-11-14 17:26:40 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/altwin,v 1.5 2003/12/03 14:09:08 pascal Exp $..partial modifier_keys .xkb_symbols "meta_alt" {. key <LALT> {.[ .Alt_L,.Meta_L..].};. key <RALT> {.[ .Alt_R,.Meta_R..].};. modifier_map Mod1.{ Alt_L, Alt_R, Meta_L, Meta_R };.// modifier_map Mod4.{};.};..// Control is mapped to the Win-keys (and the usual Ctrl keys)..partial modifier_keys .xkb_symbols "ctrl_win" {. key <LWIN> {.[ .Control_L..].};. key <RWIN> {.[ .Control_R..].};. modifier_map Control { <LWIN>, <RWIN> };.};..partial modifier_keys .xkb_symbols "meta_win" {. key <LALT> {.[ .Alt_L,.Alt_L..].};. key <RALT> {.[ .Alt_R,.Alt_R..].};. key <LWIN> {.[ .Meta_L...].};. key <RWIN> {.[ .Meta_R...].};. modifier_map Mod1.{ Alt_L, Alt_R };. modifier_map Mod4.{ <META>, Meta_L, Meta_R };.};..partial modifier_keys .xkb_symbols "left_meta_win" {. key <LALT> {.[ .Alt_L

C:\Program Files (x86)\Xming\xkb\symbols\am (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9469
Entropy (8bit):	4.960363627236577
Encrypted:	false
SSDEEP:	96:jIMI1WwSkEDO026x0MBTeJbiJgSpCE6ITZh1Te086ct9O6JIjN9mUe/TXh+0+hnP:jSuePdvft3ZYIfe+11zrY
MD5:	ACAF3CAB2DE2B21EA86181CF21001260
SHA1:	7803583AF9A1EFE446A5B7001444115F4F7D6F1B
SHA-256:	D2FD4A5CA7D9A59A04DA343A2F721437257BADF09692E16DF4666C976958CF94
SHA-512:	974E1A20013649BDCE23D95D0703C6F6DD4AB4A2AA52BCA73AB6D7362A9ADA5E7B109B55106221B272374A93D156EB3CBCD5B1AD3C942ED83DBA6C34BF018B1C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/am,v 1.11 2007-01-25 21:08:26 svu Exp $..// based on a keyboard map from an 'xkb/symbols/am' file.//.// $XFree86: xc/programs/xkbcomp/symbols/am,v 1.4 2003/05/29 12:41:58 pascal Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Armenia";.. // Alphanumeric section. key <TLDE> {.[ 0x100055d, 0x100055c.].};. key.<LSGT> {.[ question, 0x100058a.].};. key <BKSL> { [ guillemotright, guillemotleft ] };.. key <AE01> {.[ 0x1000586, 0x1000556.].};. key <AE02> {.[ 0x1000571, 0x1000541.].};. key <AE03> {.[ 0x1002013, 0x1002014 ].};. key <AE04> {.[ comma, dollar.].};. key <AE05> {.[ 0x1000589, 0x1002026.] .};. key <AE06> {.[ 0x100055e, percent.].};. key <AE07> {.[ 0x1002024, 0x1000587.] .};. key <AE08> {.[ 0x100055b, 0x10002bc.] .};. key <AE09> {.[ parenright, parenleft ] .};. key <AE10> {.[ 0x1000585, 0x1000555.].};. key <AE11> {.[ 0x1000567, 0x

C:\Program Files (x86)\Xming\xkb\symbols\ara (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10896
Entropy (8bit):	4.175369379352188
Encrypted:	false
SSDEEP:	192:UNUp15pC3dO1JZGXam16Yjkt4+iOTSV8Ag8JSBtWPjvwbOeHctf9vGqyJO01NHy9:UNi153hyfKWo3N7gbgLb8X3iWx2EglNe
MD5:	43C8DB2884B54405D193A809AA03097A
SHA1:	AFBF13054B05D72AAF62AF8B8E431177E52178C0
SHA-256:	2EAFD3EE8F7282F47A0B06AEF0FF04B213372F69DD73D6DF91E8CF7A1C87D8A4
SHA-512:	B0E6B86A7E6925583417CDDE10E3FE748EFB9415289B706EEE46819EB0D03AA2024B862A8D5B8DC06A7B2DFD4A599207D8DA514813C5442832920E0F730D6218
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ara,v 1.6 2006-09-18 13:25:31 svu Exp $..// based on a keyboard map from an 'xkb/symbols/ar' file..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Arabic";..// NOTES:.//.// there is also combined shadda diacritis in AltGr position of simple.// diacritics fatha, fathatan, damma, dammatan, kasra and kasratan.// should a third state be added to Group2 ?.//.. key <TLDE> { [ Arabic_thal, Arabic_shadda ].};. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [

C:\Program Files (x86)\Xming\xkb\symbols\az (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4148
Entropy (8bit):	4.464372007878455
Encrypted:	false
SSDEEP:	48:2H32Fab4ZY2aotY3wVtuU/QahjqG3zof2v+O5sIzFfZ:2H3MavWY3wVfIahjq0zRv+O5LzFfZ
MD5:	F193BF48BDD1B8EEEDF993C2183CAA6A
SHA1:	F00B560412A6226943E56CA5C151AF044E471BE5
SHA-256:	EDFE71EC9D0985C446F62FCB5C0B534B74041588D5EF735C7880982039E4D97D
SHA-512:	935D9838E862F642D9B2A9F44C6DD57A0E7500AFCEC1BE445E74332FAA4D5C044B3542CA05725DA967FAF5D3380C2E467C8599A42D65831A61D912BEA97B77F8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/az,v 1.5 2005-01-16 02:18:20 svu Exp $..// based on:.// symbols definition for a very simple Azerbaidjani keyboard layout..// 2001 - Pablo Saratxaga <pablo@mandrakesoft.com>..partial default alphanumeric_keys.xkb_symbols "latin" {.. include "us".. name[Group1]= "Azerbaijan";.. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };.. key <AE03> { [ 3, numbersign, U2166 ] };. key <AE06> { [ 6, colon, EuroSign, periodcentered ] };. key <AE07> { [ 7, question ] };.. key <AE08> { [ 8, asterisk, asciicircum, dead_circumflex ] };. key <AE11> { [ minus, underscore, hyphen, emdash ] };.. key <AD02> { [ udiaeresis, Udiaeresis ] };. key <AD04> { [ r, R, registered ] };. key <AD08> { [ i, Iabovedot ] };. key <AD11> { [ odiaeresis, Odiaeresis, bracketleft, braceleft ] };. key <AD12> { [ gbreve, Gbre

C:\Program Files (x86)\Xming\xkb\symbols\ba (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	886
Entropy (8bit):	4.993970407441661
Encrypted:	false
SSDEEP:	24:Yay+a60zlh6al+S6BMMltz6NldC6BlBl+qR:YzlRlylAldvlNR
MD5:	D64F51EDCED8E93B96ABF9B8A109BE42
SHA1:	332CD20F3EE7BDB745DBF8E0D5A156DCE2AC0953
SHA-256:	A38A26490CB7AB3BF627D82B92D4AFC612FEDA7F62468A132F312E8F7EFE05AD
SHA-512:	63F213DEA04FE870FD657AB8B902B646F3DB161325702039CA68612618D9C8D5D1D9F936C1A1011E5AAEE7CBE57CAF7F49EF15D91E7BA21964D0E9431CD8FF69
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ba,v 1.6 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Bosnia and Herzegovina";.. include "cs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Bosnia and Herzegovina - US keyboard with Bosnian letters";.. include "cs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Bosnia and Herzegovina - Use guillemets for quotes";.. include "cs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Bosnia and Herzegovina - Use Bosnian digraphs";.. include "cs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Bosnia and Herzegovina - US keyboard with Bosnian digraphs";.. include "cs(latinunicodeyz)".};.

C:\Program Files (x86)\Xming\xkb\symbols\bd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4396
Entropy (8bit):	5.21069687955298
Encrypted:	false
SSDEEP:	48:buHLAEQsZSAAQZCk0YGTaMBy16G3lx1rKrN35GK8lWOnLR+TR1sMiyZ+hLMIDtt:lEQOuQ8Zb5IcS1Wnaln0TviyZ+hLtt
MD5:	169C3DAF2E31CBF9EFC9F2B0487A7AC1
SHA1:	8C85AE0A94A1798570C5357BF0B3D4D7ADD77616
SHA-256:	30D26FA87E091F50806B05DCBEF97E0F051365DE3E46E838440B890967D3D441
SHA-512:	F4A4387E9AFA5F6CEE7FDA61948793153CF562FF9A6C61621ABCD905B23F65FD780EE21B27418229FBF4371F1E4444560E7B103DEE23F6000D5458AE52CAFFA7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bd,v 1.4 2006-01-15 15:01:13 svu Exp $.//.// XKB symbol :: National Bangla/Bengali Standard Keyboard Layout for Bangladesh.// Ref: http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf.//.// Author: Jamil Ahmed <jamil at bengalinux.org>.// Created: 18-12-2005.// Last Updated: 08-01-2006.// Version: 6.01.3.//.// Issues:.// <AC08> Khanda-Ta is given U-09CE; But BCC had U-09BA.// <AC07> U-09BB is added though it is not allocated in Original Unicode.// <AE06> U-09B3 is added though it is not allocated in Original Unicode.// 3 Conjunct characters are not included.//..default partial alphanumeric_keys..xkb_symbols "basic" {. name[Group1]= "Bangladesh";. key <ESC> { [ Escape ] };..// numbers. key <TLDE> { [ quoteleft,.asciitilde,.voidsymbol,.voidsymbol ] };. key <AE01> { [ 0x10009E7,.exclam,..0x10009F4,.voidsymbol ] };. key <AE02> { [ 0x10009E8,.at,..0x10009F5,.voidsymbol ] };. key <AE03> { [ 0x10009E9,.numbersign,.0x10009F

C:\Program Files (x86)\Xming\xkb\symbols\be (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6019
Entropy (8bit):	4.627944817450199
Encrypted:	false
SSDEEP:	96:R1LinxigCRnIeoWnJQSEiqGaSr5Umw2+0e8noQuda5Hz9sUy9H+ejIJkC:R18xtCxIOJ5xaSrlw2ResbKa5Z5ecJZ
MD5:	A81853A9B8542B2E0767CD1228E46D71
SHA1:	D64C1A909A99835CE2B3CBC2C9A25ABBFAF28687
SHA-256:	168714634F4E81FD5CD773D44E24B57F262C4E1F2ED7811EA612F648A15B812E
SHA-512:	5EC740310D986F872B63E53F9367776D244E6E8B2D9AB95B7493F5D693D16040E7E91AE6993E96B6EC75AEBA365412AFEAFFF6A1D2757036DB922A513185C32C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/be,v 1.7 2006-04-02 20:07:45 svu Exp $..// based on a keyboard map from an 'xkb/symbols/be' file.//.// $XFree86: xc/programs/xkbcomp/symbols/be,v 1.3 2003/04/12 10:53:48 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Belgium";.. key <AE01>.{ [ ampersand, 1, bar, exclamdown ].};. key <AE02>.{ [ eacute, 2, at, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, onequarter, dollar ].};. key <AE05>.{ [ parenleft, 5, onehalf, threeeighths ].};. key <AE06>.{ [ section, 6, asciicircum, fiveeighths ].};. key <AE07>.{ [ egrave, 7, braceleft, seveneighths ].};. key <AE08>.{ [ exclam, 8, bracketleft, trademark ].};. key <AE09>.{ [ ccedilla, 9, braceleft, plus

C:\Program Files (x86)\Xming\xkb\symbols\bg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7245
Entropy (8bit):	4.048186295865633
Encrypted:	false
SSDEEP:	96:Xy66F2fFhmPBheS1+sTMR7fiuBDFTVsT0dS3kCi:XmofOBYSAsTMRrBDFTVwNdi
MD5:	13D9E3C59CF5F53163428CB973D0E758
SHA1:	81CC13FE022D239CE4045B5BB4CB48BADBA29A75
SHA-256:	6BC368A0C13C75D1F06E581D7800829340DF515981DA5A3693E67F2ADC940D9C
SHA-512:	10C418017DC291C3DAA4D175215B497512F11DE5ABD079DD560C880A4C652D1A4193F171C1AA79CABD8A747BEEE8672C8DB44D2F157BFF56B3B1924DBCC93116
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bg,v 1.8 2005-08-07 23:00:52 svu Exp $..// based on a keyboard map:.//.//////////////////////////////////////////////////////////////////////////.// Copyright (C) 1999, 2000 by Anton Zinoviev <anton@lml.bas.bg>.//.// This software may be used, modified, copied, distributed, and sold,.// in both source and binary form provided that the above copyright.// and these terms are retained. Under no circumstances is the author.// responsible for the proper functioning of this software, nor does.// the author assume any responsibility for damages incurred with its.// use..//.////////////////////////////////////////////////////////////////////////// .// Version 1.6r1..partial default alphanumeric_keys.xkb_symbols "bds" {.// BDS is the Bulgarian Institute for Standardization.. name[Group1]= "Bulgaria";. . key <TLDE> { [ parenleft, parenright ] };. key <AE01> { [ 1, exclam ] };. key <

C:\Program Files (x86)\Xming\xkb\symbols\br (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2737
Entropy (8bit):	4.786372693980445
Encrypted:	false
SSDEEP:	48:JKuhno+MccG6S7I66BLdzoBjYQjvAMWbZ91ghr:4e+ccuqBLdze0wvs1ghr
MD5:	9E57827B4B20DB2FDD2A40AB7DB2D8FF
SHA1:	43779688F17407B36467BF21C2E4824DF8AE41D9
SHA-256:	BC13DC7F02E99BC09C0EAE4DCB6325EFC1C576B5CD821A4489B4C42DC85F9AB9
SHA-512:	12CB1F646DEABC8809F698C419F339BF49782CBBB25118E8BB70137B374236516BF98AABE0718567FC6AB4E72C3A9F5325CFDA48D8D62A9D3E9390D22AC2C512
Malicious:	false
Preview:	.// based on .// "a very simple Brasilian ABNT2 keybaord.// by Ricardo Y. Igarashi (iga@that.com.br).// Adds suport for dead-keys in I18N applications.// by Conectiva (http://www.conectiva.com.br)".//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/br,v 1.10 2006-11-20 19:18:02 svu Exp $.// $XdotOrg: xc/programs/xkbcomp/symbols/br,v 1.1.4.3 2004/03/05 13:41:32 eich Exp $.// $XFree86: xc/programs/xkbcomp/symbols/br,v 1.3 2003/04/19 12:22:11 pascal Exp $..default.xkb_symbols "abnt2" {.. include "latin". name[Group1]="Brazil";.. key <AE02>.{ [ 2, at, twosuperior, onehalf ].};. key <AE03>.{ [ 3, numbersign, threesuperior, threequarters ] };. key <AE04>.{ [ 4, dollar, sterling, onequarter ].};. key <AE05>.{ [ 5, percent, cent, threeeighths ].};. key <AE06>.{ [ 6, dead_diaeresis, notsign, diaeresis ].};. key <AE12>.{ [ equal, plus, section, dead_ogonek ].};.. key <

C:\Program Files (x86)\Xming\xkb\symbols\bt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.674894388090002
Encrypted:	false
SSDEEP:	48:L3YHfvzNxibE4Sv+WNKhecQMsRnAaWsOfdjm0ir4HhXyhwzGz7c+VKnYs+O1EjEy:LIHfvzH8CMsl3D0H5JGzgc+Ys0cOIY1
MD5:	41A9FCC33E0BC87CF7342C09C9443642
SHA1:	649420182EF3E42E2116698741FAE900E3F389B8
SHA-256:	01F5A47519725EC931BE221E8D5A0291B0420A4A550DA7EA57617885BB1990F8
SHA-512:	1F462DC0A44F8C95D133A17F2D05DA20FD25C59C07F9B9B9E3414F59E63FBA138F7B36B52B4DAC62CBAB35169F94A9EE68EC4621F6BB4FEEBD20970F25CFE9F1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bt,v 1.3 2006-10-03 22:33:37 svu Exp $.//.// Dzongkha / Tibetan layout for Bhutanese keyboard.//./////////////////////////////////////////////////////////////////.//.// Based on the official layout for Dzongkha.// approved by the Department of Information Technology &.// Dzongkha Development Authority of the Government of Bhutan.//.// Copyright (C) 2004, Gregory Mokhin <mokhin@bog.msu.ru>.///////////////////////////////////////////////////////////////// .// Version 0.97 2004-01-09 Layout map provided by Chris Fynn.// Version 1.0 2004-07-29 Some correction by Pema Geyleg <pema_geyleg@druknet.bt>./////////////////////////////////////////////////////////////////..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Bhutan";.. key <TLDE> { [ 0x1000F09, 0x1000F0A, 0x1000F6C, 0x1000F6D ].};. .// numbers e.a.. key <AE01> { [ 0x1000F21, 0x1000F04, 1, exclam ].};. key <AE

C:\Program Files (x86)\Xming\xkb\symbols\by (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3935
Entropy (8bit):	4.770940454586109
Encrypted:	false
SSDEEP:	48:kXcmG5fPR0vaEYX2ZHr/VKRRSfPxfZPWf/5tz4+:M4R6yaZ8R8xf+/7zZ
MD5:	2E29D6931CAF96C7A4671E93687031DE
SHA1:	FF56DE1FD4CBFB053C1AEA9665D509C151432421
SHA-256:	B0347DBF0F1D7841740AC89725C4BA1B2B49A23DC7EA6B97C70600C13DC71011
SHA-512:	15515AE90DBC53C354E232FC6A4B7AE996575A3865E5B8CB1EF137BC7D97AFBC3FC38DBC6F624E2B062C36A07D8809A32555FBAEF9835593122360EE44781802
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/by,v 1.8 2005-10-04 18:10:39 svu Exp $..// based on.// belarusian standard keyboard .// Alexander Mikhailian <mikhailian@altern.org>..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Belarus";.. key.<TLDE> {.[ Cyrillic_io, Cyrillic_IO.].};. key.<LSGT> {.[..bar,.brokenbar.].};.. key.<AE02> {.[..2, quotedbl.].};. key.<AE04> {.[..4, semicolon.].};. key.<AE05> {.[..5,. percent.].};. key.<AE06> {.[..6,. colon.].};. key.<AE07> {.[..7,. question.].};.. key.<AD01> {.[ Cyrillic_shorti, Cyrillic_SHORTI.].};. key.<AD02> {.[ Cyrillic_tse, Cyrillic_TSE.].};. key.<AD03> {.[ Cyrillic_u,.Cyrillic_U.].};. key.<AD04> {.[ Cyrillic_ka, Cyrillic_KA.].};. key.<AD05> {.[ Cyrillic_ie, Cyrillic_IE.].};. key.<AD06> {.[ Cyrillic_en, Cyrillic_EN.].};. key.<AB07> {.[Cyrillic_softsign,Cyrillic_SOFTSIGN.].};. key.<AD07> {.[

C:\Program Files (x86)\Xming\xkb\symbols\ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	19610
Entropy (8bit):	4.476209026118858
Encrypted:	false
SSDEEP:	384:5RoaVAuCoasgidK5oFftpSAnTbv9z9bdDFgxab7fnONHt:5irmCObFFdJgxSQ
MD5:	BD9254625BCC77FE05685586141FB2CC
SHA1:	847C2197DEC9F122B300EE2BBA193C0C608FD35F
SHA-256:	1FE52A3594B14DC1560481DC7B644B16F1E4A45923B0A71D8A8DCD7FD804145E
SHA-512:	10B41D84997F5ADB8FADD3636949032341461A6D1B48A35DA09763F0228DF1B7246FAF82F43BAB921DCD9DC96EC112CCA52C2C25B0FA64A5ABA98BCEBE0F0F22
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ca,v 1.15 2007-01-04 23:31:30 svu Exp $..default partial.xkb_symbols "fr" {. name[Group1] = "Canada";.. key <TLDE>.{ [ numbersign, bar, backslash ].};. key <AE01>.{ [ 1, exclam, plusminus ].};. key <AE02>.{ [ 2, quotedbl, at ].};. key <AE03>.{ [ 3, slash, sterling ].};. key <AE04>.{ [ 4, dollar, cent ].};. key <AE05>.{ [ 5, percent, currency ] .};. key <AE06>.{ [ 6, question, notsign ].};. key <AE07>.{ [ 7, ampersand, brokenbar ].};. key <AE08>.{ [ 8, asterisk, twosuperior ].};. key <AE09>.{ [ 9, parenleft, threesuperior ].};. key <AE10>.{ [ 0, parenright, onequarter ].};. key <AE11>.{ [ minus, underscore, onehalf ].};. key <AE12>.{ [ equal, plus, threequarters ].};.. key <AD01>.{ [ q, Q ].};

C:\Program Files (x86)\Xming\xkb\symbols\capslock (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.244015140140106
Encrypted:	false
SSDEEP:	6:jLmtdTZa3RfuGgJfEQn+N0d0NAeE8+G9ZGZ50d0dNAUNd9aZ50d0JXL+eO24zpGl:jLsZaBvmEQn+qdgnrdQAUdE0dS+eOVw
MD5:	E9A06BB7FDED381CFAC750534913C243
SHA1:	604F1E8426754ECBDECEBFCE3F31EBECEB588DBE
SHA-256:	B2ED8ABABE4C725EB0F155440FB6D98F54C2A8C7C6307A057DA949C424B23FA8
SHA-512:	5DD366808143E604870CDDABEF0ED454BCAC31DCFACCA2980873EA16CEFC83C542CAED1F146988F940AC981378498046760825A1F860DEE6EAA2147EC57DE2A2
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/capslock,v 1.3 2004-10-09 17:31:42 svu Exp $..default partial hidden modifier_keys.xkb_symbols "capslock" {. key <CAPS> {.[.Caps_Lock..].};. modifier_map Lock { Caps_Lock };.};..partial hidden modifier_keys.xkb_symbols "shiftlock" {. key <CAPS> {.[.Shift_Lock..].};. modifier_map Shift { Shift_Lock };.};..partial hidden modifier_keys.xkb_symbols "grouplock" {. key <CAPS> {.[.ISO_Next_Group,.Caps_Lock.].};.};..

C:\Program Files (x86)\Xming\xkb\symbols\cd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4177
Entropy (8bit):	3.4067455922396768
Encrypted:	false
SSDEEP:	48:y5zPOJduCsms/+TbaJLH/T+Af+Dn5Cc0fzxp1EIMUT+VrsvPaCC05ZzZ2lxDn0An:yWdlhs/+X6LH/T+6j1PNQNbnn4c
MD5:	08868FB310D41E65DD215E4C01341F17
SHA1:	34945BB0EA466BFA403DEF2E4554D080E2958388
SHA-256:	C5FCFB3C829D62379A721D904003ED221F2C506C8B738199626B33752915C7D3
SHA-512:	D5898933F5B2D8CE6083C14F4457030BD534A2C668C17A0C3288E0DEC8C2D3F9A45BE563B87316EC5FD2D93B5AD9991489A02370002B82E25AAED535364A5F93
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cd,v 1.4 2007-04-03 21:23:56 svu Exp $..// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Congo, Democratic Republic of the";.. key.type[Group1] = "FOUR_LEVEL";.. // Alphanumeric section. // TILDE, COMBINING TILDE. key <TLDE> { [ grave, asciitilde, 0x01000303] };. key <AE01> { [ ampersand, 1, numbersign ] };. key <AE02> { [0x01000301, 2, at ] };. key <AE03> { [0x01000300, 3, guillemotleft ] };. key <AE04> { [ parenleft, 4, bracketleft ] };. key <AE05> { [ braceleft, 5, less ] };. key <AE06> { [ braceright, 6, greater ] };. key <AE07> { [parenright, 7, bracketright ] };. ke

C:\Program Files (x86)\Xming\xkb\symbols\ch (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8356
Entropy (8bit):	4.837442412586958
Encrypted:	false
SSDEEP:	192:oPH4NwJ0H+AtH1MG57eZb2WFD1XsMA/0d/uuZ53OhmdzYcV3otofe6AuC:oQCJ0H+AtH1MG57eZqWFD1XC/0ygdzY3
MD5:	AD3FED4E04CA149A1AA4AE8A7D8F76C2
SHA1:	624590366B418038449DD2F5D8EB33BB71CF8F29
SHA-256:	EFF033F10251143B08142EC8BD4335F3577FA22927AA3D2E3DD12A4CE6A55939
SHA-512:	6BAE9DC83557D22ACA1CA6332DC135ADA41B34BDC676B1F66A73014416CFF75FCB2AC7D54B1BC8B76D0B3554AC8916419BCB6BE148501A9822A0A1BA0B83C6C5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ch,v 1.11 2006-10-03 22:47:43 svu Exp $.// $Xorg: ch,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.// $XFree86: xc/programs/xkbcomp/symbols/ch,v 3.6 2002/11/25 14:05:06 eich Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin".. // Alphanumeric section. name[Group1]= "Switzerland";. key <TLDE> { [ section, degree ] };. key <AE01> { [ 1, plus, bar, exclamdown ] };. key <AE02> { [ 2, quotedbl, at, oneeighth ] };. key <AE03> { [ 3, asterisk, numbersign ] };. key <AE04> { [ 4, ccedilla ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand, notsign ] };. key <AE07> { [ 7, slash, brokenbar ] };. key <AE08> { [ 8, parenleft,

C:\Program Files (x86)\Xming\xkb\symbols\compose (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	899
Entropy (8bit):	5.3778802829340595
Encrypted:	false
SSDEEP:	24:YaGxvI9OyqXRiF+yqXRiF2yqXRiFQyqXRiFFxJyqXRiFekJyqXRir:YwYyERiF+yERiF2yERiFQyERiFFxJyET
MD5:	27D27D5C869DDD8DA4AA8A2C053C1ADD
SHA1:	6C93ACA1A49E53090E3F88BF4199B3A22BC1C25B
SHA-256:	DF6D099DD0AE5313DAFCCD1992DF59B4D58258908E266037FE3F403DFEE26BD1
SHA-512:	BE26FD9D6C9867370BAB2A7FC6B012DA34C8EC212CEEB715ED3C08CD6389219A628E2289BDBAD51E0A1CE2EEF4A98BFF8D7CE7EBF8A95DA7C19A56CA60B44036
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/compose,v 1.6 2006-04-04 22:54:01 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/compose,v 1.1 2001/08/17 16:31:25 dawes Exp $. .partial modifier_keys.xkb_symbols "ralt" {. key <RALT>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin" {. key <LWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin" {. key <RWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu" {. key <MENU>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rctrl" {. key <RCTL> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "caps" {. key <CAPS> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};.

C:\Program Files (x86)\Xming\xkb\symbols\cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11919
Entropy (8bit):	4.5616485776369124
Encrypted:	false
SSDEEP:	96:n4zaH/ADdiM/1AsyHsyp8TmG+FAds/O7gDF/ZDuGKWufWOu7iB1ETlFFomF+9x7a:uaKdHApp8aSds/bwWufWOu7llFE9+ai
MD5:	B224B6AAD8F30A4EC2376B828EDD7F9F
SHA1:	F941AAAAE8575ADD9CBEDA66ED9F731AA8506476
SHA-256:	28429602BA17515688FBDF2A872DAAE9087926E2E89368F5BF2FD71077497AB1
SHA-512:	4ACF5D593301A856928BD7F32AD7927D47DC0A691D61184C94CC567F2C0301FD237DCDCAF8AD3CD052E1932C9CA4C0F51ACB07A4475305555A690F50612D55F4
Malicious:	false
Preview:	// Bosnian, Croatian, Serbian and Slovenian XKB keyboard mapping.// (derived from "Danube" D.2).//.// Danube D.2 from 2003-05-12 is available at http://srpski.org/dunav/.//.// Original authors:.// Danilo Segan (...... .....) <danilo@kvota.net>.// Chusslove Illich (...... ....) <chaslav@sezampro.yu>.//.// Danilo Segan <danilo@kvota.net>:.// - Modified for inclusion in XFree86.// - Further modifications on 2005-08-18 to support Bosnian, Croatian.// and Slovenian in xkeyboard-config.// .// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cs,v 1.6 2006-09-18 14:22:30 svu Exp $..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Serbia and Montenegro";.. include "cs(level3)". include "cs(common)". include "cs(cyralpha)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "latin" {.. name[Group1]= "Serbia and Montenegro - Latin";.. include "latin(type3)". include "cs(latalpha)". include "cs(level3)". include "c

C:\Program Files (x86)\Xming\xkb\symbols\ctrl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	5.084335316872027
Encrypted:	false
SSDEEP:	24:YaxaVx3Vdu9HEPqtBEOlqUQrWMt9OHAUQbtb7CT:Dg3P05rdqUQrWMyAUQb17CT
MD5:	A703B44AB424FC914EB1E63E4AB67FA8
SHA1:	DE964B81B5A5B1DDB10BE96C7679FC06420123FC
SHA-256:	F9E907AEBDC003480447CAC068B1467209BD5EC305A9238B5BDF946AE8F1029F
SHA-512:	9EF21ED6FC38EF916026B2262DC86252392CBD41050F105B1AF3FDC701808CBE83E6861683397043554A4CB807A50E42416CA066E553435E1C9FA12972668973
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ctrl,v 1.3 2005-12-30 01:56:21 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/ctrl,v 3.2 2003/10/24 20:38:20 tsi Exp $.//.// eliminate the caps lock key completely (replace with control).partial modifier_keys .xkb_symbols "nocaps" {. key <CAPS>.{ symbols[Group1]= [ Control_L, Control_L ] };. modifier_map Control { <CAPS>, <LCTL> };.};..// swap the caps lock key with the left control key.partial modifier_keys .xkb_symbols "swapcaps" {. key <CAPS>.{ symbols[Group1]= [ Control_L ] };. key <LCTL>.{ symbols[Group1]= [ Caps_Lock ] };.};..// moves the control key to the middle row and the caps lock.// to the bottom row. Only works if the geometry or keycodes.// file has defined appropriate aliases for the keys in question..partial modifier_keys .xkb_symbols "ctrl_ac" {. key <AC00>.{ symbols[Group1]= [ Control_L ] };. key <AA00>.{ symbols[Group1]= [ Caps_Lock ] };.};..// Moves the control key to the bottom row

C:\Program Files (x86)\Xming\xkb\symbols\cz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5328
Entropy (8bit):	4.4806813655298265
Encrypted:	false
SSDEEP:	48:whaSX3k/gOYn5jGsIyvgjKbiI2jl0VPA85cbuft3cF5XmQ:t/+n5FIrjKbiI2JgBmbSO5X9
MD5:	3804F15258659CE4874A45E147CC8F37
SHA1:	F2357932064E8D66899AD856B0D5309E62A8B5BF
SHA-256:	2D863D3D3247C60B1605EB1D96AA6491D3213E33C688785E3D40BFF03CF2CECD
SHA-512:	0203395745BF73640817F92CAC2B646730D8F464DD14C083C3EE0EB2408E6C957AB784493331C1D2A4F33FECB59A18577C41ECB0361EA1BD7E53002364746A42
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cz,v 1.9 2005-01-18 18:17:48 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/cz,v 1.2 2002/11/22 04:02:22 dawes .// Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. . // This layout conforms to a new cz compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1]= "Czechia";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ ecaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ rcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE0

C:\Program Files (x86)\Xming\xkb\symbols\de (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14206
Entropy (8bit):	4.833027562153685
Encrypted:	false
SSDEEP:	384:p2sJywQTNM4KpXMGM/NyF8FcHAlArO8zld/G3:p2NwQhM4K5wXFus3
MD5:	E5254B47CBD349BC0417691CF604D335
SHA1:	0C815D2E63286D9BAEF8435799525C4441DC252F
SHA-256:	F1001A6BC3B555B5A757FEAF37DF538B5E80B031133C2F631F260E29787173D1
SHA-512:	A1F9E6C819649DF024B706A07DEE1D5C3898FB652B5942D5EE7F24C5D1538C63F90754D0D6A17C55E3CA1853E3FBB79FA797162EBE7ED149C988DD602EF77E56
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/de' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/de,v 1.15 2006-10-08 22:43:01 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/de,v 1.6 2003/09/08 13:12:51 pascal Exp $..default.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Germany";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, section, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [ ssharp, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, dead_cedilla, dead_ogonek ].};.. key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD06>.{ [ z, Z, leftarrow, yen ].};. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, dead_tilde, dead_macron ].};..

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\is-8I23Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8011
Entropy (8bit):	5.150697601414653
Encrypted:	false
SSDEEP:	192:lYQHbYrCjYpCkH+HKJxblW9McQYN/ZphRyILK3129:lYEYrCjECkH+HKJxblW9McRRp6ILK31q
MD5:	CCF580E932A48449E3D459D017B1AC95
SHA1:	D252ABE828BC90B379E27BACA68EC55C75FC07E9
SHA-256:	3E2C215E2F3EF984CF231A80E784A1D38EC611DA3375EDD655F3425218BA9CAB
SHA-512:	91A341CF1C87F0115A4EEC1F0E80A06FD1D4E4DE1070EC917AF6BFBE1E82D4C69089FCD0CF874DE50B07854AB0E2C403022A8245CEA6064DFB8077903E44DF87
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\is-FMK2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4413
Entropy (8bit):	5.280708403924011
Encrypted:	false
SSDEEP:	96:sPQ4YQHqKoTrCvmIN5pF+tdIJHtsJRKj1a/weL:4YQHbYrCeIdwusUS
MD5:	DBF57FDC23A837B1AF6C7C0EC2B44F10
SHA1:	8CE66808C1FF7A2590F1EC43FD72E9A76D300EEC
SHA-256:	98C2E2118296A928311B0A28199A0DB1FB28E3125D1DBF02BE3BC7C5B3B8BCC2
SHA-512:	AD3C96DE9A8C33CC0B10FE072F372455109E2E348C840F0D631050B07FAFE21667C088932FBBE6B784BEE527D533BD3DA1C00C24CA68B111E914ED4B6D92CCD2
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\is-R8I0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6237
Entropy (8bit):	5.0968752291743575
Encrypted:	false
SSDEEP:	96:QPQ4YQHqKoTrCvbUmlN3Meua9w++ymIWHEHH01Qe0L3Y6jT4vf:UYQHbYrCjUmXRh9w+1ogH9exO0H
MD5:	6D2DE50DC8D90B5BA503F2AA0BCA216B
SHA1:	1075A2C805A48937748C458FF954F98A53153B6B
SHA-256:	4AD38319D0B276CA91D35F16E6CF1B3B9EE11EBBF6B6B3EA631F17C6D179438C
SHA-512:	4D12249002D4E4403608C529E71A8D391CFD737E1DA0422B411781C6547F1B1E26FD3D096E3EF518254EB699922799268566980E6E684F680F3A66EE33B61A79
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\is-R8V6E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5514
Entropy (8bit):	4.950648354401212
Encrypted:	false
SSDEEP:	96:rPQ4YQHqKoTrCvbhQ/FVZwIgRioY3H2RkQQDtLcyPTvGgX9r:XYQHbYrCjhQ/FnNOiR3OTFsygp
MD5:	C30E8DC28DA94406242F4228A7E155D9
SHA1:	97D902C57829C31F85BF63DD5D10A6071F4B6569
SHA-256:	0251743CBECD7C8ABE5C36D81C68D481F043DE44BC922316F7A8A3D871CECCA7
SHA-512:	ACD90F8535C57CA6E412573340F4E8CBEB15785B93668DADB8ABDE8B18E1679DDCE632F9198E3ED436658D35753BDBFA885EE3BD6C1AD6A944C24B87C67D25B0
Malicious:	false
Preview:	// $Xorg: vt,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\lk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4413
Entropy (8bit):	5.280708403924011
Encrypted:	false
SSDEEP:	96:sPQ4YQHqKoTrCvmIN5pF+tdIJHtsJRKj1a/weL:4YQHbYrCeIdwusUS
MD5:	DBF57FDC23A837B1AF6C7C0EC2B44F10
SHA1:	8CE66808C1FF7A2590F1EC43FD72E9A76D300EEC
SHA-256:	98C2E2118296A928311B0A28199A0DB1FB28E3125D1DBF02BE3BC7C5B3B8BCC2
SHA-512:	AD3C96DE9A8C33CC0B10FE072F372455109E2E348C840F0D631050B07FAFE21667C088932FBBE6B784BEE527D533BD3DA1C00C24CA68B111E914ED4B6D92CCD2
Malicious:	false
Preview:	// $Xorg: lk,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6237
Entropy (8bit):	5.0968752291743575
Encrypted:	false
SSDEEP:	96:QPQ4YQHqKoTrCvbUmlN3Meua9w++ymIWHEHH01Qe0L3Y6jT4vf:UYQHbYrCjUmXRh9w+1ogH9exO0H
MD5:	6D2DE50DC8D90B5BA503F2AA0BCA216B
SHA1:	1075A2C805A48937748C458FF954F98A53153B6B
SHA-256:	4AD38319D0B276CA91D35F16E6CF1B3B9EE11EBBF6B6B3EA631F17C6D179438C
SHA-512:	4D12249002D4E4403608C529E71A8D391CFD737E1DA0422B411781C6547F1B1E26FD3D096E3EF518254EB699922799268566980E6E684F680F3A66EE33B61A79
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8011
Entropy (8bit):	5.150697601414653
Encrypted:	false
SSDEEP:	192:lYQHbYrCjYpCkH+HKJxblW9McQYN/ZphRyILK3129:lYEYrCjECkH+HKJxblW9McRRp6ILK31q
MD5:	CCF580E932A48449E3D459D017B1AC95
SHA1:	D252ABE828BC90B379E27BACA68EC55C75FC07E9
SHA-256:	3E2C215E2F3EF984CF231A80E784A1D38EC611DA3375EDD655F3425218BA9CAB
SHA-512:	91A341CF1C87F0115A4EEC1F0E80A06FD1D4E4DE1070EC917AF6BFBE1E82D4C69089FCD0CF874DE50B07854AB0E2C403022A8245CEA6064DFB8077903E44DF87
Malicious:	false
Preview:	// $Xorg: us,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\digital_vndr\vt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5514
Entropy (8bit):	4.950648354401212
Encrypted:	false
SSDEEP:	96:rPQ4YQHqKoTrCvbhQ/FVZwIgRioY3H2RkQQDtLcyPTvGgX9r:XYQHbYrCjhQ/FnNOiR3OTFsygp
MD5:	C30E8DC28DA94406242F4228A7E155D9
SHA1:	97D902C57829C31F85BF63DD5D10A6071F4B6569
SHA-256:	0251743CBECD7C8ABE5C36D81C68D481F043DE44BC922316F7A8A3D871CECCA7
SHA-512:	ACD90F8535C57CA6E412573340F4E8CBEB15785B93668DADB8ABDE8B18E1679DDCE632F9198E3ED436658D35753BDBFA885EE3BD6C1AD6A944C24B87C67D25B0
Malicious:	false
Preview:	// $Xorg: vt,v 1.3 2000/08/17 19:54:44 cpqbld Exp $.//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILI

C:\Program Files (x86)\Xming\xkb\symbols\dk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	4.828459755520695
Encrypted:	false
SSDEEP:	24:/PbAagV2oGVxCT608y6BmDTGga4Y+yLd1zy8O2GpGoLqe603o8XYy0xp4bSA21Np:yLKxCn8y6wYh5+G6Gy0oeuc8DlV66sp3
MD5:	F4109FB985B8BBDAFDFEAD8ECD9FC8D9
SHA1:	96C90EC2114217B985A667DEF45B09FBCB074824
SHA-256:	901BE19FBB97698655CC4C34AABFBE54845651A2EF1B5AE4B1FD3DD013F21D44
SHA-512:	C932D43FAE986A7D737B24079AD9B3F8BFDFA185C8D9AD5D3A59A38D28CF71FAC5474E2C6E7B265DD5DF484E15B9464A9986C2F24F62CA03A69F68E6238C799F
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/dk' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/dk,v 1.9 2006-10-03 22:47:43 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/dk,v 1.3 2002/12/19 01:07:56 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]="Denmark";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ].};... key <AC10>.{ [ ae, AE, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ oslash, Ooblique, dead_circumflex, dead_caron ].};. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};.. key <LSGT>.{ [ less, greater, backslash, notsign ].};.. include "keypad(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {..

C:\Program Files (x86)\Xming\xkb\symbols\ee (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.674615119214434
Encrypted:	false
SSDEEP:	48:SGEDnMnrYzvQ21k0j0U/s1t1j4dx2S0nqUzDoxPBZ:SqnrYzvz1ZYsszd4D293DotT
MD5:	9A072317E5AA4422214CC58AF76EBFB1
SHA1:	63DEC9B7F62C33254503BF672D8A15D7221E4340
SHA-256:	B8494257751B4AD22D1E4F33B11F7F2B8A22EDDCEAD5181BDDD21580D2915F66
SHA-512:	013B2F4812755C2E8DADA661692EFAF45ADC00AB15283413AD8444DE7C08C396F99863354C46D542F525805F4C2D0C81445432E78A487BD0EDECED865E2A6DC1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ee,v 1.9 2006-03-16 22:58:05 svu Exp $..// based on.// Estonian XKB-keymap by Ville Hallik <ville@linux.ee>.//.// $XFree86: xc/programs/xkbcomp/symbols/ee,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Estonian keyboard. // This layout conforms to both EVS8:1993 and EVS8:2000 standards.. include "latin(type4)".. name[Group1]="Estonia";.. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, currency, dollar, dollar ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, grave, apostrophe ].};.. key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. k

C:\Program Files (x86)\Xming\xkb\symbols\epo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5839
Entropy (8bit):	4.3237369826704715
Encrypted:	false
SSDEEP:	48:SHEHnIBoEXchEHnIl9iLhE8Dk7Y0c3hnJdnJSMqRJdfOEi1ih+njG6o8E5VIZ9/U:jHWpcSHf4Y3hJdidfOEJhEGrVaypdr
MD5:	1D85FEF71FE6619D7A4DF480F6B3FC89
SHA1:	76B89661106506567562517B03C463B60479F16D
SHA-256:	C138D5E01BD3BA7CD068A7A54D282338B56282C7D925D175A8A8350908CA58F8
SHA-512:	21476B447C98729212A6752085D0A18F632667EC53B9FB279AC8347FBDD72218977F3B16F7A69AB4485A716C8E63CA1660A2C94F99E0AA7CC109BE44CDAF7A9B
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/epo,v 1.2 2007-01-11 23:08:23 svu Exp $..// Esperanto keyboard maps -- "Ekverto".//.// Ekverto A ("legacy") (2004-01-10).// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>.//.// Ekverto B ("basic") (2006-12-02).// Benno Schulenberg (Beno S.ilenber.) <bensberg@justemail.net>.// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Esperanto";.. include "us(basic)".. key.type[Group1] = "FOUR_LEVEL_ALPHABETIC";.. key <AD01> { [ scircumflex, Scircumflex, q, Q ] };. key <AD02> { [ gcircumflex, Gcircumflex, w, W ] };. key <AB02> { [ ccircumflex, Ccircumflex, x, X ] };. key <AD06> { [ ubreve, Ubreve, y, Y ] };.. key.type[Group1] = "FOUR_LEVEL_SEMIALPHABETIC";.. key <AD11> { [ jcircumflex, Jcircumflex, bracketleft, braceleft ] };. key

C:\Program Files (x86)\Xming\xkb\symbols\es (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5705
Entropy (8bit):	4.852765645382388
Encrypted:	false
SSDEEP:	96:bG7y48aJ1tyIi1Y21Y2jerSDwgUt4v93XapwWYGGlOa5+8vmnyXz:b48aJ1tyIie21Re2DXUGVnapwWhCOaEe
MD5:	9C90A2F4B0C864DFC4CAB55784935166
SHA1:	8B00114DE8388A96878533C23C1EE1C565C9FB44
SHA-256:	872FE33E25203FD6441C3943945DEED55D87EAFAAE35F789B3B613A4FCACC837
SHA-512:	A6DF16069B1DEA416D4F1EA510BDED9507E5D42BD5B2B9809BD29FCFBECC59FB198524197D314B702965F60838CC21E818C41215E84F737D67A326245981BD6A
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/es,v 1.13 2007-01-26 23:02:18 svu Exp $..// based on a keyboard.// Modified for a real Spanish Keyboard by Jon Tombs.//.// $XFree86: xc/programs/xkbcomp/symbols/es,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spain";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, periodcentered, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dead_tilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [exclamdown, questiondown, asciitilde, asciitilde ].};.. key <AD11>.{ [dead_grave, dead_circumflex, bracketleft, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, bracketright, dead_macron ].};.. key <AC10>.{ [ ntilde, N

C:\Program Files (x86)\Xming\xkb\symbols\eurosign (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	543
Entropy (8bit):	5.067159847916131
Encrypted:	false
SSDEEP:	12:jLsZaB1OP9MmGMxhCcMmGvERmFjCMMmGkIw53C9:YaW9MmGMnJMmGcRSxMmGNwtk
MD5:	57D6CA2BB122C963698A6E960CC90BAA
SHA1:	EBE4514CBE274831FC5E2B2A82E9038E636FC998
SHA-256:	B568FC94618F824242EE0B54AC882151CD87281F819A2C254D6B753A53306896
SHA-512:	509B83F4693C8EFF8CDACEFA64B638CD48B8738BE95312BE298FB6A2FC7C171A258886076D92E6A26364070AA6B743FD1644511617CE09059B65DD821298BAC9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/eurosign,v 1.2 2004-10-09 17:35:01 svu Exp $..// Most keyboards have the EuroSign engraved on the E key.partial.xkb_symbols "e" {. key <AD03>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};..// Many keyboards have the EuroSign engraved on the 5 key.partial.xkb_symbols "5" {. key <AE05>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};..// Many Apple keyboards have the EuroSign engraved on the 2 key.partial.xkb_symbols "2" {. key <AE02>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};.

C:\Program Files (x86)\Xming\xkb\symbols\fi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10980
Entropy (8bit):	4.091117406427457
Encrypted:	false
SSDEEP:	192:3agTn4ibYdwTt9n9AJeZOTe6yuZUolHp3li1zmpf2Y2ync:3a7dwh9n9qcOTVyuZUopp3lczmpf2Y2V
MD5:	831D45C7DF6EC5A33608113EEFDAB244
SHA1:	635C2D7D4DF8C913176353524B90860E8484D123
SHA-256:	FE0D453F519450958E112AE8D022017B994270988336835517840F56093C5340
SHA-512:	65E1D67DFA729910D647370B9736ED2F05047FB3A089EAB41C64C72DE32B7FB61FB3772EEC0A597FE51101E35A66F116BA8E810DB362BB1F635A5290A0A116AD
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/fi' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fi,v 1.13 2007-01-11 22:57:32 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/fi,v 1.9 2003/01/29 17:17:31 dawes Exp $...partial default alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "fi(fi)".};..partial alphanumeric_keys.xkb_symbols "fi" {.. // a Finnish keyboard with dead key support and all of. // ISO-8859-1 and ISO-8859-15 characters available... name[Group1]="Finland";.. key <TLDE> { [ section, onehalf, onequarter, threequarters.] };. key <LSGT> { [ less, greater, bar, brokenbar.] };. // AltGr+<SPCE> is pressed accidentally too often after AltGr+<LSGT>,. // hence AltGr+<SPCE> produces now space, not nobreakspace.. key <SPCE> { [ space, space, space, nobreakspace.] };. key <AE01> { [ 1, exclam, exclamdown, onesuperior.] };. key <AE02> {

C:\Program Files (x86)\Xming\xkb\symbols\fo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	4.5361491694918765
Encrypted:	false
SSDEEP:	24:YaXT6z31vjpGoL+UBByCB/DI1jbfH91ozMq/bc4buP+YAWz1gy8O2Ie6ko8lY2x4:h43DG4z362YiE2oeuc8r
MD5:	2AFF22DD04E11D6705B8FCA44E1FA98F
SHA1:	55F0EF036159A1C7081871C3A3260AF26F676826
SHA-256:	338ABCF5C6A993CF7B0422934AD41BE082C82921E44273A41D93BDDBCA14EAA1
SHA-512:	C433EB16DF65FF0EF65E9E0090A4F1096DF4FE8D79EACDFD08CBB332A8F16560F45FC46ACCE5E6DD16FAB8022645993EDB570A77F5EA046F75007E11382950D4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fo,v 1.7 2005-01-16 02:18:20 svu Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]= "Faroe Islands";.. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};. key <LSGT>.{ [ less, greater, backslash, notsign ].};. key <SPCE>.{ [ space, space, nobreakspace, nobreakspace ] };.. key <AE05>.{ [ 5, percent, NoSymbol, cent ] };. key <AE06>.{ [ 6, ampersand, yen, NoSymbol ] };. key <AE11>.{ [ plus, question, plusminus, questiondown ] };. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ] };.. key <AB03>.{ [ c, C, copyright, NoSymbol ] };. key <AB10>.{ [ minus, underscore, hyphen, macron ] };.. key <AC03>.{ [ d, D, eth, ETH ] };. key.<AC10>.{ [ ae,. AE.]

C:\Program Files (x86)\Xming\xkb\symbols\fr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	45527
Entropy (8bit):	4.5588646690006875
Encrypted:	false
SSDEEP:	768:DlQG8ecQ0ZxyLd08Ao2o4sOs46okfknaqDG9HmtfUQL0k9:DlQGXIVo1Os46okf1ZQfUg
MD5:	B6FB2453404904C065828E8C26FF3CD0
SHA1:	77403EA049D870CAB7B607E0BE4596E1227E4D28
SHA-256:	422DBF1C434069F683533EAF75CD1BA3F64EB133AEF74C4E342595C5FFADC127
SHA-512:	05A42E228D3B0767B39BB057BE3B1CEEC84801914FD67EE3E17D52F409C68571E8CE59CD1AF228AF3B26556FDA7C7FC41344EAFB041B319D90E3A689ED1178F7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fr,v 1.16 2007-01-04 23:31:30 svu Exp $..// based on a keyboard map from an 'xkb/symbols/fr' file.//.// $XFree86: xc/programs/xkbcomp/symbols/fr,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="France";.. key <AE01>.{ [ ampersand, 1, onesuperior, exclamdown ].};. key <AE02>.{ [ eacute, 2, asciitilde, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, braceleft, dollar ].};. key <AE05>.{ [ parenleft, 5, bracketleft, threeeighths ].};. key <AE06>.{ [ minus, 6, bar, fiveeighths ].};. key <AE07>.{ [ egrave, 7, grave, seveneighths ].};. key <AE08>.{ [underscore, 8, backslash, trademark ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, plusm

C:\Program Files (x86)\Xming\xkb\symbols\fujitsu_vndr\is-E2PAB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	5.136875024821122
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFHcNM8phGt+MyIGX41Bv2uwtgQf/11oB:OCzUqYQHKQgrTLjcNMghGQoBeDgzaI
MD5:	F4B0C717C2FF58EAD02536B410724FF6
SHA1:	0719880628CB5ECB8194922BA6943A8A564FA963
SHA-256:	B2C1E21851FE0876A5E3B37BCC1B9976F9971CD1A83E2C3C37CCE42BC3C9CEF4
SHA-512:	58478F6DA6DE67FDC8438D1CF0A745A6979122281C6D2A42F039AC0A8FAAF16C237658F083BE9A75841643B1DB609B9190992723B1447F0AFB8D50EE509FBC3F
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\fujitsu_vndr\is-RPN9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	5.214457646128203
Encrypted:	false
SSDEEP:	96:tCzUqYQHKQgrTLckMrcf+Ke4GEKEUC/+UXEWzCZyQNI4EuACXGkf9JdbhVqAdfzL:SYQHHgrTtB3K7oQNlrKinl
MD5:	A8018BB067AAC363688E0B33A61E4BBC
SHA1:	4798618EAB3771E0A600867DD1FCF40D6A692DA1
SHA-256:	6263020BBA54D8594818DBE76354AE1A3375A938551CCCA5EA6EA3CA8A8AD644
SHA-512:	6AC3D6B5110A5CDB622A46C6B0D138EDE95FDC48C841E0CAEEF555EE2B3D0DDF2AD436EB20DDDCAE29DFF4984D1ACE7933E43F492CCC1D38E554AE37168F6C26
Malicious:	false
Preview:	// $Xorg: jp,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\fujitsu_vndr\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	5.214457646128203
Encrypted:	false
SSDEEP:	96:tCzUqYQHKQgrTLckMrcf+Ke4GEKEUC/+UXEWzCZyQNI4EuACXGkf9JdbhVqAdfzL:SYQHHgrTtB3K7oQNlrKinl
MD5:	A8018BB067AAC363688E0B33A61E4BBC
SHA1:	4798618EAB3771E0A600867DD1FCF40D6A692DA1
SHA-256:	6263020BBA54D8594818DBE76354AE1A3375A938551CCCA5EA6EA3CA8A8AD644
SHA-512:	6AC3D6B5110A5CDB622A46C6B0D138EDE95FDC48C841E0CAEEF555EE2B3D0DDF2AD436EB20DDDCAE29DFF4984D1ACE7933E43F492CCC1D38E554AE37168F6C26
Malicious:	false
Preview:	// $Xorg: jp,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\fujitsu_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	5.136875024821122
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFHcNM8phGt+MyIGX41Bv2uwtgQf/11oB:OCzUqYQHKQgrTLjcNMghGQoBeDgzaI
MD5:	F4B0C717C2FF58EAD02536B410724FF6
SHA1:	0719880628CB5ECB8194922BA6943A8A564FA963
SHA-256:	B2C1E21851FE0876A5E3B37BCC1B9976F9971CD1A83E2C3C37CCE42BC3C9CEF4
SHA-512:	58478F6DA6DE67FDC8438D1CF0A745A6979122281C6D2A42F039AC0A8FAAF16C237658F083BE9A75841643B1DB609B9190992723B1447F0AFB8D50EE509FBC3F
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\gb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.781926579216175
Encrypted:	false
SSDEEP:	96:InrYoh56Hk4neEMkHanuXICH1/vHLrhXmnrYpzC:arYU52XeQHauXIU1/vHL10rYpG
MD5:	66443EBEFEFB04448F58D655292DDD43
SHA1:	4409B30F8010BABB11E6DB4E0C157F5A64BDD275
SHA-256:	CBD142FDE7746AEC713B3FB654EF47005B60B77085F3990617CD0957E3ED75A7
SHA-512:	D2807844B27FDA7BEED66B079A1844C89F55BEC02F7FD9AC70C5B4F87150AA9612EFF2B5B6F2B1AD16C9CCB1A4D1A72695A6AFCF6A88B30DF4472BD006993684
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gb,v 1.11 2006-10-03 22:25:41 svu Exp $..// based on a keyboard map from an 'xkb/symbols/gb' file.//.// $XFree86: xc/programs/xkbcomp/symbols/gb,v 1.6 2003/10/04 10:25:14 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout defined by. // the SVR4 European Language Supplement and sometimes also. // known as the IBM 166 layout... include "latin".. name[Group1]="United Kingdom";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, sterling, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, EuroSign, onequarter ].};.. key <AC11>.{ [apostrophe, at, dead_circumflex, dead_caron].};. key <TLDE>.{ [ grave, notsign, bar, bar ].};.. key <BKSL>.{ [numbersign, asciitilde, dea

C:\Program Files (x86)\Xming\xkb\symbols\ge (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	14453
Entropy (8bit):	4.376322800565033
Encrypted:	false
SSDEEP:	384:/5Foh8iknRgNk5LpkuryxQlZM8R1Jr4hrU/2BnhZVS8CoRC1QDkqBA2G:22ZOlxO
MD5:	3A9B8C955E9F12500915C0F5D51BAE47
SHA1:	D63073D626E0883796B6AA40DEA198F1E0D7B1B2
SHA-256:	836E7ACF272A70BAEDE91F6BB5E34E73BA7861E958BF0F49E70A833FAC13F212
SHA-512:	E2A5543D858655F71965EC140A9971CDAE72FE9FCC9BC248832515C79D79BAB4FEB97B1126F6C0B71AC137DDA64055962487807272D839540690537115F588C8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ge,v 1.6 2007-04-11 22:30:54 svu Exp $..// Georgian Keyboard Layouts by Aiet Kolkhi <aietkolkhi@gmail.com>.// Full layout descriptions available at http://www.gakartuleba.org/layouts/.//.// This includes the following keyboard layouts: Georgian QWERTY; Georgian Ergonomic;.// Georgian MESS; Georgian AZERTY Tskapo; Georgian Russian..//.// Layouts include Georgian Mkhedruli alphabeth; most layouts also include some special.// and ancient characters (like Fi, Yn, Elifi, Turned Gan and Ain). Layouts do not.// include Georgian Asomtavruli or Georgian Khutsuri alphabeths which are also present.// in Unicode..//.// Georgian Typewriter no longer supported, as it is no longer used in Georgia..//.// some layouts based on Georgian keyboard map, in the so called "latin" layout..// 1999, Pablo Saratxaga <srtxg@chanae.alphanet.ch>.//..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Georgia";.. key <TLDE> { [ 0x010020

C:\Program Files (x86)\Xming\xkb\symbols\gh (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3362
Entropy (8bit):	4.516965163032327
Encrypted:	false
SSDEEP:	48:hcgFwGVB5WzxVBeWX4cVBqm3Ybr9zVBU0z8Eb3PNl9wWWVB62Imz:hPFdYdFho9p8EX69Eg
MD5:	6C727EE9A30F0F22487F2CB15FAE5560
SHA1:	32389EE67D745DB94340412BB0C9BA2B0041FD9A
SHA-256:	32F366535D0DF20D2B49AFF1C22062F07B3289E6684C8D58D5C8E1D48A416D93
SHA-512:	9A9024DF498661F5525E2F86D62A7EF8DFC6C2BE857BBD447D9902B287D73C129EDEE72B9DF47640FFC6AED336738785824DCC5485EAA644E3E9243BC5AAB5B4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gh,v 1.3 2006-06-14 21:41:10 svu Exp $.//.partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Ghana";.. key <AE04> { [ 4, 0x010020B5, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "akan" {. include "gh(basic)".. name[Group1]= "Ghana - Akan";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; .};..partial alphanumeric_keys.xkb_symbols "ga" {. include "gh(basic)".. name[Group1]= "Ghana - Ga";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; . key <AB03> { [ 0x0100014B, 0x0100014A, c, C ] }; .};..partial alphanumeric_keys.xkb_symbols "ewe" {. include "gh(basic)".. name[Group1]= "Ghana - Ewe";.. key <

C:\Program Files (x86)\Xming\xkb\symbols\gr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3957
Entropy (8bit):	5.213230539584341
Encrypted:	false
SSDEEP:	96:RENJCOMkWz+SLwF0pUI3dpvvrkd85Yt/B:yNhMkWzzLwFqUKdxvrkd85Yt/B
MD5:	E3CBEFF87F3F8B620644020D38FD554F
SHA1:	B6195970036C893346617BE716354E54E2067E39
SHA-256:	84F0515B78577070965B0967FEA21D3E392812EA41EC6794EEA38FCF92F0742D
SHA-512:	BFC6CC41CAD6AEB0AF3431F2AADB180A61C4D38C54B058E5EDB0D3825F3556D7566D6EB6C1E08079577844DA60E332E5E3F175FB92715EC6BEFC0FE26E08F49D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gr,v 1.9 2007-05-02 21:48:13 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/el,v 1.2 2002/11/15 02:26:41 dawes Exp $.//.// Hellenic keyboard map for XFree86.// Original version:.//.Kostas Gewrgiou <gewrgiou@imbc.gr>.// Heavily modified and maintained by:.//.Vasilis Vasaitis <vvas@hal.csd.auth.gr>.// Originally converted to single group form by:.//.Ivan Pascal <pascal@info.tsu.ru>..default partial alphanumeric_keys alternate_group.xkb_symbols "basic" {.. include "gr(bare)".. name[Group1] = "Greece";.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};.

C:\Program Files (x86)\Xming\xkb\symbols\group (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	5.227751039550581
Encrypted:	false
SSDEEP:	192:hUZUC3JFJUmHUXIgpZ43cyTCPHL0CT2U0Gwja6H00H:yqCZFam0X/H0CTD0RJHJH
MD5:	449CC86B2DDE752751B24BDB2E4E1FEF
SHA1:	8F9AD3E35819E093D6682F699E92ED0BDE82797D
SHA-256:	DC44808DB54986F977B82EF5A5A703F9AE9B1104AEDCB174170BFA68055EF164
SHA-512:	88DEFA8F633D3CE28A153E8001B277820180C8BED892398F02038FB926D53A80C8BB4FAABB3D0BF64ED40C24644F06F4CE4523787203D12092EBEB3F81EEFE58
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/group,v 1.10 2006-10-16 19:27:05 svu Exp $.// $Xorg: group,v 1.3 2000/08/17 19:54:43 cpqbld Exp $.// using the group(switch) map, the right alt key temporarily chooses .// the second keyboard group (until it is released)..//.// $XFree86: xc/programs/xkbcomp/symbols/group,v 3.9 2003/12/30 13:26:25 pascal Exp $.partial modifier_keys .xkb_symbols "switch" {. key <RALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};..// using the group(lswitch) map, the left alt key temporarily chooses.// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "lswitch" {. key <LALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};...// using the group(win_switch) map, both Windows'logo keys temporarily.// choose the second keyboard group (until release). If you use this.// map, you would declare you keyboard as pc101 or pc102 instead of.// pc104 or

C:\Program Files (x86)\Xming\xkb\symbols\hp_vndr\is-4HQOV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	5.229046822659112
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFvIboeYS31ltP0vO6/XToarc:OCzUqYQHKQgrTLkVYSFlSvOvaI
MD5:	C8101D44F1C34F4B4DA4EC338B591796
SHA1:	347BFAB120092AFE9D8CEB2D5176DD0E80BDB02E
SHA-256:	1D6379BDAB898C10881E6D0FB0A9B7A4F74B9EEA4056E61F8F6BB40314B3AC9F
SHA-512:	E96ADC05ECDBF19E9CA5D6D201A9C700B4E9AB3D26CFB2B387FDD6D5AD9DCDA8B1941F87EFFE4798C5E2A513426F85A3CEE6BB13E9AFA3B0E2FAF7140E08C1B6
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\hp_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	5.229046822659112
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFvIboeYS31ltP0vO6/XToarc:OCzUqYQHKQgrTLkVYSFlSvOvaI
MD5:	C8101D44F1C34F4B4DA4EC338B591796
SHA1:	347BFAB120092AFE9D8CEB2D5176DD0E80BDB02E
SHA-256:	1D6379BDAB898C10881E6D0FB0A9B7A4F74B9EEA4056E61F8F6BB40314B3AC9F
SHA-512:	E96ADC05ECDBF19E9CA5D6D201A9C700B4E9AB3D26CFB2B387FDD6D5AD9DCDA8B1941F87EFFE4798C5E2A513426F85A3CEE6BB13E9AFA3B0E2FAF7140E08C1B6
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\hr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	4.535956813483921
Encrypted:	false
SSDEEP:	24:YatA+a60zmdmRViJxIvYAgwKqk5fCLqg6aIPIN8U2gH4W4bJYRl5jfDJkD6DqqDx:Azgm/YLpV0wY5RR+QsIVeBKITvwTR
MD5:	10EDAB27749EBCEF3C3646393150D68A
SHA1:	80DA650AC7D5E075FFCB966501C0DB701C7A5010
SHA-256:	4DB1C978D822503335D3CFE5FFDF58757207D7FA528D797A838C45E0ADAA4CC2
SHA-512:	47E6E68B0F3B79A956E6BEDDCA980B7F5D7B42C316EE08F57BA430AEFBA5DBA011CA0D37DF222A7A089D956228A573F98022F7DCEC4DB4B546D5E56BD5A18C81
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/hr,v 1.16 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Croatia";.. include "cs(latin)".. // Redefine these keys to match XFree86 Croatian layout. key <AE01> { [ 1, exclam, asciitilde, dead_tilde ] };. key <AE03> { [ 3, numbersign, asciicircum, dead_circumflex ] };. key <AE05> { [ 5, percent, degree, dead_abovering ] };. key <AE07> { [ 7, slash, grave, dead_grave ] };. key <AB10> { [ minus, underscore, dead_belowdot, dead_abovedot ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Croatia - US keyboard with Croatian letters";.. include "us".. key <AD01> { [ any, any,.backslash. ] };. key <AD02> { [ any, any,.bar . ] };. key <AD03> { [ any, any, .EuroSign . ] };. key <AD06> { [ any, any,.z,..Z

C:\Program Files (x86)\Xming\xkb\symbols\hu (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	14319
Entropy (8bit):	4.507619290071726
Encrypted:	false
SSDEEP:	384:4d1VZMVaieOdBNeYNC/wSrGEyrz5/wSHjEyrPs952lB4+NIVSd/rLr90IVSNKrLK:gZMM0P8YiSldicTTZlmym
MD5:	B1836EEAADC500F5501E764269C69BC1
SHA1:	85677B7CD72BB99E77138B0D3742496427164F47
SHA-256:	5BA4C9D633D928E104A6E681616BA8ED74DEE853E1469E1F3A236B0DADBAFF19
SHA-512:	FBC74491D9D64479CC25BC8F500ABD74B208F74653734D3B76F2013177F85CB58C82669A60445B6602D2323D931583922C46CE4736873F904F8FB20845004549
Malicious:	false
Preview:	// New style XKB layout for some widely used Hungarian keyboard layouts.//.// Based on old style 'xkb/symbols/hu".//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/hu,v 1.8 2005-12-21 00:40:06 svu Exp $.// (C) 2002-2004 So.s P.ter <sp@osb.hu>.//.// Permission is granted to anyone to use, distribute and modify.// this file in any way, provided that the above copyright notice.// is left intact and the author of the modification summarizes.// the changes in this header..//.// This file is distributed without any expressed or implied warranty..//.// Changes:.// 2004-04-17 - Moved to new style (only Unicode based layouts).// - Added consistent dead key support.// - Fixed abovedot.// - Added adiaeresis.// - Added EuroSign and cent symbol...// Default layout.default partial.xkb_symbols "basic" {. include "hu(102_qwertz_comma_dead)". name[Group1] = "Hungary";.};..// Standard layout.partial.xkb_symbols "standard" {. include "hu(10

C:\Program Files (x86)\Xming\xkb\symbols\ie (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20552
Entropy (8bit):	4.46587925607917
Encrypted:	false
SSDEEP:	384:bqd8YnCiMyEWDNeZV6WHe6n+RT9iEW7l8cK0BHe6cm/XT60U0uWlUoxse0tqe4YN:b6n1eISn4Ta00N+m/mV0uhe/e3TAmxz
MD5:	CB9B8AE94D6A0468FE7050C4097DD2C7
SHA1:	486902853E3035C356D28BB6EE2229B5A2E3AF34
SHA-256:	731D1D5C5981AD7409DE5EEDC2B95040987B8DD3C108A4F61CFD3F4179E18F29
SHA-512:	CE8606FED06F5C5ECE23FE1B63A2D71568DECD745B43CF6A6C56155739D6DAC5DB46B0AA21E1EA760F2F30AF88FE6047A0FA532C7AFC294F080C072AA929A634
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ie,v 1.7 2005-08-02 23:07:51 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/ie,v 1.3 2002/12/31 02:07:04 dawes Exp $..// Irish keyboard map..// Support for Irish (old and new orthography) and English.// Seamus O Ciardhuain <seoc@cnds.ucd.ie> (19 December 2002)..// The general idea is to provide the characters in ISO 8859-1,.// ISO 8859-15, ISO 8859-14, CP1252 and "Extended Latin-8"..// However, not all are accessible directly because there aren't.// enough keys; some need deadkeys to access them, others the .// "Multi_key" compose sequences...// Designed to be similar to the layouts used on Windows.// and the Macintosh...// Everything is in Group 1 to be compatible with the.// multi-layout keyboard support in XFree86 4.3...// The basic layout is a modern keyboard, but dotted consonants are.// accessible using a deadkey (AltGr+H or AltGr+W)..// If a proper Clo Gaelach keyboard is needed, then use the layout.// defined below as

C:\Program Files (x86)\Xming\xkb\symbols\il (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11390
Entropy (8bit):	5.061521795944941
Encrypted:	false
SSDEEP:	192:qokok4WgEY9qCXdoZULLOCAFmqPHjrZvm8ol5xyHt/hz4iQf3:qopk73Y9qCXdoGLnAFmqPHjTN/hzHQf3
MD5:	044760802AD507DAE2C7532599491A09
SHA1:	BC4EA510D99FE96F1CD0852A9FC2B38CB699CC7F
SHA-256:	C94F7B21A10523568BF269E7FC993C3AAFDC7E63C5E844B4E627737953A91AF5
SHA-512:	C4A52442C810E47D8B7DC047D45A7ACE4159C5CA367BF5BF5E919AC9FAC758AFC56239D22A05AF602989BBE30B2A21CD9BD7C980E3B35AE82997A4D8A3DA0771
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/il,v 1.12 2006-11-19 13:15:56 svu Exp $..// based on a keyboard map from an 'xkb/symbols/il' file.//.// $XFree86: xc/programs/xkbcomp/symbols/il,v 1.3 2003/01/07 02:03:44 dawes Exp $..// This is a partial implemetation of the Israeli standard SI-1452.// It does not implement changes to the English layout ("Alt-English"), .// as I believe that it is not the job of this layout to modify the English.// layout..partial default alphanumeric_keys .xkb_symbols "basic" {. // uses the kbd layout in use in Israel... name[Group1]= "Israel";.. key <AD01> { [ slash,.Q..].};. key <AD02> { [ apostrophe,.W..].};. key <AD03> { [ hebrew_qoph,.E..] };. key <AD04> { [ hebrew_resh,.R..].};. key <AD05> { [ hebrew_aleph,T..] };. key <AD06> { [ hebrew_tet,.Y..] };. key <AD07> { [ hebrew_waw,.U..] };. key <AD08> { [ hebrew_finalnun,.I.] };. key <AD09> { [ hebrew_finalmem,.O.] };. key <A

C:\Program Files (x86)\Xming\xkb\symbols\in (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	34007
Entropy (8bit):	4.57268989466677
Encrypted:	false
SSDEEP:	384:8TrS0b95Wmi5hlGGaAdn0r/NFvQSg4bwfnM4V0No9OxWg41HfVTzE1zFBJzipsNm:6Da81yAxTs6M09En+KPwsZxUZaqvnw80
MD5:	644F8DA981063AC0E76BBB066F3A9F91
SHA1:	22E5AFEA332FB969DB8A21D33AA5E10CF4E2F388
SHA-256:	B05AD29918489D130E50F5FEF9D5F5505677A1F29E19300E9ED10216CE6F6B9C
SHA-512:	9504B64A28D3B57E67B82730FA4E508A882901E63CBAEFFE365991A9F30A3E9816146B8FEE8C4A7494596D1444D1CB7DB3879FE33306F2FB8EF06B4F8CB40CFE
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/in,v 1.13 2006-10-10 21:37:13 svu Exp $..// This layout includes all Indian layouts, including:.// - Bengali.// - Gujarati .// - Kannada .// - Malayalam.// - Oriya .// - Tamil.// - Telugu.// - Urdu..// Links:.// - Indic INSCRIPT keyboard layout diagrams:.// http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html.// - Ekusheyr Shadhinota (Bengali layouts):.// http://ekushey.org/projects/shadhinota/index.html.// - Microsoft Windows XP SP2: Indic Language Standards - an Introduction:.// http://www.bhashaindia.com/MSProducts/XpSp2/Articles/IndicLanguageStandards.aspx..// based on a keyboard map from an 'xkb/symbols/dev' file..// Devangari is the default. Kill me if I am wrong:).default partial alphanumeric_keys.xkb_symbols "deva" {..// March 2004 -- David Holl <smyrph+dev_xkb@ece.wpi.edu>..name[Group1]="India";...key.type="FOUR_LEVEL";...key <TLDE> { [ U094a, U0912, grave,

C:\Program Files (x86)\Xming\xkb\symbols\inet (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	87225
Entropy (8bit):	4.8017961794270025
Encrypted:	false
SSDEEP:	1536:TsVZfVhQ4J/B+blBGUBmuU7oTmbtH7IeAc9tQ2z+Y3nnTRKyJVnfLZ4gojYh:4iYQI
MD5:	B47ECB2E870F80F88D3EFBBAA262DBC8
SHA1:	BE5AE74031834A9A7E76F982979A12CF6BD4869D
SHA-256:	A8D86BCB26EA47804A518FD1B75461C17703F2CE46EED4B853D3570DFE7A7FBA
SHA-512:	099C51028E4BD9C548688DA92EF6BD8DB83CBF8705F90427340AFC6D29D7822ED2D06AD0ED84A37439643FE6C5AFAA0E1D0C0CC1845B85F9B34D7530D7D209C1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/inet,v 1.52 2007-04-23 22:09:07 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/inet,v 1.38 2004/01/17 14:59:37 pascal Exp $..// EAK (Easy Access, Internet, Multimedia, PDA) keyboards.// Copyright (C) 2002 Stanislav Brabec <sbrabec@suse.cz>.//.// Based on LinEAK project.// LinEAK - Linux support for Easy Access and Internet Keyboards .// Copyright (C) 2001, 2002 Mark Smulders <Mark@PIRnet.nl>..// Usage in XF86Config:.// Option "XkbLayout"."my_kb_layout".// Option "XkbVariant"."my_kb_variant".// Option "XkbModel"."my_eak_type".// Option "XkbRules"."xfree86".// Simple command line usage:.// setxkbmap 'my_kb_layout' -variant 'my_kb_variant' -model 'my_eak_type'..// All keyboards listed here should be also mentioned in.// xc/programs/xkbcomp/rules/xfree86, xfree86.lst and xfree86.xml...// Evdev Standardized Keycodes.partial alphanumeric_keys.xkb_symbols "evdev" {. key <MUTE> { [ XF86AudioMute ] };. ke

C:\Program Files (x86)\Xming\xkb\symbols\iq (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	5.10514909719502
Encrypted:	false
SSDEEP:	12:jLsZaBXWe160d8F1mbwuFMIJz160dshuFMGbz160dRkuFMGVJz160dEtiYuFMGpg:Yap60WM8/u60M/S60Y/e602f/k60eU/O
MD5:	6C9B0A8E9A2162E1A739E373D21CD9A5
SHA1:	0D116A0BC4D851BAE6104C256FEE5DF5E0693195
SHA-256:	028C27D923BFE52910657258D0DE7FF99C2869BA06C2EA367D584B2D1842B154
SHA-512:	CE578355B8BBEEF42198D347A5CF2174BEC74C277CD227E5E2AC532B395E660CA607AE900DF38D55C3158D708B98A9C1C1BC3D157F4F1A4B9FFBD2BB06371A4C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/iq,v 1.2 2006-08-31 23:07:37 svu Exp $.// Iraque keyboard layout,..// 3-Level layout..partial default alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Iraq";.};..partial alphanumeric_keys.xkb_symbols "ku" {. include "tr(ku)". name[Group1]= "Iraq - Kurdish, Latin Q";.};..partial alphanumeric_keys.xkb_symbols "ku_f" {. include "tr(ku_f)". name[Group1]= "Iraq - Kurdish, (F)";.};..partial alphanumeric_keys.xkb_symbols "ku_alt" {. include "tr(ku_alt)". name[Group1]= "Iraq - Kurdish, Latin Alt-Q";.};..partial alphanumeric_keys.xkb_symbols "ku_ara" {. include "ir(ku_ara)". name[Group1]= "Iraq - Kurdish, Arabic-Latin";.};.

C:\Program Files (x86)\Xming\xkb\symbols\ir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9490
Entropy (8bit):	5.2168302366220844
Encrypted:	false
SSDEEP:	192:jzeZhAoKaiW+pfTivYiW8cXgFBFDnVl5QWk:j6ZhAoKaiJpfTivYiWbXcBFDnVl5QWk
MD5:	CEC6917970E40990AFC691E747D7C3EB
SHA1:	CF01AA34DE88A1C51C0676A74DB63C31709B168A
SHA-256:	E6D66F60E98EC1CE5C107E56A003398BCA2B61F3B46AB8E906C30D8F94ACDA1B
SHA-512:	4D8F49035DEFDF0CB40C8446E199FFED32B5B680B9D66B1B10884861F4B655D3B54385D55F909912CB1C1D34EABCF771194530E9E1D80FE7C35B261DA678FFBC
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ir,v 1.9 2007-01-04 23:41:09 svu Exp $.// Iranian keyboard layout,.// based on National Iranian Keyboard Standard (ISIRI 2901:1994),.// with additions..//.// Author: Behnam Esfahbod <behnam@esfahbod.info>.//...// 3-Level layout..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Iran";.. // Persian digits. key <AE01> { [ 0x10006f1,.exclam,..quoteleft..] };. key <AE02> { [ 0x10006f2,.0x100066c,.at...] };. key <AE03> { [ 0x10006f3,.0x100066b,.numbersign..] };. key <AE04> { [ 0x10006f4,.0x100fdfc,.dollar...] };. key <AE05> { [ 0x10006f5,.0x100066a,.percent...] };. key <AE06> { [ 0x10006f6,.multiply,.asciicircum..] };. key <AE07> { [ 0x10006f7,.Arabic_comma,.ampersand..] };. key <AE08> { [ 0x10006f8,.asterisk,.enfilledcircbullet.] };. key <AE09> { [ 0x10006f9,.parenright,.0x100200e..] };. key <AE10> { [ 0x10006f0,.parenleft,.0x100200f..] };.. // Other 3-Level symbols. key <T

C:\Program Files (x86)\Xming\xkb\symbols\is (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7043
Entropy (8bit):	5.241023810605663
Encrypted:	false
SSDEEP:	96:XeSRj62t6XTP6P8cjVA+hcKTuyGv0aY70OpMiQmg/bIun4LAqIumBBeEWw:PRW28XWEcnPSzafMiQmgRn4LAqWcw
MD5:	22AD5119A9F225C1B532377B2A252698
SHA1:	3B06329B05266E709A4818DB5B623A989AFD2BD6
SHA-256:	D0ABB1FABD391E2D1D88B4C654F943B9C0B4CF793D7E584419406F05F19AEC09
SHA-512:	0C02C847249E3715D1890560BA77ED702794F2DA9B97AC7711111AD074FE834E7A1B1A7C9AFDE0FD5EC26B1605AA02EDE8C38679A55EE949EBAF1DFF6434C68F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/is,v 1.8 2006-10-01 21:35:25 svu Exp $..// based on.// XKB keyboard by Hrafnkell Eiriksson - hkelle@rhi.hi.is.// fixes by Olafur Osvaldsson - oli@isnic.is.//.// $XFree86: xc/programs/xkbcomp/symbols/is,v 1.3 2002/11/26 01:57:25 dawes Exp $..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Iceland";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [odiaeresis, Odiaeresis, backslash, questiondown ].};. key <AE12>.{ [ minus, underscore, ccedilla, dead_ogonek ].};.. key <AD11>.{ [ eth, ETH, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [apostrophe, question, asciitilde, dead_macron ].};.. key <AC10>.{ [ ae, AE, asciicircum, dead_doubleacute ] };. key <AC11>.{ [dead_acute, Adiaeresis, dead_circumflex,

C:\Program Files (x86)\Xming\xkb\symbols\is-06VNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8356
Entropy (8bit):	4.837442412586958
Encrypted:	false
SSDEEP:	192:oPH4NwJ0H+AtH1MG57eZb2WFD1XsMA/0d/uuZ53OhmdzYcV3otofe6AuC:oQCJ0H+AtH1MG57eZqWFD1XC/0ygdzY3
MD5:	AD3FED4E04CA149A1AA4AE8A7D8F76C2
SHA1:	624590366B418038449DD2F5D8EB33BB71CF8F29
SHA-256:	EFF033F10251143B08142EC8BD4335F3577FA22927AA3D2E3DD12A4CE6A55939
SHA-512:	6BAE9DC83557D22ACA1CA6332DC135ADA41B34BDC676B1F66A73014416CFF75FCB2AC7D54B1BC8B76D0B3554AC8916419BCB6BE148501A9822A0A1BA0B83C6C5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ch,v 1.11 2006-10-03 22:47:43 svu Exp $.// $Xorg: ch,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.// $XFree86: xc/programs/xkbcomp/symbols/ch,v 3.6 2002/11/25 14:05:06 eich Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin".. // Alphanumeric section. name[Group1]= "Switzerland";. key <TLDE> { [ section, degree ] };. key <AE01> { [ 1, plus, bar, exclamdown ] };. key <AE02> { [ 2, quotedbl, at, oneeighth ] };. key <AE03> { [ 3, asterisk, numbersign ] };. key <AE04> { [ 4, ccedilla ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand, notsign ] };. key <AE07> { [ 7, slash, brokenbar ] };. key <AE08> { [ 8, parenleft,

C:\Program Files (x86)\Xming\xkb\symbols\is-0BT9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14206
Entropy (8bit):	4.833027562153685
Encrypted:	false
SSDEEP:	384:p2sJywQTNM4KpXMGM/NyF8FcHAlArO8zld/G3:p2NwQhM4K5wXFus3
MD5:	E5254B47CBD349BC0417691CF604D335
SHA1:	0C815D2E63286D9BAEF8435799525C4441DC252F
SHA-256:	F1001A6BC3B555B5A757FEAF37DF538B5E80B031133C2F631F260E29787173D1
SHA-512:	A1F9E6C819649DF024B706A07DEE1D5C3898FB652B5942D5EE7F24C5D1538C63F90754D0D6A17C55E3CA1853E3FBB79FA797162EBE7ED149C988DD602EF77E56
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/de' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/de,v 1.15 2006-10-08 22:43:01 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/de,v 1.6 2003/09/08 13:12:51 pascal Exp $..default.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Germany";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, section, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [ ssharp, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, dead_cedilla, dead_ogonek ].};.. key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD06>.{ [ z, Z, leftarrow, yen ].};. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, dead_tilde, dead_macron ].};..

C:\Program Files (x86)\Xming\xkb\symbols\is-10DO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4089
Entropy (8bit):	4.361183060964637
Encrypted:	false
SSDEEP:	48:/mxSn8AKGZ08M8uJwLmTu21JFnIVg47P6R2xgKH0XM:MdAKq08MNNTuiX47P6R2xgKH08
MD5:	159FCF91E98E33AC583615DECBF29E18
SHA1:	6B4AF1DD180AE9CE52DB337838674478AD0A90D4
SHA-256:	C18C73EBFDFE9B3BDCDDE5E5DB3060029E0EE3E97A63C442A9767D8DBEF3BF92
SHA-512:	98693A92D6C316FCAE17A9E8446B115766C02546C8F81A3DECD416FB2C966BF70255B7765D4D3F63EA1D74659828BE729A5F66548BBF228B2D3B577C40D684A6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mn,v 1.4 2004-12-22 21:51:19 svu Exp $..// based on:.// Mongolian standard keyboard.// Author Sanlig Badral <badral@chinggis.com>.// 2002/12/7 Version 1.0..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Mongolia";.. key <TLDE> { [ equal, . plus, ..degree ] };. key <AE01> { [ 1, numerosign, .multiply ] };. key <AE02> { [ 2, minus, .division ] };. key <AE03> { [ 3, quotedbl, .plusminus ] };. key <AE04> { [ 4, U20ae, ..notsign ] };. key <AE05> { [ 5, colon,..NoSymbol .] };. key <AE06> { [ 6, period, notequal ] };. key <AE07> { [ 7, underscore, ampersand .] };. key <AE08> { [ 8, comma, .asterisk ] };. key <AE09> { [ 9, percent, .br

C:\Program Files (x86)\Xming\xkb\symbols\is-1I4N1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4238
Entropy (8bit):	5.190760967786476
Encrypted:	false
SSDEEP:	48:qm2O2qHnQfBytojyaTJZ8GwP5TIuWDeUCV+qFUgVvRUA5Uc78UKQubX1UmsQhWwz:qmtqyYyamRTIQU9wUsU4UvU0xUmsQF
MD5:	7F01DD0E09F71AD68687B40F6654ECD5
SHA1:	9FBD05F08BCE1D2101BC1B4CFEC8162644FF61C2
SHA-256:	B53334A3B76E5ED6883F27EF63AF0F0233A042FD48698EA521770C1EB9B2D6F3
SHA-512:	9B3727BBD2E6482BDE0D0AE15C99F37AE90790C61FF98A60C07CA47CAE54FD5F3EAE72CCDD3C2389AF9FD370029EB75D7962A718B08D86604082CBA95FA76B55
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/level3,v 1.16 2006-12-19 00:18:37 svu Exp $..// these variants assign various XKB keycodes to ISO_Level3_Shift so that.// the third shift level can be reached.//.// $XFree86: xc/programs/xkbcomp/symbols/level3,v 1.7 2003/09/08 14:25:32 eich Exp $.//..// the default behavior is for the right Alt key (AltGr) to generate the.// third engraved symbol.default partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. modifier_map Mod5 { ISO_Level3_Shift };.};..// Right Alt key never chooses 3rd level..// This option attempts to undo the effect of a layout's.// including ralt_switch. You may also want to select another.// level3 option that maps the level3 shift to some other key..partial modifier_keys.xkb_symbols "ralt_alt" {. key <RALT> { . type[Group1]="TWO_LEVEL",. type[Group2]="TWO_LEVEL",. type[Group3]="TWO_LEVEL",. type[Group4]="

C:\Program Files (x86)\Xming\xkb\symbols\is-26U40.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3957
Entropy (8bit):	5.213230539584341
Encrypted:	false
SSDEEP:	96:RENJCOMkWz+SLwF0pUI3dpvvrkd85Yt/B:yNhMkWzzLwFqUKdxvrkd85Yt/B
MD5:	E3CBEFF87F3F8B620644020D38FD554F
SHA1:	B6195970036C893346617BE716354E54E2067E39
SHA-256:	84F0515B78577070965B0967FEA21D3E392812EA41EC6794EEA38FCF92F0742D
SHA-512:	BFC6CC41CAD6AEB0AF3431F2AADB180A61C4D38C54B058E5EDB0D3825F3556D7566D6EB6C1E08079577844DA60E332E5E3F175FB92715EC6BEFC0FE26E08F49D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gr,v 1.9 2007-05-02 21:48:13 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/el,v 1.2 2002/11/15 02:26:41 dawes Exp $.//.// Hellenic keyboard map for XFree86.// Original version:.//.Kostas Gewrgiou <gewrgiou@imbc.gr>.// Heavily modified and maintained by:.//.Vasilis Vasaitis <vvas@hal.csd.auth.gr>.// Originally converted to single group form by:.//.Ivan Pascal <pascal@info.tsu.ru>..default partial alphanumeric_keys alternate_group.xkb_symbols "basic" {.. include "gr(bare)".. name[Group1] = "Greece";.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};.

C:\Program Files (x86)\Xming\xkb\symbols\is-2A2UR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12601
Entropy (8bit):	5.281484876887796
Encrypted:	false
SSDEEP:	192:E7GM+UPflHk4W98zBgMXjgefwKg17gUM5BwgDUQSk9Dvhr:fwzzeg+kvr
MD5:	6FE3F5ED22137764370BF0F0A9DF3BDC
SHA1:	C111E5B8F04EEC78D1353F9F2D6F116443E6CD5F
SHA-256:	F9F4C3516B012AE679CC54331C372BC5A434A8D760E5C159CE0879CC9A805AB6
SHA-512:	EE5950C900DE241CE3B15E467FA5D3A68AAF9BE4DDA0D637F1B73F311FCC875E92705BEDA70C4BB107D0D5CF9326D492571FBC04A352D81AE468F45942B08188
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/keypad,v 1.4 2006-09-24 20:07:00 svu Exp $.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_Home.],.overlay1=<KO7>.};. key <KP8> {.[ KP_Up.],.overlay1=<KO8>.};. key <KP9> {.[ KP_Prior.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_Left.],.overlay1=<KO4>.};. key <KP5> {.[ KP_Begin.],.overlay1=<KO5>.};. key <KP6> {.[ KP_Right.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_End.],.overlay1=<KO1>.};. key <KP2> {.[ KP_Down.],.overlay1=<KO2>.};. key <KP3> {.[ KP_Next.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_Insert.],.overlay1=<KO0>.};. key <KPDL> { .[ KP_Delete.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. k

C:\Program Files (x86)\Xming\xkb\symbols\is-2ALQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	19088
Entropy (8bit):	4.865303104955355
Encrypted:	false
SSDEEP:	384:JCME/ocpYX5zbsQTTI08Zey9AOSRipYodbM86npmwkFqZo3j1PoTk9aToGFZnpgN:JSoc6hF8ZNLDv6kh74G
MD5:	B09A84D644625BEEE14D37410B0416A9
SHA1:	5C275D9544446869D5944049F5A78B268810B1A9
SHA-256:	5A8EC1A90494F29297ED517C89FB7F1C0E6556960E6055076C9F0123E341DF6C
SHA-512:	F98BC8C9129C42DF8BAF6DF7F88CCDFD29AE8102651A6F611A08685FF45E685AF3AB0CD2DE701805C3C8C37A32CD1A9FAF11515D34E9E61B3FE08DA4A9CA4DFE
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/us,v 1.29 2007-04-29 17:01:02 svu Exp $..//.// $XdotOrg: xc/programs/xkbcomp/symbols/us,v 1.1.4.3 2004/03/05 13:41:33 eich Exp $.// $XFree86: xc/programs/xkbcomp/symbols/us,v 1.6 2003/10/31 14:32:05 pascal Exp $..default.partial alphanumeric_keys modifier_keys .xkb_symbols "basic" {.. name[Group1]= "U.S. English";.. // Alphanumeric section. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {

C:\Program Files (x86)\Xming\xkb\symbols\is-2IKFG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	689
Entropy (8bit):	4.94663897284305
Encrypted:	false
SSDEEP:	12:jLsZaBm4uHB9160dJWf7KpAcaQdu7slh+9m+dgdC9mbJYY91ktC9maJEY911/eCq:YaYBT607Wf2phFlY9m+d6C9mdYY91P9w
MD5:	1019FB659CBC0E08D14AD5ABF0DBFD70
SHA1:	505BC7363A03053445364301BA549F4D49B94207
SHA-256:	1AB90AD2E6738570526DF99E17878B7787EBEC7F3D347C53BBBFB1DAB8CD71CF
SHA-512:	42CA9DCB1C52C3860F73B0AAB2EC7CDAD4A79CDD83F5D412526951650D5DB0ED43EC0C5C33D98120963F9BD687C9DD71EFA90A0CE7D4243BFDFA86B883AF85AD
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mao,v 1.2 2004-10-09 18:34:15 svu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Adds the macrons needed for the Maori language to. // a simple us keyboard layout... include "latin".. name[Group1]="Maori";.. key <AC01> { [ a, A, amacron, Amacron ] };. key <AD03> { [ e, E, emacron, Emacron ] };. key <AD08> { [ i, I, imacron, Imacron ] };.. key <AD09> { [ o, O, omacron, Omacron ] };. key <AD07> { [ u, U, umacron, Umacron ] };.. key <RALT> { type[Group1]="TWO_LEVEL",. [ ISO_Level3_Shift, Multi_key ] };. modifier_map Mod5 { <RALT> };.};.

C:\Program Files (x86)\Xming\xkb\symbols\is-32005.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7245
Entropy (8bit):	4.048186295865633
Encrypted:	false
SSDEEP:	96:Xy66F2fFhmPBheS1+sTMR7fiuBDFTVsT0dS3kCi:XmofOBYSAsTMRrBDFTVwNdi
MD5:	13D9E3C59CF5F53163428CB973D0E758
SHA1:	81CC13FE022D239CE4045B5BB4CB48BADBA29A75
SHA-256:	6BC368A0C13C75D1F06E581D7800829340DF515981DA5A3693E67F2ADC940D9C
SHA-512:	10C418017DC291C3DAA4D175215B497512F11DE5ABD079DD560C880A4C652D1A4193F171C1AA79CABD8A747BEEE8672C8DB44D2F157BFF56B3B1924DBCC93116
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bg,v 1.8 2005-08-07 23:00:52 svu Exp $..// based on a keyboard map:.//.//////////////////////////////////////////////////////////////////////////.// Copyright (C) 1999, 2000 by Anton Zinoviev <anton@lml.bas.bg>.//.// This software may be used, modified, copied, distributed, and sold,.// in both source and binary form provided that the above copyright.// and these terms are retained. Under no circumstances is the author.// responsible for the proper functioning of this software, nor does.// the author assume any responsibility for damages incurred with its.// use..//.////////////////////////////////////////////////////////////////////////// .// Version 1.6r1..partial default alphanumeric_keys.xkb_symbols "bds" {.// BDS is the Bulgarian Institute for Standardization.. name[Group1]= "Bulgaria";. . key <TLDE> { [ parenleft, parenright ] };. key <AE01> { [ 1, exclam ] };. key <

C:\Program Files (x86)\Xming\xkb\symbols\is-3QV26.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.674615119214434
Encrypted:	false
SSDEEP:	48:SGEDnMnrYzvQ21k0j0U/s1t1j4dx2S0nqUzDoxPBZ:SqnrYzvz1ZYsszd4D293DotT
MD5:	9A072317E5AA4422214CC58AF76EBFB1
SHA1:	63DEC9B7F62C33254503BF672D8A15D7221E4340
SHA-256:	B8494257751B4AD22D1E4F33B11F7F2B8A22EDDCEAD5181BDDD21580D2915F66
SHA-512:	013B2F4812755C2E8DADA661692EFAF45ADC00AB15283413AD8444DE7C08C396F99863354C46D542F525805F4C2D0C81445432E78A487BD0EDECED865E2A6DC1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ee,v 1.9 2006-03-16 22:58:05 svu Exp $..// based on.// Estonian XKB-keymap by Ville Hallik <ville@linux.ee>.//.// $XFree86: xc/programs/xkbcomp/symbols/ee,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Estonian keyboard. // This layout conforms to both EVS8:1993 and EVS8:2000 standards.. include "latin(type4)".. name[Group1]="Estonia";.. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, currency, dollar, dollar ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, grave, apostrophe ].};.. key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. k

C:\Program Files (x86)\Xming\xkb\symbols\is-4566H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2848
Entropy (8bit):	4.649899899078293
Encrypted:	false
SSDEEP:	48:ztn5nu3ODUHnQoBY3Y5A7ysNqk06CNGkODUHnUQujBY3Y5A7ysZ:znuAUHbyo5A7doN6CNGnUHijyo5A7dZ
MD5:	3F46A819D1A3863711B37EF778CA3D48
SHA1:	DC8B0D722F9AB0E6F67FF3E616366442DD07CB19
SHA-256:	BE16510832EDA25D3763BA45887581B773A3B325B064F73A6752D063E0D1F177
SHA-512:	4C9791D8F81A33D9A5B1B8F4E33EC25FA2AAA217C6EB8C772E8A1C53E670E4157ACC32DF15A16537E1D565D330812C8467C7F8564601CC47C069D28459C0F10F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mt,v 1.10 2006-06-14 21:43:30 svu Exp $..// Maltese keyboard map (based on MSA Standard DMS100).// by Ramon Casha (ramon.casha@linux.org.mt).//.// $XFree86: xc/programs/xkbcomp/symbols/mt,v 1.3 2002/12/13 04:18:04 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Malta";.. // The following four sets are the four additional letters, with the UK. // equivalents. key <TLDE>.{ [ cabovedot, Cabovedot, grave, notsign ].};. key <AD11>.{ [ gabovedot, Gabovedot, bracketleft, braceleft ].};. key <AD12>.{ [ hstroke, Hstroke, bracketright, braceright ].};. key <LSGT>.{ [ zabovedot, Zabovedot, backslash, bar ].};.. // Euro symbol. key <AE03>.{ [ 3, EuroSign, sterling ].};.. // Long accent. key <AE06>.{ [ 6, asciicircum, dead_circumflex, dead_circumflex ].};.. // Normal accented vowe

C:\Program Files (x86)\Xming\xkb\symbols\is-47TF2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8650
Entropy (8bit):	4.370311226364933
Encrypted:	false
SSDEEP:	96:qnmxWqf1QxEt/Vzr+4kzi26WGQVW4hjkLz77+Uo7Nj/sJMwTxVJh7xmYgY5uT7:qngdf2xEBxCpQrB41az7M7WJMaxV74t
MD5:	A1B63C44CCAFA4DA684F78E6CE869DE2
SHA1:	7C57B6C4177A5ED4383C239EBED2BB8768F1733C
SHA-256:	729A294DE3253F82309B2DA9EF92A058B5D70B75853891CB7C6D153B0C6C923A
SHA-512:	15F23245C1DF136BF462AA8377944883DF3C2ABEC8EAF44C8BA642E09DF65F1E4127BD6593F82099EBFF043E5CF1867E9660B0BBA3FF73232796250ABD621295
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/latin,v 1.4 2006-10-09 21:37:13 svu Exp $..// Common Latin alphabet layout.//.// $XFree86: xc/programs/xkbcomp/symbols/latin,v 1.3 2002/12/20 20:18:34 paulo Exp $..default partial.xkb_symbols "basic" {.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, numbersign, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, dollar ].};. key <AE05>.{ [ 5, percent, onehalf, threeeighths ].};. key <AE06>.{ [ 6, asciicircum, threequarters, fiveeighths ] };. key <AE07>.{ [ 7, ampersand, braceleft, seveneighths ].};. key <AE08>.{ [ 8, asterisk, bracketleft, trademark ].};. key <AE09>.{ [ 9, parenleft, bracketright, plusminus ].};. key <AE10>.{ [ 0, parenright, braceright, degree ].};.

C:\Program Files (x86)\Xming\xkb\symbols\is-54RSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.244015140140106
Encrypted:	false
SSDEEP:	6:jLmtdTZa3RfuGgJfEQn+N0d0NAeE8+G9ZGZ50d0dNAUNd9aZ50d0JXL+eO24zpGl:jLsZaBvmEQn+qdgnrdQAUdE0dS+eOVw
MD5:	E9A06BB7FDED381CFAC750534913C243
SHA1:	604F1E8426754ECBDECEBFCE3F31EBECEB588DBE
SHA-256:	B2ED8ABABE4C725EB0F155440FB6D98F54C2A8C7C6307A057DA949C424B23FA8
SHA-512:	5DD366808143E604870CDDABEF0ED454BCAC31DCFACCA2980873EA16CEFC83C542CAED1F146988F940AC981378498046760825A1F860DEE6EAA2147EC57DE2A2
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/capslock,v 1.3 2004-10-09 17:31:42 svu Exp $..default partial hidden modifier_keys.xkb_symbols "capslock" {. key <CAPS> {.[.Caps_Lock..].};. modifier_map Lock { Caps_Lock };.};..partial hidden modifier_keys.xkb_symbols "shiftlock" {. key <CAPS> {.[.Shift_Lock..].};. modifier_map Shift { Shift_Lock };.};..partial hidden modifier_keys.xkb_symbols "grouplock" {. key <CAPS> {.[.ISO_Next_Group,.Caps_Lock.].};.};..

C:\Program Files (x86)\Xming\xkb\symbols\is-6AATU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2254
Entropy (8bit):	4.9939933941875205
Encrypted:	false
SSDEEP:	24:YaencxvXEKnKWyLVgznBIH5MUdn8sFc8Wxe7WYNS4R16K0pm4WcNtKOFA6nFA6pK:xvXElrqBIH+orQiBvAWx6/+D
MD5:	A01B3C58E803D89679C53C2B4309F33A
SHA1:	74617BD56F0E65EB2493A983D0CA6148338CD079
SHA-256:	34FC3587ED96C24859BAFA70B87FE382F5438919FBB539D61027AC4679EA9847
SHA-512:	23907A26447531138802E567975829EB57572ED2CA1E96D45EB156AD72148AD619DAA346E6F5DB893FD5C396E35064E7EEFECBF58FD2E33B2FA0ED9929C1F7E7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/altwin,v 1.10 2006-11-14 17:26:40 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/altwin,v 1.5 2003/12/03 14:09:08 pascal Exp $..partial modifier_keys .xkb_symbols "meta_alt" {. key <LALT> {.[ .Alt_L,.Meta_L..].};. key <RALT> {.[ .Alt_R,.Meta_R..].};. modifier_map Mod1.{ Alt_L, Alt_R, Meta_L, Meta_R };.// modifier_map Mod4.{};.};..// Control is mapped to the Win-keys (and the usual Ctrl keys)..partial modifier_keys .xkb_symbols "ctrl_win" {. key <LWIN> {.[ .Control_L..].};. key <RWIN> {.[ .Control_R..].};. modifier_map Control { <LWIN>, <RWIN> };.};..partial modifier_keys .xkb_symbols "meta_win" {. key <LALT> {.[ .Alt_L,.Alt_L..].};. key <RALT> {.[ .Alt_R,.Alt_R..].};. key <LWIN> {.[ .Meta_L...].};. key <RWIN> {.[ .Meta_R...].};. modifier_map Mod1.{ Alt_L, Alt_R };. modifier_map Mod4.{ <META>, Meta_L, Meta_R };.};..partial modifier_keys .xkb_symbols "left_meta_win" {. key <LALT> {.[ .Alt_L

C:\Program Files (x86)\Xming\xkb\symbols\is-6AGKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	5.172236149473688
Encrypted:	false
SSDEEP:	24:Yae3UyqvD94Wc4MC8GqpLGB6PRhH9qEkLGB6OUZ:Nys94WXMNpLGB6fIFLGB6x
MD5:	EBF52A19433EC07707B427C6B04BB59E
SHA1:	1E448C78137885E4382C2725B722D82109C46B7E
SHA-256:	596563C1774115A9204ABA5CB78A434DF5FB5C3F3F868000899D0A28F5BCAB96
SHA-512:	96B45313F38A4AF0B910BDEFEDB8D01E4180A312FF545053D0FEDC49B539BFC52DF2DA03C719C19BD8C1EEAE4AB6A72FE68639E2166368999072C390D0A1B3D6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/nbsp,v 1.3 2007-01-04 23:31:30 svu Exp $.//..// Let space provide nobreakspace for the desired level...partial.xkb_symbols "none" {. key <SPCE> {. type[Group1]="ONE_LEVEL",. symbols[Group1]= [ space ]. };.};..partial.xkb_symbols "level2" {. key <SPCE> {. type[Group1]="TWO_LEVEL",. symbols[Group1]= [ space, nobreakspace ]. };.};...// level3 & level3ns provide no-breaking spaces starting from level3.// This is good for typographers but experience shows many users accidently.// type no-breaking spaces on the CLI (resulting in errors).// Used by fr(latin9).partial.xkb_symbols "level3" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace ]. };.};..// level3s kills fourth level.// Used by ca(multix).partial.xkb_symbols "level3s" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace, NoSymbol ]. };.};..// level3n provides narrow no-br

C:\Program Files (x86)\Xming\xkb\symbols\is-6G7GM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	14319
Entropy (8bit):	4.507619290071726
Encrypted:	false
SSDEEP:	384:4d1VZMVaieOdBNeYNC/wSrGEyrz5/wSHjEyrPs952lB4+NIVSd/rLr90IVSNKrLK:gZMM0P8YiSldicTTZlmym
MD5:	B1836EEAADC500F5501E764269C69BC1
SHA1:	85677B7CD72BB99E77138B0D3742496427164F47
SHA-256:	5BA4C9D633D928E104A6E681616BA8ED74DEE853E1469E1F3A236B0DADBAFF19
SHA-512:	FBC74491D9D64479CC25BC8F500ABD74B208F74653734D3B76F2013177F85CB58C82669A60445B6602D2323D931583922C46CE4736873F904F8FB20845004549
Malicious:	false
Preview:	// New style XKB layout for some widely used Hungarian keyboard layouts.//.// Based on old style 'xkb/symbols/hu".//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/hu,v 1.8 2005-12-21 00:40:06 svu Exp $.// (C) 2002-2004 So.s P.ter <sp@osb.hu>.//.// Permission is granted to anyone to use, distribute and modify.// this file in any way, provided that the above copyright notice.// is left intact and the author of the modification summarizes.// the changes in this header..//.// This file is distributed without any expressed or implied warranty..//.// Changes:.// 2004-04-17 - Moved to new style (only Unicode based layouts).// - Added consistent dead key support.// - Fixed abovedot.// - Added adiaeresis.// - Added EuroSign and cent symbol...// Default layout.default partial.xkb_symbols "basic" {. include "hu(102_qwertz_comma_dead)". name[Group1] = "Hungary";.};..// Standard layout.partial.xkb_symbols "standard" {. include "hu(10

C:\Program Files (x86)\Xming\xkb\symbols\is-710K5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4396
Entropy (8bit):	5.21069687955298
Encrypted:	false
SSDEEP:	48:buHLAEQsZSAAQZCk0YGTaMBy16G3lx1rKrN35GK8lWOnLR+TR1sMiyZ+hLMIDtt:lEQOuQ8Zb5IcS1Wnaln0TviyZ+hLtt
MD5:	169C3DAF2E31CBF9EFC9F2B0487A7AC1
SHA1:	8C85AE0A94A1798570C5357BF0B3D4D7ADD77616
SHA-256:	30D26FA87E091F50806B05DCBEF97E0F051365DE3E46E838440B890967D3D441
SHA-512:	F4A4387E9AFA5F6CEE7FDA61948793153CF562FF9A6C61621ABCD905B23F65FD780EE21B27418229FBF4371F1E4444560E7B103DEE23F6000D5458AE52CAFFA7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bd,v 1.4 2006-01-15 15:01:13 svu Exp $.//.// XKB symbol :: National Bangla/Bengali Standard Keyboard Layout for Bangladesh.// Ref: http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf.//.// Author: Jamil Ahmed <jamil at bengalinux.org>.// Created: 18-12-2005.// Last Updated: 08-01-2006.// Version: 6.01.3.//.// Issues:.// <AC08> Khanda-Ta is given U-09CE; But BCC had U-09BA.// <AC07> U-09BB is added though it is not allocated in Original Unicode.// <AE06> U-09B3 is added though it is not allocated in Original Unicode.// 3 Conjunct characters are not included.//..default partial alphanumeric_keys..xkb_symbols "basic" {. name[Group1]= "Bangladesh";. key <ESC> { [ Escape ] };..// numbers. key <TLDE> { [ quoteleft,.asciitilde,.voidsymbol,.voidsymbol ] };. key <AE01> { [ 0x10009E7,.exclam,..0x10009F4,.voidsymbol ] };. key <AE02> { [ 0x10009E8,.at,..0x10009F5,.voidsymbol ] };. key <AE03> { [ 0x10009E9,.numbersign,.0x10009F

C:\Program Files (x86)\Xming\xkb\symbols\is-72RTJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9469
Entropy (8bit):	4.960363627236577
Encrypted:	false
SSDEEP:	96:jIMI1WwSkEDO026x0MBTeJbiJgSpCE6ITZh1Te086ct9O6JIjN9mUe/TXh+0+hnP:jSuePdvft3ZYIfe+11zrY
MD5:	ACAF3CAB2DE2B21EA86181CF21001260
SHA1:	7803583AF9A1EFE446A5B7001444115F4F7D6F1B
SHA-256:	D2FD4A5CA7D9A59A04DA343A2F721437257BADF09692E16DF4666C976958CF94
SHA-512:	974E1A20013649BDCE23D95D0703C6F6DD4AB4A2AA52BCA73AB6D7362A9ADA5E7B109B55106221B272374A93D156EB3CBCD5B1AD3C942ED83DBA6C34BF018B1C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/am,v 1.11 2007-01-25 21:08:26 svu Exp $..// based on a keyboard map from an 'xkb/symbols/am' file.//.// $XFree86: xc/programs/xkbcomp/symbols/am,v 1.4 2003/05/29 12:41:58 pascal Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Armenia";.. // Alphanumeric section. key <TLDE> {.[ 0x100055d, 0x100055c.].};. key.<LSGT> {.[ question, 0x100058a.].};. key <BKSL> { [ guillemotright, guillemotleft ] };.. key <AE01> {.[ 0x1000586, 0x1000556.].};. key <AE02> {.[ 0x1000571, 0x1000541.].};. key <AE03> {.[ 0x1002013, 0x1002014 ].};. key <AE04> {.[ comma, dollar.].};. key <AE05> {.[ 0x1000589, 0x1002026.] .};. key <AE06> {.[ 0x100055e, percent.].};. key <AE07> {.[ 0x1002024, 0x1000587.] .};. key <AE08> {.[ 0x100055b, 0x10002bc.] .};. key <AE09> {.[ parenright, parenleft ] .};. key <AE10> {.[ 0x1000585, 0x1000555.].};. key <AE11> {.[ 0x1000567, 0x

C:\Program Files (x86)\Xming\xkb\symbols\is-736NU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6019
Entropy (8bit):	4.627944817450199
Encrypted:	false
SSDEEP:	96:R1LinxigCRnIeoWnJQSEiqGaSr5Umw2+0e8noQuda5Hz9sUy9H+ejIJkC:R18xtCxIOJ5xaSrlw2ResbKa5Z5ecJZ
MD5:	A81853A9B8542B2E0767CD1228E46D71
SHA1:	D64C1A909A99835CE2B3CBC2C9A25ABBFAF28687
SHA-256:	168714634F4E81FD5CD773D44E24B57F262C4E1F2ED7811EA612F648A15B812E
SHA-512:	5EC740310D986F872B63E53F9367776D244E6E8B2D9AB95B7493F5D693D16040E7E91AE6993E96B6EC75AEBA365412AFEAFFF6A1D2757036DB922A513185C32C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/be,v 1.7 2006-04-02 20:07:45 svu Exp $..// based on a keyboard map from an 'xkb/symbols/be' file.//.// $XFree86: xc/programs/xkbcomp/symbols/be,v 1.3 2003/04/12 10:53:48 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Belgium";.. key <AE01>.{ [ ampersand, 1, bar, exclamdown ].};. key <AE02>.{ [ eacute, 2, at, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, onequarter, dollar ].};. key <AE05>.{ [ parenleft, 5, onehalf, threeeighths ].};. key <AE06>.{ [ section, 6, asciicircum, fiveeighths ].};. key <AE07>.{ [ egrave, 7, braceleft, seveneighths ].};. key <AE08>.{ [ exclam, 8, bracketleft, trademark ].};. key <AE09>.{ [ ccedilla, 9, braceleft, plus

C:\Program Files (x86)\Xming\xkb\symbols\is-7E4BT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3935
Entropy (8bit):	4.770940454586109
Encrypted:	false
SSDEEP:	48:kXcmG5fPR0vaEYX2ZHr/VKRRSfPxfZPWf/5tz4+:M4R6yaZ8R8xf+/7zZ
MD5:	2E29D6931CAF96C7A4671E93687031DE
SHA1:	FF56DE1FD4CBFB053C1AEA9665D509C151432421
SHA-256:	B0347DBF0F1D7841740AC89725C4BA1B2B49A23DC7EA6B97C70600C13DC71011
SHA-512:	15515AE90DBC53C354E232FC6A4B7AE996575A3865E5B8CB1EF137BC7D97AFBC3FC38DBC6F624E2B062C36A07D8809A32555FBAEF9835593122360EE44781802
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/by,v 1.8 2005-10-04 18:10:39 svu Exp $..// based on.// belarusian standard keyboard .// Alexander Mikhailian <mikhailian@altern.org>..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Belarus";.. key.<TLDE> {.[ Cyrillic_io, Cyrillic_IO.].};. key.<LSGT> {.[..bar,.brokenbar.].};.. key.<AE02> {.[..2, quotedbl.].};. key.<AE04> {.[..4, semicolon.].};. key.<AE05> {.[..5,. percent.].};. key.<AE06> {.[..6,. colon.].};. key.<AE07> {.[..7,. question.].};.. key.<AD01> {.[ Cyrillic_shorti, Cyrillic_SHORTI.].};. key.<AD02> {.[ Cyrillic_tse, Cyrillic_TSE.].};. key.<AD03> {.[ Cyrillic_u,.Cyrillic_U.].};. key.<AD04> {.[ Cyrillic_ka, Cyrillic_KA.].};. key.<AD05> {.[ Cyrillic_ie, Cyrillic_IE.].};. key.<AD06> {.[ Cyrillic_en, Cyrillic_EN.].};. key.<AB07> {.[Cyrillic_softsign,Cyrillic_SOFTSIGN.].};. key.<AD07> {.[

C:\Program Files (x86)\Xming\xkb\symbols\is-8BGU9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2798
Entropy (8bit):	4.132399956524305
Encrypted:	false
SSDEEP:	48:AiLe0b3Ceaxdxly1zsD7HGjaRjSYKjQlYEFUVjXCS8VMuWuOU9JkbWnpHV:qi3Ceaxly1ID7HZR+YKjQlAVjXCS8VMk
MD5:	E682538687EBC7B2083E4F571977393C
SHA1:	51A1A217489465A58E55AD2AA2D8CD7696BAF430
SHA-256:	0EA328B13C290E339B14EB3928E95AF16912C8FE92B06F5CD9D6ADE69B68BE0E
SHA-512:	F6A298077028B6E78A80FC8ED03C65826FE3183EDCC1101AD86F6801FEAAF62C4161A762C30858A60AB6604FBEFB21484B9207F7F2CB04C554E72E0FF2D7D3E8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mm,v 1.5 2004-12-22 21:51:19 svu Exp $..// based on a keyboard map from an 'xkb/symbols/mm' file..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Myanmar";..// Mainly numbers.. key <AE01> { [ 0x1001041, exclam .].};. key <AE02> { [ 0x1001042 ..].};. key <AE03> { [ 0x1001043 . .].};. key <AE04> { [ 0x1001044 . .].};. key <AE05> { [ 0x1001045 ..].};. key <AE06> { [ 0x1001046 . .].};. key <AE07> { [ 0x1001047 ..].};. key <AE08> { [ 0x1001048 . .].};. key <AE09> { [ 0x1001049, parenleft .].};. key <AE10> { [ 0x1001040, parenright ].};. key <AE11> { [ minus, 0x1001038 .].};. key <AE12> { [ 0x1001052, 0x1001056 .].};..// Mainly long vowels. key <AD01> { [ 0x100102A, 0x100102A ].};. key <AD02> { [ 0x1001032, 0x1001032 ].};. key <AD03> { [ 0x100102C, 0x100102

C:\Program Files (x86)\Xming\xkb\symbols\is-8TST4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3362
Entropy (8bit):	4.516965163032327
Encrypted:	false
SSDEEP:	48:hcgFwGVB5WzxVBeWX4cVBqm3Ybr9zVBU0z8Eb3PNl9wWWVB62Imz:hPFdYdFho9p8EX69Eg
MD5:	6C727EE9A30F0F22487F2CB15FAE5560
SHA1:	32389EE67D745DB94340412BB0C9BA2B0041FD9A
SHA-256:	32F366535D0DF20D2B49AFF1C22062F07B3289E6684C8D58D5C8E1D48A416D93
SHA-512:	9A9024DF498661F5525E2F86D62A7EF8DFC6C2BE857BBD447D9902B287D73C129EDEE72B9DF47640FFC6AED336738785824DCC5485EAA644E3E9243BC5AAB5B4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gh,v 1.3 2006-06-14 21:41:10 svu Exp $.//.partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Ghana";.. key <AE04> { [ 4, 0x010020B5, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "akan" {. include "gh(basic)".. name[Group1]= "Ghana - Akan";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; .};..partial alphanumeric_keys.xkb_symbols "ga" {. include "gh(basic)".. name[Group1]= "Ghana - Ga";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; . key <AB03> { [ 0x0100014B, 0x0100014A, c, C ] }; .};..partial alphanumeric_keys.xkb_symbols "ewe" {. include "gh(basic)".. name[Group1]= "Ghana - Ewe";.. key <

C:\Program Files (x86)\Xming\xkb\symbols\is-97K4Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	20552
Entropy (8bit):	4.46587925607917
Encrypted:	false
SSDEEP:	384:bqd8YnCiMyEWDNeZV6WHe6n+RT9iEW7l8cK0BHe6cm/XT60U0uWlUoxse0tqe4YN:b6n1eISn4Ta00N+m/mV0uhe/e3TAmxz
MD5:	CB9B8AE94D6A0468FE7050C4097DD2C7
SHA1:	486902853E3035C356D28BB6EE2229B5A2E3AF34
SHA-256:	731D1D5C5981AD7409DE5EEDC2B95040987B8DD3C108A4F61CFD3F4179E18F29
SHA-512:	CE8606FED06F5C5ECE23FE1B63A2D71568DECD745B43CF6A6C56155739D6DAC5DB46B0AA21E1EA760F2F30AF88FE6047A0FA532C7AFC294F080C072AA929A634
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ie,v 1.7 2005-08-02 23:07:51 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/ie,v 1.3 2002/12/31 02:07:04 dawes Exp $..// Irish keyboard map..// Support for Irish (old and new orthography) and English.// Seamus O Ciardhuain <seoc@cnds.ucd.ie> (19 December 2002)..// The general idea is to provide the characters in ISO 8859-1,.// ISO 8859-15, ISO 8859-14, CP1252 and "Extended Latin-8"..// However, not all are accessible directly because there aren't.// enough keys; some need deadkeys to access them, others the .// "Multi_key" compose sequences...// Designed to be similar to the layouts used on Windows.// and the Macintosh...// Everything is in Group 1 to be compatible with the.// multi-layout keyboard support in XFree86 4.3...// The basic layout is a modern keyboard, but dotted consonants are.// accessible using a deadkey (AltGr+H or AltGr+W)..// If a proper Clo Gaelach keyboard is needed, then use the layout.// defined below as

C:\Program Files (x86)\Xming\xkb\symbols\is-97NE1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4148
Entropy (8bit):	4.464372007878455
Encrypted:	false
SSDEEP:	48:2H32Fab4ZY2aotY3wVtuU/QahjqG3zof2v+O5sIzFfZ:2H3MavWY3wVfIahjq0zRv+O5LzFfZ
MD5:	F193BF48BDD1B8EEEDF993C2183CAA6A
SHA1:	F00B560412A6226943E56CA5C151AF044E471BE5
SHA-256:	EDFE71EC9D0985C446F62FCB5C0B534B74041588D5EF735C7880982039E4D97D
SHA-512:	935D9838E862F642D9B2A9F44C6DD57A0E7500AFCEC1BE445E74332FAA4D5C044B3542CA05725DA967FAF5D3380C2E467C8599A42D65831A61D912BEA97B77F8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/az,v 1.5 2005-01-16 02:18:20 svu Exp $..// based on:.// symbols definition for a very simple Azerbaidjani keyboard layout..// 2001 - Pablo Saratxaga <pablo@mandrakesoft.com>..partial default alphanumeric_keys.xkb_symbols "latin" {.. include "us".. name[Group1]= "Azerbaijan";.. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };.. key <AE03> { [ 3, numbersign, U2166 ] };. key <AE06> { [ 6, colon, EuroSign, periodcentered ] };. key <AE07> { [ 7, question ] };.. key <AE08> { [ 8, asterisk, asciicircum, dead_circumflex ] };. key <AE11> { [ minus, underscore, hyphen, emdash ] };.. key <AD02> { [ udiaeresis, Udiaeresis ] };. key <AD04> { [ r, R, registered ] };. key <AD08> { [ i, Iabovedot ] };. key <AD11> { [ odiaeresis, Odiaeresis, bracketleft, braceleft ] };. key <AD12> { [ gbreve, Gbre

C:\Program Files (x86)\Xming\xkb\symbols\is-9AJIL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8269
Entropy (8bit):	4.959204810796883
Encrypted:	false
SSDEEP:	96:I5ppNFS5dwZ3AOet2Jw2/38qs81yHDv2Vr59i4A4UF5xm3jnatB:I5pLFSwOFsJw2/38qN1yj2xTih4e22
MD5:	B5DFA4E10813AF68AC72633F46156B19
SHA1:	5774BB7E7E0904089037856DDA5C5F9212CABE7B
SHA-256:	CB30996537D3C56CC675561000AD5A58AB03273390FBAFA535DB40ACDE307ED9
SHA-512:	2B6BA795BC1B680734FDF78BC7B5A82E22A70022510504BA6EF152E9A514CD6F9F2146E26F69FA2A3E32B08F60EF2BD994DC6F5C683AF4B79AAA0A1343955E92
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/th,v 1.6 2005-01-16 02:18:20 svu Exp $..// based on a keyboard map from an 'xkb/symbols/th' file.//.// $XFree86: xc/programs/xkbcomp/symbols/th,v 1.3 2003/04/03 16:34:51 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Thailand";.. // converted to THai keysysms - Pablo Saratxaga <pablo@mandrakesoft.com>.. key <TLDE> { [ underscore,..percent..].};. key <AE01> { [ Thai_lakkhangyao,.plus..].};. key <AE02> { [ slash,..Thai_leknung.].};. key <AE03> { [ minus,..Thai_leksong.].};. key <AE04> { [ Thai_phosamphao,.Thai_leksam.].};. key <AE05> { [ Thai_thothung,.Thai_leksi.].};. key <AE06> { [ Thai_sarau,..Thai_sarauu.].};. key <AE07> { [ Thai_saraue,..Thai_baht.].};. key <AE08> { [ Thai_khokhwai,.Thai_lekha.].};. key <AE09> { [ Thai_totao,..Thai_lekhok.].};. key <AE10> { [ Thai_chochan,.Thai_lekchet.].};. key <AE11> { [ Thai_khokhai,.Thai_lekpaet.].};. key <AE1

C:\Program Files (x86)\Xming\xkb\symbols\is-9KV2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8706
Entropy (8bit):	4.711116140430485
Encrypted:	false
SSDEEP:	192:RC/odlswSdTPguNlETN1JtAUMrLdsflCuDa:R6guTPguDErJStcCuDa
MD5:	74CB09236BA5243E23A543ED3842C819
SHA1:	DE9C3F6A48407A784B3D3F9F2C62F358FE2B20C7
SHA-256:	64055AD26EF90313EA84A8BF109BFF6071DC80423CCD1300A696A4069D5432F5
SHA-512:	166A02C649F4A652EAB8608BE2F06062D95CD060CACE78810D21F8423B3FB5E3558F95A3FC3ACB0F071F00587941EAA4EC98F2AE56DB55B8CE42A20F5D4E4022
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ru,v 1.11 2006-09-04 20:25:10 svu Exp $..// based on.// russian standard keyboard.// AEN <aen@logic.ru>.// 2001/12/23 by Leon Kanter <leon@blackcatlinux.com>.// 2005/12/09 Valery Inozemtsev <shrek@altlinux.ru>.//.// $XFree86: xc/programs/xkbcomp/symbols/ru,v 1.3 2003/02/15 22:27:05 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Russia";.. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numbersign.].};. key.<AE04> {.[..4, asterisk.].};. key.<AE05> {.[..5,. colon.].};. key.<AE06> {.[..6,. comma.].};. key.<AE07> {.[..7,. period.].};. key.<AE08> {.[..8,. semicolon.].};. key.<AE09> {.[..9,. parenleft.].};. key.<AE10> {.[..0,.parenright.].};. key.<AE11> {.[. minus,.underscore.].};. key.<AE12> {.[. equal,. plus.].};. key.<BKSL> {.[.backslash, bar.].};. key.<AB10>

C:\Program Files (x86)\Xming\xkb\symbols\is-AOM9R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	4.6864998639436495
Encrypted:	false
SSDEEP:	24:Ya8vZv6eDT60OPYc4gN9+aidY+vCSL6/wJgixaQ8q+kknyXE9VBNLlM4bLvGB23x:qtpDnOw4mYYJ6Wvalj3Nn+L/sT
MD5:	00008C2339024245EEA36AE060297B64
SHA1:	9F443149451DECC031EC3F3EAAAB1BD33BB0A8A0
SHA-256:	DED3E683A55D33D9B655F6A0F3AA0901E97A5D5132F6DFD2D25B2A0F1BE01A7F
SHA-512:	E449B6F158D4A88C88943E92F28E0DC7D64193A0BE327CC85A7B3344E8091126CBE343888815FF711BC222AEED066AA4A85EA6F2AED4AB14BADC60618B4BC436
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/al,v 1.5 2004-12-22 21:51:19 svu Exp $..// based on.// albanian keyboard layout.// done by Pablo Saratxaga <pablo@mandrakesoft.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/al,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type3)".. name[Group1]="Albania";.. key <AE01>.{ [ 1, exclam, asciitilde, dead_tilde ].};. key <AE02>.{ [ 2, quotedbl, dead_caron, oneeighth ].};. key <AE03>.{ [ 3, numbersign, dead_circumflex, sterling ].};. key <AE04>.{ [ 4, dollar, dead_breve, dollar ].};. key <AE05>.{ [ 5, percent, dead_abovering, threeeighths] };. key <AE06>.{ [ 6, asciicircum, dead_ogonek, fiveeighths ].};. key <AE07>.{ [ 7, ampersand, grave, dead_grave ].};. key <AE08>.{ [ 8, asterisk, dead_abovedot, trademark ].};. key <AE09>.{ [

C:\Program Files (x86)\Xming\xkb\symbols\is-AT2SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.0018769239056775
Encrypted:	false
SSDEEP:	192:wHombkQJ3v2sORZPhKznkpVh0cuoxQAX1wWxDRKMeEP8Z30c8/xQW3v2iORZPhKr:wHombkE3v2sORZPhKjkpVh0cuoxxX1wg
MD5:	678A77C157C8209348A02CCA15ECE3CB
SHA1:	7A6D1A7CA8CF0CA77C1FE376DB3127CD51E06B9F
SHA-256:	41EF6631CF2A6C2A582FEC458AA35A12ACFFBE920CAB84976C9CD3215AC79EAA
SHA-512:	B514E607B6375EE12BE28D6C11936D01D17F614210E1D7395E7E1ED0B85777D208A3C2D21BA64D059A170B1069457E8F43F63250F6FDC8A81F3716DA29A49011
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/af,v 1.2 2006-10-11 19:32:35 svu Exp $.//.// Keymap for the Afghan dari keybord layout.// Based on the specification "Computer Locale Requirements for .// Afghanstan" [1] from the "United Nations Development Programme.// Afghanistan" and the "Afghan Transitional Islamic .// Administration Ministry of Communications". .// [1] http://www.evertype.com/standards/af/.// For a MINI HOWTO see [2]..// [2] http://www.afghanischerKulturverein.de/en/afghanComputer_en.php.//.// 2006-02-15 file created by M. Emal Alekozai <memala@gmx.net>..partial default alphanumeric_keys .xkb_symbols "basic" {. //name[Group1]= "Afghanistan Dari";. name[Group1]= "Afghanistan";.. key <TLDE> { [ 0x100200d, 0x10000f7, dead_tilde ] };. key <AE01> { [ 0x10006f1, exclam, 0x1000060 ] };. key <AE02> { [ 0x10006f2, 0x100066c, 0x1000040 ] };. key <AE03> { [ 0x10006f3, 0x100066b, numbersign ] };. key <AE04> { [ 0x10006f4, 0x100e60b, 0x1000024] };. key <AE0

C:\Program Files (x86)\Xming\xkb\symbols\is-B1NU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	4.637678775632978
Encrypted:	false
SSDEEP:	24:YaT46+75te600EyYYwaf9T360kCMyYjLPeiUtmP5Mbt9m4bFf9a0y60PHyYfCp88:t+tw0E5kLkn5HVfPIe0+PH50tz8Ebv
MD5:	70D1203167B0B83B523D1EE890933C9F
SHA1:	84D7AFCC565FB9EF928BF4902B00F70F499A01EB
SHA-256:	0DA83BF33E591FA2A649323EDCACE663BB7AD7342612615DA0293F3282BA20A4
SHA-512:	544A2A4404EBD00518B89F3A486F0912D29B8E10B438B3DDB039BDDF7A74A9497560EB22D0FB7CEDBECBB4CB4E1FB76A259A09AD385DBE983F0A9F1D040B4C47
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ng,v 1.2 2006-10-11 19:32:35 svu Exp $.//..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Nigeria";. key <AE04> { [ 4, 0x010020A6, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "yoruba" {. include "ng(basic)".. name[Group1]= "Nigeria - Yoruba";.. key <AD01> { [ 0x01001EB9, 0x01001EB8, q, Q ] };. key <AB02> { [ 0x01001ECD, 0x01001ECC, x, X ] }; . key <AB04> { [ 0x01001E63, 0x01001E62, v, V ] }; .};..partial alphanumeric_keys.xkb_symbols "igbo" {. include "ng(basic)".. name[Group1]= "Nigeria - Igbo";.. key <AD01> { [ 0x01001ECB, 0x01001ECA, q, Q ] };. key <AB02> { [ 0x01001E45, 0x01001E44, x, X ] }; . key <AC10> { [ 0x01001EE5, 0x01001EE4, semicolon,. colon ] };. key <AD11> { [ 0x01001ECD, 0x

C:\Program Files (x86)\Xming\xkb\symbols\is-BL4N9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5328
Entropy (8bit):	4.4806813655298265
Encrypted:	false
SSDEEP:	48:whaSX3k/gOYn5jGsIyvgjKbiI2jl0VPA85cbuft3cF5XmQ:t/+n5FIrjKbiI2JgBmbSO5X9
MD5:	3804F15258659CE4874A45E147CC8F37
SHA1:	F2357932064E8D66899AD856B0D5309E62A8B5BF
SHA-256:	2D863D3D3247C60B1605EB1D96AA6491D3213E33C688785E3D40BFF03CF2CECD
SHA-512:	0203395745BF73640817F92CAC2B646730D8F464DD14C083C3EE0EB2408E6C957AB784493331C1D2A4F33FECB59A18577C41ECB0361EA1BD7E53002364746A42
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cz,v 1.9 2005-01-18 18:17:48 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/cz,v 1.2 2002/11/22 04:02:22 dawes .// Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. . // This layout conforms to a new cz compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1]= "Czechia";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ ecaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ rcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE0

C:\Program Files (x86)\Xming\xkb\symbols\is-C9EVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	4.594277169221976
Encrypted:	false
SSDEEP:	96:zzCTNTnrYJPJYJx53f8laXQ8yHXN2GCXLvtJXR1WuoUYnXT1g:zkhrYJRYlEh8uXNrsjtJXRkXUsjK
MD5:	C26294A0983A5EBD84155E1E989AA10E
SHA1:	5C4710847D8F8A76A87EDCA7DC320E1BCEDB39E7
SHA-256:	2558D2482DA06B5AF4B2EDCEE8336B822C3F0585C3A63F106ADE9E82D686484A
SHA-512:	36FD908D5DE3B1A7D87923B658C6554A4D41DB376785B5FEEC4CEBA79D6A0896572A65FFBD6BE6D88D1A7FE4D52A2EDDC12C791E055ADE6FEC6CB697AD0338E0
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pl,v 1.10 2006-07-30 19:28:56 svu Exp $..// based on a keyboard map from an 'xkb/symbols/pl' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pl,v 1.3 2003/04/19 12:22:12 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Poland";.. key <AD03>.{ [ e, E, eogonek, Eogonek ].};. key <AD09>.{ [ o, O, oacute, Oacute ].};.. key <AC01>.{ [ a, A, aogonek, Aogonek ].};. key <AC02>.{ [ s, S, sacute, Sacute ].};.. key <AB01>.{ [ z, Z, zabovedot, Zabovedot ].};. key <AB02>.{ [ x, X, zacute, Zacute ].};. key <AB03>.{ [ c, C, cacute, Cacute ].};. key <AB06>.{ [ n, N, nacute, Nacute ].};.. include "keypad(comma)".. include "level3(ralt_switch

C:\Program Files (x86)\Xming\xkb\symbols\is-CA42C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10528
Entropy (8bit):	4.522926655487274
Encrypted:	false
SSDEEP:	96:a4iSTSD5SvBGU9X0iSX8Q24IcYvzE1rZl8LiSDeGUDWd0iS3aHS62wiSFuWiSFHm:JbuDMB3ubM2IXLoob6GH6bqy6FbFLbw
MD5:	934E399AE620FC1998AA08CC5B5502A3
SHA1:	70DAD7825170DB5B9A7647231549E12D54499F27
SHA-256:	7256081ADD76CE4EE23746676C0F383D8FBA8A6A0EA21D4C28AF203187FEAE0C
SHA-512:	2203BAD6CB2F578C8CE3486121DBF6B963ADD147547AAE72531AD4525E499BE3CA2B8791A3D5328D41F00E22D13A2F65F27432A07D64B10F312924ADFCB7FA42
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/tr,v 1.10 2006-03-22 23:02:42 svu Exp $..// based on.// Turkish keyboard symbols for PC and xkb.// This file distributed without any expressed or implied warranty.// Nilg.n Belma Bug.ner <nilgun@belgeler.org>, 2005.//.// $XFree86: xc/programs/xkbcomp/symbols/tr,v 1.5 2003/04/19 12:22:12 pascal Exp $..//Default Layout (Turkish Q).default partial.xkb_symbols "basic" {.. include "latin".. name[Group1]="Turkey";.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ] };. key <AE02>.{ [ 2, apostrophe, sterling, twosuperior ] };. key <AE03>.{ [ 3, asciicircum, numbersign, threesuperior ] };. key <AE04>.{ [ 4, plus, dollar, onequarter ] };. key <AE06>.{ [ 6, ampersand, threequarters, VoidSymbol ] };. key <AE07>.{ [ 7, slash, braceleft, VoidSymbol ] };. key <AE08>.{ [ 8, parenleft, bracketleft, VoidSymbo

C:\Program Files (x86)\Xming\xkb\symbols\is-DD00D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10980
Entropy (8bit):	4.091117406427457
Encrypted:	false
SSDEEP:	192:3agTn4ibYdwTt9n9AJeZOTe6yuZUolHp3li1zmpf2Y2ync:3a7dwh9n9qcOTVyuZUopp3lczmpf2Y2V
MD5:	831D45C7DF6EC5A33608113EEFDAB244
SHA1:	635C2D7D4DF8C913176353524B90860E8484D123
SHA-256:	FE0D453F519450958E112AE8D022017B994270988336835517840F56093C5340
SHA-512:	65E1D67DFA729910D647370B9736ED2F05047FB3A089EAB41C64C72DE32B7FB61FB3772EEC0A597FE51101E35A66F116BA8E810DB362BB1F635A5290A0A116AD
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/fi' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fi,v 1.13 2007-01-11 22:57:32 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/fi,v 1.9 2003/01/29 17:17:31 dawes Exp $...partial default alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "fi(fi)".};..partial alphanumeric_keys.xkb_symbols "fi" {.. // a Finnish keyboard with dead key support and all of. // ISO-8859-1 and ISO-8859-15 characters available... name[Group1]="Finland";.. key <TLDE> { [ section, onehalf, onequarter, threequarters.] };. key <LSGT> { [ less, greater, bar, brokenbar.] };. // AltGr+<SPCE> is pressed accidentally too often after AltGr+<LSGT>,. // hence AltGr+<SPCE> produces now space, not nobreakspace.. key <SPCE> { [ space, space, space, nobreakspace.] };. key <AE01> { [ 1, exclam, exclamdown, onesuperior.] };. key <AE02> {

C:\Program Files (x86)\Xming\xkb\symbols\is-DP3US.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.126863065142419
Encrypted:	false
SSDEEP:	48:MLxLW7d6IfweoYHJJ+/4qm0H5KZ0rh6yJYbfPP8wRH2jlFEYX2f1XCT7:6y51JY/XH4WAocP8Q2jl5qBM7
MD5:	814CA9B435BFFD4BDB281A281B3327FE
SHA1:	AAC37A7DB38D6283BA1F1CBF06C0B9D4B74B1127
SHA-256:	CFD765A5EF0018E7461AEEBA47C1D4411985830AA2CA5DEB4B6246525FA4C277
SHA-512:	E8B5E30E85570853C71571E27724B6855343CB22023D928CB6D26BEE223E502BB5BD6DDAC974E13DFBE4AFCFC8A7F2F54BC486E9F858754AC66558194DEC73BF
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/uz,v 1.6 2007-02-25 21:38:32 svu Exp $.// Uzbek standard keyboard.//.// Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// History:.//.// Jun 2, 2003. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Created based on Russian standard keyboard. AEN <aen@logic.ru> .// The following symbols of Russian standard keyboard were replaced:.// minus (key <AE11>) with Byelorussian_shortu (U045e),.// equal (key <AE12>) with Cyrillic_ka_descender (U049b).// Cyrillic_ha (key <AD11>) with Cyrillic_ghe_bar (U0493).// Cyrillic_hardsign (key <AD12>) with Cyrillic_ha_descender (U04b3).// The following symbols of Russian standard keyboard were moved:.// Cyrillic_ze to key <AC02> (english 's'), .// Cyrillic_sha to key <AD08> (english 'i'),.// Cyrillic_ha to key <AD09> (english 'o'),.// Cyrillic_hardsign to key <AD10> (english 'p'). .//.// Feb 25, 2007. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Made cyrillic and latin variants. Default is

C:\Program Files (x86)\Xming\xkb\symbols\is-E2JM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7150
Entropy (8bit):	4.06496731074999
Encrypted:	false
SSDEEP:	96:ewgocfSSvoHXMQwaPD8Tyd7bAnTKrr6GDo1gWImnygy:escfdvocQwaATyd4KyGDVW5ygy
MD5:	57FC3BC30B3500AA311D60D9E33DB698
SHA1:	87BF7A3732C29C6C8F53D8DB630F005C65806C70
SHA-256:	63510789813C4B6238608AE8DADF21F589AEDD9A0601D15F12117E2184F615F8
SHA-512:	3980D6F10655FD57BA1A9543C081A5C24F7334AE0024AD364CB3372048FB0592CA75BA62D47C3922CF39009251083E2745A97637ED805CD8A51C47DBCD0217B7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/nl,v 1.10 2007-01-11 22:58:48 svu Exp $..// Basic layout based on converted file, from keytable file to xkb/symbols/ file.// with mk_xkb by root@linux.chanae.stben.be Tue Sep 30 00:53:29 MET DST 1997..// Converted from the nl-latin.map of the Linux kbd package by.// Pablo Saratxaga <srtxg@f2219.n293.z2.fidonet.org>.//.// $XFree86: xc/programs/xkbcomp/symbols/nl,v 1.2 2002/11/22 04:03:28 dawes Exp $..// Official layout by Benno Schulenberg <bensberg@justemail.net>, January 2007,.// based on http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Netherlands";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE06>.{ [ 6, ampersand, threequarters, fiveeighths ].};. key <AE07>.{ [ 7, underscore, sterling, seveneighths ].};. key <AE08>.{ [ 8, parenleft, braceleft,

C:\Program Files (x86)\Xming\xkb\symbols\is-E9LTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	34007
Entropy (8bit):	4.57268989466677
Encrypted:	false
SSDEEP:	384:8TrS0b95Wmi5hlGGaAdn0r/NFvQSg4bwfnM4V0No9OxWg41HfVTzE1zFBJzipsNm:6Da81yAxTs6M09En+KPwsZxUZaqvnw80
MD5:	644F8DA981063AC0E76BBB066F3A9F91
SHA1:	22E5AFEA332FB969DB8A21D33AA5E10CF4E2F388
SHA-256:	B05AD29918489D130E50F5FEF9D5F5505677A1F29E19300E9ED10216CE6F6B9C
SHA-512:	9504B64A28D3B57E67B82730FA4E508A882901E63CBAEFFE365991A9F30A3E9816146B8FEE8C4A7494596D1444D1CB7DB3879FE33306F2FB8EF06B4F8CB40CFE
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/in,v 1.13 2006-10-10 21:37:13 svu Exp $..// This layout includes all Indian layouts, including:.// - Bengali.// - Gujarati .// - Kannada .// - Malayalam.// - Oriya .// - Tamil.// - Telugu.// - Urdu..// Links:.// - Indic INSCRIPT keyboard layout diagrams:.// http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html.// - Ekusheyr Shadhinota (Bengali layouts):.// http://ekushey.org/projects/shadhinota/index.html.// - Microsoft Windows XP SP2: Indic Language Standards - an Introduction:.// http://www.bhashaindia.com/MSProducts/XpSp2/Articles/IndicLanguageStandards.aspx..// based on a keyboard map from an 'xkb/symbols/dev' file..// Devangari is the default. Kill me if I am wrong:).default partial alphanumeric_keys.xkb_symbols "deva" {..// March 2004 -- David Holl <smyrph+dev_xkb@ece.wpi.edu>..name[Group1]="India";...key.type="FOUR_LEVEL";...key <TLDE> { [ U094a, U0912, grave,

C:\Program Files (x86)\Xming\xkb\symbols\is-EDTV3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.412125756997269
Encrypted:	false
SSDEEP:	24:YaoHO+NSvoT6UkvG7s4GMa7FYkOOCOm7FK8TpAnC:xGyoZkvG7s4GM1kOOCOaK8TyC
MD5:	9B14FC268EDE4B0CC634DFD0472D2896
SHA1:	CDE58620C1D55CBE61C43A39F2004ADA8BB624CA
SHA-256:	DB2D25CDFFFDC8FAC50874352604ADFDEF746D406A50EFA0506CF53370B0AA87
SHA-512:	480C50E94073A0D5B46133EEA3F8ED368DF9D6B074415CC657EB7D8F00D8D753B21C99EF1607650A3A9C3ED7430355FC04E9C4D55972EC7C570F1C2F08981A73
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kg,v 1.3 2004-12-22 22:55:55 svu Exp $..// based on.// russian standard keyboard.// Yury Fedorov <yury-fedorov@prime-task.com>.// Last Changes 2004/10/25 by Yury Fedorov <yury-fedorov@prime-task.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/kg,v 0.0 Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "ru(winkeys)".. name[Group1]= "Kyrgyzstan";.. key.type[group1]="FOUR_LEVEL_ALPHABETIC";.. key.<AC07> { [ .Cyrillic_o,..Cyrillic_O,......Cyrillic_o_bar, .Cyrillic_O_bar.] };. key.<AD03> { [ .Cyrillic_u,..Cyrillic_U,....Cyrillic_u_straight,.Cyrillic_U_straight.] };. key.<AD06> { [ .Cyrillic_en, ..Cyrillic_EN,.....Cyrillic_en_descender,.Cyrillic_EN_descender.] };.... include "level3(ralt_switch)".};..

C:\Program Files (x86)\Xming\xkb\symbols\is-EM5DA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	899
Entropy (8bit):	5.3778802829340595
Encrypted:	false
SSDEEP:	24:YaGxvI9OyqXRiF+yqXRiF2yqXRiFQyqXRiFFxJyqXRiFekJyqXRir:YwYyERiF+yERiF2yERiFQyERiFFxJyET
MD5:	27D27D5C869DDD8DA4AA8A2C053C1ADD
SHA1:	6C93ACA1A49E53090E3F88BF4199B3A22BC1C25B
SHA-256:	DF6D099DD0AE5313DAFCCD1992DF59B4D58258908E266037FE3F403DFEE26BD1
SHA-512:	BE26FD9D6C9867370BAB2A7FC6B012DA34C8EC212CEEB715ED3C08CD6389219A628E2289BDBAD51E0A1CE2EEF4A98BFF8D7CE7EBF8A95DA7C19A56CA60B44036
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/compose,v 1.6 2006-04-04 22:54:01 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/compose,v 1.1 2001/08/17 16:31:25 dawes Exp $. .partial modifier_keys.xkb_symbols "ralt" {. key <RALT>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin" {. key <LWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin" {. key <RWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu" {. key <MENU>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rctrl" {. key <RCTL> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "caps" {. key <CAPS> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};.

C:\Program Files (x86)\Xming\xkb\symbols\is-F6AH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3606
Entropy (8bit):	4.942295985662373
Encrypted:	false
SSDEEP:	48:lv/WAxVs3RTrat40dE+MfPTiFeJUehull:5/HxVsBHSd0Wc2e0ll
MD5:	0CC2A5A7441509CC232CB70F04C9C963
SHA1:	9AAF8773BB5E38875E60CCEF9105D28D7E043847
SHA-256:	868E48A715C64CC5DA54F021EEEB6DCD10B588A806F99950209D508A3D424C1A
SHA-512:	AC5A56D6515C553A39E9CBADA44D5055E490EBA864364BEEC8C656335DA5251991A99632DFA0CBDFE1CFD990480C7419F0334724A2872E63F6BE1C40825E5B74
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/tj,v 1.9 2005-08-01 22:11:07 svu Exp $..// based on.// Tajik keyboard .// it is a Russian layout keyboard, with SHCHA replaced with .// dead_cedilla/dead_macron.// that allows to type the SHCHA with dead_cedilla + SHA.// and all the extra Tajik keys:.// dead_cedilla + KA, HA --> KA descender, HA descender.// dead_macron + I, U, GHE --> I macron, U macron, GHE horizontal stroke.// it requires proper dead_cedilla and dead_macron entries in Compose file.// it also allows to use Mode_switch when in cyrillic mode to enter.// special letters by doing Mode_switch + base letter.//.// AEN <aen@logic.ru> (for the Russian layout).// Pablo Saratxaga <pablo@mandrakesoft> (for the dead keys changes).//..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Tajikistan";.. key.<TLDE> {.[ Cyrillic_io, Cyrillic_IO.].};. key.<LSGT> {.[. bar,. brokenbar.].};. key.<AD01> {.[ Cyrillic_shorti, Cyrillic_SHORTI.]

C:\Program Files (x86)\Xming\xkb\symbols\is-FC4J3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	5.047212599322196
Encrypted:	false
SSDEEP:	24:YaVCK71EKBZb60WEx0triy2d8ALXE/uwewglx9cV4zN9q7Zq3vQqmVzFvO0C:3nEKBVWEuE3Vy4zzZeFvg
MD5:	4E7FB3124BC729A7475F636B2045C6F6
SHA1:	A9973B2172D7B79E52168E7ED3CDE1E552075DEA
SHA-256:	DE0D142687BAF943F1816A445BBD33D454547A0B7725CE5A3266997F6156281B
SHA-512:	47E156F4A4DF560CF477FB78D3FF1084B19479E35CBD10F24281179DC84D51F10364B9AB2AB9365FA89F2DEE76612577AE179B4BD53275956BD19DCCBC717993
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ad,v 1.1 2006-01-06 23:53:21 svu Exp $..//.// Catalan Keyboard, as manufactured by Large Format Computing, Inc..//.// For layout graphic, see http://www.language-keyboard.com/languages/catalan_layout.htm.//.// Contributed by Robert Millan..partial default alphanumeric_keys.xkb_symbols "basic" {. include "us".. name[Group1]="Andorra";.. key <AE02> { [ 2, at, dead_diaeresis ] };. key <AE07> { [ 7, ampersand, dead_acute ] };. key <AE09> { [ 9, parenleft, dead_grave ] };. key <AD02> { [ w, W, eacute, Eacute ] };. key <AD03> { [ e, E, egrave, Egrave ] };. key <AD06> { [ y, Y, udiaeresis, Udiaeresis ] };. key <AD07> { [ u, U, uacute, Uacute.] };. key <AD08> { [ i, I, iacute, Iacute.] };. key <AD09> { [ o, O, oacute, Oacute.] };. key <AD10> { [ p, P, ograve, Ograve.] };. key <AD12> { [ bracketright, braceright, EuroSign ] };. key <AC01> { [ a, A, agrave, Agrave ] };. key <AC08> { [ k, K, idiaere

C:\Program Files (x86)\Xming\xkb\symbols\is-G40RJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	4.724431980073704
Encrypted:	false
SSDEEP:	192:P7EjLi70h6ZXkY7sIH5VtskGiAe5EoQ0ziwZ+4HjjEEDrDXStxTgMJW0y1kIrqhl:DEonZnMln4AmxTmtNiWr
MD5:	2F593BFC8E6F5322342B5461775D0E1E
SHA1:	50BEECBB8FD4C82D39F3DE550EC66198AE5F4ECA
SHA-256:	7E7BEF0D4E565E24CDEDC975E1DEF3D6B4B6A79C7054608231ED6FA40FEC5624
SHA-512:	0299C89B150157FC48AA49D3E64196F19A3FB693F2E0E4AE8418F1A51A98A176F8DFE325613ADF16BDC08FB234C51D0C750E518E1CC0B3A8C6F07114343B8AF9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/sy,v 1.2 2006-05-04 21:52:51 svu Exp $..//.// $XFree86: xc/programs/xkbcomp/symbols/syr,v 1.1 2002/11/22 03:06:50 dawes Exp $.//..partial default alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Syria";.};..partial alphanumeric_keys.xkb_symbols "syc" {. name[Group1]= "Syria - Syriac";.. key <TLDE> { [.0x100070F,.0x100032E,.Arabic_shadda..] };. key <AE01> { [ .1,..exclam,..0x1000701..] };. key <AE02> { [ .2,..0x100030A,.0x1000702..] };. key <AE03> { [ .3,..0x1000325,.0x1000703..] };. key <AE04> { [ .4,..0x1000749,.0x1000704..] };. key <AE05> { [ .5,..0x1002670, 0x1000705..] };. key <AE06> { [ .6,..0x1002671, .0x1000708..] };. key <AE07> { [ .7,..0x100070A, .0x1000709..] };. key <AE08> { [ .8,..0x10000BB,.0x100070B..] };. key <AE09> { [ .9,..parenright,.0x100070C..] };. key <AE10> { [ .0,..paren

C:\Program Files (x86)\Xming\xkb\symbols\is-G4TDS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12467
Entropy (8bit):	5.01031851508168
Encrypted:	false
SSDEEP:	384:OMds66CAG06BAjb66gLUCya6ZRBb6fWGt9+GF6fLCNGG:OM+66806BI66bI6ZTb6fj6fM
MD5:	272A6FEFB3A884615328BEA0AC5357D5
SHA1:	2820D6F5FC4C394E31866BE179FD284861EE94E8
SHA-256:	7FF6E4BB865859AC30762602D64EF0B4D01FD7AD59CB155CD7D1FDE3D635BD59
SHA-512:	AB00D01F39FE325F50EB0BD96A6708017B7180234D282FB642E3414C38B7D947D4CE3D47860C5F8BB26230E306308812CCF5028F7D224C7FE20B70F5D8994CCC
Malicious:	false
Preview:	// Arabic AZERTY with modern Latin digits .partial default alphanumeric_keys.xkb_symbols "arabic" {. include "ara(azerty)".. name[Group1]="Morocco";.};..// French AZERTY keyboard used when typing French.partial alphanumeric_keys.xkb_symbols "french" {. include "fr(basic)".. name[Group1]="Morocco - French";.};..// Clavier unicode tifinaghe de base r.alis. par l'IRCAM (Institut Royal de la Culture Amazighe du Maroc) http://www.ircam.ma/.// Support des lettres unicode tifinaghe-IRCAM, n.otifinaghes & touar.gues..// Les caract.res tifinaghes sont accessibles en SHIFT positions pour le niveau 2, en ALTGR positions pour le niveau 3.// Polices tifinaghes Unicode . t.l.charger depuis :.// http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf (licence non libre, libre t.l.chargement et distribution uniquement).// Minihowto ici: http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html..partial alphanumeric_keys.xkb_symbols "tifinagh" {.. name[Group1]="Morocco

C:\Program Files (x86)\Xming\xkb\symbols\is-GCUN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5705
Entropy (8bit):	4.852765645382388
Encrypted:	false
SSDEEP:	96:bG7y48aJ1tyIi1Y21Y2jerSDwgUt4v93XapwWYGGlOa5+8vmnyXz:b48aJ1tyIie21Re2DXUGVnapwWhCOaEe
MD5:	9C90A2F4B0C864DFC4CAB55784935166
SHA1:	8B00114DE8388A96878533C23C1EE1C565C9FB44
SHA-256:	872FE33E25203FD6441C3943945DEED55D87EAFAAE35F789B3B613A4FCACC837
SHA-512:	A6DF16069B1DEA416D4F1EA510BDED9507E5D42BD5B2B9809BD29FCFBECC59FB198524197D314B702965F60838CC21E818C41215E84F737D67A326245981BD6A
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/es,v 1.13 2007-01-26 23:02:18 svu Exp $..// based on a keyboard.// Modified for a real Spanish Keyboard by Jon Tombs.//.// $XFree86: xc/programs/xkbcomp/symbols/es,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spain";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, periodcentered, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dead_tilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [exclamdown, questiondown, asciitilde, asciitilde ].};.. key <AD11>.{ [dead_grave, dead_circumflex, bracketleft, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, bracketright, dead_macron ].};.. key <AC10>.{ [ ntilde, N

C:\Program Files (x86)\Xming\xkb\symbols\is-GTTBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	5.084335316872027
Encrypted:	false
SSDEEP:	24:YaxaVx3Vdu9HEPqtBEOlqUQrWMt9OHAUQbtb7CT:Dg3P05rdqUQrWMyAUQb17CT
MD5:	A703B44AB424FC914EB1E63E4AB67FA8
SHA1:	DE964B81B5A5B1DDB10BE96C7679FC06420123FC
SHA-256:	F9E907AEBDC003480447CAC068B1467209BD5EC305A9238B5BDF946AE8F1029F
SHA-512:	9EF21ED6FC38EF916026B2262DC86252392CBD41050F105B1AF3FDC701808CBE83E6861683397043554A4CB807A50E42416CA066E553435E1C9FA12972668973
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ctrl,v 1.3 2005-12-30 01:56:21 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/ctrl,v 3.2 2003/10/24 20:38:20 tsi Exp $.//.// eliminate the caps lock key completely (replace with control).partial modifier_keys .xkb_symbols "nocaps" {. key <CAPS>.{ symbols[Group1]= [ Control_L, Control_L ] };. modifier_map Control { <CAPS>, <LCTL> };.};..// swap the caps lock key with the left control key.partial modifier_keys .xkb_symbols "swapcaps" {. key <CAPS>.{ symbols[Group1]= [ Control_L ] };. key <LCTL>.{ symbols[Group1]= [ Caps_Lock ] };.};..// moves the control key to the middle row and the caps lock.// to the bottom row. Only works if the geometry or keycodes.// file has defined appropriate aliases for the keys in question..partial modifier_keys .xkb_symbols "ctrl_ac" {. key <AC00>.{ symbols[Group1]= [ Control_L ] };. key <AA00>.{ symbols[Group1]= [ Caps_Lock ] };.};..// Moves the control key to the bottom row

C:\Program Files (x86)\Xming\xkb\symbols\is-HBURA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	4.535956813483921
Encrypted:	false
SSDEEP:	24:YatA+a60zmdmRViJxIvYAgwKqk5fCLqg6aIPIN8U2gH4W4bJYRl5jfDJkD6DqqDx:Azgm/YLpV0wY5RR+QsIVeBKITvwTR
MD5:	10EDAB27749EBCEF3C3646393150D68A
SHA1:	80DA650AC7D5E075FFCB966501C0DB701C7A5010
SHA-256:	4DB1C978D822503335D3CFE5FFDF58757207D7FA528D797A838C45E0ADAA4CC2
SHA-512:	47E6E68B0F3B79A956E6BEDDCA980B7F5D7B42C316EE08F57BA430AEFBA5DBA011CA0D37DF222A7A089D956228A573F98022F7DCEC4DB4B546D5E56BD5A18C81
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/hr,v 1.16 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Croatia";.. include "cs(latin)".. // Redefine these keys to match XFree86 Croatian layout. key <AE01> { [ 1, exclam, asciitilde, dead_tilde ] };. key <AE03> { [ 3, numbersign, asciicircum, dead_circumflex ] };. key <AE05> { [ 5, percent, degree, dead_abovering ] };. key <AE07> { [ 7, slash, grave, dead_grave ] };. key <AB10> { [ minus, underscore, dead_belowdot, dead_abovedot ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Croatia - US keyboard with Croatian letters";.. include "us".. key <AD01> { [ any, any,.backslash. ] };. key <AD02> { [ any, any,.bar . ] };. key <AD03> { [ any, any, .EuroSign . ] };. key <AD06> { [ any, any,.z,..Z

C:\Program Files (x86)\Xming\xkb\symbols\is-HFSN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6432
Entropy (8bit):	5.050687757492257
Encrypted:	false
SSDEEP:	96:qWgOrIXGi5Dc2r/3ogJZOXtoI5pfbBWTyBEaNSKOw1Zuju4:qlOkdn/whBkIPBOwXuK4
MD5:	62CD22BB079ACDBB8F4E709E80C29A40
SHA1:	E0D67B447F818520BFA8329E8DD4D2AC84A38A42
SHA-256:	0B701341D7446E1B8C71F5B77CFBAA73029C4FD474E7DE48AED2EE033A722057
SHA-512:	338C3C8986AE3034F2EAA129C76BB1A8B96E2D2AE570C911924A74F8B8DBE897E457172F455947B6D38E9A6E785471638564B6948FB8E96966A62667CB660342
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lt,v 1.9 2006-09-02 00:34:17 svu Exp $..// based on.// Lithuanian keyboard map by Ri.ardas .epas <rch@richard.eu.org>.// merged into one file by Nerijus Bali.nas.// Added number and special characters writing in basic lt layout with RAlt by.// Mantas Kriau.i.nas <mantas@akl.lt>, 2004.//.// $XFree86: xc/programs/xkbcomp/symbols/lt,v 1.3 2002/12/14 22:26:11 dawes Exp $..// If you want to have 2 layouts, use.// Option "XkbLayout" "lt,lt(us)"..// Lithuanian Baltic layout - Lithuanian letters on the numeric row.partial default alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Lithuania";.. key <AE01>.{ [ aogonek, Aogonek, 1, exclam ].};. key <AE02>.{ [ ccaron, Ccaron, 2, at ].};. key <AE03>.{ [ eogonek, Eogonek, 3, numbersign ].};. key <AE04>.{ [ eabovedot, Eabovedot, 4, dollar ].};. key <AE05>.{ [ i

C:\Program Files (x86)\Xming\xkb\symbols\is-HHUSH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4177
Entropy (8bit):	3.4067455922396768
Encrypted:	false
SSDEEP:	48:y5zPOJduCsms/+TbaJLH/T+Af+Dn5Cc0fzxp1EIMUT+VrsvPaCC05ZzZ2lxDn0An:yWdlhs/+X6LH/T+6j1PNQNbnn4c
MD5:	08868FB310D41E65DD215E4C01341F17
SHA1:	34945BB0EA466BFA403DEF2E4554D080E2958388
SHA-256:	C5FCFB3C829D62379A721D904003ED221F2C506C8B738199626B33752915C7D3
SHA-512:	D5898933F5B2D8CE6083C14F4457030BD534A2C668C17A0C3288E0DEC8C2D3F9A45BE563B87316EC5FD2D93B5AD9991489A02370002B82E25AAED535364A5F93
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cd,v 1.4 2007-04-03 21:23:56 svu Exp $..// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Congo, Democratic Republic of the";.. key.type[Group1] = "FOUR_LEVEL";.. // Alphanumeric section. // TILDE, COMBINING TILDE. key <TLDE> { [ grave, asciitilde, 0x01000303] };. key <AE01> { [ ampersand, 1, numbersign ] };. key <AE02> { [0x01000301, 2, at ] };. key <AE03> { [0x01000300, 3, guillemotleft ] };. key <AE04> { [ parenleft, 4, bracketleft ] };. key <AE05> { [ braceleft, 5, less ] };. key <AE06> { [ braceright, 6, greater ] };. key <AE07> { [parenright, 7, bracketright ] };. ke

C:\Program Files (x86)\Xming\xkb\symbols\is-HL9AK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	5.427530323020008
Encrypted:	false
SSDEEP:	48:fb7GPff6BtRx2afogPUmoAwdtClxf8oaZC:CERx9QrrdIrf8oaU
MD5:	8FD7AD49B34B242CDA7F8C9E6CD280DC
SHA1:	45B3B704DA26AE7398F3B5F9A7FD2A844DE9399A
SHA-256:	DBF0738C66DFE3275B3C0B9F72D0A39D8A93B30D37F463BF0C0A0A77E9791149
SHA-512:	C1D852618E17880E675A31AEFF9F0287F373A4D40CE0D7AA12290FE6B53D650200D1EF31CE7FC8D7B7895A99F380D34E55AA4BA77A07E4E633E7CB6971504060
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/srvr_ctrl,v 1.2 2004-10-09 18:34:15 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/srvr_ctrl,v 1.4 2003/12/18 14:14:38 pascal Exp $.//.// Actions which control the server's behavior..partial keypad_keys function_keys.xkb_symbols "xfree86" {. include "srvr_ctrl(stdkeypad)". include "srvr_ctrl(fkey2vt)".};..partial keypad_keys .xkb_symbols "stdkeypad" {.. key <BKSP> {..type="CTRL+ALT",..symbols[Group1]= [ BackSpace, Terminate_Server ]. };..// Ungrab cancels server/keyboard/pointer grabs. key <KPDV> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Divide,.XF86_Ungrab ]. };..// ClsGrb kills whichever client has a grab in effect. key <KPMU> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Multiply,.XF86_ClearGrab ]. };..// -VMode switches to the previous video mode. key <KPSU> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Subtract, XF86_Prev_VMode ]. };..// +VMode switches to the next video mode. key <KPAD> {..ty

C:\Program Files (x86)\Xming\xkb\symbols\is-HMPTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	698
Entropy (8bit):	5.084666819383202
Encrypted:	false
SSDEEP:	12:jLsZaBM1J483K160d3uFTldH1y3aTJk160dBuFTlAIfvy3aTB2aT9XgRb2dyb56W:YaeDW60des60jeffcaI5JKZ4Vv
MD5:	4DA445213DC6B490C79CBC622B0A07DA
SHA1:	BF6357F695EB1B6F1BF497C59202FC1C7A25DA16
SHA-256:	0C9B0B14F2380958B973CDE9944B8F770F26AF583CECF221A5A9B29C8813115F
SHA-512:	C7D1EA486C9221306DB4394F7C6E3F7785590741F83C0911698BA410983FA9786474CC330D2F67BAA12EB9DCF467973332BFEE19D07ACB1096204D74E1C9C708
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kr,v 1.4 2006-10-11 19:32:35 svu Exp $.//..default alphanumeric_keys.xkb_symbols "kr106" {. name[Group1]= "Korea, Republic of";. include "us". include "kr(koreankeys)".};..alphanumeric_keys.xkb_symbols "kr104" {. name[Group1]= "Korea, Republic of - 101/104 key Compatible";. include "us". include "kr(koreankeys)". include "kr(koreankeys_raltctl)".};..partial hidden function_keys.xkb_symbols "koreankeys" {. key <K72> { [ Hangul ] };. key <K71> { [ Hangul_Hanja ] }; .};..partial hidden function_keys.xkb_symbols "koreankeys_raltctl" {. key <RALT> { [ Hangul ] };. key <RCTL> { [ Hangul_Hanja ] }; .};..

C:\Program Files (x86)\Xming\xkb\symbols\is-HR230.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	19610
Entropy (8bit):	4.476209026118858
Encrypted:	false
SSDEEP:	384:5RoaVAuCoasgidK5oFftpSAnTbv9z9bdDFgxab7fnONHt:5irmCObFFdJgxSQ
MD5:	BD9254625BCC77FE05685586141FB2CC
SHA1:	847C2197DEC9F122B300EE2BBA193C0C608FD35F
SHA-256:	1FE52A3594B14DC1560481DC7B644B16F1E4A45923B0A71D8A8DCD7FD804145E
SHA-512:	10B41D84997F5ADB8FADD3636949032341461A6D1B48A35DA09763F0228DF1B7246FAF82F43BAB921DCD9DC96EC112CCA52C2C25B0FA64A5ABA98BCEBE0F0F22
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ca,v 1.15 2007-01-04 23:31:30 svu Exp $..default partial.xkb_symbols "fr" {. name[Group1] = "Canada";.. key <TLDE>.{ [ numbersign, bar, backslash ].};. key <AE01>.{ [ 1, exclam, plusminus ].};. key <AE02>.{ [ 2, quotedbl, at ].};. key <AE03>.{ [ 3, slash, sterling ].};. key <AE04>.{ [ 4, dollar, cent ].};. key <AE05>.{ [ 5, percent, currency ] .};. key <AE06>.{ [ 6, question, notsign ].};. key <AE07>.{ [ 7, ampersand, brokenbar ].};. key <AE08>.{ [ 8, asterisk, twosuperior ].};. key <AE09>.{ [ 9, parenleft, threesuperior ].};. key <AE10>.{ [ 0, parenright, onequarter ].};. key <AE11>.{ [ minus, underscore, onehalf ].};. key <AE12>.{ [ equal, plus, threequarters ].};.. key <AD01>.{ [ q, Q ].};

C:\Program Files (x86)\Xming\xkb\symbols\is-IA46D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11533
Entropy (8bit):	4.302738376623475
Encrypted:	false
SSDEEP:	192:c8seSd9mrCCcIbvnR/SZe+dKsQNLmbQkY23e+dKsYNLCbnJY24:Jse09me1WvRQeQKsyLQt73eQKs6LcJ74
MD5:	208753E56C714EE6E5282471457330FC
SHA1:	2669E981D272BB87303E691CD5E58F20246AEDF4
SHA-256:	6A254D248128833C5D63AE6EB2D784D46F9E81564363EEEA7A3A364D4A061574
SHA-512:	9353C3A117531F2E5635EDBA7987B3BD9615F94D0E1D159CCF3ACEA8C9B93BAB3ADBF58FACF87F25D4946AD01C5DAC42030558FB6065CF9289F3D6A2E7042444
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kz,v 1.2 2005-09-22 22:09:38 svu Exp $..// Based on http://www.sci.kz/~sairan/keyboard/kzkbd.html.// Baurzhan Ismagulov <ibr@radix50.net>.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/ru,v 1.4 2003/05/05 12:11:10 pascal Exp $..// TODO:.// 1. AltGr with TLDE and LSGT..// 2. Dead key for ruskaz and kazrus..// 3. Ctrl + <key>..// 4. Alt-Tab...// RST KazSSR 903-90.// levels 3 and 4 are non-standard extensions.partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1] = "Kazakhstan";..key.type[group1] = "FOUR_LEVEL";.. key <TLDE> { [ parenleft, parenright, Cyrillic_io, Cyrillic_IO ] };. key <AE01> { [ doublelowquotemark, exclam ] };. key <AE06> { [ comma, semicolon ] };. key <AE07> { [ period, colon ] };. key <BKSL> { [ backslash, slash ] };. key <AB10> { [ numerosign, question ] };. key <LSGT> { [ less,

C:\Program Files (x86)\Xming\xkb\symbols\is-IBA9H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	5.123378930254987
Encrypted:	false
SSDEEP:	24:Yaeh8htDm6+qtqmfc7NgOFxXj2yMNofsgCC25KZhTAkHENyEE7sqmPblvHIF5Y:EEDgqQwcKwj6MvCC2Q3k+hEEfqZl
MD5:	8A4E700CB7E447F2105BCAD0DB6574F3
SHA1:	D3B34E00117CE88EC0A63FB1E0E5704F9A3C808A
SHA-256:	BC0945C9F8EFE1D56BFBC2EBFFB3F41D1E7694C731CF3317045D618B7D00D629
SHA-512:	F65E439EBBF48AD6A21236D9F79BD92139FC6EE6C7D45EA5150E8D9B6E09CE14762F645A0AF062DED545180AFD69BC0B7A29B69A2000E1B2E68DE0CBB907BD8F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/vn,v 1.6 2006-09-03 22:25:14 svu Exp $..// based on:.// vn, TCVN 5712:1993.// Le Hong Boi <le.hong.boi@bigfoot.com>.// August 1999.// Further modified by Ashley Clark <aclark@debian.org>.// July 2000 for X 4.0...partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Vietnam";.. // Alphanumeric section. key <TLDE> { [ quoteleft, asciitilde ].};. key <AE01> { [. abreve,.Abreve..] };. key <AE02> { [. acircumflex, Acircumflex.] };. key <AE03> { [. ecircumflex,.Ecircumflex.] };. key <AE04> { [. ocircumflex,.Ocircumflex.] };. key <AE05> { [. dead_grave,.percent..] };. key <AE06> { [. dead_hook,.asciicircum.] };. key <AE07> { [. dead_tilde,.ampersand.] };. key <AE08> { [. dead_acute,.asterisk.] };. key <AE09> { [. dead_belowdot,parenleft.] };. key <AE10> { [. dstroke,.Dstroke..] };. key <AE11> { [ minus, underscore ].};. key <AE12

C:\Program Files (x86)\Xming\xkb\symbols\is-IHUQN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5523
Entropy (8bit):	4.63251957097356
Encrypted:	false
SSDEEP:	96:pvy374TMxc1raH2Fxqvs1BEiv3SThnvlX1Y+:pq374Qxc1O6xTjE23StnN1t
MD5:	745C457315B9CFB6EBC470B2F0E6727B
SHA1:	10BF305541D4798ABA89321748C3F4452AAC3535
SHA-256:	708D5B7FCF4D0C7001D96CC885F787301E34562AE7B8D8F177FD32BFA5C71316
SHA-512:	16F742AF87FC9F7B8B012E4D50139EC7861110BB5701F292888A7720D68FBD76845449B7C8A8B286356F6E5B8352CF8F2ADAE9E41FCAE0A76C2145E2A1F352F9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/it,v 1.10 2006-10-15 21:17:04 svu Exp $..// based on a keyboard map from an 'xkb/symbols/it' file.// 17 May 2003 Modified by Sebastiano Vigna (vigna@dsi.unimi.it).//.// $XFree86: xc/programs/xkbcomp/symbols/it,v 1.4 2003/04/19 12:22:12 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Italy";.. key <TLDE>.{ [ backslash, bar, notsign, brokenbar ].};.. key <AE02>.{ [ 2, quotedbl, twosuperior, dead_doubleacute ] };. key <AE03>.{ [ 3, sterling,threesuperior, dead_tilde ].};. key <AE04>.{ [ 4, dollar, onequarter, oneeighth ] };.. key <AE10>.{ [ 0, equal, braceright, dead_ogonek ] };. key <AE11>.{ [apostrophe, question, grave, questiondown ].};. key <AE12>.{ [ igrave, asciicircum, asciitilde, dead_circumflex ] };.. key <AD11>.{ [ egrave, eacute, bracketleft,

C:\Program Files (x86)\Xming\xkb\symbols\is-IIQK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	4.5361491694918765
Encrypted:	false
SSDEEP:	24:YaXT6z31vjpGoL+UBByCB/DI1jbfH91ozMq/bc4buP+YAWz1gy8O2Ie6ko8lY2x4:h43DG4z362YiE2oeuc8r
MD5:	2AFF22DD04E11D6705B8FCA44E1FA98F
SHA1:	55F0EF036159A1C7081871C3A3260AF26F676826
SHA-256:	338ABCF5C6A993CF7B0422934AD41BE082C82921E44273A41D93BDDBCA14EAA1
SHA-512:	C433EB16DF65FF0EF65E9E0090A4F1096DF4FE8D79EACDFD08CBB332A8F16560F45FC46ACCE5E6DD16FAB8022645993EDB570A77F5EA046F75007E11382950D4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fo,v 1.7 2005-01-16 02:18:20 svu Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]= "Faroe Islands";.. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};. key <LSGT>.{ [ less, greater, backslash, notsign ].};. key <SPCE>.{ [ space, space, nobreakspace, nobreakspace ] };.. key <AE05>.{ [ 5, percent, NoSymbol, cent ] };. key <AE06>.{ [ 6, ampersand, yen, NoSymbol ] };. key <AE11>.{ [ plus, question, plusminus, questiondown ] };. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ] };.. key <AB03>.{ [ c, C, copyright, NoSymbol ] };. key <AB10>.{ [ minus, underscore, hyphen, macron ] };.. key <AC03>.{ [ d, D, eth, ETH ] };. key.<AC10>.{ [ ae,. AE.]

C:\Program Files (x86)\Xming\xkb\symbols\is-IO1NN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11390
Entropy (8bit):	5.061521795944941
Encrypted:	false
SSDEEP:	192:qokok4WgEY9qCXdoZULLOCAFmqPHjrZvm8ol5xyHt/hz4iQf3:qopk73Y9qCXdoGLnAFmqPHjTN/hzHQf3
MD5:	044760802AD507DAE2C7532599491A09
SHA1:	BC4EA510D99FE96F1CD0852A9FC2B38CB699CC7F
SHA-256:	C94F7B21A10523568BF269E7FC993C3AAFDC7E63C5E844B4E627737953A91AF5
SHA-512:	C4A52442C810E47D8B7DC047D45A7ACE4159C5CA367BF5BF5E919AC9FAC758AFC56239D22A05AF602989BBE30B2A21CD9BD7C980E3B35AE82997A4D8A3DA0771
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/il,v 1.12 2006-11-19 13:15:56 svu Exp $..// based on a keyboard map from an 'xkb/symbols/il' file.//.// $XFree86: xc/programs/xkbcomp/symbols/il,v 1.3 2003/01/07 02:03:44 dawes Exp $..// This is a partial implemetation of the Israeli standard SI-1452.// It does not implement changes to the English layout ("Alt-English"), .// as I believe that it is not the job of this layout to modify the English.// layout..partial default alphanumeric_keys .xkb_symbols "basic" {. // uses the kbd layout in use in Israel... name[Group1]= "Israel";.. key <AD01> { [ slash,.Q..].};. key <AD02> { [ apostrophe,.W..].};. key <AD03> { [ hebrew_qoph,.E..] };. key <AD04> { [ hebrew_resh,.R..].};. key <AD05> { [ hebrew_aleph,T..] };. key <AD06> { [ hebrew_tet,.Y..] };. key <AD07> { [ hebrew_waw,.U..] };. key <AD08> { [ hebrew_finalnun,.I.] };. key <AD09> { [ hebrew_finalmem,.O.] };. key <A

C:\Program Files (x86)\Xming\xkb\symbols\is-IT1DR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	886
Entropy (8bit):	4.993970407441661
Encrypted:	false
SSDEEP:	24:Yay+a60zlh6al+S6BMMltz6NldC6BlBl+qR:YzlRlylAldvlNR
MD5:	D64F51EDCED8E93B96ABF9B8A109BE42
SHA1:	332CD20F3EE7BDB745DBF8E0D5A156DCE2AC0953
SHA-256:	A38A26490CB7AB3BF627D82B92D4AFC612FEDA7F62468A132F312E8F7EFE05AD
SHA-512:	63F213DEA04FE870FD657AB8B902B646F3DB161325702039CA68612618D9C8D5D1D9F936C1A1011E5AAEE7CBE57CAF7F49EF15D91E7BA21964D0E9431CD8FF69
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ba,v 1.6 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Bosnia and Herzegovina";.. include "cs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Bosnia and Herzegovina - US keyboard with Bosnian letters";.. include "cs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Bosnia and Herzegovina - Use guillemets for quotes";.. include "cs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Bosnia and Herzegovina - Use Bosnian digraphs";.. include "cs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Bosnia and Herzegovina - US keyboard with Bosnian digraphs";.. include "cs(latinunicodeyz)".};.

C:\Program Files (x86)\Xming\xkb\symbols\is-JC62F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9716
Entropy (8bit):	4.3624319406018754
Encrypted:	false
SSDEEP:	192:EkxkdPdDJJuXoJXtPq7DJJDwzCJLneeG7dtJUPzzvI:6PdDfuXoJXBq7DbDwzCJLneeMtJUbzvI
MD5:	4A5DC42A5A6DB3E338A599E7EDE7D8D9
SHA1:	21B3A66716B99611F28CD3D7E294D0F8B4CA086A
SHA-256:	813BF19CAF5B97D5B38EDFBF0990D143D2FCAB4846B34A8FCCCC32816BF7A58A
SHA-512:	81E16D8CCEAF6E13D9D7819A469D4F5727F6CAD6F0B30D789C1D620F1D79AB7ABA2639F19AF1B445369435348076C747320B8CA150CA28F77DAE2D5493ADB03A
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ro,v 1.12 2006-07-02 21:05:20 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/ro,v 1.6 2003/09/08 13:12:51 pascal Exp $.//.// Complete set of Romanian keyboards as described in the new Romanian standard.// SR 13392:2004 adopted in December 2004 by ASRO, "Asociatia de Standardizare .// din Romania"..// .// The default mapping is the RO_US/Programmers layout because of the lack of .// Romanian hardware keyboards. The primary standard layout is implemented as .// the "std" variant. If you're really determined to get commas bellow as in .// ISO-8859-16 (and not cedillas as in ISO-8859-2) use the already defined .// variants: "comma" for the default layout or "academic" for the standard one..// MS compatible layout included (use the "winkeys" variant)..// .// Created by Cristian Gafton, <gafton@redhat.com> (C) 2000.// Modified by Marius Andreiana, <mandreiana@yahoo.com> (C) 2001.// Completed by Misu Moldovan, <dumol@gnome.ro> (C) 2001

C:\Program Files (x86)\Xming\xkb\symbols\is-JLGR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11919
Entropy (8bit):	4.5616485776369124
Encrypted:	false
SSDEEP:	96:n4zaH/ADdiM/1AsyHsyp8TmG+FAds/O7gDF/ZDuGKWufWOu7iB1ETlFFomF+9x7a:uaKdHApp8aSds/bwWufWOu7llFE9+ai
MD5:	B224B6AAD8F30A4EC2376B828EDD7F9F
SHA1:	F941AAAAE8575ADD9CBEDA66ED9F731AA8506476
SHA-256:	28429602BA17515688FBDF2A872DAAE9087926E2E89368F5BF2FD71077497AB1
SHA-512:	4ACF5D593301A856928BD7F32AD7927D47DC0A691D61184C94CC567F2C0301FD237DCDCAF8AD3CD052E1932C9CA4C0F51ACB07A4475305555A690F50612D55F4
Malicious:	false
Preview:	// Bosnian, Croatian, Serbian and Slovenian XKB keyboard mapping.// (derived from "Danube" D.2).//.// Danube D.2 from 2003-05-12 is available at http://srpski.org/dunav/.//.// Original authors:.// Danilo Segan (...... .....) <danilo@kvota.net>.// Chusslove Illich (...... ....) <chaslav@sezampro.yu>.//.// Danilo Segan <danilo@kvota.net>:.// - Modified for inclusion in XFree86.// - Further modifications on 2005-08-18 to support Bosnian, Croatian.// and Slovenian in xkeyboard-config.// .// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/cs,v 1.6 2006-09-18 14:22:30 svu Exp $..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Serbia and Montenegro";.. include "cs(level3)". include "cs(common)". include "cs(cyralpha)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "latin" {.. name[Group1]= "Serbia and Montenegro - Latin";.. include "latin(type3)". include "cs(latalpha)". include "cs(level3)". include "c

C:\Program Files (x86)\Xming\xkb\symbols\is-JUIB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4135
Entropy (8bit):	4.318729242205518
Encrypted:	false
SSDEEP:	48:YFfzto1sF1HPQYHIrbFLEJmy1y8YGHbbFi7Zz8lzPTjVe+feEv:++0vQ3P1EVYybWz8lzYXEv
MD5:	922A2DF13BEB772E20BCD70646BA368C
SHA1:	DA48F7CC70CCBB55914A1EE9DE926885545B51C3
SHA-256:	0CB3A06772AD4E4FF4C1D3161FD14EEF393EC2CF7394C9207E53B0789075B1B1
SHA-512:	A941846E26537B759767A77A6B0528FE487E7F463EA5A7B964E3FC4C05A610A2150605C2AEB0F3DC556500D8958BE5798C8CF29DA9A513A76C362EBA12B7EBD6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mv,v 1.1 2005-08-22 22:13:05 svu Exp $.//.// NOTES:.//.//Keymap for thaana/divehi script (divehi language)..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Maldives";..// The key <TLDE> should have the same values as US_en keyboard.. key <TLDE> { [.quoteleft, asciitilde ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenleft ] };. key <AE10

C:\Program Files (x86)\Xming\xkb\symbols\is-KACA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5839
Entropy (8bit):	4.3237369826704715
Encrypted:	false
SSDEEP:	48:SHEHnIBoEXchEHnIl9iLhE8Dk7Y0c3hnJdnJSMqRJdfOEi1ih+njG6o8E5VIZ9/U:jHWpcSHf4Y3hJdidfOEJhEGrVaypdr
MD5:	1D85FEF71FE6619D7A4DF480F6B3FC89
SHA1:	76B89661106506567562517B03C463B60479F16D
SHA-256:	C138D5E01BD3BA7CD068A7A54D282338B56282C7D925D175A8A8350908CA58F8
SHA-512:	21476B447C98729212A6752085D0A18F632667EC53B9FB279AC8347FBDD72218977F3B16F7A69AB4485A716C8E63CA1660A2C94F99E0AA7CC109BE44CDAF7A9B
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/epo,v 1.2 2007-01-11 23:08:23 svu Exp $..// Esperanto keyboard maps -- "Ekverto".//.// Ekverto A ("legacy") (2004-01-10).// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>.//.// Ekverto B ("basic") (2006-12-02).// Benno Schulenberg (Beno S.ilenber.) <bensberg@justemail.net>.// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Esperanto";.. include "us(basic)".. key.type[Group1] = "FOUR_LEVEL_ALPHABETIC";.. key <AD01> { [ scircumflex, Scircumflex, q, Q ] };. key <AD02> { [ gcircumflex, Gcircumflex, w, W ] };. key <AB02> { [ ccircumflex, Ccircumflex, x, X ] };. key <AD06> { [ ubreve, Ubreve, y, Y ] };.. key.type[Group1] = "FOUR_LEVEL_SEMIALPHABETIC";.. key <AD11> { [ jcircumflex, Jcircumflex, bracketleft, braceleft ] };. key

C:\Program Files (x86)\Xming\xkb\symbols\is-KC34L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	4.828459755520695
Encrypted:	false
SSDEEP:	24:/PbAagV2oGVxCT608y6BmDTGga4Y+yLd1zy8O2GpGoLqe603o8XYy0xp4bSA21Np:yLKxCn8y6wYh5+G6Gy0oeuc8DlV66sp3
MD5:	F4109FB985B8BBDAFDFEAD8ECD9FC8D9
SHA1:	96C90EC2114217B985A667DEF45B09FBCB074824
SHA-256:	901BE19FBB97698655CC4C34AABFBE54845651A2EF1B5AE4B1FD3DD013F21D44
SHA-512:	C932D43FAE986A7D737B24079AD9B3F8BFDFA185C8D9AD5D3A59A38D28CF71FAC5474E2C6E7B265DD5DF484E15B9464A9986C2F24F62CA03A69F68E6238C799F
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/dk' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/dk,v 1.9 2006-10-03 22:47:43 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/dk,v 1.3 2002/12/19 01:07:56 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]="Denmark";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ].};... key <AC10>.{ [ ae, AE, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ oslash, Ooblique, dead_circumflex, dead_caron ].};. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};.. key <LSGT>.{ [ less, greater, backslash, notsign ].};.. include "keypad(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {..

C:\Program Files (x86)\Xming\xkb\symbols\is-MHP8T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	4.548493874820345
Encrypted:	false
SSDEEP:	24:KJGaxFT60NBbp9oeOR4VbXY82kC8inAFqZz/goZd3QB7AgKqlUt93N4b97F91dlz:KJZFnNEocPg7mjmVF9ri+QWyv7W
MD5:	91FAD804076784E129922ABF84A4835B
SHA1:	474D77D20A15D78AB9A91BEC8128E382E450C7B3
SHA-256:	47856E4555CAC9A1DB41AE2A7C13A9EAC588CEDB22AA6E3F4B5796031033AC6B
SHA-512:	C65CC2CD6C8FADA553DD1567040888A96C4D4E24C78E11D4FAD0A445D7AE1610CF15160D103BAAADB7E1952BEA59A94C8038DD2D66B3F0309385B522DC8D309A
Malicious:	false
Preview:	.// based on keyboard map:.// Author: Damjan Georgievski <penguinista AT mail.net.mk>.// Revision: 1.5.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mk,v 1.12 2005-09-20 21:10:47 svu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" { . name[Group1]= "Macedonia";.. key <AB01> { [ Cyrillic_ze, Cyrillic_ZE.].};. key <AC02> { [ Cyrillic_es, Cyrillic_ES.].};. key <AC01> { [ Cyrillic_a, Cyrillic_A.].};. key <AD01> { [ Cyrillic_lje, Cyrillic_LJE.].};. key <AD02> { [ Cyrillic_nje, Cyrillic_NJE.].};. key <AB03> { [ Cyrillic_tse, Cyrillic_TSE.].};. key <AB02> { [ Cyrillic_dzhe, Cyrillic_DZHE.].};. key <AC03> { [ Cyrillic_de, Cyrillic_DE.].};. key <AD03> { [ Cyrillic_ie, Cyrillic_IE.].};. key <AB04> { [ Cyrillic_ve, Cyrillic_VE.].};. key <AC04> { [ Cyrillic_ef, Cyrillic_EF.].};. key <AD05> { [ Cyrillic_te, Cyrillic_TE.].};. key <AD04> { [ Cyrill

C:\Program Files (x86)\Xming\xkb\symbols\is-MIJIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	543
Entropy (8bit):	5.067159847916131
Encrypted:	false
SSDEEP:	12:jLsZaB1OP9MmGMxhCcMmGvERmFjCMMmGkIw53C9:YaW9MmGMnJMmGcRSxMmGNwtk
MD5:	57D6CA2BB122C963698A6E960CC90BAA
SHA1:	EBE4514CBE274831FC5E2B2A82E9038E636FC998
SHA-256:	B568FC94618F824242EE0B54AC882151CD87281F819A2C254D6B753A53306896
SHA-512:	509B83F4693C8EFF8CDACEFA64B638CD48B8738BE95312BE298FB6A2FC7C171A258886076D92E6A26364070AA6B743FD1644511617CE09059B65DD821298BAC9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/eurosign,v 1.2 2004-10-09 17:35:01 svu Exp $..// Most keyboards have the EuroSign engraved on the E key.partial.xkb_symbols "e" {. key <AD03>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};..// Many keyboards have the EuroSign engraved on the 5 key.partial.xkb_symbols "5" {. key <AE05>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};..// Many Apple keyboards have the EuroSign engraved on the 2 key.partial.xkb_symbols "2" {. key <AE02>.{ [ NoSymbol, NoSymbol, EuroSign ].};.};.

C:\Program Files (x86)\Xming\xkb\symbols\is-MJ02G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3831
Entropy (8bit):	4.919833064694103
Encrypted:	false
SSDEEP:	96:cIdihfAtse/EX/Lu75mnrYKZ8xUbAyirH:cfhfAtse/wvrYKZ8xUbAyi7
MD5:	E8F801F2B9909B7123F73265C225F352
SHA1:	735B0B50C8B6E13274B949C518A9FAED3D4707CA
SHA-256:	BCD13DA6B926A801A0B44D5A033EE58B0097D2DD455D366F48770BF22DB0D1CB
SHA-512:	5CFB511A53A5C87DEB87DE2141CDAB143D1B34BF52ADAEEAC124172617E78DC2E0066CDF471083DB2C754497CA4C35A81C19EA4F500D73CFB6277DF8B104863D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pt,v 1.10 2006-10-03 22:47:43 svu Exp $..// based on a keyboard map from an 'xkb/symbols/pt' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pt,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Portugal";.. key <LSGT> { [ less, greater ] };. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, dollar, section, dollar ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [guillemotleft, guillemotright, dead_cedilla, dead_ogonek ] };.. key <AD11>.{ [ plus, asterisk, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [dead_acute, dead_grave, dead_tilde, dead_macron ].};.. key <AC10>.{ [ ccedilla, Ccedilla, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ masculine, ordfeminine, dead_circumflex, dead

C:\Program Files (x86)\Xming\xkb\symbols\is-MJ2RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3656
Entropy (8bit):	5.170714878135555
Encrypted:	false
SSDEEP:	48:ZKE2dEIkOLJ2vqBmCSxtU4qNQFaApC914C5:MtwyII75
MD5:	36C40EC96D3C971D6B78A6B8F16E1469
SHA1:	F8F99AC611F2A12F35969114051CD4D380F54B0F
SHA-256:	CB3C5561A687FAA237A6D0DD7B79F617287F91AA2B0F7750E951AC718D4E3C15
SHA-512:	F43E619581001F03C8DC6C40FC2DAE07311E250B3AE4065CD4FED69EB692EE437F23648C4EF5D38A484F510DA2B86664A38A58E503D2748898D5EF9DABAA67A8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pc,v 1.7 2007-01-02 20:56:55 svu Exp $..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, brokenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {. type="CTRL+ALT",. symbols[Group1]= [ BackSpace, Terminate_Server ]. };.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};.. key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};.. key <RTSH> {.

C:\Program Files (x86)\Xming\xkb\symbols\is-N2A44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10896
Entropy (8bit):	4.175369379352188
Encrypted:	false
SSDEEP:	192:UNUp15pC3dO1JZGXam16Yjkt4+iOTSV8Ag8JSBtWPjvwbOeHctf9vGqyJO01NHy9:UNi153hyfKWo3N7gbgLb8X3iWx2EglNe
MD5:	43C8DB2884B54405D193A809AA03097A
SHA1:	AFBF13054B05D72AAF62AF8B8E431177E52178C0
SHA-256:	2EAFD3EE8F7282F47A0B06AEF0FF04B213372F69DD73D6DF91E8CF7A1C87D8A4
SHA-512:	B0E6B86A7E6925583417CDDE10E3FE748EFB9415289B706EEE46819EB0D03AA2024B862A8D5B8DC06A7B2DFD4A599207D8DA514813C5442832920E0F730D6218
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ara,v 1.6 2006-09-18 13:25:31 svu Exp $..// based on a keyboard map from an 'xkb/symbols/ar' file..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Arabic";..// NOTES:.//.// there is also combined shadda diacritis in AltGr position of simple.// diacritics fatha, fathatan, damma, dammatan, kasra and kasratan.// should a third state be added to Group2 ?.//.. key <TLDE> { [ Arabic_thal, Arabic_shadda ].};. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [

C:\Program Files (x86)\Xming\xkb\symbols\is-N5VAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9490
Entropy (8bit):	5.2168302366220844
Encrypted:	false
SSDEEP:	192:jzeZhAoKaiW+pfTivYiW8cXgFBFDnVl5QWk:j6ZhAoKaiJpfTivYiWbXcBFDnVl5QWk
MD5:	CEC6917970E40990AFC691E747D7C3EB
SHA1:	CF01AA34DE88A1C51C0676A74DB63C31709B168A
SHA-256:	E6D66F60E98EC1CE5C107E56A003398BCA2B61F3B46AB8E906C30D8F94ACDA1B
SHA-512:	4D8F49035DEFDF0CB40C8446E199FFED32B5B680B9D66B1B10884861F4B655D3B54385D55F909912CB1C1D34EABCF771194530E9E1D80FE7C35B261DA678FFBC
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ir,v 1.9 2007-01-04 23:41:09 svu Exp $.// Iranian keyboard layout,.// based on National Iranian Keyboard Standard (ISIRI 2901:1994),.// with additions..//.// Author: Behnam Esfahbod <behnam@esfahbod.info>.//...// 3-Level layout..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Iran";.. // Persian digits. key <AE01> { [ 0x10006f1,.exclam,..quoteleft..] };. key <AE02> { [ 0x10006f2,.0x100066c,.at...] };. key <AE03> { [ 0x10006f3,.0x100066b,.numbersign..] };. key <AE04> { [ 0x10006f4,.0x100fdfc,.dollar...] };. key <AE05> { [ 0x10006f5,.0x100066a,.percent...] };. key <AE06> { [ 0x10006f6,.multiply,.asciicircum..] };. key <AE07> { [ 0x10006f7,.Arabic_comma,.ampersand..] };. key <AE08> { [ 0x10006f8,.asterisk,.enfilledcircbullet.] };. key <AE09> { [ 0x10006f9,.parenright,.0x100200e..] };. key <AE10> { [ 0x10006f0,.parenleft,.0x100200f..] };.. // Other 3-Level symbols. key <T

C:\Program Files (x86)\Xming\xkb\symbols\is-NVB42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10000
Entropy (8bit):	4.694291609399501
Encrypted:	false
SSDEEP:	192:DHqg8Q3emHzt/aR1MUhgPTXHCoTMqZrYrkdNtMRuUXamMq7+t0uNkV:D3J3emZ/aRmUhgrSmMqZrYrkdNtMRuUb
MD5:	4FC1C82E2A9B1ECEA814C7D0EC9E82F9
SHA1:	61D46880837E3004EDDCB3012F17D4FDD438ED50
SHA-256:	65624BF3D1EDAFB446224A15284AFC4ACB1CF3AE0408E9A12155842F3BDA40AD
SHA-512:	11FB0614EE9356299387B90248D903330C2C83E86B0B1174DB17522316BF4DC2F62E7B9991BB26A6D9DEB44C6D13D2E8E6CF4F31D9EED09BCA1E271821D8A2C0
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/se' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/se,v 1.15 2007-04-04 23:03:15 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/se,v 1.5 2003/01/26 02:01:48 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "se(se)".};..partial alphanumeric_keys.xkb_symbols "se" {.. name[Group1]="Sweden";.. key <AE05>.{ [ 5, percent, EuroSign, cent ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, plusminus, notsign ].};... key <AC10>.{ [odiaeresis, Odiaeresis, oslash, Ooblique ].};. key <AC11>.{ [adiaeresis, Adiaeresis, ae, AE ].};. key <TLDE>.{ [ section, onehalf, paragraph, threequarters].};.. key <BKSL>.{ [apostrophe, asterisk, acute, multiply ].};.. key <SPCE>.{ [ space, space, space, no

C:\Program Files (x86)\Xming\xkb\symbols\is-O9UAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5355
Entropy (8bit):	5.196930750002717
Encrypted:	false
SSDEEP:	96:qdUXdLb+JOXnEg2Vj7e9syUNoPasQ8wNzIa8JCtJL0WU9zF4/1aZ2b:qdKx+4Eg2x78sNo32x2Stm2b
MD5:	A697AC4178704BF9E44AE12ADE5FED36
SHA1:	2F9BE94395A7DB4068660644F64E0D4BA9059E8E
SHA-256:	F34DCDC91AF8E6FEFC251AFD2E48E4B3B1FA64DFC6CEFACEBFE35801185A8270
SHA-512:	06DCB7C7FD8BD17C06A169D75B26657D28D5B6262F54692A4AED6F48DCCF558D2966DF3ADC044D2A7C384CF2C02140C44899994140CE9ECE8BFB8128F99FD5E5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lv,v 1.7 2005-01-16 02:18:20 svu Exp $..// Latvian keymap version 1.1.// Copyright (C) Dmitry Golubev <lastguru@mail.ru>, 2003-2004.//.// Reworked to get rid of dead_keys (use of which in this case.// is a dirty hack). It is now not dependent on locale settings.// and GTK_IM_MODULES in Gnome. The map is also providing some of.// ISO9995-3 alternate characters. Note that this version works.// correctly under Gnome 2.6. This is to be put into symbols/.// directory, or somewhere else..//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation, and that the name of the copyright holder(s) not be used in.// advertising or publicity pertaining to distribution of the software without.// s

C:\Program Files (x86)\Xming\xkb\symbols\is-OMFMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5346
Entropy (8bit):	4.463581487211096
Encrypted:	false
SSDEEP:	48:aJS+3kwJOYnXaGsIyvgjobiI2jl0R+l85MyZJ2mxKt3cQZz8mQ:VwfnXSIrjobiI2JcDyMJ2zz89
MD5:	D6E69779376DFF7C800CA4DBBB3ECC51
SHA1:	B60F3CDE725FA40524CB384BDC302E01867BE435
SHA-256:	B3CB5935C7F7F848A2EDBF35BC3F5CF31E62EA05DE7F04A8E1B8A76456F88B20
SHA-512:	337074324D2F75C800145EB063D664DFA50A645E0B52D2BE7BE361C16814DC284E700213906BFECE44D975798E7D1BDDDE0913404EF1EAA8DB353F0AA913B244
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/sk,v 1.8 2005-01-16 02:18:20 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/sk,v 1.2 2002/11/22 04:02:22 dawes .// Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. . // This layout conforms to a new sk compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1] = "Slovakia";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ lcaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ tcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <

C:\Program Files (x86)\Xming\xkb\symbols\is-PINEA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3445
Entropy (8bit):	4.705070218017659
Encrypted:	false
SSDEEP:	48:ktpEMl4nSp5X9nUXjjPft2Ru5/vGhS3dD3DfcPI08bWEvtm9JLQr+xftspDyflS2:nnSLtnOjj15/P9g38bWEvsYr+fQyfUfu
MD5:	CC31D57D596BF413C0038B3B9C6A7105
SHA1:	4A43A24A939B3B323A916FD6BAB17D4BC3E691A9
SHA-256:	87306A1BA3AA9AB90188533180247B64AB02E30AA80894495EB7984A2AB9464A
SHA-512:	D3C04CEDCAB124324911B0374B5AE8EC267B5BC75D8B442033BA454F5B3DA6DCD6187E71083512BFFCA79D83DA331749ACB4E16AB4CD347FE5DEA2AA83FBE6B5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pk,v 1.1 2005-07-30 02:32:00 svu Exp $..// Urdu keymap.// Developed by:.// Zaeem Arshad <zaeem@linux.net.pk>.// Last update: 2004-03-12.//Notice:.//Alt key combinations are yet to be put in. The unavailable keys are those which do not have a corresponding //glyph in unicode...partial default alphanumeric_keys.xkb_symbols "urd" {. name[Group1]= "Pakistan";.. // Keys '~' - '='. // All keys checked and complete. key <TLDE> { [ 0x10006d4 ] };. key <AE01> { [ 0x1000661, exclam ] };. key <AE02> { [ 0x1000662, 0x1000040 ] };. key <AE03> { [ 0x1000663, 0x1000023 ] };. key <AE04> { [ 0x10006f4, 0x1000024 ] };. key <AE05> { [ 0x10006f5, 0x1000025 ] };. key <AE06> { [ 0x1000666, 0x100005e ] };. key <AE07> { [ 0x1000667, 0x1000026 ] };. key <AE08> { [ 0x1000668, asterisk ] };. key <AE09> { [ 0x1000669, parenleft ] };. key <AE10> { [ 0x1000660, parenright ] };. k

C:\Program Files (x86)\Xming\xkb\symbols\is-PKG41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.4581030440073635
Encrypted:	false
SSDEEP:	24:Yai/6CMPtdANEamSO+J+BYDjs7EtYedSyUu7M7b7BGN7x5RyC1t+a2KAQVgqLG0Y:05MFdU1yBYMtyfQPQMC0
MD5:	DCBDF2278AE5641143662A9B0492ECBB
SHA1:	BB63315055B8C07EE2BAE661194F6DD045FD7F44
SHA-256:	4D073AF6E175BE383C49781B60350CA31658559265F556FAA0E34B2390539D93
SHA-512:	4672E03B31C0A3AB109116388A2E416537EF88260B56AD61ABC900EEEB429F135297BE19815307AFA174A403899C4544F83C499CCB4AC413884B84BA3525E858
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/za,v 1.2 2006-10-11 19:32:35 svu Exp $.//.// based on the Latvian and GB keyboard maps..partial default alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. // Describes the differences between an en_US . // keyboard and a South African layout with . // dead keys. By Dwayne Bailey (dwayne@translate.org.za) .. include "latin".. name[Group1]="South Africa";.. key <TLDE> { [ grave, asciitilde, dead_grave ] };. key <AE02>.{ [ 2, at, yen ].};. key <AE03>.{ [ 3, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dollar ].};. key <AE05>.{ [ 5, percent, EuroSign ].};. key <AE06> { [ 6, asciicircum, dead_circumflex ] };.. key <AD03>.{ [ e, E, ediaeresis, Ediaeresis ].};. key <AD04>.{ [ r, R, ecircumflex, Ecircumflex ].};. key <AD05>.{ [ t, T, U1e71, U1e70

C:\Program Files (x86)\Xming\xkb\symbols\is-PMQOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	9897
Entropy (8bit):	4.6395109627008555
Encrypted:	false
SSDEEP:	192:/rRxNw1k6IFd4BV+Ntrqta1Nrs4ncq8lSL9QkIjF3nyNerYYjnP8xI+4nx:/rHK1k6I6V+br+anrRnL8uu3nprYwnPv
MD5:	7A4F5D8D109BDFC727D1958FCCBBBA6F
SHA1:	29CDF8E57ACED5AD9654362D069F0900718052BE
SHA-256:	FACA390228B14231EF8CBAC4076AD71224A9EB403E1D784B32C84F59EB4C05E4
SHA-512:	CF80B82D0488D5CAF9FE84496C375C4F475EBB39CFB7CA3C3BA742FE61555C0FF60DCE826E11F749FEEF08EB97F62066B9C684D968A4C6C3D94B2B96B2AEC8F9
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/no' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/no,v 1.12 2006-10-03 22:47:43 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/no,v 1.3 2002/12/19 01:07:56 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Norwegian keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin(type2)".. name[Group1]="Norway";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [ backslash, dead_grave, dead_acute, notsign ].};... key <AC10>.{ [ oslash, Ooblique, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ ae, AE, dead_circumflex, dead_caron].};. key <TLDE>.{ [ bar, section, brokenbar, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};. key <LSGT>.{ [

C:\Program Files (x86)\Xming\xkb\symbols\is-Q660A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2379
Entropy (8bit):	4.916069733228254
Encrypted:	false
SSDEEP:	48:qFPOADnWhW0hnEr/6vYlFoTTxz0bzv+fSHLEN/61YLq7:qg3hXpE76Qfbv9LEx61Y27
MD5:	1580CEC4F41DAED2139FC529947D0C84
SHA1:	9BC681BB1CCB0DA7FF26742FE92E57245D66D581
SHA-256:	515A231FAD98C8CB200E97612B5F101098BC2A25AB0DEDD3FFBA88E6FC01E041
SHA-512:	45148E8D1DA13436895E9340A04697A76C7E1B819DDD60EF070FBC156E293761D500FF55A1AE6EC12969B571135110F46DBE87206F07F568695680790161BC46
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/latam,v 1.5 2005-01-16 02:18:20 svu Exp $..// based on a keyboard.// Modified for a real Latin American Keyboard by Fabian Mandelbaum.//.// $XFree86: xc/programs/xkbcomp/symbols/la,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Latin American";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, numbersign, periodcentered, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [questiondown, exclamdown, dead_cedilla, dead_ogonek].};.. key <AD11>.{ [dead_acute, dead_diaeresis, dead_diaeresis, dead_abovering ].};. key <AD12>.{ [ plus, asterisk, asciitilde, dead_macron ].};..

C:\Program Files (x86)\Xming\xkb\symbols\is-QDP3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.781926579216175
Encrypted:	false
SSDEEP:	96:InrYoh56Hk4neEMkHanuXICH1/vHLrhXmnrYpzC:arYU52XeQHauXIU1/vHL10rYpG
MD5:	66443EBEFEFB04448F58D655292DDD43
SHA1:	4409B30F8010BABB11E6DB4E0C157F5A64BDD275
SHA-256:	CBD142FDE7746AEC713B3FB654EF47005B60B77085F3990617CD0957E3ED75A7
SHA-512:	D2807844B27FDA7BEED66B079A1844C89F55BEC02F7FD9AC70C5B4F87150AA9612EFF2B5B6F2B1AD16C9CCB1A4D1A72695A6AFCF6A88B30DF4472BD006993684
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/gb,v 1.11 2006-10-03 22:25:41 svu Exp $..// based on a keyboard map from an 'xkb/symbols/gb' file.//.// $XFree86: xc/programs/xkbcomp/symbols/gb,v 1.6 2003/10/04 10:25:14 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout defined by. // the SVR4 European Language Supplement and sometimes also. // known as the IBM 166 layout... include "latin".. name[Group1]="United Kingdom";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, sterling, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, EuroSign, onequarter ].};.. key <AC11>.{ [apostrophe, at, dead_circumflex, dead_caron].};. key <TLDE>.{ [ grave, notsign, bar, bar ].};.. key <BKSL>.{ [numbersign, asciitilde, dea

C:\Program Files (x86)\Xming\xkb\symbols\is-RJFPI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	5.10514909719502
Encrypted:	false
SSDEEP:	12:jLsZaBXWe160d8F1mbwuFMIJz160dshuFMGbz160dRkuFMGVJz160dEtiYuFMGpg:Yap60WM8/u60M/S60Y/e602f/k60eU/O
MD5:	6C9B0A8E9A2162E1A739E373D21CD9A5
SHA1:	0D116A0BC4D851BAE6104C256FEE5DF5E0693195
SHA-256:	028C27D923BFE52910657258D0DE7FF99C2869BA06C2EA367D584B2D1842B154
SHA-512:	CE578355B8BBEEF42198D347A5CF2174BEC74C277CD227E5E2AC532B395E660CA607AE900DF38D55C3158D708B98A9C1C1BC3D157F4F1A4B9FFBD2BB06371A4C
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/iq,v 1.2 2006-08-31 23:07:37 svu Exp $.// Iraque keyboard layout,..// 3-Level layout..partial default alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Iraq";.};..partial alphanumeric_keys.xkb_symbols "ku" {. include "tr(ku)". name[Group1]= "Iraq - Kurdish, Latin Q";.};..partial alphanumeric_keys.xkb_symbols "ku_f" {. include "tr(ku_f)". name[Group1]= "Iraq - Kurdish, (F)";.};..partial alphanumeric_keys.xkb_symbols "ku_alt" {. include "tr(ku_alt)". name[Group1]= "Iraq - Kurdish, Latin Alt-Q";.};..partial alphanumeric_keys.xkb_symbols "ku_ara" {. include "ir(ku_ara)". name[Group1]= "Iraq - Kurdish, Arabic-Latin";.};.

C:\Program Files (x86)\Xming\xkb\symbols\is-RK5SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4597
Entropy (8bit):	4.941956117710937
Encrypted:	false
SSDEEP:	96:JjVJP53sPAeBQyTIEeoLvjez4FDlHKP+dW4w:7H8PAuQ5E57jeslqP34w
MD5:	D9C679DF7AB3637C8A560772B3C7BBB1
SHA1:	01F72B213755C8551030C19D5F7AEC6E6EE479BE
SHA-256:	82AA2A6C7A6ADC86CD22FB698FA4BC1B8E672C4B93BB2CECB30DFD40489C0AC2
SHA-512:	08A1AF3BD736313CFA05EEC87060B5A2AE3725F723243B463773232C0B04A02A5CD4BE71421BDD19F8EE4B6059ECC33E6B129EE6DFCD553E0AE37C62B46C262B
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kh,v 1.2 2005-12-31 02:02:46 svu Exp $.//.// khmer unicode keyboard for XFree86 4.3 or XOrg .// (might work with older versions, not tested).//.// layout defined by National Information Communications Technology Development Authority (NiDA).// http://www.nida.gov.kh.//.// version: 1.0.1.//.// date: 14.09.2005.//.// author: Jens Herden (jens at khmeros.info).//.//.// understanding the symbols:.//.// 0x100yyyy = unicode, yyyy is hexcode.// codes that are not assigned in unicode (0x10017fb-0x10017ff),.// are used to make compositions for special vowels.//.// voidsymbol = no symbol for this combination.//.// all other symbol are defined in: /usr/X11/include/X11/keysymdef.h.// but with a leading 'XK_'.//..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Cambodia";. .// there are four levels defined:.//.//

C:\Program Files (x86)\Xming\xkb\symbols\is-RSJII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3047
Entropy (8bit):	4.218488927286778
Encrypted:	false
SSDEEP:	48:aEEDD56xCrLRy1GNjsbcrpuxhYndjzJVZoo6flzTZrdhfA/yurvhnEiIwFFGVmdr:HKwCrVy1GNjsgluxhYntzJ7oo6flzTZK
MD5:	6B56923E4D6059E6189A833C9F0F18B8
SHA1:	9E6EFDEE77411720C4E3C4F6D90AD5DB39ADFDBF
SHA-256:	297F056DB8AC631C4DA4F562F57160594C7579DE670177E580F4DC13176E5CC7
SHA-512:	3EBA34458C8787D18777CA46208054D691F86B96F2D0CB6EE80DE279ED60F8DDEDCA6EE9E50BEAE312EDE3836BB6FFE9E551BE83893A7F1E5A3ECED777F0A336
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/np,v 1.2 2006-10-03 22:33:37 svu Exp $..// based on a keyboard map from an 'xkb/symbols/dev' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/dev,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Nepal";..// `,1,2,3,4,5,6,7,8,9,0,-,=.. key <TLDE> { [ 0x100093D,0x100093C ].};. key <AE01> { [ 0x1000967. ..].};. key <AE02> { [ 0x1000968...].};. key <AE03> { [ 0x1000969 . ..].};. key <AE04> { [ 0x100096A . ..].};. key <AE05> { [ 0x100096B . ..].};. key <AE06> { [ 0x100096C . ..].};. key <AE07> { [ 0x100096D ].};. key <AE08> { [ 0x100096e . ..].};. key <AE09> { [ 0x100096F. ..].};. key <AE10> { [ 0x1000966,0x1000970..].};. key <AE11> { [ minus, 0x1000952 ..].};. key <AE12> { [ equal, 0x100200C ..].};..// q,w,e,r,t,y,

C:\Program Files (x86)\Xming\xkb\symbols\is-RUP5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	5.111356837489246
Encrypted:	false
SSDEEP:	48:qanNvH5P2VGyG6Mj1+Jd6kwC7Cg3MLFao4HOlxJiYnWqQaIpOCTaIPV163:q2Nh+VGRjed37CZAJHOnJlnFSOC1163
MD5:	A946F3E807742D2C0FC63F179A89BC2C
SHA1:	BF0E25D08A229C57B5CAD44765157D9F59119D7E
SHA-256:	8DB245607B6D1FE1B77A2401FA9D7BE881058CD097191338FE9D737E045F4D68
SHA-512:	C97D8C9B455A1FAF949700FCAFEFA0677DF923A7AD0056D3B3BFEE61C367B52242E85BB36636AAF18B0C218E9C19067AF8A92C4F537E9AF1B059B9E6E53E3E36
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lk,v 1.8 2006-09-04 20:25:10 svu Exp $..// X Keyboard Extension file for Sinhala (Sri Lanka) (2004-04-22).// Maintainer : Harshula Jayasuriya <harshula@gmail.com>.// Last Updated: 2006-07-14.// This is a static phonetic mapping for a standard US-English keyboard.// (qwerty).// http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html..// Repaya, Rakaransaya and Yansaya aren't inserted with A-r, R and Y,.// respectively. The problem lies with the XKB infrastructure which.// only allows a one-to-one mapping of keycodes to Unicode codepoints..// Unfortunately, the 3 mentioned glyphs actually consists of 3.// Unicode codepoints each. The resultant is that the user must.// manually construct the glyph by typing each of the 3 codepoints..// Alt-backslash represents the 'join' key, this requires.// two codepoints, hence it also has to be manually constructed..// Similarly, Alt-Shift-backslash representing the 'touch' key requires.

C:\Program Files (x86)\Xming\xkb\symbols\is-SHM8D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	45527
Entropy (8bit):	4.5588646690006875
Encrypted:	false
SSDEEP:	768:DlQG8ecQ0ZxyLd08Ao2o4sOs46okfknaqDG9HmtfUQL0k9:DlQGXIVo1Os46okf1ZQfUg
MD5:	B6FB2453404904C065828E8C26FF3CD0
SHA1:	77403EA049D870CAB7B607E0BE4596E1227E4D28
SHA-256:	422DBF1C434069F683533EAF75CD1BA3F64EB133AEF74C4E342595C5FFADC127
SHA-512:	05A42E228D3B0767B39BB057BE3B1CEEC84801914FD67EE3E17D52F409C68571E8CE59CD1AF228AF3B26556FDA7C7FC41344EAFB041B319D90E3A689ED1178F7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/fr,v 1.16 2007-01-04 23:31:30 svu Exp $..// based on a keyboard map from an 'xkb/symbols/fr' file.//.// $XFree86: xc/programs/xkbcomp/symbols/fr,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="France";.. key <AE01>.{ [ ampersand, 1, onesuperior, exclamdown ].};. key <AE02>.{ [ eacute, 2, asciitilde, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, braceleft, dollar ].};. key <AE05>.{ [ parenleft, 5, bracketleft, threeeighths ].};. key <AE06>.{ [ minus, 6, bar, fiveeighths ].};. key <AE07>.{ [ egrave, 7, grave, seveneighths ].};. key <AE08>.{ [underscore, 8, backslash, trademark ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, plusm

C:\Program Files (x86)\Xming\xkb\symbols\is-SJTS1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2870
Entropy (8bit):	4.688140216816754
Encrypted:	false
SSDEEP:	48:q83V/1uMnp4nSOt/r6lFrZm3JM9GA8sZ8c:q83F1xnp4Bt/4FOJMgW
MD5:	93C0CEC1FDD2559D4E44248860F7E893
SHA1:	990AE8654BDA51B10C8ADC0BA8738EA8C052A1D0
SHA-256:	C1012303C7B936A71642B4FE911C23893783BC01AE3FC61C3330E1CBEEE70C1A
SHA-512:	3CE3FAAE61BBF962FB5E89E25070066084D4160D42160F82D9E2155E6518A2C358EE307FB66F561E971C4CDF30764E5A4EE6BDEA5774C1878AD12292C4CA6D4F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/la,v 1.5 2006-09-04 20:25:10 svu Exp $..// $XConsortium: lo 2002/11/28 $.//.// Lao keymap, by Anousak Souphavanh <anousak@muanglao.com>..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a Lao keyboard. // This keymap uses the Lao keyboard standard [kind of] widely used inLaos.. name[Group1]= "Laos";.. // Alphanumeric section. key <TLDE> { [ 0x100200D...]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE02> { [ 0x1000e9f, 0x1000ed2.]};. key <AE03> { [ 0x1000ec2, 0x1000ed3.]};. key <AE04> { [ 0x1000e96, 0x1000ed4.]};. key <AE05> { [ 0x1000eb8, 0x1000ecc.]};. key <AE06> { [ 0x1000eb9, 0x1000ebc.]};. key <AE07> { [ 0x1000e84, 0x1000ed5.]};. key <AE08> { [ 0x1000e95, 0x1000ed6.]};. key <AE09> { [ 0x1000e88,

C:\Program Files (x86)\Xming\xkb\symbols\is-SSBJH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2737
Entropy (8bit):	4.786372693980445
Encrypted:	false
SSDEEP:	48:JKuhno+MccG6S7I66BLdzoBjYQjvAMWbZ91ghr:4e+ccuqBLdze0wvs1ghr
MD5:	9E57827B4B20DB2FDD2A40AB7DB2D8FF
SHA1:	43779688F17407B36467BF21C2E4824DF8AE41D9
SHA-256:	BC13DC7F02E99BC09C0EAE4DCB6325EFC1C576B5CD821A4489B4C42DC85F9AB9
SHA-512:	12CB1F646DEABC8809F698C419F339BF49782CBBB25118E8BB70137B374236516BF98AABE0718567FC6AB4E72C3A9F5325CFDA48D8D62A9D3E9390D22AC2C512
Malicious:	false
Preview:	.// based on .// "a very simple Brasilian ABNT2 keybaord.// by Ricardo Y. Igarashi (iga@that.com.br).// Adds suport for dead-keys in I18N applications.// by Conectiva (http://www.conectiva.com.br)".//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/br,v 1.10 2006-11-20 19:18:02 svu Exp $.// $XdotOrg: xc/programs/xkbcomp/symbols/br,v 1.1.4.3 2004/03/05 13:41:32 eich Exp $.// $XFree86: xc/programs/xkbcomp/symbols/br,v 1.3 2003/04/19 12:22:11 pascal Exp $..default.xkb_symbols "abnt2" {.. include "latin". name[Group1]="Brazil";.. key <AE02>.{ [ 2, at, twosuperior, onehalf ].};. key <AE03>.{ [ 3, numbersign, threesuperior, threequarters ] };. key <AE04>.{ [ 4, dollar, sterling, onequarter ].};. key <AE05>.{ [ 5, percent, cent, threeeighths ].};. key <AE06>.{ [ 6, dead_diaeresis, notsign, diaeresis ].};. key <AE12>.{ [ equal, plus, section, dead_ogonek ].};.. key <

C:\Program Files (x86)\Xming\xkb\symbols\is-TNAIG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7043
Entropy (8bit):	5.241023810605663
Encrypted:	false
SSDEEP:	96:XeSRj62t6XTP6P8cjVA+hcKTuyGv0aY70OpMiQmg/bIun4LAqIumBBeEWw:PRW28XWEcnPSzafMiQmgRn4LAqWcw
MD5:	22AD5119A9F225C1B532377B2A252698
SHA1:	3B06329B05266E709A4818DB5B623A989AFD2BD6
SHA-256:	D0ABB1FABD391E2D1D88B4C654F943B9C0B4CF793D7E584419406F05F19AEC09
SHA-512:	0C02C847249E3715D1890560BA77ED702794F2DA9B97AC7711111AD074FE834E7A1B1A7C9AFDE0FD5EC26B1605AA02EDE8C38679A55EE949EBAF1DFF6434C68F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/is,v 1.8 2006-10-01 21:35:25 svu Exp $..// based on.// XKB keyboard by Hrafnkell Eiriksson - hkelle@rhi.hi.is.// fixes by Olafur Osvaldsson - oli@isnic.is.//.// $XFree86: xc/programs/xkbcomp/symbols/is,v 1.3 2002/11/26 01:57:25 dawes Exp $..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Iceland";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [odiaeresis, Odiaeresis, backslash, questiondown ].};. key <AE12>.{ [ minus, underscore, ccedilla, dead_ogonek ].};.. key <AD11>.{ [ eth, ETH, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [apostrophe, question, asciitilde, dead_macron ].};.. key <AC10>.{ [ ae, AE, asciicircum, dead_doubleacute ] };. key <AC11>.{ [dead_acute, Adiaeresis, dead_circumflex,

C:\Program Files (x86)\Xming\xkb\symbols\is-UKQHU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	822
Entropy (8bit):	4.99471794445411
Encrypted:	false
SSDEEP:	24:YaX+a60z56aZI76BMMZXz6NZoC6BlBZI5R:PzZLYmvWR
MD5:	A3EEB6C53D58880DADA061270259904E
SHA1:	995806C5A1106511D416A61512470F50DFB02D7B
SHA-256:	3084E9C43381A0A6E8DBDA59C3A5DD1F72262C86BDB57F5F2D99F4DB2AD6FD4C
SHA-512:	7E34E976CC97F684D937A9C14BB0F2B5CE4DA7FB0D9319A948DF27908ABCCADCF54D38FE9CB1942483EB771997DD12587C38FCA61225E7566356EACE5424D8A7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/si,v 1.8 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Slovenia";.. include "cs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Slovenia - US keyboard with Slovenian letters";.. include "cs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Slovenia - Use guillemets for quotes";.. include "cs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Slovenia - Use Slovenian digraphs";.. include "cs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Slovenia - US keyboard with Slovenian digraphs";.. include "cs(latinunicodeyz)".};.

C:\Program Files (x86)\Xming\xkb\symbols\is-V1AR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	14453
Entropy (8bit):	4.376322800565033
Encrypted:	false
SSDEEP:	384:/5Foh8iknRgNk5LpkuryxQlZM8R1Jr4hrU/2BnhZVS8CoRC1QDkqBA2G:22ZOlxO
MD5:	3A9B8C955E9F12500915C0F5D51BAE47
SHA1:	D63073D626E0883796B6AA40DEA198F1E0D7B1B2
SHA-256:	836E7ACF272A70BAEDE91F6BB5E34E73BA7861E958BF0F49E70A833FAC13F212
SHA-512:	E2A5543D858655F71965EC140A9971CDAE72FE9FCC9BC248832515C79D79BAB4FEB97B1126F6C0B71AC137DDA64055962487807272D839540690537115F588C8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ge,v 1.6 2007-04-11 22:30:54 svu Exp $..// Georgian Keyboard Layouts by Aiet Kolkhi <aietkolkhi@gmail.com>.// Full layout descriptions available at http://www.gakartuleba.org/layouts/.//.// This includes the following keyboard layouts: Georgian QWERTY; Georgian Ergonomic;.// Georgian MESS; Georgian AZERTY Tskapo; Georgian Russian..//.// Layouts include Georgian Mkhedruli alphabeth; most layouts also include some special.// and ancient characters (like Fi, Yn, Elifi, Turned Gan and Ain). Layouts do not.// include Georgian Asomtavruli or Georgian Khutsuri alphabeths which are also present.// in Unicode..//.// Georgian Typewriter no longer supported, as it is no longer used in Georgia..//.// some layouts based on Georgian keyboard map, in the so called "latin" layout..// 1999, Pablo Saratxaga <srtxg@chanae.alphanet.ch>.//..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Georgia";.. key <TLDE> { [ 0x010020

C:\Program Files (x86)\Xming\xkb\symbols\is-VEJUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	87225
Entropy (8bit):	4.8017961794270025
Encrypted:	false
SSDEEP:	1536:TsVZfVhQ4J/B+blBGUBmuU7oTmbtH7IeAc9tQ2z+Y3nnTRKyJVnfLZ4gojYh:4iYQI
MD5:	B47ECB2E870F80F88D3EFBBAA262DBC8
SHA1:	BE5AE74031834A9A7E76F982979A12CF6BD4869D
SHA-256:	A8D86BCB26EA47804A518FD1B75461C17703F2CE46EED4B853D3570DFE7A7FBA
SHA-512:	099C51028E4BD9C548688DA92EF6BD8DB83CBF8705F90427340AFC6D29D7822ED2D06AD0ED84A37439643FE6C5AFAA0E1D0C0CC1845B85F9B34D7530D7D209C1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/inet,v 1.52 2007-04-23 22:09:07 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/inet,v 1.38 2004/01/17 14:59:37 pascal Exp $..// EAK (Easy Access, Internet, Multimedia, PDA) keyboards.// Copyright (C) 2002 Stanislav Brabec <sbrabec@suse.cz>.//.// Based on LinEAK project.// LinEAK - Linux support for Easy Access and Internet Keyboards .// Copyright (C) 2001, 2002 Mark Smulders <Mark@PIRnet.nl>..// Usage in XF86Config:.// Option "XkbLayout"."my_kb_layout".// Option "XkbVariant"."my_kb_variant".// Option "XkbModel"."my_eak_type".// Option "XkbRules"."xfree86".// Simple command line usage:.// setxkbmap 'my_kb_layout' -variant 'my_kb_variant' -model 'my_eak_type'..// All keyboards listed here should be also mentioned in.// xc/programs/xkbcomp/rules/xfree86, xfree86.lst and xfree86.xml...// Evdev Standardized Keycodes.partial alphanumeric_keys.xkb_symbols "evdev" {. key <MUTE> { [ XF86AudioMute ] };. ke

C:\Program Files (x86)\Xming\xkb\symbols\is-VIO51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	5.023060894520747
Encrypted:	false
SSDEEP:	96:njkrXyqtO2UGBfmKNYD6rqzUB+XB/z3I1F6pR47l6iBT:jkLdtO2UWDYDLzFB/z3S6pAlRh
MD5:	2FEFBD70CEFDAEC6B2D8DE926ADE6868
SHA1:	6A70C9A31DA0E6C2FB6101D4A71474ECEABAFBC9
SHA-256:	EF067222651DFB2C857D23C07F105487882D4A6AB063380FF61BDD8F3B1D781A
SHA-512:	736B33D70271678876652C40EAC9FC52976189D4053C457F36254F59F2AB567423FC6D758F29F176D92A1CDC060AE92FE96B54DF118C478626D2EEF38ABE46D1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/jp,v 1.13 2006-10-29 14:23:23 svu Exp $..// based on:.// symbols for a Japanese 106 keyboard(by tsuka@kawalab.dnj.ynu.ac.jp)..// jp106 keyboard map.partial default alphanumeric_keys.xkb_symbols "106" {. include "jp(common)". name[Group1]= "Japan";.. key <AE13> { [ backslash, bar .] };.};..// common latin part of jp keyboard map.partial hidden alphanumeric_keys.xkb_symbols "common" {. // "Common" keys for jp 106/109A layout.. // Alphanumeric section. key <HZTG> {..type[Group1]="PC_SYSRQ",..symbols[Group1]= [ Zenkaku_Hankaku, Kanji ]. };.. key <AE01> { [ 1, exclam..] };. key <AE02> { [ 2, quotedbl..] };. key <AE03> { [ 3, numbersign.] };. key <AE04> { [ 4, dollar..] };. key <AE05> { [ 5, percent..] };. key <AE06> { [ 6, ampersand..] };. key <AE07> { [ 7, apostrophe.] };. key <AE08> { [ 8, parenleft..] };. key <AE09> { [ 9, parenright.] };. key <AE10> { [ 0, asciitilde.] };. key <AE

C:\Program Files (x86)\Xming\xkb\symbols\is-VJAM1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	600
Entropy (8bit):	5.2421288080410875
Encrypted:	false
SSDEEP:	12:jLsZaBue0Ax8W7TQ70hjXzva32by/DnRS7Pe1LVd6Wv:YaoGx8UEWvO2+DnRSbiVUWv
MD5:	583CCE05C29339A2A9BE79E84693862A
SHA1:	3619C6309F1AF4D5DC71E831761C504CB5B3DD31
SHA-256:	B44BE9A2470E17AD7FBA5C0CCE2D3F397096009D2FF643409E636A3658CE7530
SHA-512:	4D5F79EE998769610C44C31F0EEFD621E07F5EF9ABA0EE175793BD325DCDDF14D68AD60B8AA76C864CB4F77E903FB9C00B1AA8FD7007158132C548921353CE37
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/level5,v 1.3 2006-06-13 21:16:52 svu Exp $..// these variants assign various XKB keycodes to ISO_Level5_Shift so that.// the third shift level can be reached.//.// $XFree86: xc/programs/xkbcomp/symbols/level3,v 1.7 2003/09/08 14:25:32 eich Exp $.//..// using the level(switch) map, the right Control key temporarily.// chooses the fifth shift level (until it is released)..partial modifier_keys.xkb_symbols "rctrl_switch" {. key <RCTL> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ 0xfe11 ]. };. modifier_map Mod3 { 0xfe11 };.};.

C:\Program Files (x86)\Xming\xkb\symbols\is-VKG7H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.674894388090002
Encrypted:	false
SSDEEP:	48:L3YHfvzNxibE4Sv+WNKhecQMsRnAaWsOfdjm0ir4HhXyhwzGz7c+VKnYs+O1EjEy:LIHfvzH8CMsl3D0H5JGzgc+Ys0cOIY1
MD5:	41A9FCC33E0BC87CF7342C09C9443642
SHA1:	649420182EF3E42E2116698741FAE900E3F389B8
SHA-256:	01F5A47519725EC931BE221E8D5A0291B0420A4A550DA7EA57617885BB1990F8
SHA-512:	1F462DC0A44F8C95D133A17F2D05DA20FD25C59C07F9B9B9E3414F59E63FBA138F7B36B52B4DAC62CBAB35169F94A9EE68EC4621F6BB4FEEBD20970F25CFE9F1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/bt,v 1.3 2006-10-03 22:33:37 svu Exp $.//.// Dzongkha / Tibetan layout for Bhutanese keyboard.//./////////////////////////////////////////////////////////////////.//.// Based on the official layout for Dzongkha.// approved by the Department of Information Technology &.// Dzongkha Development Authority of the Government of Bhutan.//.// Copyright (C) 2004, Gregory Mokhin <mokhin@bog.msu.ru>.///////////////////////////////////////////////////////////////// .// Version 0.97 2004-01-09 Layout map provided by Chris Fynn.// Version 1.0 2004-07-29 Some correction by Pema Geyleg <pema_geyleg@druknet.bt>./////////////////////////////////////////////////////////////////..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Bhutan";.. key <TLDE> { [ 0x1000F09, 0x1000F0A, 0x1000F6C, 0x1000F6D ].};. .// numbers e.a.. key <AE01> { [ 0x1000F21, 0x1000F04, 1, exclam ].};. key <AE

C:\Program Files (x86)\Xming\xkb\symbols\is-VRDHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9186
Entropy (8bit):	4.559427740814211
Encrypted:	false
SSDEEP:	96:RKdUHK7JB1gRBgsoEms7sT0dSoMsvKxsC6:RKeq9jg3gs/7wNo4uC6
MD5:	71D83DE032A2E11EF2355137393698F7
SHA1:	24DFD18C44C058435B407518409A64621E3C9F4B
SHA-256:	E48661B90B4325AE26E4D4F71F41F6230E8A0BA6EE90519AE1B5E2B88A46F3E9
SHA-512:	61D6389EC3C2810E9DEFABB0259DFDB4D0D507FC83FAC25D7B6B9BA2A4BC1E4524EC509EC7E18132162CEBC5C26865D0FBC45E425DF80ECAC11452E7BEE7F9BF
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ua,v 1.7 2005-07-19 23:03:51 svu Exp $..// based on.// ukrainian standard keyboard .// AEN <aen@logic.ru> & Leon Kanter <leon@geon.donetsk.ua>.// Last Changes 2003/09/03 by Andriy Rysin <arysin@yahoo.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/ua,v 1.4 2003/05/15 11:29:47 pascal Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Ukraine";.. key.<TLDE> {.[ apostrophe,.asciitilde.].};. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numbersign.].};. key.<AE04> {.[..4, asterisk.].};. key.<AE05> {.[..5,. colon.].};. key.<AE06> {.[..6,. comma.].};. key.<AE07> {.[..7,. period.].};. key.<AE08> {.[..8,. semicolon.].};. key.<AE09> {.[..9,. parenleft.].};. key.<AE10> {.[..0,.parenright.].};. key.<AE11> {.[. minus,.underscore.].};. key.<AE12> {.[. equal,. plus.].};.. key.<AD01>

C:\Program Files (x86)\Xming\xkb\symbols\is-VSEOM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	5.227751039550581
Encrypted:	false
SSDEEP:	192:hUZUC3JFJUmHUXIgpZ43cyTCPHL0CT2U0Gwja6H00H:yqCZFam0X/H0CTD0RJHJH
MD5:	449CC86B2DDE752751B24BDB2E4E1FEF
SHA1:	8F9AD3E35819E093D6682F699E92ED0BDE82797D
SHA-256:	DC44808DB54986F977B82EF5A5A703F9AE9B1104AEDCB174170BFA68055EF164
SHA-512:	88DEFA8F633D3CE28A153E8001B277820180C8BED892398F02038FB926D53A80C8BB4FAABB3D0BF64ED40C24644F06F4CE4523787203D12092EBEB3F81EEFE58
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/group,v 1.10 2006-10-16 19:27:05 svu Exp $.// $Xorg: group,v 1.3 2000/08/17 19:54:43 cpqbld Exp $.// using the group(switch) map, the right alt key temporarily chooses .// the second keyboard group (until it is released)..//.// $XFree86: xc/programs/xkbcomp/symbols/group,v 3.9 2003/12/30 13:26:25 pascal Exp $.partial modifier_keys .xkb_symbols "switch" {. key <RALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};..// using the group(lswitch) map, the left alt key temporarily chooses.// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "lswitch" {. key <LALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};...// using the group(win_switch) map, both Windows'logo keys temporarily.// choose the second keyboard group (until release). If you use this.// map, you would declare you keyboard as pc101 or pc102 instead of.// pc104 or

C:\Program Files (x86)\Xming\xkb\symbols\it (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5523
Entropy (8bit):	4.63251957097356
Encrypted:	false
SSDEEP:	96:pvy374TMxc1raH2Fxqvs1BEiv3SThnvlX1Y+:pq374Qxc1O6xTjE23StnN1t
MD5:	745C457315B9CFB6EBC470B2F0E6727B
SHA1:	10BF305541D4798ABA89321748C3F4452AAC3535
SHA-256:	708D5B7FCF4D0C7001D96CC885F787301E34562AE7B8D8F177FD32BFA5C71316
SHA-512:	16F742AF87FC9F7B8B012E4D50139EC7861110BB5701F292888A7720D68FBD76845449B7C8A8B286356F6E5B8352CF8F2ADAE9E41FCAE0A76C2145E2A1F352F9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/it,v 1.10 2006-10-15 21:17:04 svu Exp $..// based on a keyboard map from an 'xkb/symbols/it' file.// 17 May 2003 Modified by Sebastiano Vigna (vigna@dsi.unimi.it).//.// $XFree86: xc/programs/xkbcomp/symbols/it,v 1.4 2003/04/19 12:22:12 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Italy";.. key <TLDE>.{ [ backslash, bar, notsign, brokenbar ].};.. key <AE02>.{ [ 2, quotedbl, twosuperior, dead_doubleacute ] };. key <AE03>.{ [ 3, sterling,threesuperior, dead_tilde ].};. key <AE04>.{ [ 4, dollar, onequarter, oneeighth ] };.. key <AE10>.{ [ 0, equal, braceright, dead_ogonek ] };. key <AE11>.{ [apostrophe, question, grave, questiondown ].};. key <AE12>.{ [ igrave, asciicircum, asciitilde, dead_circumflex ] };.. key <AD11>.{ [ egrave, eacute, bracketleft,

C:\Program Files (x86)\Xming\xkb\symbols\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	5.023060894520747
Encrypted:	false
SSDEEP:	96:njkrXyqtO2UGBfmKNYD6rqzUB+XB/z3I1F6pR47l6iBT:jkLdtO2UWDYDLzFB/z3S6pAlRh
MD5:	2FEFBD70CEFDAEC6B2D8DE926ADE6868
SHA1:	6A70C9A31DA0E6C2FB6101D4A71474ECEABAFBC9
SHA-256:	EF067222651DFB2C857D23C07F105487882D4A6AB063380FF61BDD8F3B1D781A
SHA-512:	736B33D70271678876652C40EAC9FC52976189D4053C457F36254F59F2AB567423FC6D758F29F176D92A1CDC060AE92FE96B54DF118C478626D2EEF38ABE46D1
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/jp,v 1.13 2006-10-29 14:23:23 svu Exp $..// based on:.// symbols for a Japanese 106 keyboard(by tsuka@kawalab.dnj.ynu.ac.jp)..// jp106 keyboard map.partial default alphanumeric_keys.xkb_symbols "106" {. include "jp(common)". name[Group1]= "Japan";.. key <AE13> { [ backslash, bar .] };.};..// common latin part of jp keyboard map.partial hidden alphanumeric_keys.xkb_symbols "common" {. // "Common" keys for jp 106/109A layout.. // Alphanumeric section. key <HZTG> {..type[Group1]="PC_SYSRQ",..symbols[Group1]= [ Zenkaku_Hankaku, Kanji ]. };.. key <AE01> { [ 1, exclam..] };. key <AE02> { [ 2, quotedbl..] };. key <AE03> { [ 3, numbersign.] };. key <AE04> { [ 4, dollar..] };. key <AE05> { [ 5, percent..] };. key <AE06> { [ 6, ampersand..] };. key <AE07> { [ 7, apostrophe.] };. key <AE08> { [ 8, parenleft..] };. key <AE09> { [ 9, parenright.] };. key <AE10> { [ 0, asciitilde.] };. key <AE

C:\Program Files (x86)\Xming\xkb\symbols\keypad (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12601
Entropy (8bit):	5.281484876887796
Encrypted:	false
SSDEEP:	192:E7GM+UPflHk4W98zBgMXjgefwKg17gUM5BwgDUQSk9Dvhr:fwzzeg+kvr
MD5:	6FE3F5ED22137764370BF0F0A9DF3BDC
SHA1:	C111E5B8F04EEC78D1353F9F2D6F116443E6CD5F
SHA-256:	F9F4C3516B012AE679CC54331C372BC5A434A8D760E5C159CE0879CC9A805AB6
SHA-512:	EE5950C900DE241CE3B15E467FA5D3A68AAF9BE4DDA0D637F1B73F311FCC875E92705BEDA70C4BB107D0D5CF9326D492571FBC04A352D81AE468F45942B08188
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/keypad,v 1.4 2006-09-24 20:07:00 svu Exp $.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_Home.],.overlay1=<KO7>.};. key <KP8> {.[ KP_Up.],.overlay1=<KO8>.};. key <KP9> {.[ KP_Prior.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_Left.],.overlay1=<KO4>.};. key <KP5> {.[ KP_Begin.],.overlay1=<KO5>.};. key <KP6> {.[ KP_Right.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_End.],.overlay1=<KO1>.};. key <KP2> {.[ KP_Down.],.overlay1=<KO2>.};. key <KP3> {.[ KP_Next.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_Insert.],.overlay1=<KO0>.};. key <KPDL> { .[ KP_Delete.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. k

C:\Program Files (x86)\Xming\xkb\symbols\kg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.412125756997269
Encrypted:	false
SSDEEP:	24:YaoHO+NSvoT6UkvG7s4GMa7FYkOOCOm7FK8TpAnC:xGyoZkvG7s4GM1kOOCOaK8TyC
MD5:	9B14FC268EDE4B0CC634DFD0472D2896
SHA1:	CDE58620C1D55CBE61C43A39F2004ADA8BB624CA
SHA-256:	DB2D25CDFFFDC8FAC50874352604ADFDEF746D406A50EFA0506CF53370B0AA87
SHA-512:	480C50E94073A0D5B46133EEA3F8ED368DF9D6B074415CC657EB7D8F00D8D753B21C99EF1607650A3A9C3ED7430355FC04E9C4D55972EC7C570F1C2F08981A73
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kg,v 1.3 2004-12-22 22:55:55 svu Exp $..// based on.// russian standard keyboard.// Yury Fedorov <yury-fedorov@prime-task.com>.// Last Changes 2004/10/25 by Yury Fedorov <yury-fedorov@prime-task.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/kg,v 0.0 Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "ru(winkeys)".. name[Group1]= "Kyrgyzstan";.. key.type[group1]="FOUR_LEVEL_ALPHABETIC";.. key.<AC07> { [ .Cyrillic_o,..Cyrillic_O,......Cyrillic_o_bar, .Cyrillic_O_bar.] };. key.<AD03> { [ .Cyrillic_u,..Cyrillic_U,....Cyrillic_u_straight,.Cyrillic_U_straight.] };. key.<AD06> { [ .Cyrillic_en, ..Cyrillic_EN,.....Cyrillic_en_descender,.Cyrillic_EN_descender.] };.... include "level3(ralt_switch)".};..

C:\Program Files (x86)\Xming\xkb\symbols\kh (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4597
Entropy (8bit):	4.941956117710937
Encrypted:	false
SSDEEP:	96:JjVJP53sPAeBQyTIEeoLvjez4FDlHKP+dW4w:7H8PAuQ5E57jeslqP34w
MD5:	D9C679DF7AB3637C8A560772B3C7BBB1
SHA1:	01F72B213755C8551030C19D5F7AEC6E6EE479BE
SHA-256:	82AA2A6C7A6ADC86CD22FB698FA4BC1B8E672C4B93BB2CECB30DFD40489C0AC2
SHA-512:	08A1AF3BD736313CFA05EEC87060B5A2AE3725F723243B463773232C0B04A02A5CD4BE71421BDD19F8EE4B6059ECC33E6B129EE6DFCD553E0AE37C62B46C262B
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kh,v 1.2 2005-12-31 02:02:46 svu Exp $.//.// khmer unicode keyboard for XFree86 4.3 or XOrg .// (might work with older versions, not tested).//.// layout defined by National Information Communications Technology Development Authority (NiDA).// http://www.nida.gov.kh.//.// version: 1.0.1.//.// date: 14.09.2005.//.// author: Jens Herden (jens at khmeros.info).//.//.// understanding the symbols:.//.// 0x100yyyy = unicode, yyyy is hexcode.// codes that are not assigned in unicode (0x10017fb-0x10017ff),.// are used to make compositions for special vowels.//.// voidsymbol = no symbol for this combination.//.// all other symbol are defined in: /usr/X11/include/X11/keysymdef.h.// but with a leading 'XK_'.//..partial default alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Cambodia";. .// there are four levels defined:.//.//

C:\Program Files (x86)\Xming\xkb\symbols\kr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	698
Entropy (8bit):	5.084666819383202
Encrypted:	false
SSDEEP:	12:jLsZaBM1J483K160d3uFTldH1y3aTJk160dBuFTlAIfvy3aTB2aT9XgRb2dyb56W:YaeDW60des60jeffcaI5JKZ4Vv
MD5:	4DA445213DC6B490C79CBC622B0A07DA
SHA1:	BF6357F695EB1B6F1BF497C59202FC1C7A25DA16
SHA-256:	0C9B0B14F2380958B973CDE9944B8F770F26AF583CECF221A5A9B29C8813115F
SHA-512:	C7D1EA486C9221306DB4394F7C6E3F7785590741F83C0911698BA410983FA9786474CC330D2F67BAA12EB9DCF467973332BFEE19D07ACB1096204D74E1C9C708
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kr,v 1.4 2006-10-11 19:32:35 svu Exp $.//..default alphanumeric_keys.xkb_symbols "kr106" {. name[Group1]= "Korea, Republic of";. include "us". include "kr(koreankeys)".};..alphanumeric_keys.xkb_symbols "kr104" {. name[Group1]= "Korea, Republic of - 101/104 key Compatible";. include "us". include "kr(koreankeys)". include "kr(koreankeys_raltctl)".};..partial hidden function_keys.xkb_symbols "koreankeys" {. key <K72> { [ Hangul ] };. key <K71> { [ Hangul_Hanja ] }; .};..partial hidden function_keys.xkb_symbols "koreankeys_raltctl" {. key <RALT> { [ Hangul ] };. key <RCTL> { [ Hangul_Hanja ] }; .};..

C:\Program Files (x86)\Xming\xkb\symbols\kz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	11533
Entropy (8bit):	4.302738376623475
Encrypted:	false
SSDEEP:	192:c8seSd9mrCCcIbvnR/SZe+dKsQNLmbQkY23e+dKsYNLCbnJY24:Jse09me1WvRQeQKsyLQt73eQKs6LcJ74
MD5:	208753E56C714EE6E5282471457330FC
SHA1:	2669E981D272BB87303E691CD5E58F20246AEDF4
SHA-256:	6A254D248128833C5D63AE6EB2D784D46F9E81564363EEEA7A3A364D4A061574
SHA-512:	9353C3A117531F2E5635EDBA7987B3BD9615F94D0E1D159CCF3ACEA8C9B93BAB3ADBF58FACF87F25D4946AD01C5DAC42030558FB6065CF9289F3D6A2E7042444
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/kz,v 1.2 2005-09-22 22:09:38 svu Exp $..// Based on http://www.sci.kz/~sairan/keyboard/kzkbd.html.// Baurzhan Ismagulov <ibr@radix50.net>.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/ru,v 1.4 2003/05/05 12:11:10 pascal Exp $..// TODO:.// 1. AltGr with TLDE and LSGT..// 2. Dead key for ruskaz and kazrus..// 3. Ctrl + <key>..// 4. Alt-Tab...// RST KazSSR 903-90.// levels 3 and 4 are non-standard extensions.partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1] = "Kazakhstan";..key.type[group1] = "FOUR_LEVEL";.. key <TLDE> { [ parenleft, parenright, Cyrillic_io, Cyrillic_IO ] };. key <AE01> { [ doublelowquotemark, exclam ] };. key <AE06> { [ comma, semicolon ] };. key <AE07> { [ period, colon ] };. key <BKSL> { [ backslash, slash ] };. key <AB10> { [ numerosign, question ] };. key <LSGT> { [ less,

C:\Program Files (x86)\Xming\xkb\symbols\la (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2870
Entropy (8bit):	4.688140216816754
Encrypted:	false
SSDEEP:	48:q83V/1uMnp4nSOt/r6lFrZm3JM9GA8sZ8c:q83F1xnp4Bt/4FOJMgW
MD5:	93C0CEC1FDD2559D4E44248860F7E893
SHA1:	990AE8654BDA51B10C8ADC0BA8738EA8C052A1D0
SHA-256:	C1012303C7B936A71642B4FE911C23893783BC01AE3FC61C3330E1CBEEE70C1A
SHA-512:	3CE3FAAE61BBF962FB5E89E25070066084D4160D42160F82D9E2155E6518A2C358EE307FB66F561E971C4CDF30764E5A4EE6BDEA5774C1878AD12292C4CA6D4F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/la,v 1.5 2006-09-04 20:25:10 svu Exp $..// $XConsortium: lo 2002/11/28 $.//.// Lao keymap, by Anousak Souphavanh <anousak@muanglao.com>..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a Lao keyboard. // This keymap uses the Lao keyboard standard [kind of] widely used inLaos.. name[Group1]= "Laos";.. // Alphanumeric section. key <TLDE> { [ 0x100200D...]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE02> { [ 0x1000e9f, 0x1000ed2.]};. key <AE03> { [ 0x1000ec2, 0x1000ed3.]};. key <AE04> { [ 0x1000e96, 0x1000ed4.]};. key <AE05> { [ 0x1000eb8, 0x1000ecc.]};. key <AE06> { [ 0x1000eb9, 0x1000ebc.]};. key <AE07> { [ 0x1000e84, 0x1000ed5.]};. key <AE08> { [ 0x1000e95, 0x1000ed6.]};. key <AE09> { [ 0x1000e88,

C:\Program Files (x86)\Xming\xkb\symbols\latam (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2379
Entropy (8bit):	4.916069733228254
Encrypted:	false
SSDEEP:	48:qFPOADnWhW0hnEr/6vYlFoTTxz0bzv+fSHLEN/61YLq7:qg3hXpE76Qfbv9LEx61Y27
MD5:	1580CEC4F41DAED2139FC529947D0C84
SHA1:	9BC681BB1CCB0DA7FF26742FE92E57245D66D581
SHA-256:	515A231FAD98C8CB200E97612B5F101098BC2A25AB0DEDD3FFBA88E6FC01E041
SHA-512:	45148E8D1DA13436895E9340A04697A76C7E1B819DDD60EF070FBC156E293761D500FF55A1AE6EC12969B571135110F46DBE87206F07F568695680790161BC46
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/latam,v 1.5 2005-01-16 02:18:20 svu Exp $..// based on a keyboard.// Modified for a real Latin American Keyboard by Fabian Mandelbaum.//.// $XFree86: xc/programs/xkbcomp/symbols/la,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Latin American";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, numbersign, periodcentered, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [questiondown, exclamdown, dead_cedilla, dead_ogonek].};.. key <AD11>.{ [dead_acute, dead_diaeresis, dead_diaeresis, dead_abovering ].};. key <AD12>.{ [ plus, asterisk, asciitilde, dead_macron ].};..

C:\Program Files (x86)\Xming\xkb\symbols\latin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8650
Entropy (8bit):	4.370311226364933
Encrypted:	false
SSDEEP:	96:qnmxWqf1QxEt/Vzr+4kzi26WGQVW4hjkLz77+Uo7Nj/sJMwTxVJh7xmYgY5uT7:qngdf2xEBxCpQrB41az7M7WJMaxV74t
MD5:	A1B63C44CCAFA4DA684F78E6CE869DE2
SHA1:	7C57B6C4177A5ED4383C239EBED2BB8768F1733C
SHA-256:	729A294DE3253F82309B2DA9EF92A058B5D70B75853891CB7C6D153B0C6C923A
SHA-512:	15F23245C1DF136BF462AA8377944883DF3C2ABEC8EAF44C8BA642E09DF65F1E4127BD6593F82099EBFF043E5CF1867E9660B0BBA3FF73232796250ABD621295
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/latin,v 1.4 2006-10-09 21:37:13 svu Exp $..// Common Latin alphabet layout.//.// $XFree86: xc/programs/xkbcomp/symbols/latin,v 1.3 2002/12/20 20:18:34 paulo Exp $..default partial.xkb_symbols "basic" {.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, numbersign, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, dollar ].};. key <AE05>.{ [ 5, percent, onehalf, threeeighths ].};. key <AE06>.{ [ 6, asciicircum, threequarters, fiveeighths ] };. key <AE07>.{ [ 7, ampersand, braceleft, seveneighths ].};. key <AE08>.{ [ 8, asterisk, bracketleft, trademark ].};. key <AE09>.{ [ 9, parenleft, bracketright, plusminus ].};. key <AE10>.{ [ 0, parenright, braceright, degree ].};.

C:\Program Files (x86)\Xming\xkb\symbols\level3 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4238
Entropy (8bit):	5.190760967786476
Encrypted:	false
SSDEEP:	48:qm2O2qHnQfBytojyaTJZ8GwP5TIuWDeUCV+qFUgVvRUA5Uc78UKQubX1UmsQhWwz:qmtqyYyamRTIQU9wUsU4UvU0xUmsQF
MD5:	7F01DD0E09F71AD68687B40F6654ECD5
SHA1:	9FBD05F08BCE1D2101BC1B4CFEC8162644FF61C2
SHA-256:	B53334A3B76E5ED6883F27EF63AF0F0233A042FD48698EA521770C1EB9B2D6F3
SHA-512:	9B3727BBD2E6482BDE0D0AE15C99F37AE90790C61FF98A60C07CA47CAE54FD5F3EAE72CCDD3C2389AF9FD370029EB75D7962A718B08D86604082CBA95FA76B55
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/level3,v 1.16 2006-12-19 00:18:37 svu Exp $..// these variants assign various XKB keycodes to ISO_Level3_Shift so that.// the third shift level can be reached.//.// $XFree86: xc/programs/xkbcomp/symbols/level3,v 1.7 2003/09/08 14:25:32 eich Exp $.//..// the default behavior is for the right Alt key (AltGr) to generate the.// third engraved symbol.default partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. modifier_map Mod5 { ISO_Level3_Shift };.};..// Right Alt key never chooses 3rd level..// This option attempts to undo the effect of a layout's.// including ralt_switch. You may also want to select another.// level3 option that maps the level3 shift to some other key..partial modifier_keys.xkb_symbols "ralt_alt" {. key <RALT> { . type[Group1]="TWO_LEVEL",. type[Group2]="TWO_LEVEL",. type[Group3]="TWO_LEVEL",. type[Group4]="

C:\Program Files (x86)\Xming\xkb\symbols\level5 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	600
Entropy (8bit):	5.2421288080410875
Encrypted:	false
SSDEEP:	12:jLsZaBue0Ax8W7TQ70hjXzva32by/DnRS7Pe1LVd6Wv:YaoGx8UEWvO2+DnRSbiVUWv
MD5:	583CCE05C29339A2A9BE79E84693862A
SHA1:	3619C6309F1AF4D5DC71E831761C504CB5B3DD31
SHA-256:	B44BE9A2470E17AD7FBA5C0CCE2D3F397096009D2FF643409E636A3658CE7530
SHA-512:	4D5F79EE998769610C44C31F0EEFD621E07F5EF9ABA0EE175793BD325DCDDF14D68AD60B8AA76C864CB4F77E903FB9C00B1AA8FD7007158132C548921353CE37
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/level5,v 1.3 2006-06-13 21:16:52 svu Exp $..// these variants assign various XKB keycodes to ISO_Level5_Shift so that.// the third shift level can be reached.//.// $XFree86: xc/programs/xkbcomp/symbols/level3,v 1.7 2003/09/08 14:25:32 eich Exp $.//..// using the level(switch) map, the right Control key temporarily.// chooses the fifth shift level (until it is released)..partial modifier_keys.xkb_symbols "rctrl_switch" {. key <RCTL> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ 0xfe11 ]. };. modifier_map Mod3 { 0xfe11 };.};.

C:\Program Files (x86)\Xming\xkb\symbols\lk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	5.111356837489246
Encrypted:	false
SSDEEP:	48:qanNvH5P2VGyG6Mj1+Jd6kwC7Cg3MLFao4HOlxJiYnWqQaIpOCTaIPV163:q2Nh+VGRjed37CZAJHOnJlnFSOC1163
MD5:	A946F3E807742D2C0FC63F179A89BC2C
SHA1:	BF0E25D08A229C57B5CAD44765157D9F59119D7E
SHA-256:	8DB245607B6D1FE1B77A2401FA9D7BE881058CD097191338FE9D737E045F4D68
SHA-512:	C97D8C9B455A1FAF949700FCAFEFA0677DF923A7AD0056D3B3BFEE61C367B52242E85BB36636AAF18B0C218E9C19067AF8A92C4F537E9AF1B059B9E6E53E3E36
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lk,v 1.8 2006-09-04 20:25:10 svu Exp $..// X Keyboard Extension file for Sinhala (Sri Lanka) (2004-04-22).// Maintainer : Harshula Jayasuriya <harshula@gmail.com>.// Last Updated: 2006-07-14.// This is a static phonetic mapping for a standard US-English keyboard.// (qwerty).// http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html..// Repaya, Rakaransaya and Yansaya aren't inserted with A-r, R and Y,.// respectively. The problem lies with the XKB infrastructure which.// only allows a one-to-one mapping of keycodes to Unicode codepoints..// Unfortunately, the 3 mentioned glyphs actually consists of 3.// Unicode codepoints each. The resultant is that the user must.// manually construct the glyph by typing each of the 3 codepoints..// Alt-backslash represents the 'join' key, this requires.// two codepoints, hence it also has to be manually constructed..// Similarly, Alt-Shift-backslash representing the 'touch' key requires.

C:\Program Files (x86)\Xming\xkb\symbols\lt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6432
Entropy (8bit):	5.050687757492257
Encrypted:	false
SSDEEP:	96:qWgOrIXGi5Dc2r/3ogJZOXtoI5pfbBWTyBEaNSKOw1Zuju4:qlOkdn/whBkIPBOwXuK4
MD5:	62CD22BB079ACDBB8F4E709E80C29A40
SHA1:	E0D67B447F818520BFA8329E8DD4D2AC84A38A42
SHA-256:	0B701341D7446E1B8C71F5B77CFBAA73029C4FD474E7DE48AED2EE033A722057
SHA-512:	338C3C8986AE3034F2EAA129C76BB1A8B96E2D2AE570C911924A74F8B8DBE897E457172F455947B6D38E9A6E785471638564B6948FB8E96966A62667CB660342
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lt,v 1.9 2006-09-02 00:34:17 svu Exp $..// based on.// Lithuanian keyboard map by Ri.ardas .epas <rch@richard.eu.org>.// merged into one file by Nerijus Bali.nas.// Added number and special characters writing in basic lt layout with RAlt by.// Mantas Kriau.i.nas <mantas@akl.lt>, 2004.//.// $XFree86: xc/programs/xkbcomp/symbols/lt,v 1.3 2002/12/14 22:26:11 dawes Exp $..// If you want to have 2 layouts, use.// Option "XkbLayout" "lt,lt(us)"..// Lithuanian Baltic layout - Lithuanian letters on the numeric row.partial default alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Lithuania";.. key <AE01>.{ [ aogonek, Aogonek, 1, exclam ].};. key <AE02>.{ [ ccaron, Ccaron, 2, at ].};. key <AE03>.{ [ eogonek, Eogonek, 3, numbersign ].};. key <AE04>.{ [ eabovedot, Eabovedot, 4, dollar ].};. key <AE05>.{ [ i

C:\Program Files (x86)\Xming\xkb\symbols\lv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5355
Entropy (8bit):	5.196930750002717
Encrypted:	false
SSDEEP:	96:qdUXdLb+JOXnEg2Vj7e9syUNoPasQ8wNzIa8JCtJL0WU9zF4/1aZ2b:qdKx+4Eg2x78sNo32x2Stm2b
MD5:	A697AC4178704BF9E44AE12ADE5FED36
SHA1:	2F9BE94395A7DB4068660644F64E0D4BA9059E8E
SHA-256:	F34DCDC91AF8E6FEFC251AFD2E48E4B3B1FA64DFC6CEFACEBFE35801185A8270
SHA-512:	06DCB7C7FD8BD17C06A169D75B26657D28D5B6262F54692A4AED6F48DCCF558D2966DF3ADC044D2A7C384CF2C02140C44899994140CE9ECE8BFB8128F99FD5E5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/lv,v 1.7 2005-01-16 02:18:20 svu Exp $..// Latvian keymap version 1.1.// Copyright (C) Dmitry Golubev <lastguru@mail.ru>, 2003-2004.//.// Reworked to get rid of dead_keys (use of which in this case.// is a dirty hack). It is now not dependent on locale settings.// and GTK_IM_MODULES in Gnome. The map is also providing some of.// ISO9995-3 alternate characters. Note that this version works.// correctly under Gnome 2.6. This is to be put into symbols/.// directory, or somewhere else..//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation, and that the name of the copyright holder(s) not be used in.// advertising or publicity pertaining to distribution of the software without.// s

C:\Program Files (x86)\Xming\xkb\symbols\ma (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12467
Entropy (8bit):	5.01031851508168
Encrypted:	false
SSDEEP:	384:OMds66CAG06BAjb66gLUCya6ZRBb6fWGt9+GF6fLCNGG:OM+66806BI66bI6ZTb6fj6fM
MD5:	272A6FEFB3A884615328BEA0AC5357D5
SHA1:	2820D6F5FC4C394E31866BE179FD284861EE94E8
SHA-256:	7FF6E4BB865859AC30762602D64EF0B4D01FD7AD59CB155CD7D1FDE3D635BD59
SHA-512:	AB00D01F39FE325F50EB0BD96A6708017B7180234D282FB642E3414C38B7D947D4CE3D47860C5F8BB26230E306308812CCF5028F7D224C7FE20B70F5D8994CCC
Malicious:	false
Preview:	// Arabic AZERTY with modern Latin digits .partial default alphanumeric_keys.xkb_symbols "arabic" {. include "ara(azerty)".. name[Group1]="Morocco";.};..// French AZERTY keyboard used when typing French.partial alphanumeric_keys.xkb_symbols "french" {. include "fr(basic)".. name[Group1]="Morocco - French";.};..// Clavier unicode tifinaghe de base r.alis. par l'IRCAM (Institut Royal de la Culture Amazighe du Maroc) http://www.ircam.ma/.// Support des lettres unicode tifinaghe-IRCAM, n.otifinaghes & touar.gues..// Les caract.res tifinaghes sont accessibles en SHIFT positions pour le niveau 2, en ALTGR positions pour le niveau 3.// Polices tifinaghes Unicode . t.l.charger depuis :.// http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf (licence non libre, libre t.l.chargement et distribution uniquement).// Minihowto ici: http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html..partial alphanumeric_keys.xkb_symbols "tifinagh" {.. name[Group1]="Morocco

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\apple (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	5.007574144019122
Encrypted:	false
SSDEEP:	48:eocpqk5ByKuEbY0av8TA/NPxistquBytlsIkXcZh32:e6KuEbyHPJwJ/lz2
MD5:	59F838ABD20FED0F440D0B80B94538A1
SHA1:	931717117CD17D2F2AEDBD0D97746C11ECE8F751
SHA-256:	BA96FD490026FB4AC57B7126BE63390BEE916CFAB4654F36D01A523B83E561C2
SHA-512:	3BD444BA286668969A000FD71C3936392E1E6D96A0AE3264B7A3DB855D9FECF026B1C2D3A83DE45A8413B2EC03A2F5173388F4E8CD94B3DF622B8F8BF5E334D0
Malicious:	false
Preview:	//.// Keyboard modification for Apple keyboards.//.// $XFree86: xc/programs/xkbcomp/symbols/apple,v 1.2 2003/10/24 20:38:20 tsi Exp $..partial default modifier_keys.xkb_symbols "extended" {.. key <KPEQ> { [ KP_Equal ] }; ..// The key in the PC's Insert position is sometimes engraved Help (at least.// in Switzerland and Great Britain), with Insert sometimes above. But in the.// US and Canada, it remains Insert. So this should probably be an XkbOption,.// but I have to do more research..// Perhaps Help should be the primary symbol with Insert in the 1st shift-level.// key <INS> { [ Help, Insert ] };.// The keys next to F12, labeled F13, F14, & F15 generate codes that XFree86.// claims not to generate. I think they should be equivalent to the PC keys.// Print Screen / SysRq, Scroll Lock, and Pause. Linux kernel bug?.// key <PRSC> { [ F13 ] }; // should be keycode 93 or.// key <FK13> { [ F13 ] }; // should be keycode 118.// key <SCLK> { [ F14 ] }; // should be keycode 123 o

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\ch (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4088
Entropy (8bit):	5.094268119055927
Encrypted:	false
SSDEEP:	96:AxKYJsMA/0d/uuZ5385hmdzYgvV3oNfcHi5neyxKZub:AhsMA/0d/uuZ53OhmdzYcV3oto4eymub
MD5:	9406E1F4F46DEB7A65101D5198709798
SHA1:	5635D5D0C25002E180583A095D1FF79424BC302E
SHA-256:	02745AE4C16AACFEB1978E2F29E7E4A9C8B1918890A8589872656870772EED22
SHA-512:	750EE05CC89C782F5FF8B9C8A1EDE48B1FD9D8DB3E349C5D8216EDBEF17C02378B6EDC1EAF5E7524AB4D6CBCE271A1B8011D2E4D5B869DD877EF93B93B490BF4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/macintosh_vndr/ch,v 1.6 2006-09-17 20:03:34 svu Exp $.//.// 03.01.2003.// Andreas Tobler <a.tobler@schweiz.ch>.// modified for Swiss German Apple Extended Keyboard II..partial alphanumeric_keys.xkb_symbols "extended" {. . name[Group1]= "Switzerland - German, Mac";.. // Alphanumeric section.. key <AE01> { [.1,.plus, .plusminus,.infinity..].};. key <AE02> { [.2,.quotedbl, leftdoublequotemark, rightdoublequotemark .].};. key <AE03> { [.3,.asterisk, .numbersign,.leftcaret.].};......// not displayed here. key <AE04> { [.4,.ccedilla, .Ccedilla,.slash..].};. key <AE05> { [.5,.percent, .bracketleft...].};. key <AE06> { [.6,.ampersand, .bracketright...].};. key <AE07> { [.7,.slash, .bar,..backslash..].};. key <AE08> { [.8,.parenleft, .braceleft,.Ograve..].};. key <AE09> { [.9,.parenright, .braceright,.Ocircumflex.].};. key <AE10> { [.0,.equal, .notequal,.Uacute...].};. key <AE11> { [.apostrophe,.ques

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\de (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	4.958137546833441
Encrypted:	false
SSDEEP:	96:R2WWneZjHYhZUtz+4j4MrC5JV2AiRSVe2cgLaiArMdKs:8XeZjICz+RuaZiSdcgLai3dKs
MD5:	DB990709B92A362B54CAF270041DD88D
SHA1:	90848A4CB2FB9B9325B166F2E04EEE5B6CFA7228
SHA-256:	EA6D5DB48AC2C9AB384E970C38B740CCBE01931F0B53040BD514FFBD289E2882
SHA-512:	BFF503FFAFFFA252F94BB9157DD15D16461AA21F434628DE0CE877D5E41BEC8E41F4DF4D397359E6CF4B97B1A2EED0E9F5F84039F18B218B2BE2EE4E6786CAA9
Malicious:	false
Preview:	// $XConsortium: de /main/4 1996/08/31 12:19:20 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/de,v 3.7.2.2 1999/07/13 07:09:56 hohndel Exp $..// olh@suse.de very close to MacOS map..default partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a very simple German keybaord.. include "latin". name[Group1]= "Germany - Mac";.. // Alphanumeric section. key <TLDE> {.[ dead_circumflex,.degree, notsign ..].};. key <AE01> {.[ 1, exclam, exclamdown, at..].};. key <AE02> {.[. 2,.quotedbl, twosuperior...].};. key <AE03> {.[. 3,.section, threesuperior,sterling.].};. key <AE04> {.[. 4,.dollar, onequarter,.currency.].};. key <AE05> {.[. 5,.percent, bracketleft...].};. key <AE06> {.[. 6,.ampersand, bracketright..].};. key <AE07> {.[. 7,.slash, bar, backslash..].};. key <AE08> {.[. 8,.parenleft, braceleft, asciitilde.].};. key <AE09> {.[

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\dk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	4.206889152916211
Encrypted:	false
SSDEEP:	96:RynrfbkjE4A3bZnERlUYNwT9ipd88Lwsp:GrfbKE4Ub9EP1Y9ipdss
MD5:	6A8349B0525D020CB190F74A9E004C7A
SHA1:	1C0A394A8EAA78F4D9003780E5E393D2CDE65877
SHA-256:	715449710EC46BD4F71F24ECC308B2017D4B1CCDD98223C9CA223C8B700AD0FF
SHA-512:	6ECA570D6E322CA65B418599FCF70E597ED6A7AB7406C8835A1A256D4AEFBF05F55BC439ACF3D44A4E3F28EAE476A96BCCAEE3102E74624E3163452AF099AD5E
Malicious:	false
Preview:	// $XConsortium: dk /main/3 1996/08/31 12:19:29 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/dk,v 3.3.2.1 1999/12/20 12:56:01 hohndel Exp $.partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Danish keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin". name[Group1]= "Denmark - Mac";.. key <TLDE> {.[ onehalf, section, threequarters, paragraph.]};. key <LSGT> {.[ less, greater, backslash, notsign.]};. key <SPCE> {.[ space, space, nobreakspace, nobreakspace.]};. key <AE01> {.[ 1, exclam, exclamdown, onesuperior.]};. key <AE02> {.[ 2, quotedbl, at, twosuperior.]};. key <AE03> {.[ 3, numbersign, sterling, threesuperior.]};. key <AE04> {.[ 4, EuroSign, dollar, oneq

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\es (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.6355050352057985
Encrypted:	false
SSDEEP:	3:QRYD5f+pz1MtvcW469aHtwFFFeA9AK//LEIAKx4oWuMK:Q2Gz1av39fFwAiK/YbKx4oWDK
MD5:	6350B476FB7E3C09AF3683F6C153138F
SHA1:	F9C5F7DBE5A792C17BF9E667A184D8C79EC427BA
SHA-256:	F360B657911B5CA802E1BE2EF84291AF58921F85F76344FE3A51F55EB9C27074
SHA-512:	7ED6F7517D29882B6B73845009E95203006D55561830C29B0DF7FD35152729CB10B3C178554CEE3B645DCB1E5227340A44830C3DF4B2778BB2BE8CBBB53DF30E
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {. include "es". name[Group1]= "Spain - Mac";.};.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\fi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.7517197991399005
Encrypted:	false
SSDEEP:	12:Q916BnXAFUARaqPaKuFRvyz16ko8VqPaluFRv8pDn:y6BnXCUYWvA6ko8rWv8xn
MD5:	68FE695D66D2F132ED0F3220AFAFE6A3
SHA1:	84C5BA3FA50F0CF3F8C301DD48B972F50B55AB6E
SHA-256:	886D6C185A87D78603F30BB42EC4A0FD79FEE863EBDECDEF228B9E27A236BB47
SHA-512:	8B6A75C71682540E82E4C4561C1E455FFFB4D7393F71F2A8B0416572F20636A42DDED98AECA20236847D21B7F6E2EBF63D2E0854E7773189C775FED95B24222A
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Swedish(Finland) keybaord.. include "macintosh_vndr/se(basic)" // for consistent naming. name[Group1]= "Finland - Mac";..};...partial alphanumeric_keys .xkb_symbols "nodeadkeys" {. include "macintosh_vndr/se(basic)".// for consistent naming. name[Group1]= "Finland - Mac, eliminate dead keys";.};.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\fr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	5.102473410679876
Encrypted:	false
SSDEEP:	96:i44FZMrtA4RY537HhGpUYXWkJ1rO2xhL2nyLBkWcpvYD:i4OWaaY537HhZfsOwL2n26fFYD
MD5:	7F0D98535AD59DAD16D408C7C71632F0
SHA1:	CD319B5DDE0CC0DEDA44E1256CD2D254D5D9694D
SHA-256:	214B5EE6FD81123F8D3F201C248687975B1255BFA83D37D813AE488E296B9AF3
SHA-512:	694DE37CA7D2DC6C47125162C6684CAF87D51122DCFB05146190A12C4AD7B4757D40B951198B6735C58DD135CA8139F1DB08905A30038EE2D39BEECF5885852E
Malicious:	false
Preview:	// Marc.Shapiro@inria.fr 19-sep-1998.// modifications : Etienne Herlent <eherlent@linux-france.org> june 2000.// adapted to the new input layer :.// Martin Costabel <costabel@wanadoo.fr> 3-jan-2001.//////////////////////////////////////////////////////////////////.// Petites Modification le juillet 2005 par Bin Zhang <bb.zhang@free.fr> : .// 1) La ligne 83 : remplacer les deux "VoidSymbol" par oe et OE .// 2) La ligne 89 : remplacer "VoidSymbol" par "EuroSign".// ( 1) et 2) fonctionnent sous UTF-8, mais pas sous iso-8859-1. ).// 3) Remplacer la ligne 148 par la ligne 149 pour que la touche Alt_L.// (la touche Apple-Pomme) fonctionne correctement sous Xorg, une id.e.// motiv.e par http://www.linux-france.org/macintosh/clavier_gentoo.html.//////////////////////////////////////////////////////////////////.// This map is an almost-complete mapping of the standard French.// MacIntosh keyboard under Xwindows. I tried to remain as faithful.// as possible to the Mac meaning of each key

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\gb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.84364959206847
Encrypted:	false
SSDEEP:	12:jLpNJNiZjEqXzvacfPu916BnraFoEaQduFQxvQ7Zxz/p1HaUs:RNziZjEYnHI6BnrYplvQ1xz/HZs
MD5:	17E8933E98F5F3E687DEA340796A9DFE
SHA1:	125131E09F61F26198EB55C3DB81A0B1D905D336
SHA-256:	C624713413828CF91CBB5D8AD922C001F1B1BB333748D08F6630AD4BDD8142D0
SHA-512:	E0C84A8067552A0D2ACCE3B04C5134CA55AFF01CB3D421C70A6AB8CF2718EE558C89E5625E3BD1900CF718A177815CE27FA38F080CD3FB529E9A947663913A63
Malicious:	false
Preview:	// $XConsortium: gb /main/3 1996/08/31 12:19:51 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/gb,v 3.3 1996/12/23 07:13:25 dawes Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout.. include "latin".. name[Group1]= "United Kingdom - Mac";.. key <AE02> {.[ 2, at, EuroSign.].};. key <AE03> {.[ 3, sterling, numbersign.].};.. // End alphanumeric section. . include "level3(ralt_switch)".};...

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	5.436373652417627
Encrypted:	false
SSDEEP:	96:HrpJOuQHGI6rB/whcKTuyGv0aa0hpMiQmg/bIun4LAqIumBBeEW20G:LpLQHF6rBIPSzIyMiQmgRn4LAqWc2v
MD5:	E629D687DD4FD3ECFFBF7986EAC93586
SHA1:	AF4B91DFA2BD14404A865DB2F49F4643C8DCDD64
SHA-256:	4AA73ACA57B6987FCD8A7C1CA20DC56FCAF1021AFDDC564C29D21791B9F5EDB6
SHA-512:	039EE877099344D93FFC534999E73DA90C06C666CCD39641EC98CA47F571DDFA6B9F713FB8AF0B0BB7CD66C61B3817108868B3431EE07F65347FD99A17793D80
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/macintosh_vndr/is,v 1.4 2006-09-17 20:03:34 svu Exp $.//.// This file describes the differences between a Macintosh US Extended.// keymap and an Icelandic keyboard layout in the style of Mac OS and Mac OS X.//.// Copyright (C) 2004, 2006 .var Arnfj.r. Bjarmason <avarab@gmail.com>.//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation..//.// The above copyright notice and this permission notice shall be.// included in all copies or substantial portions of the Software..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEME

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-0B9RG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	4.431627168451095
Encrypted:	false
SSDEEP:	48:9kwViv3fBkThaWSBSnE2TKwlI810+RHYr+:BViv3SThaWvlX1Y+
MD5:	733C5F16130AC0556B5AA95BAB069782
SHA1:	FB951571B2C4A1B370A124ED3B12AA0273504180
SHA-256:	BA4689579411FF1B97DFBF543DD6FF1387712CE1BD0EB8E2E894DC757F144C29
SHA-512:	30D1AA9F831730815B84165B6675F0741952FFEE15B3E2851EF9236FFF3FD4F25D9859E12E6F470C38AB16C38144D057E7063948184C6A0CC86393DEBA03B830
Malicious:	false
Preview:	.xkb_symbols "extended" {.. name[Group1]= "Italy - Mac";.. // Alphanumeric section. key <LSGT> {.[ less, greater .].};. key <TLDE> { [ at, numbersign, periodcentered ].};. key <AE01> {.[ ampersand, 1, guillemotleft,guillemotright.].};. key <AE02> {.[ quotedbl, 2 ..].};. key <AE03> {.[ apostrophe, 3 .].};. key <AE04> {.[ parenleft, 4, braceleft, bracketleft.].};. key <AE05> {.[ ccedilla, 5, Ccedilla, Iacute.].};. key <AE06> {.[ egrave, 6, paragraph, periodcentered].};. key <AE07> {.[ parenright, 7, braceright,. bracketright.].};. key <AE08> {.[ sterling, 8, infinity...].};. key <AE09> {.[ agrave, 9, acute, Ocircumflex.].};. key <AE10> {.[ eacute, 0, grave, Oacute.].};. key <AE11> {.[ minus, underscore.].};. key <AE12> {.[ equal, . plus, notequal, plusminus.].};..

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-0I9JC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	5.436373652417627
Encrypted:	false
SSDEEP:	96:HrpJOuQHGI6rB/whcKTuyGv0aa0hpMiQmg/bIun4LAqIumBBeEW20G:LpLQHF6rBIPSzIyMiQmgRn4LAqWc2v
MD5:	E629D687DD4FD3ECFFBF7986EAC93586
SHA1:	AF4B91DFA2BD14404A865DB2F49F4643C8DCDD64
SHA-256:	4AA73ACA57B6987FCD8A7C1CA20DC56FCAF1021AFDDC564C29D21791B9F5EDB6
SHA-512:	039EE877099344D93FFC534999E73DA90C06C666CCD39641EC98CA47F571DDFA6B9F713FB8AF0B0BB7CD66C61B3817108868B3431EE07F65347FD99A17793D80
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/macintosh_vndr/is,v 1.4 2006-09-17 20:03:34 svu Exp $.//.// This file describes the differences between a Macintosh US Extended.// keymap and an Icelandic keyboard layout in the style of Mac OS and Mac OS X.//.// Copyright (C) 2004, 2006 .var Arnfj.r. Bjarmason <avarab@gmail.com>.//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation..//.// The above copyright notice and this permission notice shall be.// included in all copies or substantial portions of the Software..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEME

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-0PN9B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.6355050352057985
Encrypted:	false
SSDEEP:	3:QRYD5f+pz1MtvcW469aHtwFFFeA9AK//LEIAKx4oWuMK:Q2Gz1av39fFwAiK/YbKx4oWDK
MD5:	6350B476FB7E3C09AF3683F6C153138F
SHA1:	F9C5F7DBE5A792C17BF9E667A184D8C79EC427BA
SHA-256:	F360B657911B5CA802E1BE2EF84291AF58921F85F76344FE3A51F55EB9C27074
SHA-512:	7ED6F7517D29882B6B73845009E95203006D55561830C29B0DF7FD35152729CB10B3C178554CEE3B645DCB1E5227340A44830C3DF4B2778BB2BE8CBBB53DF30E
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {. include "es". name[Group1]= "Spain - Mac";.};.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-3PUV9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	5.007574144019122
Encrypted:	false
SSDEEP:	48:eocpqk5ByKuEbY0av8TA/NPxistquBytlsIkXcZh32:e6KuEbyHPJwJ/lz2
MD5:	59F838ABD20FED0F440D0B80B94538A1
SHA1:	931717117CD17D2F2AEDBD0D97746C11ECE8F751
SHA-256:	BA96FD490026FB4AC57B7126BE63390BEE916CFAB4654F36D01A523B83E561C2
SHA-512:	3BD444BA286668969A000FD71C3936392E1E6D96A0AE3264B7A3DB855D9FECF026B1C2D3A83DE45A8413B2EC03A2F5173388F4E8CD94B3DF622B8F8BF5E334D0
Malicious:	false
Preview:	//.// Keyboard modification for Apple keyboards.//.// $XFree86: xc/programs/xkbcomp/symbols/apple,v 1.2 2003/10/24 20:38:20 tsi Exp $..partial default modifier_keys.xkb_symbols "extended" {.. key <KPEQ> { [ KP_Equal ] }; ..// The key in the PC's Insert position is sometimes engraved Help (at least.// in Switzerland and Great Britain), with Insert sometimes above. But in the.// US and Canada, it remains Insert. So this should probably be an XkbOption,.// but I have to do more research..// Perhaps Help should be the primary symbol with Insert in the 1st shift-level.// key <INS> { [ Help, Insert ] };.// The keys next to F12, labeled F13, F14, & F15 generate codes that XFree86.// claims not to generate. I think they should be equivalent to the PC keys.// Print Screen / SysRq, Scroll Lock, and Pause. Linux kernel bug?.// key <PRSC> { [ F13 ] }; // should be keycode 93 or.// key <FK13> { [ F13 ] }; // should be keycode 118.// key <SCLK> { [ F14 ] }; // should be keycode 123 o

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-6D039.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	4.303070642033435
Encrypted:	false
SSDEEP:	48:RXU0tXnrYRwBGi0dNtgbRuUX7umYxtQx2bxn:RXZnrYRwBv0dNtMRuUXamMt221
MD5:	3FD65F86E7FBF13ADB8F20E87A8A7ED7
SHA1:	643EDFC864EE8B153D603B46BBE64047F61A81B6
SHA-256:	057DC7A4C897C98BFCB75C58C6E01ED9891F745698AEF0B60DDD8B71CF25B198
SHA-512:	5F66F8FA95873D6CC8A589C75433B8B635781A77230F64ACF8F85DD89EAEE43F107D1B53582078752F5B5D2F7F3EB118EA297EF4BE02B9F42C52B8D397E3C80E
Malicious:	false
Preview:	// $XConsortium: se /main/3 1996/08/31 12:20:15 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/macintosh/se,v 1.1 2000/09/19 12:46:26 eich Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Swedish(Sweden) keybaord.. include "latin".. name[Group1]= "Sweden - Mac";.. key <TLDE> {.[ section, degree.].};.. key <AE01> {.[ 1, exclam, copyright, exclamdown.].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE03> {.[ 3, numbersign, sterling, yen.].};. key <AE04> {.[ 4, currency, . dollar,. cent.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.].};. key <AE08> {.[ 8, parenleft, bracketle

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-7S13A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	296
Entropy (8bit):	4.665179987531507
Encrypted:	false
SSDEEP:	6:Q2Gz1av391FYZ+9UKylAXlafmxAxJcOfvFelAQdbKx4orcclAUUIG6XbSn:Q916BnXAFjEaQduFr9aU3bSn
MD5:	34B9248D0DAD1BFF481DFFDADE03F08A
SHA1:	FCD5183F1884D229A93403D91A7A855FF5631170
SHA-256:	26182191189C8821271E64601D206244DC188518671B5BD34E54CC3F478D68EE
SHA-512:	7ED9C3E97BB2925CE1A6F13F8792BB47D39320A70981B3B308D95E22B3091C7EC5516804A1CDC0E2D28A97507BE7AA3534E82BBCEE113F70A8701DEE9EEDA7D3
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple netherland keybaord.. include "latin".. name[Group1]= "Netherlands - Mac";.. include "level3(ralt_switch)"..// do just nothing..};..

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-BNJ5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	4.958137546833441
Encrypted:	false
SSDEEP:	96:R2WWneZjHYhZUtz+4j4MrC5JV2AiRSVe2cgLaiArMdKs:8XeZjICz+RuaZiSdcgLai3dKs
MD5:	DB990709B92A362B54CAF270041DD88D
SHA1:	90848A4CB2FB9B9325B166F2E04EEE5B6CFA7228
SHA-256:	EA6D5DB48AC2C9AB384E970C38B740CCBE01931F0B53040BD514FFBD289E2882
SHA-512:	BFF503FFAFFFA252F94BB9157DD15D16461AA21F434628DE0CE877D5E41BEC8E41F4DF4D397359E6CF4B97B1A2EED0E9F5F84039F18B218B2BE2EE4E6786CAA9
Malicious:	false
Preview:	// $XConsortium: de /main/4 1996/08/31 12:19:20 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/de,v 3.7.2.2 1999/07/13 07:09:56 hohndel Exp $..// olh@suse.de very close to MacOS map..default partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a very simple German keybaord.. include "latin". name[Group1]= "Germany - Mac";.. // Alphanumeric section. key <TLDE> {.[ dead_circumflex,.degree, notsign ..].};. key <AE01> {.[ 1, exclam, exclamdown, at..].};. key <AE02> {.[. 2,.quotedbl, twosuperior...].};. key <AE03> {.[. 3,.section, threesuperior,sterling.].};. key <AE04> {.[. 4,.dollar, onequarter,.currency.].};. key <AE05> {.[. 5,.percent, bracketleft...].};. key <AE06> {.[. 6,.ampersand, bracketright..].};. key <AE07> {.[. 7,.slash, bar, backslash..].};. key <AE08> {.[. 8,.parenleft, braceleft, asciitilde.].};. key <AE09> {.[

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-FQAKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	4.206889152916211
Encrypted:	false
SSDEEP:	96:RynrfbkjE4A3bZnERlUYNwT9ipd88Lwsp:GrfbKE4Ub9EP1Y9ipdss
MD5:	6A8349B0525D020CB190F74A9E004C7A
SHA1:	1C0A394A8EAA78F4D9003780E5E393D2CDE65877
SHA-256:	715449710EC46BD4F71F24ECC308B2017D4B1CCDD98223C9CA223C8B700AD0FF
SHA-512:	6ECA570D6E322CA65B418599FCF70E597ED6A7AB7406C8835A1A256D4AEFBF05F55BC439ACF3D44A4E3F28EAE476A96BCCAEE3102E74624E3163452AF099AD5E
Malicious:	false
Preview:	// $XConsortium: dk /main/3 1996/08/31 12:19:29 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/dk,v 3.3.2.1 1999/12/20 12:56:01 hohndel Exp $.partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Danish keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin". name[Group1]= "Denmark - Mac";.. key <TLDE> {.[ onehalf, section, threequarters, paragraph.]};. key <LSGT> {.[ less, greater, backslash, notsign.]};. key <SPCE> {.[ space, space, nobreakspace, nobreakspace.]};. key <AE01> {.[ 1, exclam, exclamdown, onesuperior.]};. key <AE02> {.[ 2, quotedbl, at, twosuperior.]};. key <AE03> {.[ 3, numbersign, sterling, threesuperior.]};. key <AE04> {.[ 4, EuroSign, dollar, oneq

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-HAJF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	5.102473410679876
Encrypted:	false
SSDEEP:	96:i44FZMrtA4RY537HhGpUYXWkJ1rO2xhL2nyLBkWcpvYD:i4OWaaY537HhZfsOwL2n26fFYD
MD5:	7F0D98535AD59DAD16D408C7C71632F0
SHA1:	CD319B5DDE0CC0DEDA44E1256CD2D254D5D9694D
SHA-256:	214B5EE6FD81123F8D3F201C248687975B1255BFA83D37D813AE488E296B9AF3
SHA-512:	694DE37CA7D2DC6C47125162C6684CAF87D51122DCFB05146190A12C4AD7B4757D40B951198B6735C58DD135CA8139F1DB08905A30038EE2D39BEECF5885852E
Malicious:	false
Preview:	// Marc.Shapiro@inria.fr 19-sep-1998.// modifications : Etienne Herlent <eherlent@linux-france.org> june 2000.// adapted to the new input layer :.// Martin Costabel <costabel@wanadoo.fr> 3-jan-2001.//////////////////////////////////////////////////////////////////.// Petites Modification le juillet 2005 par Bin Zhang <bb.zhang@free.fr> : .// 1) La ligne 83 : remplacer les deux "VoidSymbol" par oe et OE .// 2) La ligne 89 : remplacer "VoidSymbol" par "EuroSign".// ( 1) et 2) fonctionnent sous UTF-8, mais pas sous iso-8859-1. ).// 3) Remplacer la ligne 148 par la ligne 149 pour que la touche Alt_L.// (la touche Apple-Pomme) fonctionne correctement sous Xorg, une id.e.// motiv.e par http://www.linux-france.org/macintosh/clavier_gentoo.html.//////////////////////////////////////////////////////////////////.// This map is an almost-complete mapping of the standard French.// MacIntosh keyboard under Xwindows. I tried to remain as faithful.// as possible to the Mac meaning of each key

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-MQENE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1946
Entropy (8bit):	4.105426071788667
Encrypted:	false
SSDEEP:	24:y6BnXC9CuCdPS907NaJx3PbyEgT8f2oLCQaMcSQPsOO741TZv4bxQQ8XZ7K47q7e:Tny9CucP4nPWXFgvSOFWJB2y
MD5:	0EC05103F7EF1598B7268CA09690C722
SHA1:	CA53650FAB3BDE384DD30F366A0D30C0E3F4EDBD
SHA-256:	474C0BD6AC826134DF9FAF9619AAE844441E34E1C9A8617CEC3B3885BCE2CDBF
SHA-512:	5B4471507AC0B3DC03F51AFB00A0F15A51F4A27DD456A02BB82ECF39D74E32DF5FB32A37046683E43B7C8BDCC64DB8D7367BE4B87DEECC6D276F1A9D882DC3C4
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Spanish keybaord.. include "latin". name[Group1]= "Latin American - Mac";.. key <TLDE> {.[ bracketleft, bracketright, braceleft, braceright.].};. key <LSGT> {.[ less, greater, bracketleft, braceleft.].};. key <AE01> {.[ 1, exclamdown .].};. key <AE02> {.[ 2, exclam, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, guillemotleft, guillemotright.].};. key <AE04> {.[ 4, dollar, yen, Icircumflex.].};. key <AE05> {.[ 5, percent.].};. key <AE06> {.[ 6, slash, backslash, Idiaeresis.].};. key <AE07> {.[ 7, ampersand, bar, Iacute.].};. k

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-OID70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.84364959206847
Encrypted:	false
SSDEEP:	12:jLpNJNiZjEqXzvacfPu916BnraFoEaQduFQxvQ7Zxz/p1HaUs:RNziZjEYnHI6BnrYplvQ1xz/HZs
MD5:	17E8933E98F5F3E687DEA340796A9DFE
SHA1:	125131E09F61F26198EB55C3DB81A0B1D905D336
SHA-256:	C624713413828CF91CBB5D8AD922C001F1B1BB333748D08F6630AD4BDD8142D0
SHA-512:	E0C84A8067552A0D2ACCE3B04C5134CA55AFF01CB3D421C70A6AB8CF2718EE558C89E5625E3BD1900CF718A177815CE27FA38F080CD3FB529E9A947663913A63
Malicious:	false
Preview:	// $XConsortium: gb /main/3 1996/08/31 12:19:51 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/gb,v 3.3 1996/12/23 07:13:25 dawes Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout.. include "latin".. name[Group1]= "United Kingdom - Mac";.. key <AE02> {.[ 2, at, EuroSign.].};. key <AE03> {.[ 3, sterling, numbersign.].};.. // End alphanumeric section. . include "level3(ralt_switch)".};...

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-OOCH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4088
Entropy (8bit):	5.094268119055927
Encrypted:	false
SSDEEP:	96:AxKYJsMA/0d/uuZ5385hmdzYgvV3oNfcHi5neyxKZub:AhsMA/0d/uuZ53OhmdzYcV3oto4eymub
MD5:	9406E1F4F46DEB7A65101D5198709798
SHA1:	5635D5D0C25002E180583A095D1FF79424BC302E
SHA-256:	02745AE4C16AACFEB1978E2F29E7E4A9C8B1918890A8589872656870772EED22
SHA-512:	750EE05CC89C782F5FF8B9C8A1EDE48B1FD9D8DB3E349C5D8216EDBEF17C02378B6EDC1EAF5E7524AB4D6CBCE271A1B8011D2E4D5B869DD877EF93B93B490BF4
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/macintosh_vndr/ch,v 1.6 2006-09-17 20:03:34 svu Exp $.//.// 03.01.2003.// Andreas Tobler <a.tobler@schweiz.ch>.// modified for Swiss German Apple Extended Keyboard II..partial alphanumeric_keys.xkb_symbols "extended" {. . name[Group1]= "Switzerland - German, Mac";.. // Alphanumeric section.. key <AE01> { [.1,.plus, .plusminus,.infinity..].};. key <AE02> { [.2,.quotedbl, leftdoublequotemark, rightdoublequotemark .].};. key <AE03> { [.3,.asterisk, .numbersign,.leftcaret.].};......// not displayed here. key <AE04> { [.4,.ccedilla, .Ccedilla,.slash..].};. key <AE05> { [.5,.percent, .bracketleft...].};. key <AE06> { [.6,.ampersand, .bracketright...].};. key <AE07> { [.7,.slash, .bar,..backslash..].};. key <AE08> { [.8,.parenleft, .braceleft,.Ograve..].};. key <AE09> { [.9,.parenright, .braceright,.Ocircumflex.].};. key <AE10> { [.0,.equal, .notequal,.Uacute...].};. key <AE11> { [.apostrophe,.ques

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-OUUM2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2773
Entropy (8bit):	4.553112259690495
Encrypted:	false
SSDEEP:	48:RM03oqqnrYCr0XzxgI68ebfYC06738O1frH:RMnrYCr0XzxgI68yACn73/lrH
MD5:	A7E9092801BD0F53916A74DF7743A32C
SHA1:	5CE2F06239020816E2B550F5BFE62FC0D3200B95
SHA-256:	A9F89D24986AE489C27C60BCF7E64CCE329A498E044DAB0234C6F0ACDB1FBAF3
SHA-512:	E00F056AF93632C6EF1867FD1605BD2CF049C731BBB318DBA786AB462B75DCDA462FF2A55732051C84845E1282103ED0EB15233862CCE7219A6BC67531BEEEA5
Malicious:	false
Preview:	// $XConsortium: pt /main/3 1996/08/31 12:20:08 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/pt,v 3.3.2.1 1999/11/18 15:37:37 hohndel Exp $.// mac version from Ricardo Cabral <bfe00991@mail.telepac.pt>..partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Portuguese keybaord.. include "latin".. name[Group1]= "Portugal - Mac";.. key <LSGT> {.[. less,. greater, . bar, brokenbar.].};. key <AE02> {.[ 2,. quotedbl, . at, oneeighth.].};. key <AE04> {.[ 4,. dollar, section, dollar.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling .].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash .].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft .].};. k

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-P0IUE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.7517197991399005
Encrypted:	false
SSDEEP:	12:Q916BnXAFUARaqPaKuFRvyz16ko8VqPaluFRv8pDn:y6BnXCUYWvA6ko8rWv8xn
MD5:	68FE695D66D2F132ED0F3220AFAFE6A3
SHA1:	84C5BA3FA50F0CF3F8C301DD48B972F50B55AB6E
SHA-256:	886D6C185A87D78603F30BB42EC4A0FD79FEE863EBDECDEF228B9E27A236BB47
SHA-512:	8B6A75C71682540E82E4C4561C1E455FFFB4D7393F71F2A8B0416572F20636A42DDED98AECA20236847D21B7F6E2EBF63D2E0854E7773189C775FED95B24222A
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Swedish(Finland) keybaord.. include "macintosh_vndr/se(basic)" // for consistent naming. name[Group1]= "Finland - Mac";..};...partial alphanumeric_keys .xkb_symbols "nodeadkeys" {. include "macintosh_vndr/se(basic)".// for consistent naming. name[Group1]= "Finland - Mac, eliminate dead keys";.};.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-SH61I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4443
Entropy (8bit):	4.995917586549579
Encrypted:	false
SSDEEP:	48:RcJHHM0Bkw/CEfuXC35bq4Mnh2T7wdCnOYw1N1u9jhqK2vqBKSxt/fz:RCHnd/CA5bhMnECkqoj8nyhL
MD5:	52573D7535176C5C2ED86167E30FA356
SHA1:	183D6D2C7CF3A5592DDEC999C2F8E22415A9F2B4
SHA-256:	55EA87CB1747670FC6D9BDD05F41CE36B106A72580335C841CE7ED9525E90282
SHA-512:	A9F080923C97E54F3A9F668D14F8A8E2DF15E5D9FC8432BA6BE3445E88F412E6162008C88315675104907F1C11ABF3B89E7CCC8091848B9026F96D06A00819E9
Malicious:	false
Preview:	// $XConsortium: macintosh /main/10 1996/01/29 19:54:54 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/macintosh/us,v 1.8 2003/08/04 10:32:31 eich Exp $..// symbols definition for a Macintosh "Extended" keyboard..xkb_symbols "extended" {.. name[Group1]= "U.S. English";. key <ESC> {.[ Escape...].};.. // Alphanumeric section. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\is-UP702.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2328
Entropy (8bit):	4.328483545196613
Encrypted:	false
SSDEEP:	48:R2s09ByqnrYY0iEFX1yEDbuUdsNmxfLJ/pUiEFJyc:RCnrYY0nV1yEXuUdsNKfN/+nHyc
MD5:	5C0C68CBA380947783FF1096B49F8088
SHA1:	0F57E1950C31864DDF817AA4D494722CD68FB8C3
SHA-256:	69C98580B8F70BA7FBFE31A2563EC87B2B5894E9D7D16EA42584A0C8F1DB91EE
SHA-512:	3F205AF8F43BF5ED38199BD000F5D5310662454DFE3536AEA15A4EAFE30FBDA7C25EDEAB1945241376F63F531577160229C0C076DFF40EC0DF5DB15A726855F9
Malicious:	false
Preview:	// $XConsortium: no /main/3 1996/08/31 12:20:02 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/no,v 3.3.2.1 1997/07/26 06:31:01 dawes Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Norwegian keybaord.. include "latin".. name[Group1]= "Norway - Mac";.. key <TLDE> {.[ bar, section ].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE04> {.[. 4, currency, . dollar,. dollar.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.] .};. key <AE08> {.[ 8, parenleft, bracketleft,. braceleft.].};. key <AE09> {.[ 9, parenright, bracketright, braceright.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\it (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	4.431627168451095
Encrypted:	false
SSDEEP:	48:9kwViv3fBkThaWSBSnE2TKwlI810+RHYr+:BViv3SThaWvlX1Y+
MD5:	733C5F16130AC0556B5AA95BAB069782
SHA1:	FB951571B2C4A1B370A124ED3B12AA0273504180
SHA-256:	BA4689579411FF1B97DFBF543DD6FF1387712CE1BD0EB8E2E894DC757F144C29
SHA-512:	30D1AA9F831730815B84165B6675F0741952FFEE15B3E2851EF9236FFF3FD4F25D9859E12E6F470C38AB16C38144D057E7063948184C6A0CC86393DEBA03B830
Malicious:	false
Preview:	.xkb_symbols "extended" {.. name[Group1]= "Italy - Mac";.. // Alphanumeric section. key <LSGT> {.[ less, greater .].};. key <TLDE> { [ at, numbersign, periodcentered ].};. key <AE01> {.[ ampersand, 1, guillemotleft,guillemotright.].};. key <AE02> {.[ quotedbl, 2 ..].};. key <AE03> {.[ apostrophe, 3 .].};. key <AE04> {.[ parenleft, 4, braceleft, bracketleft.].};. key <AE05> {.[ ccedilla, 5, Ccedilla, Iacute.].};. key <AE06> {.[ egrave, 6, paragraph, periodcentered].};. key <AE07> {.[ parenright, 7, braceright,. bracketright.].};. key <AE08> {.[ sterling, 8, infinity...].};. key <AE09> {.[ agrave, 9, acute, Ocircumflex.].};. key <AE10> {.[ eacute, 0, grave, Oacute.].};. key <AE11> {.[ minus, underscore.].};. key <AE12> {.[ equal, . plus, notequal, plusminus.].};..

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\latam (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1946
Entropy (8bit):	4.105426071788667
Encrypted:	false
SSDEEP:	24:y6BnXC9CuCdPS907NaJx3PbyEgT8f2oLCQaMcSQPsOO741TZv4bxQQ8XZ7K47q7e:Tny9CucP4nPWXFgvSOFWJB2y
MD5:	0EC05103F7EF1598B7268CA09690C722
SHA1:	CA53650FAB3BDE384DD30F366A0D30C0E3F4EDBD
SHA-256:	474C0BD6AC826134DF9FAF9619AAE844441E34E1C9A8617CEC3B3885BCE2CDBF
SHA-512:	5B4471507AC0B3DC03F51AFB00A0F15A51F4A27DD456A02BB82ECF39D74E32DF5FB32A37046683E43B7C8BDCC64DB8D7367BE4B87DEECC6D276F1A9D882DC3C4
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Spanish keybaord.. include "latin". name[Group1]= "Latin American - Mac";.. key <TLDE> {.[ bracketleft, bracketright, braceleft, braceright.].};. key <LSGT> {.[ less, greater, bracketleft, braceleft.].};. key <AE01> {.[ 1, exclamdown .].};. key <AE02> {.[ 2, exclam, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, guillemotleft, guillemotright.].};. key <AE04> {.[ 4, dollar, yen, Icircumflex.].};. key <AE05> {.[ 5, percent.].};. key <AE06> {.[ 6, slash, backslash, Idiaeresis.].};. key <AE07> {.[ 7, ampersand, bar, Iacute.].};. k

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\nl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	296
Entropy (8bit):	4.665179987531507
Encrypted:	false
SSDEEP:	6:Q2Gz1av391FYZ+9UKylAXlafmxAxJcOfvFelAQdbKx4orcclAUUIG6XbSn:Q916BnXAFjEaQduFr9aU3bSn
MD5:	34B9248D0DAD1BFF481DFFDADE03F08A
SHA1:	FCD5183F1884D229A93403D91A7A855FF5631170
SHA-256:	26182191189C8821271E64601D206244DC188518671B5BD34E54CC3F478D68EE
SHA-512:	7ED9C3E97BB2925CE1A6F13F8792BB47D39320A70981B3B308D95E22B3091C7EC5516804A1CDC0E2D28A97507BE7AA3534E82BBCEE113F70A8701DEE9EEDA7D3
Malicious:	false
Preview:	.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple netherland keybaord.. include "latin".. name[Group1]= "Netherlands - Mac";.. include "level3(ralt_switch)"..// do just nothing..};..

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\no (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2328
Entropy (8bit):	4.328483545196613
Encrypted:	false
SSDEEP:	48:R2s09ByqnrYY0iEFX1yEDbuUdsNmxfLJ/pUiEFJyc:RCnrYY0nV1yEXuUdsNKfN/+nHyc
MD5:	5C0C68CBA380947783FF1096B49F8088
SHA1:	0F57E1950C31864DDF817AA4D494722CD68FB8C3
SHA-256:	69C98580B8F70BA7FBFE31A2563EC87B2B5894E9D7D16EA42584A0C8F1DB91EE
SHA-512:	3F205AF8F43BF5ED38199BD000F5D5310662454DFE3536AEA15A4EAFE30FBDA7C25EDEAB1945241376F63F531577160229C0C076DFF40EC0DF5DB15A726855F9
Malicious:	false
Preview:	// $XConsortium: no /main/3 1996/08/31 12:20:02 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/no,v 3.3.2.1 1997/07/26 06:31:01 dawes Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Norwegian keybaord.. include "latin".. name[Group1]= "Norway - Mac";.. key <TLDE> {.[ bar, section ].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE04> {.[. 4, currency, . dollar,. dollar.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.] .};. key <AE08> {.[ 8, parenleft, bracketleft,. braceleft.].};. key <AE09> {.[ 9, parenright, bracketright, braceright.

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\pt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2773
Entropy (8bit):	4.553112259690495
Encrypted:	false
SSDEEP:	48:RM03oqqnrYCr0XzxgI68ebfYC06738O1frH:RMnrYCr0XzxgI68yACn73/lrH
MD5:	A7E9092801BD0F53916A74DF7743A32C
SHA1:	5CE2F06239020816E2B550F5BFE62FC0D3200B95
SHA-256:	A9F89D24986AE489C27C60BCF7E64CCE329A498E044DAB0234C6F0ACDB1FBAF3
SHA-512:	E00F056AF93632C6EF1867FD1605BD2CF049C731BBB318DBA786AB462B75DCDA462FF2A55732051C84845E1282103ED0EB15233862CCE7219A6BC67531BEEEA5
Malicious:	false
Preview:	// $XConsortium: pt /main/3 1996/08/31 12:20:08 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/pt,v 3.3.2.1 1999/11/18 15:37:37 hohndel Exp $.// mac version from Ricardo Cabral <bfe00991@mail.telepac.pt>..partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Portuguese keybaord.. include "latin".. name[Group1]= "Portugal - Mac";.. key <LSGT> {.[. less,. greater, . bar, brokenbar.].};. key <AE02> {.[ 2,. quotedbl, . at, oneeighth.].};. key <AE04> {.[ 4,. dollar, section, dollar.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling .].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash .].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft .].};. k

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\se (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	4.303070642033435
Encrypted:	false
SSDEEP:	48:RXU0tXnrYRwBGi0dNtgbRuUX7umYxtQx2bxn:RXZnrYRwBv0dNtMRuUXamMt221
MD5:	3FD65F86E7FBF13ADB8F20E87A8A7ED7
SHA1:	643EDFC864EE8B153D603B46BBE64047F61A81B6
SHA-256:	057DC7A4C897C98BFCB75C58C6E01ED9891F745698AEF0B60DDD8B71CF25B198
SHA-512:	5F66F8FA95873D6CC8A589C75433B8B635781A77230F64ACF8F85DD89EAEE43F107D1B53582078752F5B5D2F7F3EB118EA297EF4BE02B9F42C52B8D397E3C80E
Malicious:	false
Preview:	// $XConsortium: se /main/3 1996/08/31 12:20:15 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/macintosh/se,v 1.1 2000/09/19 12:46:26 eich Exp $.partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Swedish(Sweden) keybaord.. include "latin".. name[Group1]= "Sweden - Mac";.. key <TLDE> {.[ section, degree.].};.. key <AE01> {.[ 1, exclam, copyright, exclamdown.].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE03> {.[ 3, numbersign, sterling, yen.].};. key <AE04> {.[ 4, currency, . dollar,. cent.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.].};. key <AE08> {.[ 8, parenleft, bracketle

C:\Program Files (x86)\Xming\xkb\symbols\macintosh_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4443
Entropy (8bit):	4.995917586549579
Encrypted:	false
SSDEEP:	48:RcJHHM0Bkw/CEfuXC35bq4Mnh2T7wdCnOYw1N1u9jhqK2vqBKSxt/fz:RCHnd/CA5bhMnECkqoj8nyhL
MD5:	52573D7535176C5C2ED86167E30FA356
SHA1:	183D6D2C7CF3A5592DDEC999C2F8E22415A9F2B4
SHA-256:	55EA87CB1747670FC6D9BDD05F41CE36B106A72580335C841CE7ED9525E90282
SHA-512:	A9F080923C97E54F3A9F668D14F8A8E2DF15E5D9FC8432BA6BE3445E88F412E6162008C88315675104907F1C11ABF3B89E7CCC8091848B9026F96D06A00819E9
Malicious:	false
Preview:	// $XConsortium: macintosh /main/10 1996/01/29 19:54:54 kaleb $.// $XFree86: xc/programs/xkbcomp/symbols/macintosh/us,v 1.8 2003/08/04 10:32:31 eich Exp $..// symbols definition for a Macintosh "Extended" keyboard..xkb_symbols "extended" {.. name[Group1]= "U.S. English";. key <ESC> {.[ Escape...].};.. // Alphanumeric section. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.

C:\Program Files (x86)\Xming\xkb\symbols\mao (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	689
Entropy (8bit):	4.94663897284305
Encrypted:	false
SSDEEP:	12:jLsZaBm4uHB9160dJWf7KpAcaQdu7slh+9m+dgdC9mbJYY91ktC9maJEY911/eCq:YaYBT607Wf2phFlY9m+d6C9mdYY91P9w
MD5:	1019FB659CBC0E08D14AD5ABF0DBFD70
SHA1:	505BC7363A03053445364301BA549F4D49B94207
SHA-256:	1AB90AD2E6738570526DF99E17878B7787EBEC7F3D347C53BBBFB1DAB8CD71CF
SHA-512:	42CA9DCB1C52C3860F73B0AAB2EC7CDAD4A79CDD83F5D412526951650D5DB0ED43EC0C5C33D98120963F9BD687C9DD71EFA90A0CE7D4243BFDFA86B883AF85AD
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mao,v 1.2 2004-10-09 18:34:15 svu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Adds the macrons needed for the Maori language to. // a simple us keyboard layout... include "latin".. name[Group1]="Maori";.. key <AC01> { [ a, A, amacron, Amacron ] };. key <AD03> { [ e, E, emacron, Emacron ] };. key <AD08> { [ i, I, imacron, Imacron ] };.. key <AD09> { [ o, O, omacron, Omacron ] };. key <AD07> { [ u, U, umacron, Umacron ] };.. key <RALT> { type[Group1]="TWO_LEVEL",. [ ISO_Level3_Shift, Multi_key ] };. modifier_map Mod5 { <RALT> };.};.

C:\Program Files (x86)\Xming\xkb\symbols\mk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	4.548493874820345
Encrypted:	false
SSDEEP:	24:KJGaxFT60NBbp9oeOR4VbXY82kC8inAFqZz/goZd3QB7AgKqlUt93N4b97F91dlz:KJZFnNEocPg7mjmVF9ri+QWyv7W
MD5:	91FAD804076784E129922ABF84A4835B
SHA1:	474D77D20A15D78AB9A91BEC8128E382E450C7B3
SHA-256:	47856E4555CAC9A1DB41AE2A7C13A9EAC588CEDB22AA6E3F4B5796031033AC6B
SHA-512:	C65CC2CD6C8FADA553DD1567040888A96C4D4E24C78E11D4FAD0A445D7AE1610CF15160D103BAAADB7E1952BEA59A94C8038DD2D66B3F0309385B522DC8D309A
Malicious:	false
Preview:	.// based on keyboard map:.// Author: Damjan Georgievski <penguinista AT mail.net.mk>.// Revision: 1.5.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mk,v 1.12 2005-09-20 21:10:47 svu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" { . name[Group1]= "Macedonia";.. key <AB01> { [ Cyrillic_ze, Cyrillic_ZE.].};. key <AC02> { [ Cyrillic_es, Cyrillic_ES.].};. key <AC01> { [ Cyrillic_a, Cyrillic_A.].};. key <AD01> { [ Cyrillic_lje, Cyrillic_LJE.].};. key <AD02> { [ Cyrillic_nje, Cyrillic_NJE.].};. key <AB03> { [ Cyrillic_tse, Cyrillic_TSE.].};. key <AB02> { [ Cyrillic_dzhe, Cyrillic_DZHE.].};. key <AC03> { [ Cyrillic_de, Cyrillic_DE.].};. key <AD03> { [ Cyrillic_ie, Cyrillic_IE.].};. key <AB04> { [ Cyrillic_ve, Cyrillic_VE.].};. key <AC04> { [ Cyrillic_ef, Cyrillic_EF.].};. key <AD05> { [ Cyrillic_te, Cyrillic_TE.].};. key <AD04> { [ Cyrill

C:\Program Files (x86)\Xming\xkb\symbols\mm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2798
Entropy (8bit):	4.132399956524305
Encrypted:	false
SSDEEP:	48:AiLe0b3Ceaxdxly1zsD7HGjaRjSYKjQlYEFUVjXCS8VMuWuOU9JkbWnpHV:qi3Ceaxly1ID7HZR+YKjQlAVjXCS8VMk
MD5:	E682538687EBC7B2083E4F571977393C
SHA1:	51A1A217489465A58E55AD2AA2D8CD7696BAF430
SHA-256:	0EA328B13C290E339B14EB3928E95AF16912C8FE92B06F5CD9D6ADE69B68BE0E
SHA-512:	F6A298077028B6E78A80FC8ED03C65826FE3183EDCC1101AD86F6801FEAAF62C4161A762C30858A60AB6604FBEFB21484B9207F7F2CB04C554E72E0FF2D7D3E8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mm,v 1.5 2004-12-22 21:51:19 svu Exp $..// based on a keyboard map from an 'xkb/symbols/mm' file..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Myanmar";..// Mainly numbers.. key <AE01> { [ 0x1001041, exclam .].};. key <AE02> { [ 0x1001042 ..].};. key <AE03> { [ 0x1001043 . .].};. key <AE04> { [ 0x1001044 . .].};. key <AE05> { [ 0x1001045 ..].};. key <AE06> { [ 0x1001046 . .].};. key <AE07> { [ 0x1001047 ..].};. key <AE08> { [ 0x1001048 . .].};. key <AE09> { [ 0x1001049, parenleft .].};. key <AE10> { [ 0x1001040, parenright ].};. key <AE11> { [ minus, 0x1001038 .].};. key <AE12> { [ 0x1001052, 0x1001056 .].};..// Mainly long vowels. key <AD01> { [ 0x100102A, 0x100102A ].};. key <AD02> { [ 0x1001032, 0x1001032 ].};. key <AD03> { [ 0x100102C, 0x100102

C:\Program Files (x86)\Xming\xkb\symbols\mn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4089
Entropy (8bit):	4.361183060964637
Encrypted:	false
SSDEEP:	48:/mxSn8AKGZ08M8uJwLmTu21JFnIVg47P6R2xgKH0XM:MdAKq08MNNTuiX47P6R2xgKH08
MD5:	159FCF91E98E33AC583615DECBF29E18
SHA1:	6B4AF1DD180AE9CE52DB337838674478AD0A90D4
SHA-256:	C18C73EBFDFE9B3BDCDDE5E5DB3060029E0EE3E97A63C442A9767D8DBEF3BF92
SHA-512:	98693A92D6C316FCAE17A9E8446B115766C02546C8F81A3DECD416FB2C966BF70255B7765D4D3F63EA1D74659828BE729A5F66548BBF228B2D3B577C40D684A6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mn,v 1.4 2004-12-22 21:51:19 svu Exp $..// based on:.// Mongolian standard keyboard.// Author Sanlig Badral <badral@chinggis.com>.// 2002/12/7 Version 1.0..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Mongolia";.. key <TLDE> { [ equal, . plus, ..degree ] };. key <AE01> { [ 1, numerosign, .multiply ] };. key <AE02> { [ 2, minus, .division ] };. key <AE03> { [ 3, quotedbl, .plusminus ] };. key <AE04> { [ 4, U20ae, ..notsign ] };. key <AE05> { [ 5, colon,..NoSymbol .] };. key <AE06> { [ 6, period, notequal ] };. key <AE07> { [ 7, underscore, ampersand .] };. key <AE08> { [ 8, comma, .asterisk ] };. key <AE09> { [ 9, percent, .br

C:\Program Files (x86)\Xming\xkb\symbols\mt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2848
Entropy (8bit):	4.649899899078293
Encrypted:	false
SSDEEP:	48:ztn5nu3ODUHnQoBY3Y5A7ysNqk06CNGkODUHnUQujBY3Y5A7ysZ:znuAUHbyo5A7doN6CNGnUHijyo5A7dZ
MD5:	3F46A819D1A3863711B37EF778CA3D48
SHA1:	DC8B0D722F9AB0E6F67FF3E616366442DD07CB19
SHA-256:	BE16510832EDA25D3763BA45887581B773A3B325B064F73A6752D063E0D1F177
SHA-512:	4C9791D8F81A33D9A5B1B8F4E33EC25FA2AAA217C6EB8C772E8A1C53E670E4157ACC32DF15A16537E1D565D330812C8467C7F8564601CC47C069D28459C0F10F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mt,v 1.10 2006-06-14 21:43:30 svu Exp $..// Maltese keyboard map (based on MSA Standard DMS100).// by Ramon Casha (ramon.casha@linux.org.mt).//.// $XFree86: xc/programs/xkbcomp/symbols/mt,v 1.3 2002/12/13 04:18:04 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Malta";.. // The following four sets are the four additional letters, with the UK. // equivalents. key <TLDE>.{ [ cabovedot, Cabovedot, grave, notsign ].};. key <AD11>.{ [ gabovedot, Gabovedot, bracketleft, braceleft ].};. key <AD12>.{ [ hstroke, Hstroke, bracketright, braceright ].};. key <LSGT>.{ [ zabovedot, Zabovedot, backslash, bar ].};.. // Euro symbol. key <AE03>.{ [ 3, EuroSign, sterling ].};.. // Long accent. key <AE06>.{ [ 6, asciicircum, dead_circumflex, dead_circumflex ].};.. // Normal accented vowe

C:\Program Files (x86)\Xming\xkb\symbols\mv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4135
Entropy (8bit):	4.318729242205518
Encrypted:	false
SSDEEP:	48:YFfzto1sF1HPQYHIrbFLEJmy1y8YGHbbFi7Zz8lzPTjVe+feEv:++0vQ3P1EVYybWz8lzYXEv
MD5:	922A2DF13BEB772E20BCD70646BA368C
SHA1:	DA48F7CC70CCBB55914A1EE9DE926885545B51C3
SHA-256:	0CB3A06772AD4E4FF4C1D3161FD14EEF393EC2CF7394C9207E53B0789075B1B1
SHA-512:	A941846E26537B759767A77A6B0528FE487E7F463EA5A7B964E3FC4C05A610A2150605C2AEB0F3DC556500D8958BE5798C8CF29DA9A513A76C362EBA12B7EBD6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/mv,v 1.1 2005-08-22 22:13:05 svu Exp $.//.// NOTES:.//.//Keymap for thaana/divehi script (divehi language)..partial default alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Maldives";..// The key <TLDE> should have the same values as US_en keyboard.. key <TLDE> { [.quoteleft, asciitilde ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenleft ] };. key <AE10

C:\Program Files (x86)\Xming\xkb\symbols\nbsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	5.172236149473688
Encrypted:	false
SSDEEP:	24:Yae3UyqvD94Wc4MC8GqpLGB6PRhH9qEkLGB6OUZ:Nys94WXMNpLGB6fIFLGB6x
MD5:	EBF52A19433EC07707B427C6B04BB59E
SHA1:	1E448C78137885E4382C2725B722D82109C46B7E
SHA-256:	596563C1774115A9204ABA5CB78A434DF5FB5C3F3F868000899D0A28F5BCAB96
SHA-512:	96B45313F38A4AF0B910BDEFEDB8D01E4180A312FF545053D0FEDC49B539BFC52DF2DA03C719C19BD8C1EEAE4AB6A72FE68639E2166368999072C390D0A1B3D6
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/nbsp,v 1.3 2007-01-04 23:31:30 svu Exp $.//..// Let space provide nobreakspace for the desired level...partial.xkb_symbols "none" {. key <SPCE> {. type[Group1]="ONE_LEVEL",. symbols[Group1]= [ space ]. };.};..partial.xkb_symbols "level2" {. key <SPCE> {. type[Group1]="TWO_LEVEL",. symbols[Group1]= [ space, nobreakspace ]. };.};...// level3 & level3ns provide no-breaking spaces starting from level3.// This is good for typographers but experience shows many users accidently.// type no-breaking spaces on the CLI (resulting in errors).// Used by fr(latin9).partial.xkb_symbols "level3" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace ]. };.};..// level3s kills fourth level.// Used by ca(multix).partial.xkb_symbols "level3s" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace, NoSymbol ]. };.};..// level3n provides narrow no-br

C:\Program Files (x86)\Xming\xkb\symbols\nec_vndr\is-90668.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6255
Entropy (8bit):	5.144533705805175
Encrypted:	false
SSDEEP:	96:QCzUqYQHKQgrTL/BrBtFvWOduf7v3VcT8rKryKtV8R:VYQHHgrTpdvWOcv3RCyKt6R
MD5:	FD16D1BAA7F3535E98474EBDC730B312
SHA1:	15B223313F19BE501E5A3A2FA3CC54A58619CEEB
SHA-256:	661F42CF3464AE5360B34549545AD8523D9EAC0DCB2BDD6D4B55B34AA2A689AA
SHA-512:	AB401FF114ED69C93D056C0CBCB772DAA3C078B63C435081F00676DDA1D8C2317744EBD68337F957C6D83ECD8DB6FCBC02FC87724FCB48C03DE22A834D495DED
Malicious:	false
Preview:	// $Xorg: jp,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\nec_vndr\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6255
Entropy (8bit):	5.144533705805175
Encrypted:	false
SSDEEP:	96:QCzUqYQHKQgrTL/BrBtFvWOduf7v3VcT8rKryKtV8R:VYQHHgrTpdvWOcv3RCyKt6R
MD5:	FD16D1BAA7F3535E98474EBDC730B312
SHA1:	15B223313F19BE501E5A3A2FA3CC54A58619CEEB
SHA-256:	661F42CF3464AE5360B34549545AD8523D9EAC0DCB2BDD6D4B55B34AA2A689AA
SHA-512:	AB401FF114ED69C93D056C0CBCB772DAA3C078B63C435081F00676DDA1D8C2317744EBD68337F957C6D83ECD8DB6FCBC02FC87724FCB48C03DE22A834D495DED
Malicious:	false
Preview:	// $Xorg: jp,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\ng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	4.637678775632978
Encrypted:	false
SSDEEP:	24:YaT46+75te600EyYYwaf9T360kCMyYjLPeiUtmP5Mbt9m4bFf9a0y60PHyYfCp88:t+tw0E5kLkn5HVfPIe0+PH50tz8Ebv
MD5:	70D1203167B0B83B523D1EE890933C9F
SHA1:	84D7AFCC565FB9EF928BF4902B00F70F499A01EB
SHA-256:	0DA83BF33E591FA2A649323EDCACE663BB7AD7342612615DA0293F3282BA20A4
SHA-512:	544A2A4404EBD00518B89F3A486F0912D29B8E10B438B3DDB039BDDF7A74A9497560EB22D0FB7CEDBECBB4CB4E1FB76A259A09AD385DBE983F0A9F1D040B4C47
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ng,v 1.2 2006-10-11 19:32:35 svu Exp $.//..partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Nigeria";. key <AE04> { [ 4, 0x010020A6, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "yoruba" {. include "ng(basic)".. name[Group1]= "Nigeria - Yoruba";.. key <AD01> { [ 0x01001EB9, 0x01001EB8, q, Q ] };. key <AB02> { [ 0x01001ECD, 0x01001ECC, x, X ] }; . key <AB04> { [ 0x01001E63, 0x01001E62, v, V ] }; .};..partial alphanumeric_keys.xkb_symbols "igbo" {. include "ng(basic)".. name[Group1]= "Nigeria - Igbo";.. key <AD01> { [ 0x01001ECB, 0x01001ECA, q, Q ] };. key <AB02> { [ 0x01001E45, 0x01001E44, x, X ] }; . key <AC10> { [ 0x01001EE5, 0x01001EE4, semicolon,. colon ] };. key <AD11> { [ 0x01001ECD, 0x

C:\Program Files (x86)\Xming\xkb\symbols\nl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7150
Entropy (8bit):	4.06496731074999
Encrypted:	false
SSDEEP:	96:ewgocfSSvoHXMQwaPD8Tyd7bAnTKrr6GDo1gWImnygy:escfdvocQwaATyd4KyGDVW5ygy
MD5:	57FC3BC30B3500AA311D60D9E33DB698
SHA1:	87BF7A3732C29C6C8F53D8DB630F005C65806C70
SHA-256:	63510789813C4B6238608AE8DADF21F589AEDD9A0601D15F12117E2184F615F8
SHA-512:	3980D6F10655FD57BA1A9543C081A5C24F7334AE0024AD364CB3372048FB0592CA75BA62D47C3922CF39009251083E2745A97637ED805CD8A51C47DBCD0217B7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/nl,v 1.10 2007-01-11 22:58:48 svu Exp $..// Basic layout based on converted file, from keytable file to xkb/symbols/ file.// with mk_xkb by root@linux.chanae.stben.be Tue Sep 30 00:53:29 MET DST 1997..// Converted from the nl-latin.map of the Linux kbd package by.// Pablo Saratxaga <srtxg@f2219.n293.z2.fidonet.org>.//.// $XFree86: xc/programs/xkbcomp/symbols/nl,v 1.2 2002/11/22 04:03:28 dawes Exp $..// Official layout by Benno Schulenberg <bensberg@justemail.net>, January 2007,.// based on http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Netherlands";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE06>.{ [ 6, ampersand, threequarters, fiveeighths ].};. key <AE07>.{ [ 7, underscore, sterling, seveneighths ].};. key <AE08>.{ [ 8, parenleft, braceleft,

C:\Program Files (x86)\Xming\xkb\symbols\no (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	9897
Entropy (8bit):	4.6395109627008555
Encrypted:	false
SSDEEP:	192:/rRxNw1k6IFd4BV+Ntrqta1Nrs4ncq8lSL9QkIjF3nyNerYYjnP8xI+4nx:/rHK1k6I6V+br+anrRnL8uu3nprYwnPv
MD5:	7A4F5D8D109BDFC727D1958FCCBBBA6F
SHA1:	29CDF8E57ACED5AD9654362D069F0900718052BE
SHA-256:	FACA390228B14231EF8CBAC4076AD71224A9EB403E1D784B32C84F59EB4C05E4
SHA-512:	CF80B82D0488D5CAF9FE84496C375C4F475EBB39CFB7CA3C3BA742FE61555C0FF60DCE826E11F749FEEF08EB97F62066B9C684D968A4C6C3D94B2B96B2AEC8F9
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/no' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/no,v 1.12 2006-10-03 22:47:43 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/no,v 1.3 2002/12/19 01:07:56 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Norwegian keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin(type2)".. name[Group1]="Norway";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [ backslash, dead_grave, dead_acute, notsign ].};... key <AC10>.{ [ oslash, Ooblique, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ ae, AE, dead_circumflex, dead_caron].};. key <TLDE>.{ [ bar, section, brokenbar, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};. key <LSGT>.{ [

C:\Program Files (x86)\Xming\xkb\symbols\np (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3047
Entropy (8bit):	4.218488927286778
Encrypted:	false
SSDEEP:	48:aEEDD56xCrLRy1GNjsbcrpuxhYndjzJVZoo6flzTZrdhfA/yurvhnEiIwFFGVmdr:HKwCrVy1GNjsgluxhYntzJ7oo6flzTZK
MD5:	6B56923E4D6059E6189A833C9F0F18B8
SHA1:	9E6EFDEE77411720C4E3C4F6D90AD5DB39ADFDBF
SHA-256:	297F056DB8AC631C4DA4F562F57160594C7579DE670177E580F4DC13176E5CC7
SHA-512:	3EBA34458C8787D18777CA46208054D691F86B96F2D0CB6EE80DE279ED60F8DDEDCA6EE9E50BEAE312EDE3836BB6FFE9E551BE83893A7F1E5A3ECED777F0A336
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/np,v 1.2 2006-10-03 22:33:37 svu Exp $..// based on a keyboard map from an 'xkb/symbols/dev' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pc/dev,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Nepal";..// `,1,2,3,4,5,6,7,8,9,0,-,=.. key <TLDE> { [ 0x100093D,0x100093C ].};. key <AE01> { [ 0x1000967. ..].};. key <AE02> { [ 0x1000968...].};. key <AE03> { [ 0x1000969 . ..].};. key <AE04> { [ 0x100096A . ..].};. key <AE05> { [ 0x100096B . ..].};. key <AE06> { [ 0x100096C . ..].};. key <AE07> { [ 0x100096D ].};. key <AE08> { [ 0x100096e . ..].};. key <AE09> { [ 0x100096F. ..].};. key <AE10> { [ 0x1000966,0x1000970..].};. key <AE11> { [ minus, 0x1000952 ..].};. key <AE12> { [ equal, 0x100200C ..].};..// q,w,e,r,t,y,

C:\Program Files (x86)\Xming\xkb\symbols\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3656
Entropy (8bit):	5.170714878135555
Encrypted:	false
SSDEEP:	48:ZKE2dEIkOLJ2vqBmCSxtU4qNQFaApC914C5:MtwyII75
MD5:	36C40EC96D3C971D6B78A6B8F16E1469
SHA1:	F8F99AC611F2A12F35969114051CD4D380F54B0F
SHA-256:	CB3C5561A687FAA237A6D0DD7B79F617287F91AA2B0F7750E951AC718D4E3C15
SHA-512:	F43E619581001F03C8DC6C40FC2DAE07311E250B3AE4065CD4FED69EB692EE437F23648C4EF5D38A484F510DA2B86664A38A58E503D2748898D5EF9DABAA67A8
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pc,v 1.7 2007-01-02 20:56:55 svu Exp $..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, brokenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {. type="CTRL+ALT",. symbols[Group1]= [ BackSpace, Terminate_Server ]. };.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};.. key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};.. key <RTSH> {.

C:\Program Files (x86)\Xming\xkb\symbols\pk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3445
Entropy (8bit):	4.705070218017659
Encrypted:	false
SSDEEP:	48:ktpEMl4nSp5X9nUXjjPft2Ru5/vGhS3dD3DfcPI08bWEvtm9JLQr+xftspDyflS2:nnSLtnOjj15/P9g38bWEvsYr+fQyfUfu
MD5:	CC31D57D596BF413C0038B3B9C6A7105
SHA1:	4A43A24A939B3B323A916FD6BAB17D4BC3E691A9
SHA-256:	87306A1BA3AA9AB90188533180247B64AB02E30AA80894495EB7984A2AB9464A
SHA-512:	D3C04CEDCAB124324911B0374B5AE8EC267B5BC75D8B442033BA454F5B3DA6DCD6187E71083512BFFCA79D83DA331749ACB4E16AB4CD347FE5DEA2AA83FBE6B5
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pk,v 1.1 2005-07-30 02:32:00 svu Exp $..// Urdu keymap.// Developed by:.// Zaeem Arshad <zaeem@linux.net.pk>.// Last update: 2004-03-12.//Notice:.//Alt key combinations are yet to be put in. The unavailable keys are those which do not have a corresponding //glyph in unicode...partial default alphanumeric_keys.xkb_symbols "urd" {. name[Group1]= "Pakistan";.. // Keys '~' - '='. // All keys checked and complete. key <TLDE> { [ 0x10006d4 ] };. key <AE01> { [ 0x1000661, exclam ] };. key <AE02> { [ 0x1000662, 0x1000040 ] };. key <AE03> { [ 0x1000663, 0x1000023 ] };. key <AE04> { [ 0x10006f4, 0x1000024 ] };. key <AE05> { [ 0x10006f5, 0x1000025 ] };. key <AE06> { [ 0x1000666, 0x100005e ] };. key <AE07> { [ 0x1000667, 0x1000026 ] };. key <AE08> { [ 0x1000668, asterisk ] };. key <AE09> { [ 0x1000669, parenleft ] };. key <AE10> { [ 0x1000660, parenright ] };. k

C:\Program Files (x86)\Xming\xkb\symbols\pl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	4.594277169221976
Encrypted:	false
SSDEEP:	96:zzCTNTnrYJPJYJx53f8laXQ8yHXN2GCXLvtJXR1WuoUYnXT1g:zkhrYJRYlEh8uXNrsjtJXRkXUsjK
MD5:	C26294A0983A5EBD84155E1E989AA10E
SHA1:	5C4710847D8F8A76A87EDCA7DC320E1BCEDB39E7
SHA-256:	2558D2482DA06B5AF4B2EDCEE8336B822C3F0585C3A63F106ADE9E82D686484A
SHA-512:	36FD908D5DE3B1A7D87923B658C6554A4D41DB376785B5FEEC4CEBA79D6A0896572A65FFBD6BE6D88D1A7FE4D52A2EDDC12C791E055ADE6FEC6CB697AD0338E0
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pl,v 1.10 2006-07-30 19:28:56 svu Exp $..// based on a keyboard map from an 'xkb/symbols/pl' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pl,v 1.3 2003/04/19 12:22:12 pascal Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Poland";.. key <AD03>.{ [ e, E, eogonek, Eogonek ].};. key <AD09>.{ [ o, O, oacute, Oacute ].};.. key <AC01>.{ [ a, A, aogonek, Aogonek ].};. key <AC02>.{ [ s, S, sacute, Sacute ].};.. key <AB01>.{ [ z, Z, zabovedot, Zabovedot ].};. key <AB02>.{ [ x, X, zacute, Zacute ].};. key <AB03>.{ [ c, C, cacute, Cacute ].};. key <AB06>.{ [ n, N, nacute, Nacute ].};.. include "keypad(comma)".. include "level3(ralt_switch

C:\Program Files (x86)\Xming\xkb\symbols\pt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3831
Entropy (8bit):	4.919833064694103
Encrypted:	false
SSDEEP:	96:cIdihfAtse/EX/Lu75mnrYKZ8xUbAyirH:cfhfAtse/wvrYKZ8xUbAyi7
MD5:	E8F801F2B9909B7123F73265C225F352
SHA1:	735B0B50C8B6E13274B949C518A9FAED3D4707CA
SHA-256:	BCD13DA6B926A801A0B44D5A033EE58B0097D2DD455D366F48770BF22DB0D1CB
SHA-512:	5CFB511A53A5C87DEB87DE2141CDAB143D1B34BF52ADAEEAC124172617E78DC2E0066CDF471083DB2C754497CA4C35A81C19EA4F500D73CFB6277DF8B104863D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/pt,v 1.10 2006-10-03 22:47:43 svu Exp $..// based on a keyboard map from an 'xkb/symbols/pt' file.//.// $XFree86: xc/programs/xkbcomp/symbols/pt,v 1.2 2002/11/22 04:03:28 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Portugal";.. key <LSGT> { [ less, greater ] };. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, dollar, section, dollar ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [guillemotleft, guillemotright, dead_cedilla, dead_ogonek ] };.. key <AD11>.{ [ plus, asterisk, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [dead_acute, dead_grave, dead_tilde, dead_macron ].};.. key <AC10>.{ [ ccedilla, Ccedilla, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ masculine, ordfeminine, dead_circumflex, dead

C:\Program Files (x86)\Xming\xkb\symbols\ro (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9716
Entropy (8bit):	4.3624319406018754
Encrypted:	false
SSDEEP:	192:EkxkdPdDJJuXoJXtPq7DJJDwzCJLneeG7dtJUPzzvI:6PdDfuXoJXBq7DbDwzCJLneeMtJUbzvI
MD5:	4A5DC42A5A6DB3E338A599E7EDE7D8D9
SHA1:	21B3A66716B99611F28CD3D7E294D0F8B4CA086A
SHA-256:	813BF19CAF5B97D5B38EDFBF0990D143D2FCAB4846B34A8FCCCC32816BF7A58A
SHA-512:	81E16D8CCEAF6E13D9D7819A469D4F5727F6CAD6F0B30D789C1D620F1D79AB7ABA2639F19AF1B445369435348076C747320B8CA150CA28F77DAE2D5493ADB03A
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ro,v 1.12 2006-07-02 21:05:20 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/ro,v 1.6 2003/09/08 13:12:51 pascal Exp $.//.// Complete set of Romanian keyboards as described in the new Romanian standard.// SR 13392:2004 adopted in December 2004 by ASRO, "Asociatia de Standardizare .// din Romania"..// .// The default mapping is the RO_US/Programmers layout because of the lack of .// Romanian hardware keyboards. The primary standard layout is implemented as .// the "std" variant. If you're really determined to get commas bellow as in .// ISO-8859-16 (and not cedillas as in ISO-8859-2) use the already defined .// variants: "comma" for the default layout or "academic" for the standard one..// MS compatible layout included (use the "winkeys" variant)..// .// Created by Cristian Gafton, <gafton@redhat.com> (C) 2000.// Modified by Marius Andreiana, <mandreiana@yahoo.com> (C) 2001.// Completed by Misu Moldovan, <dumol@gnome.ro> (C) 2001

C:\Program Files (x86)\Xming\xkb\symbols\ru (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8706
Entropy (8bit):	4.711116140430485
Encrypted:	false
SSDEEP:	192:RC/odlswSdTPguNlETN1JtAUMrLdsflCuDa:R6guTPguDErJStcCuDa
MD5:	74CB09236BA5243E23A543ED3842C819
SHA1:	DE9C3F6A48407A784B3D3F9F2C62F358FE2B20C7
SHA-256:	64055AD26EF90313EA84A8BF109BFF6071DC80423CCD1300A696A4069D5432F5
SHA-512:	166A02C649F4A652EAB8608BE2F06062D95CD060CACE78810D21F8423B3FB5E3558F95A3FC3ACB0F071F00587941EAA4EC98F2AE56DB55B8CE42A20F5D4E4022
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ru,v 1.11 2006-09-04 20:25:10 svu Exp $..// based on.// russian standard keyboard.// AEN <aen@logic.ru>.// 2001/12/23 by Leon Kanter <leon@blackcatlinux.com>.// 2005/12/09 Valery Inozemtsev <shrek@altlinux.ru>.//.// $XFree86: xc/programs/xkbcomp/symbols/ru,v 1.3 2003/02/15 22:27:05 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Russia";.. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numbersign.].};. key.<AE04> {.[..4, asterisk.].};. key.<AE05> {.[..5,. colon.].};. key.<AE06> {.[..6,. comma.].};. key.<AE07> {.[..7,. period.].};. key.<AE08> {.[..8,. semicolon.].};. key.<AE09> {.[..9,. parenleft.].};. key.<AE10> {.[..0,.parenright.].};. key.<AE11> {.[. minus,.underscore.].};. key.<AE12> {.[. equal,. plus.].};. key.<BKSL> {.[.backslash, bar.].};. key.<AB10>

C:\Program Files (x86)\Xming\xkb\symbols\se (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	10000
Entropy (8bit):	4.694291609399501
Encrypted:	false
SSDEEP:	192:DHqg8Q3emHzt/aR1MUhgPTXHCoTMqZrYrkdNtMRuUXamMq7+t0uNkV:D3J3emZ/aRmUhgrSmMqZrYrkdNtMRuUb
MD5:	4FC1C82E2A9B1ECEA814C7D0EC9E82F9
SHA1:	61D46880837E3004EDDCB3012F17D4FDD438ED50
SHA-256:	65624BF3D1EDAFB446224A15284AFC4ACB1CF3AE0408E9A12155842F3BDA40AD
SHA-512:	11FB0614EE9356299387B90248D903330C2C83E86B0B1174DB17522316BF4DC2F62E7B9991BB26A6D9DEB44C6D13D2E8E6CF4F31D9EED09BCA1E271821D8A2C0
Malicious:	false
Preview:	.// based on a keyboard map from an 'xkb/symbols/se' file.//.// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/se,v 1.15 2007-04-04 23:03:15 svu Exp $.// $XFree86: xc/programs/xkbcomp/symbols/se,v 1.5 2003/01/26 02:01:48 dawes Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "se(se)".};..partial alphanumeric_keys.xkb_symbols "se" {.. name[Group1]="Sweden";.. key <AE05>.{ [ 5, percent, EuroSign, cent ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, plusminus, notsign ].};... key <AC10>.{ [odiaeresis, Odiaeresis, oslash, Ooblique ].};. key <AC11>.{ [adiaeresis, Adiaeresis, ae, AE ].};. key <TLDE>.{ [ section, onehalf, paragraph, threequarters].};.. key <BKSL>.{ [apostrophe, asterisk, acute, multiply ].};.. key <SPCE>.{ [ space, space, space, no

C:\Program Files (x86)\Xming\xkb\symbols\sgi_vndr\is-02QVT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2143
Entropy (8bit):	3.8609812321607153
Encrypted:	false
SSDEEP:	24:WROL0WNRDxsZ6t8mgnA4vUemV097x478TYmQb3kjmZqW1L3pbVJ9/EO6CSIaB4Rj:EOobgZCCV5dEhIhuc
MD5:	A0FB045B73AA4DB9867F6F08FACA45BD
SHA1:	67B79EBB401E1931EF413670AC95CA358C89A49A
SHA-256:	A80AB827EF8F3E04307BB039147EEE7BA34B7F96D83E7607BA9338E9E2B8FD02
SHA-512:	0E390B8920EF5AB74E5B6F85C26188A2094F5E8927EE2D172839DA477CB36898A4A3EA543D8CBD347684C06AC1905C5C51F4A09991C673A88A68AABD0F3A8590
Malicious:	false
Preview:	// $Xorg: jp,v 1.3 2000/08/17 19:54:45 cpqbld Exp $.xkb_symbols "jp106" {.. name[group1]="Japan/ASCII";.. key <HZTG> { [ Zenkaku_Hankaku .. ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, quotedbl ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, apostrophe ] };. key <AE08> { [ 8, parenleft ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, asciitilde ] };. key <AE11> { [ minus, equal ] };. key <AE12> { [ asciicircum, overbar ] };. key <AE13> { [ yen, ba

C:\Program Files (x86)\Xming\xkb\symbols\sgi_vndr\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2143
Entropy (8bit):	3.8609812321607153
Encrypted:	false
SSDEEP:	24:WROL0WNRDxsZ6t8mgnA4vUemV097x478TYmQb3kjmZqW1L3pbVJ9/EO6CSIaB4Rj:EOobgZCCV5dEhIhuc
MD5:	A0FB045B73AA4DB9867F6F08FACA45BD
SHA1:	67B79EBB401E1931EF413670AC95CA358C89A49A
SHA-256:	A80AB827EF8F3E04307BB039147EEE7BA34B7F96D83E7607BA9338E9E2B8FD02
SHA-512:	0E390B8920EF5AB74E5B6F85C26188A2094F5E8927EE2D172839DA477CB36898A4A3EA543D8CBD347684C06AC1905C5C51F4A09991C673A88A68AABD0F3A8590
Malicious:	false
Preview:	// $Xorg: jp,v 1.3 2000/08/17 19:54:45 cpqbld Exp $.xkb_symbols "jp106" {.. name[group1]="Japan/ASCII";.. key <HZTG> { [ Zenkaku_Hankaku .. ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, quotedbl ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, apostrophe ] };. key <AE08> { [ 8, parenleft ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, asciitilde ] };. key <AE11> { [ minus, equal ] };. key <AE12> { [ asciicircum, overbar ] };. key <AE13> { [ yen, ba

C:\Program Files (x86)\Xming\xkb\symbols\si (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	822
Entropy (8bit):	4.99471794445411
Encrypted:	false
SSDEEP:	24:YaX+a60z56aZI76BMMZXz6NZoC6BlBZI5R:PzZLYmvWR
MD5:	A3EEB6C53D58880DADA061270259904E
SHA1:	995806C5A1106511D416A61512470F50DFB02D7B
SHA-256:	3084E9C43381A0A6E8DBDA59C3A5DD1F72262C86BDB57F5F2D99F4DB2AD6FD4C
SHA-512:	7E34E976CC97F684D937A9C14BB0F2B5CE4DA7FB0D9319A948DF27908ABCCADCF54D38FE9CB1942483EB771997DD12587C38FCA61225E7566356EACE5424D8A7
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/si,v 1.8 2006-10-11 19:32:35 svu Exp $.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Slovenia";.. include "cs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Slovenia - US keyboard with Slovenian letters";.. include "cs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Slovenia - Use guillemets for quotes";.. include "cs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Slovenia - Use Slovenian digraphs";.. include "cs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Slovenia - US keyboard with Slovenian digraphs";.. include "cs(latinunicodeyz)".};.

C:\Program Files (x86)\Xming\xkb\symbols\sk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5346
Entropy (8bit):	4.463581487211096
Encrypted:	false
SSDEEP:	48:aJS+3kwJOYnXaGsIyvgjobiI2jl0R+l85MyZJ2mxKt3cQZz8mQ:VwfnXSIrjobiI2JcDyMJ2zz89
MD5:	D6E69779376DFF7C800CA4DBBB3ECC51
SHA1:	B60F3CDE725FA40524CB384BDC302E01867BE435
SHA-256:	B3CB5935C7F7F848A2EDBF35BC3F5CF31E62EA05DE7F04A8E1B8A76456F88B20
SHA-512:	337074324D2F75C800145EB063D664DFA50A645E0B52D2BE7BE361C16814DC284E700213906BFECE44D975798E7D1BDDDE0913404EF1EAA8DB353F0AA913B244
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/sk,v 1.8 2005-01-16 02:18:20 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/sk,v 1.2 2002/11/22 04:02:22 dawes .// Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. . // This layout conforms to a new sk compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1] = "Slovakia";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ lcaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ tcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <

C:\Program Files (x86)\Xming\xkb\symbols\sony_vndr\is-9GFBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	5.259479046322673
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFYmwuphGWFuG1GNwthn/oIToI:OCzUqYQHKQgrTLnJhG+fGNkhsI
MD5:	A2D9292E0829154D04151DBA2839F7AF
SHA1:	E006A61C5D8CD2F24238F62AA556FABBA1B1817A
SHA-256:	A4497038CDD2C03889C397CB8DCDD91A59C16F95460A41572BAE0EC3EC79F7FD
SHA-512:	84E1BB0CE9DF9665B2F9F3719297111E8427123BA697442069F9ACC3EC919E8946FA965853AC721E58A2AD16232D617A7D0603490D900A0436F0D3C741323BE5
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\sony_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	5.259479046322673
Encrypted:	false
SSDEEP:	48:kWritctUOUqYQHEssz4INW3Z2rmUaOYCFYmwuphGWFuG1GNwthn/oIToI:OCzUqYQHKQgrTLnJhG+fGNkhsI
MD5:	A2D9292E0829154D04151DBA2839F7AF
SHA1:	E006A61C5D8CD2F24238F62AA556FABBA1B1817A
SHA-256:	A4497038CDD2C03889C397CB8DCDD91A59C16F95460A41572BAE0EC3EC79F7FD
SHA-512:	84E1BB0CE9DF9665B2F9F3719297111E8427123BA697442069F9ACC3EC919E8946FA965853AC721E58A2AD16232D617A7D0603490D900A0436F0D3C741323BE5
Malicious:	false
Preview:	// $Xorg: us,v 1.4 2001/02/09 02:05:53 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..

C:\Program Files (x86)\Xming\xkb\symbols\srvr_ctrl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	5.427530323020008
Encrypted:	false
SSDEEP:	48:fb7GPff6BtRx2afogPUmoAwdtClxf8oaZC:CERx9QrrdIrf8oaU
MD5:	8FD7AD49B34B242CDA7F8C9E6CD280DC
SHA1:	45B3B704DA26AE7398F3B5F9A7FD2A844DE9399A
SHA-256:	DBF0738C66DFE3275B3C0B9F72D0A39D8A93B30D37F463BF0C0A0A77E9791149
SHA-512:	C1D852618E17880E675A31AEFF9F0287F373A4D40CE0D7AA12290FE6B53D650200D1EF31CE7FC8D7B7895A99F380D34E55AA4BA77A07E4E633E7CB6971504060
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/srvr_ctrl,v 1.2 2004-10-09 18:34:15 svu Exp $..// $XFree86: xc/programs/xkbcomp/symbols/srvr_ctrl,v 1.4 2003/12/18 14:14:38 pascal Exp $.//.// Actions which control the server's behavior..partial keypad_keys function_keys.xkb_symbols "xfree86" {. include "srvr_ctrl(stdkeypad)". include "srvr_ctrl(fkey2vt)".};..partial keypad_keys .xkb_symbols "stdkeypad" {.. key <BKSP> {..type="CTRL+ALT",..symbols[Group1]= [ BackSpace, Terminate_Server ]. };..// Ungrab cancels server/keyboard/pointer grabs. key <KPDV> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Divide,.XF86_Ungrab ]. };..// ClsGrb kills whichever client has a grab in effect. key <KPMU> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Multiply,.XF86_ClearGrab ]. };..// -VMode switches to the previous video mode. key <KPSU> {..type="CTRL+ALT",..symbols[Group1]= [ KP_Subtract, XF86_Prev_VMode ]. };..// +VMode switches to the next video mode. key <KPAD> {..ty

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.204341456704585
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY7EmFSNdrzrQaa:OePIa23fQHG49cF51eNrxN8EmmNzda
MD5:	9392C7B8EFDC6989111C18B15354FA2B
SHA1:	A15D8092762FD5AC53F4B169676B6122449F2B3D
SHA-256:	599C6EDC0B1751917F09E562FF8371E83369D827E04080341DCD2C0B86E847E2
SHA-512:	3C2806F4909BFC2F404A3FF56208DAC30CE8EED0D5C0A0525A80D10349EEC2B3CE9C1275E596820EAB6485EE7F54E386A65EE66BB3499084059619412C87CBA8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\cz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.204341456704585
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY7EmFSNdrzrQaa:OePIa23fQHG49cF51eNrxN8EmmNzda
MD5:	9392C7B8EFDC6989111C18B15354FA2B
SHA1:	A15D8092762FD5AC53F4B169676B6122449F2B3D
SHA-256:	599C6EDC0B1751917F09E562FF8371E83369D827E04080341DCD2C0B86E847E2
SHA-512:	3C2806F4909BFC2F404A3FF56208DAC30CE8EED0D5C0A0525A80D10349EEC2B3CE9C1275E596820EAB6485EE7F54E386A65EE66BB3499084059619412C87CBA8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\de (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3695
Entropy (8bit):	4.5794765886547415
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNmqYrpo/6ipJKGQ8P:OhQHV9cF51mrxwqYe/6ipJK5y
MD5:	AA3FE84BD9CA51ED45E15C8A50EC47BA
SHA1:	9A7DF23FB961AB8F44A198A1919D8AD9561618F5
SHA-256:	DC0D2667C98E26FA2FE5BCF91311E9D5B261AEB1E6AC74B49DFDD39554958F28
SHA-512:	63287244190603DB6C6DBA6A49696147FE7A061A85F8B665B6CC7194780847508DBF547751F144EEFA56EF8EF2C90BAF0BD7405A388121F8D87FD33B62F979A7
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\dk (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3301
Entropy (8bit):	5.290877064154622
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNN+a2dj/3oxbGGFp4/r:OhQHV9cF51mrxn+ndj/4R/p4/r
MD5:	B2E5E743544A38BD137FB67F8559347E
SHA1:	45CD2AAFBF189BBE2939FE1D0C1587C09AB5CF01
SHA-256:	AE682C08996EE804AEC65F7F9080CFD53BA82F754196202B9B1211CBB6C6455A
SHA-512:	534A9BD74C8C45CD871A7CF322649F818709B9E12E9C41BDB792F443F9FCC84F6D47E6CD0B01F110C41B319333B93ACB44FA5C7E2871A7CA907F980C88F5EA7F
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\es (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	5.064247442678256
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNMvrSr8/0+AilIWFp4/PTBFp4/N:OhQHV9cF51mrxWDSo/07ie0p4/PTHp4F
MD5:	3F15A15BD110A03A85E1D8061537B2C5
SHA1:	FC37B85779E3569EAA112ADAAC6B963232F5325E
SHA-256:	A8D9F183D6ED74F36ECC567F511DC2846A1A6BBD363576D9D0EC2B02B8F374C3
SHA-512:	04DDD5695E416CCDEAB7CB3F6F5F3D6040786B0019D784013BC45BA7480DE54B41F06086A751B03623FAD8134196609EDC252D50DF99E2DD0A0215A7B20783AB
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\fi (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	5.146173563449571
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYJuxV:OePIa23fQHG49cF51eNrxNJxV
MD5:	BAE5349749949505D4E48B17BE82A952
SHA1:	1A7CF87ABAE772E23A5C1CDDC8DC3C57A3EEEC89
SHA-256:	20451FC2BE0D43B5A6EAABB5CDB876DDBAD223AB6E5AD85DFF82891B84E1123A
SHA-512:	CE5C8AFFFB9599F61773C59C947906E2BD482604E06E273AEBAA662E2FA69899377F8F9B2FCE529A1FB5F3A971D6C12EDEA9D51E7D33A303C32E4674B19BB600
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\fr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3405
Entropy (8bit):	5.245853841775105
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxN+lNe5MCWDtnafr/jZ:OhQHV9cF51mrxwlNe5MCWpnKr1
MD5:	56B4AB5DEF992F7B6ACB62A37BF8C8F7
SHA1:	7D209FD0345E6BB7E6680100557DC2B494BCB646
SHA-256:	DB83C3244626ED5157538488DB010C0A9F68358D60BF8CBB58F87C1074C759B1
SHA-512:	73FDF3C60B88E418DDD7C6A188A638D8672550143B3328074A735105AB626764E12424BBEAF1A5FAB62C3FE2E261269D0000CB5285307E1F1AA409F1978DD7F7
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\gb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	5.299945867858995
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYQb:OePIa23fQHG49cF51eNrxNPb
MD5:	49B905120ED3587817A3844C8C77ECD2
SHA1:	966D7A3430D3D10E6C5EFC52CB5E1E45FE4199E2
SHA-256:	3378D588DB3CD36F8CFB478218FDB8048E2AFAFC33CBC3CE7EFCDE49F0909EDB
SHA-512:	169A16A4093624FC8E31595B7530EDF52EB56808CAF62328F8A9F6058C1153BFB3A253BEDD34C5F809CF1E71DD6D7841366D28E48E839A61A16F5669E1D35035
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\gr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1863
Entropy (8bit):	5.2059973962162
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY9/:OePIa23fQHG49cF51eNrxNW/
MD5:	B5AAB259488CFA064B2D154677D62D30
SHA1:	7406ADB485101E969AB8260F9732481C7E3D246F
SHA-256:	A992467511C71F59E4DD494DADFFCE5B4D7A48C6912B4AC051E1EE90E17C3183
SHA-512:	DED1B0927A2662F06B046131DF2EF77393F11CFEB973F64F09AFD265BADF6AD66C22781893BC97178BADF447CC72BED1236EBB4286460923DCC4274D135BE987
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\hu (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3415
Entropy (8bit):	5.261479514362835
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNkHneT0EnfPCoCNoA7xY7Ad5zuO8:OhQHV9cF51mrxaeT0Mf6JNL7C74zuO8
MD5:	521C8705498E5F579F6139AE5A2E9AC7
SHA1:	7BFDE2FAB9E8BAAEED1E0804DC96CE3BC3586B02
SHA-256:	47ACED61A7AAED1250CD5478EEF2186DD580594FB9D429D7D8877FC3C3C806B5
SHA-512:	D84D88A86E1CD831F7D4E05BF27E386D23C8003BAAC4603B184B7970F2DBB6D5775E5913BD9A3BF53C12B02F3C0E72B3F6D3F4F52A1AFB0AC9F07343BC587123
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-0IPGK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.204341456704585
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY7EmFSNdrzrQaa:OePIa23fQHG49cF51eNrxN8EmmNzda
MD5:	9392C7B8EFDC6989111C18B15354FA2B
SHA1:	A15D8092762FD5AC53F4B169676B6122449F2B3D
SHA-256:	599C6EDC0B1751917F09E562FF8371E83369D827E04080341DCD2C0B86E847E2
SHA-512:	3C2806F4909BFC2F404A3FF56208DAC30CE8EED0D5C0A0525A80D10349EEC2B3CE9C1275E596820EAB6485EE7F54E386A65EE66BB3499084059619412C87CBA8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-28GSC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3405
Entropy (8bit):	5.245853841775105
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxN+lNe5MCWDtnafr/jZ:OhQHV9cF51mrxwlNe5MCWpnKr1
MD5:	56B4AB5DEF992F7B6ACB62A37BF8C8F7
SHA1:	7D209FD0345E6BB7E6680100557DC2B494BCB646
SHA-256:	DB83C3244626ED5157538488DB010C0A9F68358D60BF8CBB58F87C1074C759B1
SHA-512:	73FDF3C60B88E418DDD7C6A188A638D8672550143B3328074A735105AB626764E12424BBEAF1A5FAB62C3FE2E261269D0000CB5285307E1F1AA409F1978DD7F7
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-34LN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	5.277795341749622
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYYeG/HOl0WTYwr:OePIa23fQHG49cF51eNrxNLeG/H40WT/
MD5:	8AD22E4C015E003DC91F19F1EA4724BA
SHA1:	0D78B589C1A8D445BD6FAD4B6575B90E96127B50
SHA-256:	3EAC0246B3D8E71941F125E6AE25A20ED8EBA80149C24328FE03CCE9168D65E9
SHA-512:	F637541D17BD1551BD51849D306F589A44AE508C64469C3E23D69756504E207312EEE3860FBE2511A7F928DE83F601CA4C92D078BCB003A9A2CD766CE07D522E
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-40H8L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	5.102069103886074
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNmENcfl/Tw4EgI8cfl/7V:OhQHV9cF51mrxYEifl/04EZTfl/7V
MD5:	5676BC6FB035B55C3469B5CC33F74491
SHA1:	44F4FE8974792C7F1F798B6EC4E8FB191A3485C4
SHA-256:	93C8EBED2B3E6B277A4DB112ADBB6364C21D3820F18D0E17027AE21C4CBFF9BB
SHA-512:	E3B8E1B9BDEFA1CFEF15E967A9242D2A24547FCF3421AFAB2FB0AB8434F148D5D86090E8EC45CB5ABD4D7BFF045DF01F467A5CB9AE623D97450B11C1D593DAC8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-4QRMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	5.064247442678256
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNMvrSr8/0+AilIWFp4/PTBFp4/N:OhQHV9cF51mrxWDSo/07ie0p4/PTHp4F
MD5:	3F15A15BD110A03A85E1D8061537B2C5
SHA1:	FC37B85779E3569EAA112ADAAC6B963232F5325E
SHA-256:	A8D9F183D6ED74F36ECC567F511DC2846A1A6BBD363576D9D0EC2B02B8F374C3
SHA-512:	04DDD5695E416CCDEAB7CB3F6F5F3D6040786B0019D784013BC45BA7480DE54B41F06086A751B03623FAD8134196609EDC252D50DF99E2DD0A0215A7B20783AB
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-4S0T4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8985
Entropy (8bit):	5.229945204770479
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrxdYQHHgrTZE2lNpGa0u2lFXf/f/1DiV:4B5YrxdYGgrT2KfguK1nf/1o
MD5:	C361250F2F11782FADCF4FE4B43081CE
SHA1:	381C557CB4BB7EC150899BD3929C2C3D8AB86CAF
SHA-256:	3B039421D08C84A879E8123A4C581D45F100046F052602A007688A932C3BBF54
SHA-512:	00A17936380F64F58BE33564D9A46FB496FCA5BA96742F5B3ADB648F2D956E45A597C8C7F677024BDE575BA12706C9A8A4829DBE783708A8FFB40A40490F29EE
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-5JIEO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3695
Entropy (8bit):	4.5794765886547415
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNmqYrpo/6ipJKGQ8P:OhQHV9cF51mrxwqYe/6ipJK5y
MD5:	AA3FE84BD9CA51ED45E15C8A50EC47BA
SHA1:	9A7DF23FB961AB8F44A198A1919D8AD9561618F5
SHA-256:	DC0D2667C98E26FA2FE5BCF91311E9D5B261AEB1E6AC74B49DFDD39554958F28
SHA-512:	63287244190603DB6C6DBA6A49696147FE7A061A85F8B665B6CC7194780847508DBF547751F144EEFA56EF8EF2C90BAF0BD7405A388121F8D87FD33B62F979A7
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-5TVH3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1863
Entropy (8bit):	5.2059973962162
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY9/:OePIa23fQHG49cF51eNrxNW/
MD5:	B5AAB259488CFA064B2D154677D62D30
SHA1:	7406ADB485101E969AB8260F9732481C7E3D246F
SHA-256:	A992467511C71F59E4DD494DADFFCE5B4D7A48C6912B4AC051E1EE90E17C3183
SHA-512:	DED1B0927A2662F06B046131DF2EF77393F11CFEB973F64F09AFD265BADF6AD66C22781893BC97178BADF447CC72BED1236EBB4286460923DCC4274D135BE987
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-679NP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	5.299945867858995
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYQb:OePIa23fQHG49cF51eNrxNPb
MD5:	49B905120ED3587817A3844C8C77ECD2
SHA1:	966D7A3430D3D10E6C5EFC52CB5E1E45FE4199E2
SHA-256:	3378D588DB3CD36F8CFB478218FDB8048E2AFAFC33CBC3CE7EFCDE49F0909EDB
SHA-512:	169A16A4093624FC8E31595B7530EDF52EB56808CAF62328F8A9F6058C1153BFB3A253BEDD34C5F809CF1E71DD6D7841366D28E48E839A61A16F5669E1D35035
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-68NP3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	5.255705384202102
Encrypted:	false
SSDEEP:	48:OY/DQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYWCRb:ODPIa23fQHG49cF51eNrxNTCRb
MD5:	7D867FE058469273DD6A793A364BF4AC
SHA1:	46E6B15369756885CF782F235582F52E1875AB0E
SHA-256:	B4A3802A4432172E5D7F1D4DFE3DC1A02DDE302505D88C6A2C9430B1D7B42ED3
SHA-512:	C9AA13ACBE9B1DF5EEFE12D593DE393E501A44D8026F2BA8DFF5A909EA3E8958DE9B405DD28897A65CC6AAF30B228B8E1A8D182D494AF730605FADCAED9C3439
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-6IMKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.278172983292095
Encrypted:	false
SSDEEP:	48:OY/DQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYFqZeoNeW:ODPIa23fQHG49cF51eNrxNOqJn
MD5:	E962DF371EF8DB859088D01CD928CC7E
SHA1:	6747F00DC85A81A2E2EC57E1DAD9DC95F7AAEB7A
SHA-256:	C2108968AEB2A843A8D01C507AE56BB997797BC4C9B3333870E53DCE0B4E8090
SHA-512:	2A31AC6584C26147CAC0751101B983199859F8EF6A60870170CF4EBB685DC4CC76EB977CA2E8834A1CBE6447436DD39A52BD0DD5D395CD59E465B0FEE8E73041
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-7H4TU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	5.146173563449571
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYJuxV:OePIa23fQHG49cF51eNrxNJxV
MD5:	BAE5349749949505D4E48B17BE82A952
SHA1:	1A7CF87ABAE772E23A5C1CDDC8DC3C57A3EEEC89
SHA-256:	20451FC2BE0D43B5A6EAABB5CDB876DDBAD223AB6E5AD85DFF82891B84E1123A
SHA-512:	CE5C8AFFFB9599F61773C59C947906E2BD482604E06E273AEBAA662E2FA69899377F8F9B2FCE529A1FB5F3A971D6C12EDEA9D51E7D33A303C32E4674B19BB600
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-9HPHE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	32425
Entropy (8bit):	5.0239882127890025
Encrypted:	false
SSDEEP:	384:4B5YrxdYGgrT9dgCRnaRsKgdgCRn3RxKK/QdgCRS3RBK1nf/1/cpo4lT3HoK1/3d:Y5YlFgHsPJ1810S
MD5:	256FD40801EC18AFD6DD7EAF40C32F31
SHA1:	4CC0ACC41A8BAC9CC588ACE0A5A7DD3B6008A7B2
SHA-256:	EA67C69B8BC40DECED16F3E369F3A0E972185FFC12DD5E6FA95FDF821E33ECDE
SHA-512:	CDBFC5A1CAD90728F1D85921BD5CE1013DF7460F5E77B18263AEEBE9E0EB9867F7B6C0AE7335C1A0093FE2692DC795622A5752A073DC524157894B9E98FAF669
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-A6OLG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7797
Entropy (8bit):	4.844922340661658
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrx4rYe/6ipJK5/m/CNVJ5SJ0mZ/u0dv8J4vdQ/usv8Gda:4B5Yrx40e/vpJU+/guJjZ/xv8iW/Rv8L
MD5:	DF166459C73ABB52A8F649788DA8E032
SHA1:	05471B624C244856FBAE5236B3463851DA5EA449
SHA-256:	9B52D9A18F5BF3513D5ACC512A924F63283ED49A015203C92A1322C94D4CF52C
SHA-512:	E3D847907BC083515E857878A107F47933464346C990DCBE291D10336A842DD855BD92829E33D21C6BF145A83811A858FC4D745595534E5F0625634686D541E4
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-ADJNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.136428361590648
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYJHatyQkHyY:OePIa23fQHG49cF51eNrxNAaRkSY
MD5:	3F65684A98EA49C92C315B5BD178C885
SHA1:	459D5AA470C753FFD0A1599B7B9279603AF1828B
SHA-256:	5B8F3548CC36C51BBA8588C1E2988C33BCF8776168B0FFFB6BED1D2FB1037855
SHA-512:	ACB0CE5DEBD849AB99173B7EEF9E7F4644FA5EE4B99FD44386CC35FA67A0C6A13777C7B55BE3C57C47E65CDCBD1EF55BAE2C0697B4368AFF6ECDAE9EE2F48A65
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-D9RRA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3776
Entropy (8bit):	5.293990169415956
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNsovlPk/l7esIfFp4/YMztFp4/H:OhQHV9cF51mrxttc/heFtp4/YMXp4/H
MD5:	9C20E1E7713308A6DFAEE9E6566E46C9
SHA1:	4E39CF79560A3FE920C0F42555D500A5CDC0739F
SHA-256:	CD9D04208BA1E41738900DB4F3A7C0397DB8F885D19813D9751C30F5AA1B6C8C
SHA-512:	F074396740BA05D83CFFC5BD79C43A079BBE06FCFF19977F48EECFC92BDC330031EA776B88B8BC0457E20529644500EE42CF15E3CF9A3D1182E9DDC7936C22B8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-DGSIE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3236
Entropy (8bit):	5.309260480657556
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNPyFGkJDJbM9AZq:OhQHV9cF51mrxBiGkJDJwCg
MD5:	66BD0637AB573D976BCCD17E88F66E0B
SHA1:	03B5BB309010BB498465B27F811EEFF715F7605C
SHA-256:	A28F1DBFDBCC82B76930F9E377F20121BE7217C0D22C4DD0825B39DA371D72D5
SHA-512:	E86EC18AD34EB8E7B9187CB07082726B4AABF1C513ED768C74393B863035820946B655BB2C67A449F4F244DA9A91913E415A977880F63D407D6DDF17D797DFDC
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-DNK0V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3415
Entropy (8bit):	5.261479514362835
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNkHneT0EnfPCoCNoA7xY7Ad5zuO8:OhQHV9cF51mrxaeT0Mf6JNL7C74zuO8
MD5:	521C8705498E5F579F6139AE5A2E9AC7
SHA1:	7BFDE2FAB9E8BAAEED1E0804DC96CE3BC3586B02
SHA-256:	47ACED61A7AAED1250CD5478EEF2186DD580594FB9D429D7D8877FC3C3C806B5
SHA-512:	D84D88A86E1CD831F7D4E05BF27E386D23C8003BAAC4603B184B7970F2DBB6D5775E5913BD9A3BF53C12B02F3C0E72B3F6D3F4F52A1AFB0AC9F07343BC587123
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-FQ86G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	5.209747472645233
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNxvWcodQ/kXm/Dz+bqjBV:OhQHV9cF51mrx7OcoK/kXm7qSBV
MD5:	1C5ED014E3F12231B3EEAD67C82B3F1C
SHA1:	1F55AF7E3DC24E1BAC0A67A29149A826848E9566
SHA-256:	B184A15AD586029F2873416DB385481E48EC03420CA730CF8823CFEF316C2028
SHA-512:	4FD3A4F9C3E0F874ED8FFC272ACF4D33887DBC65B3FF25E339091CA2F555D830F99E875476AF544C8ED082A5CC39F3CF8C5994E267B92762E56838D773E84241
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-GPGHC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5428
Entropy (8bit):	4.909052623173244
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxN1oYfVc/bQLhihqnq5ANPw10+nZtxXqxvmiyctqP:OhQHV9cF51mrxPo6Vc/bQchqnq6O1Hnr
MD5:	70EA79DE6B1CC6796B3FE88661E493F8
SHA1:	CFCFC885ED43B285F2921409B693BB339C230387
SHA-256:	F4E9909B77F3F7DFFE43C55A74B7A825A60DD62D4A88A7CE340955D4991DF1A1
SHA-512:	D0545C7171DBF64F643C611C054D1F8631F05C095075091A7ACB7F81F8FA449236C077CF2455B0CC2B803B05E155B5E8DB9F3A3CA8420BD7072A1244D4753BB3
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-I9QTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.204341456704585
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNY7EmFSNdrzrQaa:OePIa23fQHG49cF51eNrxN8EmmNzda
MD5:	9392C7B8EFDC6989111C18B15354FA2B
SHA1:	A15D8092762FD5AC53F4B169676B6122449F2B3D
SHA-256:	599C6EDC0B1751917F09E562FF8371E83369D827E04080341DCD2C0B86E847E2
SHA-512:	3C2806F4909BFC2F404A3FF56208DAC30CE8EED0D5C0A0525A80D10349EEC2B3CE9C1275E596820EAB6485EE7F54E386A65EE66BB3499084059619412C87CBA8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-L1MSM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3301
Entropy (8bit):	5.290877064154622
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNN+a2dj/3oxbGGFp4/r:OhQHV9cF51mrxn+ndj/4R/p4/r
MD5:	B2E5E743544A38BD137FB67F8559347E
SHA1:	45CD2AAFBF189BBE2939FE1D0C1587C09AB5CF01
SHA-256:	AE682C08996EE804AEC65F7F9080CFD53BA82F754196202B9B1211CBB6C6455A
SHA-512:	534A9BD74C8C45CD871A7CF322649F818709B9E12E9C41BDB792F443F9FCC84F6D47E6CD0B01F110C41B319333B93ACB44FA5C7E2871A7CA907F980C88F5EA7F
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-MPUET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	5.1124486042222514
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYkneTN0IJEH1yQa7CiK6YEQ:OePIa23fQHG49cF51eNrxNnneTN0SEHp
MD5:	B68206DFCCFA1D38D9A3D36B447639DB
SHA1:	96C78DEC4FA51919ED89110E31A479012DC4DB14
SHA-256:	3BB366BD72E1C9106728FB5AB9B25A62544C6FDF8AD17D7F43DE8CE85F3F45B7
SHA-512:	8D3313C7D6197349D6315C137DD5BE79CFA1DA8476C627D7041FFDA1B334AA8E4FA09780B4A9DF3DFD035F7E6D4F791BBD660798BE6858D0D061D0E3902801F6
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-O2R4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	860
Entropy (8bit):	5.044265335517369
Encrypted:	false
SSDEEP:	24:QOjCnOAe9a62zMJd1SMsxEyLc2cW1gXRHR1JCVpn:QSXD6ZghRTSn
MD5:	8D59A1F967517EE1E94ADA2E81FC604A
SHA1:	652923D661EAFF2B61AC358C221C29CA692B12A9
SHA-256:	A8BBD2DFD36832A69ACA2552BF5DDC63175BF79F1FECBF1435B601A3A49EE342
SHA-512:	DD251468B0BECADECEB90F283FE1076BA68DDF80FA776D69B57D1D2D127BBDC26A84F2DCA26615CBB8D2B4DA40CD87F5CEA8B0F0D0C75DA59443BE08619BA1B5
Malicious:	false
Preview:	// Additional keys for Sun USB keyboard..xkb_symbols "sun_usb" {.. key <STOP> { [ Cancel.],.[ F11.].};. key <AGAI> { [ Redo..],.[ F12.].};. key <PROP> { [ SunProps.],.[ F13.].};. key <UNDO> { [ Undo..],.[ F14.].};. key <FRNT> { [ SunFront.],.[ F15.].};. key <COPY> { [ SunCopy.],.[ F16.].};. key <OPEN> { [ SunOpen.],.[ F17.].};. key <PAST> { [ SunPaste.],.[ F18.].};. key <FIND> { [ Find..],.[ F19.].};. key <CUT> { [ SunCut.],.[ F20.].};. key <HELP> { [ Help..].};.. key <MUTE> { [ SunAudioMute,.SunVideoDegauss..].};. key <VOL-> { [ SunAudioLowerVolume,SunVideoLowerBrightness ].};. key <VOL+> { [ SunAudioRaiseVolume,SunVideoRaiseBrightness.].};. key <POWR> { [ SunPowerSwitch,.SunPowerSwitchShift.].};.. key <LMTA> { [.Meta_L..].};. key <RMTA> { [.Meta_R..].};. key <COMP> { [.Multi_key.].};.};..

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-OIBB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	12132
Entropy (8bit):	5.244480266761398
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrxsYQHHgrTf5xWM2ljv+x3evqRtXT/1R2qvfkXvFzMsYAQ:4B5YrxsYGgrTRxWMKiNJNT/1R9vsXvFI
MD5:	F2BCC9464D6193CE67661D2013659FCA
SHA1:	5088D9662AE9C697200FDD52874DD652C2D20485
SHA-256:	E0F40909C28C0B7915F0F52281F79DB69C363CBF9670BACBF8FAB8632524CEBD
SHA-512:	5C501BEDD46443A18AD5701C5C6F440225B81EF5FE5A2BA66E7A3F9AFD83F6E93801E5F8506B33095AC39E98548541672C8EC1AA86AC75EDE3700DCC93CAA451
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-Q88CB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3241
Entropy (8bit):	5.3011203221392265
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNNsbY/XxXZIQyFW4/f:OhQHV9cF51mrxn5/hXi1W4/f
MD5:	6674EB6FFCB389C1BB70800DB82540E3
SHA1:	810916E8994F8B411067EC57646D4251C4252FFA
SHA-256:	84BB56D1799639BC8562468CC02642EA35B73646C87BE67644B096ED0DF1274D
SHA-512:	03DFE447D405DC34E113C26779964AE9B590632DAD6655D6017DDA3CB07B25D94AC7A0F3269EFE7E82BB8E2B160C38D6326BD403118539717E6E12E45AC64C70
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-QCBJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8448
Entropy (8bit):	4.730939156998466
Encrypted:	false
SSDEEP:	96:QDPIa23JQHG49cF51eprxN6WLO2XP0k0/qWgv4G2F5ZYBw29CALjKt/4Le1:Q0QHV9cF51grxMWLO+vCjZYG29yt/4y
MD5:	C475995B4023DA3E2F95AFAA5A9BDE13
SHA1:	8CD57315F839E7B1BB1DB165BD59C48E08543359
SHA-256:	BA18D40B49352F199733DA8F5388190CAECC7EE8BA6C692E02E7DB887A8E1CB4
SHA-512:	9E6F25CD03237A89D8E5990C3210C0B90678F44940EBAC9C86A30A33E721A19D811563C8A6CA260677DDE938776C6A09D3C6672068B5827F01BD9B45917DB0E4
Malicious:	false
Preview:	//-------------------------------------------------------------------------.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PART

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\is-S3G0E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	5.333089768395665
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNkHneT0P4foKNowBu:OhQHV9cF51mrxaeT0P4fvNfu
MD5:	D948900448740F0455B6EC0DFF8DB60C
SHA1:	307F5862147F95D10616AD86E2D17F684A613F5D
SHA-256:	2821F24307ECE32DECFAAE98DAEC489AAA45BDC302973D62C5B77EB19DACA35B
SHA-512:	BAC81B38BD7F9C14DE9FFACECA361C20127BA47022FBB6492B8FC193067CC19F2D8A3723194793F647ADBC6BDD08CABB7DE85EE73306876A337B83A72CBEFCFC
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\it (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	5.209747472645233
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNxvWcodQ/kXm/Dz+bqjBV:OhQHV9cF51mrx7OcoK/kXm7qSBV
MD5:	1C5ED014E3F12231B3EEAD67C82B3F1C
SHA1:	1F55AF7E3DC24E1BAC0A67A29149A826848E9566
SHA-256:	B184A15AD586029F2873416DB385481E48EC03420CA730CF8823CFEF316C2028
SHA-512:	4FD3A4F9C3E0F874ED8FFC272ACF4D33887DBC65B3FF25E339091CA2F555D830F99E875476AF544C8ED082A5CC39F3CF8C5994E267B92762E56838D773E84241
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\jp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	32425
Entropy (8bit):	5.0239882127890025
Encrypted:	false
SSDEEP:	384:4B5YrxdYGgrT9dgCRnaRsKgdgCRn3RxKK/QdgCRS3RBK1nf/1/cpo4lT3HoK1/3d:Y5YlFgHsPJ1810S
MD5:	256FD40801EC18AFD6DD7EAF40C32F31
SHA1:	4CC0ACC41A8BAC9CC588ACE0A5A7DD3B6008A7B2
SHA-256:	EA67C69B8BC40DECED16F3E369F3A0E972185FFC12DD5E6FA95FDF821E33ECDE
SHA-512:	CDBFC5A1CAD90728F1D85921BD5CE1013DF7460F5E77B18263AEEBE9E0EB9867F7B6C0AE7335C1A0093FE2692DC795622A5752A073DC524157894B9E98FAF669
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\ko (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.278172983292095
Encrypted:	false
SSDEEP:	48:OY/DQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYFqZeoNeW:ODPIa23fQHG49cF51eNrxNOqJn
MD5:	E962DF371EF8DB859088D01CD928CC7E
SHA1:	6747F00DC85A81A2E2EC57E1DAD9DC95F7AAEB7A
SHA-256:	C2108968AEB2A843A8D01C507AE56BB997797BC4C9B3333870E53DCE0B4E8090
SHA-512:	2A31AC6584C26147CAC0751101B983199859F8EF6A60870170CF4EBB685DC4CC76EB977CA2E8834A1CBE6447436DD39A52BD0DD5D395CD59E465B0FEE8E73041
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\lt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	5.333089768395665
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNkHneT0P4foKNowBu:OhQHV9cF51mrxaeT0P4fvNfu
MD5:	D948900448740F0455B6EC0DFF8DB60C
SHA1:	307F5862147F95D10616AD86E2D17F684A613F5D
SHA-256:	2821F24307ECE32DECFAAE98DAEC489AAA45BDC302973D62C5B77EB19DACA35B
SHA-512:	BAC81B38BD7F9C14DE9FFACECA361C20127BA47022FBB6492B8FC193067CC19F2D8A3723194793F647ADBC6BDD08CABB7DE85EE73306876A337B83A72CBEFCFC
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\lv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	5.1124486042222514
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYkneTN0IJEH1yQa7CiK6YEQ:OePIa23fQHG49cF51eNrxNnneTN0SEHp
MD5:	B68206DFCCFA1D38D9A3D36B447639DB
SHA1:	96C78DEC4FA51919ED89110E31A479012DC4DB14
SHA-256:	3BB366BD72E1C9106728FB5AB9B25A62544C6FDF8AD17D7F43DE8CE85F3F45B7
SHA-512:	8D3313C7D6197349D6315C137DD5BE79CFA1DA8476C627D7041FFDA1B334AA8E4FA09780B4A9DF3DFD035F7E6D4F791BBD660798BE6858D0D061D0E3902801F6
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\nl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3236
Entropy (8bit):	5.309260480657556
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNPyFGkJDJbM9AZq:OhQHV9cF51mrxBiGkJDJwCg
MD5:	66BD0637AB573D976BCCD17E88F66E0B
SHA1:	03B5BB309010BB498465B27F811EEFF715F7605C
SHA-256:	A28F1DBFDBCC82B76930F9E377F20121BE7217C0D22C4DD0825B39DA371D72D5
SHA-512:	E86EC18AD34EB8E7B9187CB07082726B4AABF1C513ED768C74393B863035820946B655BB2C67A449F4F244DA9A91913E415A977880F63D407D6DDF17D797DFDC
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\no (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3241
Entropy (8bit):	5.3011203221392265
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNNsbY/XxXZIQyFW4/f:OhQHV9cF51mrxn5/hXi1W4/f
MD5:	6674EB6FFCB389C1BB70800DB82540E3
SHA1:	810916E8994F8B411067EC57646D4251C4252FFA
SHA-256:	84BB56D1799639BC8562468CC02642EA35B73646C87BE67644B096ED0DF1274D
SHA-512:	03DFE447D405DC34E113C26779964AE9B590632DAD6655D6017DDA3CB07B25D94AC7A0F3269EFE7E82BB8E2B160C38D6326BD403118539717E6E12E45AC64C70
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\pl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	5.277795341749622
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYYeG/HOl0WTYwr:OePIa23fQHG49cF51eNrxNLeG/H40WT/
MD5:	8AD22E4C015E003DC91F19F1EA4724BA
SHA1:	0D78B589C1A8D445BD6FAD4B6575B90E96127B50
SHA-256:	3EAC0246B3D8E71941F125E6AE25A20ED8EBA80149C24328FE03CCE9168D65E9
SHA-512:	F637541D17BD1551BD51849D306F589A44AE508C64469C3E23D69756504E207312EEE3860FBE2511A7F928DE83F601CA4C92D078BCB003A9A2CD766CE07D522E
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\pt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3776
Entropy (8bit):	5.293990169415956
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNsovlPk/l7esIfFp4/YMztFp4/H:OhQHV9cF51mrxttc/heFtp4/YMXp4/H
MD5:	9C20E1E7713308A6DFAEE9E6566E46C9
SHA1:	4E39CF79560A3FE920C0F42555D500A5CDC0739F
SHA-256:	CD9D04208BA1E41738900DB4F3A7C0397DB8F885D19813D9751C30F5AA1B6C8C
SHA-512:	F074396740BA05D83CFFC5BD79C43A079BBE06FCFF19977F48EECFC92BDC330031EA776B88B8BC0457E20529644500EE42CF15E3CF9A3D1182E9DDC7936C22B8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\ru (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.136428361590648
Encrypted:	false
SSDEEP:	48:OlDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYJHatyQkHyY:OePIa23fQHG49cF51eNrxNAaRkSY
MD5:	3F65684A98EA49C92C315B5BD178C885
SHA1:	459D5AA470C753FFD0A1599B7B9279603AF1828B
SHA-256:	5B8F3548CC36C51BBA8588C1E2988C33BCF8776168B0FFFB6BED1D2FB1037855
SHA-512:	ACB0CE5DEBD849AB99173B7EEF9E7F4644FA5EE4B99FD44386CC35FA67A0C6A13777C7B55BE3C57C47E65CDCBD1EF55BAE2C0697B4368AFF6ECDAE9EE2F48A65
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\se (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	5.102069103886074
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxNmENcfl/Tw4EgI8cfl/7V:OhQHV9cF51mrxYEifl/04EZTfl/7V
MD5:	5676BC6FB035B55C3469B5CC33F74491
SHA1:	44F4FE8974792C7F1F798B6EC4E8FB191A3485C4
SHA-256:	93C8EBED2B3E6B277A4DB112ADBB6364C21D3820F18D0E17027AE21C4CBFF9BB
SHA-512:	E3B8E1B9BDEFA1CFEF15E967A9242D2A24547FCF3421AFAB2FB0AB8434F148D5D86090E8EC45CB5ABD4D7BFF045DF01F467A5CB9AE623D97450B11C1D593DAC8
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\solaris (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8448
Entropy (8bit):	4.730939156998466
Encrypted:	false
SSDEEP:	96:QDPIa23JQHG49cF51eprxN6WLO2XP0k0/qWgv4G2F5ZYBw29CALjKt/4Le1:Q0QHV9cF51grxMWLO+vCjZYG29yt/4y
MD5:	C475995B4023DA3E2F95AFAA5A9BDE13
SHA1:	8CD57315F839E7B1BB1DB165BD59C48E08543359
SHA-256:	BA18D40B49352F199733DA8F5388190CAECC7EE8BA6C692E02E7DB887A8E1CB4
SHA-512:	9E6F25CD03237A89D8E5990C3210C0B90678F44940EBAC9C86A30A33E721A19D811563C8A6CA260677DDE938776C6A09D3C6672068B5827F01BD9B45917DB0E4
Malicious:	false
Preview:	//-------------------------------------------------------------------------.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PART

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\sw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7797
Entropy (8bit):	4.844922340661658
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrx4rYe/6ipJK5/m/CNVJ5SJ0mZ/u0dv8J4vdQ/usv8Gda:4B5Yrx40e/vpJU+/guJjZ/xv8iW/Rv8L
MD5:	DF166459C73ABB52A8F649788DA8E032
SHA1:	05471B624C244856FBAE5236B3463851DA5EA449
SHA-256:	9B52D9A18F5BF3513D5ACC512A924F63283ED49A015203C92A1322C94D4CF52C
SHA-512:	E3D847907BC083515E857878A107F47933464346C990DCBE291D10336A842DD855BD92829E33D21C6BF145A83811A858FC4D745595534E5F0625634686D541E4
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\tr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	5428
Entropy (8bit):	4.909052623173244
Encrypted:	false
SSDEEP:	96:OePIa23fQHG49cF51eNrxN1oYfVc/bQLhihqnq5ANPw10+nZtxXqxvmiyctqP:OhQHV9cF51mrxPo6Vc/bQchqnq6O1Hnr
MD5:	70EA79DE6B1CC6796B3FE88661E493F8
SHA1:	CFCFC885ED43B285F2921409B693BB339C230387
SHA-256:	F4E9909B77F3F7DFFE43C55A74B7A825A60DD62D4A88A7CE340955D4991DF1A1
SHA-512:	D0545C7171DBF64F643C611C054D1F8631F05C095075091A7ACB7F81F8FA449236C077CF2455B0CC2B803B05E155B5E8DB9F3A3CA8420BD7072A1244D4753BB3
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\tuv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8985
Entropy (8bit):	5.229945204770479
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrxdYQHHgrTZE2lNpGa0u2lFXf/f/1DiV:4B5YrxdYGgrT2KfguK1nf/1o
MD5:	C361250F2F11782FADCF4FE4B43081CE
SHA1:	381C557CB4BB7EC150899BD3929C2C3D8AB86CAF
SHA-256:	3B039421D08C84A879E8123A4C581D45F100046F052602A007688A932C3BBF54
SHA-512:	00A17936380F64F58BE33564D9A46FB496FCA5BA96742F5B3ADB648F2D956E45A597C8C7F677024BDE575BA12706C9A8A4829DBE783708A8FFB40A40490F29EE
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\tw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	5.255705384202102
Encrypted:	false
SSDEEP:	48:OY/DQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYWCRb:ODPIa23fQHG49cF51eNrxNTCRb
MD5:	7D867FE058469273DD6A793A364BF4AC
SHA1:	46E6B15369756885CF782F235582F52E1875AB0E
SHA-256:	B4A3802A4432172E5D7F1D4DFE3DC1A02DDE302505D88C6A2C9430B1D7B42ED3
SHA-512:	C9AA13ACBE9B1DF5EEFE12D593DE393E501A44D8026F2BA8DFF5A909EA3E8958DE9B405DD28897A65CC6AAF30B228B8E1A8D182D494AF730605FADCAED9C3439
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2005 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	12132
Entropy (8bit):	5.244480266761398
Encrypted:	false
SSDEEP:	192:OhQHV9cF51mrxsYQHHgrTf5xWM2ljv+x3evqRtXT/1R2qvfkXvFzMsYAQ:4B5YrxsYGgrTRxWMKiNJNT/1R9vsXvFI
MD5:	F2BCC9464D6193CE67661D2013659FCA
SHA1:	5088D9662AE9C697200FDD52874DD652C2D20485
SHA-256:	E0F40909C28C0B7915F0F52281F79DB69C363CBF9670BACBF8FAB8632524CEBD
SHA-512:	5C501BEDD46443A18AD5701C5C6F440225B81EF5FE5A2BA66E7A3F9AFD83F6E93801E5F8506B33095AC39E98548541672C8EC1AA86AC75EDE3700DCC93CAA451
Malicious:	false
Preview:	// $XdotOrg: $.//.// Copyright 2004 Sun Microsystems, Inc. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLDE

C:\Program Files (x86)\Xming\xkb\symbols\sun_vndr\usb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	860
Entropy (8bit):	5.044265335517369
Encrypted:	false
SSDEEP:	24:QOjCnOAe9a62zMJd1SMsxEyLc2cW1gXRHR1JCVpn:QSXD6ZghRTSn
MD5:	8D59A1F967517EE1E94ADA2E81FC604A
SHA1:	652923D661EAFF2B61AC358C221C29CA692B12A9
SHA-256:	A8BBD2DFD36832A69ACA2552BF5DDC63175BF79F1FECBF1435B601A3A49EE342
SHA-512:	DD251468B0BECADECEB90F283FE1076BA68DDF80FA776D69B57D1D2D127BBDC26A84F2DCA26615CBB8D2B4DA40CD87F5CEA8B0F0D0C75DA59443BE08619BA1B5
Malicious:	false
Preview:	// Additional keys for Sun USB keyboard..xkb_symbols "sun_usb" {.. key <STOP> { [ Cancel.],.[ F11.].};. key <AGAI> { [ Redo..],.[ F12.].};. key <PROP> { [ SunProps.],.[ F13.].};. key <UNDO> { [ Undo..],.[ F14.].};. key <FRNT> { [ SunFront.],.[ F15.].};. key <COPY> { [ SunCopy.],.[ F16.].};. key <OPEN> { [ SunOpen.],.[ F17.].};. key <PAST> { [ SunPaste.],.[ F18.].};. key <FIND> { [ Find..],.[ F19.].};. key <CUT> { [ SunCut.],.[ F20.].};. key <HELP> { [ Help..].};.. key <MUTE> { [ SunAudioMute,.SunVideoDegauss..].};. key <VOL-> { [ SunAudioLowerVolume,SunVideoLowerBrightness ].};. key <VOL+> { [ SunAudioRaiseVolume,SunVideoRaiseBrightness.].};. key <POWR> { [ SunPowerSwitch,.SunPowerSwitchShift.].};.. key <LMTA> { [.Meta_L..].};. key <RMTA> { [.Meta_R..].};. key <COMP> { [.Multi_key.].};.};..

C:\Program Files (x86)\Xming\xkb\symbols\sy (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	4.724431980073704
Encrypted:	false
SSDEEP:	192:P7EjLi70h6ZXkY7sIH5VtskGiAe5EoQ0ziwZ+4HjjEEDrDXStxTgMJW0y1kIrqhl:DEonZnMln4AmxTmtNiWr
MD5:	2F593BFC8E6F5322342B5461775D0E1E
SHA1:	50BEECBB8FD4C82D39F3DE550EC66198AE5F4ECA
SHA-256:	7E7BEF0D4E565E24CDEDC975E1DEF3D6B4B6A79C7054608231ED6FA40FEC5624
SHA-512:	0299C89B150157FC48AA49D3E64196F19A3FB693F2E0E4AE8418F1A51A98A176F8DFE325613ADF16BDC08FB234C51D0C750E518E1CC0B3A8C6F07114343B8AF9
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/sy,v 1.2 2006-05-04 21:52:51 svu Exp $..//.// $XFree86: xc/programs/xkbcomp/symbols/syr,v 1.1 2002/11/22 03:06:50 dawes Exp $.//..partial default alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Syria";.};..partial alphanumeric_keys.xkb_symbols "syc" {. name[Group1]= "Syria - Syriac";.. key <TLDE> { [.0x100070F,.0x100032E,.Arabic_shadda..] };. key <AE01> { [ .1,..exclam,..0x1000701..] };. key <AE02> { [ .2,..0x100030A,.0x1000702..] };. key <AE03> { [ .3,..0x1000325,.0x1000703..] };. key <AE04> { [ .4,..0x1000749,.0x1000704..] };. key <AE05> { [ .5,..0x1002670, 0x1000705..] };. key <AE06> { [ .6,..0x1002671, .0x1000708..] };. key <AE07> { [ .7,..0x100070A, .0x1000709..] };. key <AE08> { [ .8,..0x10000BB,.0x100070B..] };. key <AE09> { [ .9,..parenright,.0x100070C..] };. key <AE10> { [ .0,..paren

C:\Program Files (x86)\Xming\xkb\symbols\th (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	8269
Entropy (8bit):	4.959204810796883
Encrypted:	false
SSDEEP:	96:I5ppNFS5dwZ3AOet2Jw2/38qs81yHDv2Vr59i4A4UF5xm3jnatB:I5pLFSwOFsJw2/38qN1yj2xTih4e22
MD5:	B5DFA4E10813AF68AC72633F46156B19
SHA1:	5774BB7E7E0904089037856DDA5C5F9212CABE7B
SHA-256:	CB30996537D3C56CC675561000AD5A58AB03273390FBAFA535DB40ACDE307ED9
SHA-512:	2B6BA795BC1B680734FDF78BC7B5A82E22A70022510504BA6EF152E9A514CD6F9F2146E26F69FA2A3E32B08F60EF2BD994DC6F5C683AF4B79AAA0A1343955E92
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/th,v 1.6 2005-01-16 02:18:20 svu Exp $..// based on a keyboard map from an 'xkb/symbols/th' file.//.// $XFree86: xc/programs/xkbcomp/symbols/th,v 1.3 2003/04/03 16:34:51 dawes Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {. name[Group1]= "Thailand";.. // converted to THai keysysms - Pablo Saratxaga <pablo@mandrakesoft.com>.. key <TLDE> { [ underscore,..percent..].};. key <AE01> { [ Thai_lakkhangyao,.plus..].};. key <AE02> { [ slash,..Thai_leknung.].};. key <AE03> { [ minus,..Thai_leksong.].};. key <AE04> { [ Thai_phosamphao,.Thai_leksam.].};. key <AE05> { [ Thai_thothung,.Thai_leksi.].};. key <AE06> { [ Thai_sarau,..Thai_sarauu.].};. key <AE07> { [ Thai_saraue,..Thai_baht.].};. key <AE08> { [ Thai_khokhwai,.Thai_lekha.].};. key <AE09> { [ Thai_totao,..Thai_lekhok.].};. key <AE10> { [ Thai_chochan,.Thai_lekchet.].};. key <AE11> { [ Thai_khokhai,.Thai_lekpaet.].};. key <AE1

C:\Program Files (x86)\Xming\xkb\symbols\tj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3606
Entropy (8bit):	4.942295985662373
Encrypted:	false
SSDEEP:	48:lv/WAxVs3RTrat40dE+MfPTiFeJUehull:5/HxVsBHSd0Wc2e0ll
MD5:	0CC2A5A7441509CC232CB70F04C9C963
SHA1:	9AAF8773BB5E38875E60CCEF9105D28D7E043847
SHA-256:	868E48A715C64CC5DA54F021EEEB6DCD10B588A806F99950209D508A3D424C1A
SHA-512:	AC5A56D6515C553A39E9CBADA44D5055E490EBA864364BEEC8C656335DA5251991A99632DFA0CBDFE1CFD990480C7419F0334724A2872E63F6BE1C40825E5B74
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/tj,v 1.9 2005-08-01 22:11:07 svu Exp $..// based on.// Tajik keyboard .// it is a Russian layout keyboard, with SHCHA replaced with .// dead_cedilla/dead_macron.// that allows to type the SHCHA with dead_cedilla + SHA.// and all the extra Tajik keys:.// dead_cedilla + KA, HA --> KA descender, HA descender.// dead_macron + I, U, GHE --> I macron, U macron, GHE horizontal stroke.// it requires proper dead_cedilla and dead_macron entries in Compose file.// it also allows to use Mode_switch when in cyrillic mode to enter.// special letters by doing Mode_switch + base letter.//.// AEN <aen@logic.ru> (for the Russian layout).// Pablo Saratxaga <pablo@mandrakesoft> (for the dead keys changes).//..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Tajikistan";.. key.<TLDE> {.[ Cyrillic_io, Cyrillic_IO.].};. key.<LSGT> {.[. bar,. brokenbar.].};. key.<AD01> {.[ Cyrillic_shorti, Cyrillic_SHORTI.]

C:\Program Files (x86)\Xming\xkb\symbols\tr (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10528
Entropy (8bit):	4.522926655487274
Encrypted:	false
SSDEEP:	96:a4iSTSD5SvBGU9X0iSX8Q24IcYvzE1rZl8LiSDeGUDWd0iS3aHS62wiSFuWiSFHm:JbuDMB3ubM2IXLoob6GH6bqy6FbFLbw
MD5:	934E399AE620FC1998AA08CC5B5502A3
SHA1:	70DAD7825170DB5B9A7647231549E12D54499F27
SHA-256:	7256081ADD76CE4EE23746676C0F383D8FBA8A6A0EA21D4C28AF203187FEAE0C
SHA-512:	2203BAD6CB2F578C8CE3486121DBF6B963ADD147547AAE72531AD4525E499BE3CA2B8791A3D5328D41F00E22D13A2F65F27432A07D64B10F312924ADFCB7FA42
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/tr,v 1.10 2006-03-22 23:02:42 svu Exp $..// based on.// Turkish keyboard symbols for PC and xkb.// This file distributed without any expressed or implied warranty.// Nilg.n Belma Bug.ner <nilgun@belgeler.org>, 2005.//.// $XFree86: xc/programs/xkbcomp/symbols/tr,v 1.5 2003/04/19 12:22:12 pascal Exp $..//Default Layout (Turkish Q).default partial.xkb_symbols "basic" {.. include "latin".. name[Group1]="Turkey";.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ] };. key <AE02>.{ [ 2, apostrophe, sterling, twosuperior ] };. key <AE03>.{ [ 3, asciicircum, numbersign, threesuperior ] };. key <AE04>.{ [ 4, plus, dollar, onequarter ] };. key <AE06>.{ [ 6, ampersand, threequarters, VoidSymbol ] };. key <AE07>.{ [ 7, slash, braceleft, VoidSymbol ] };. key <AE08>.{ [ 8, parenleft, bracketleft, VoidSymbo

C:\Program Files (x86)\Xming\xkb\symbols\ua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9186
Entropy (8bit):	4.559427740814211
Encrypted:	false
SSDEEP:	96:RKdUHK7JB1gRBgsoEms7sT0dSoMsvKxsC6:RKeq9jg3gs/7wNo4uC6
MD5:	71D83DE032A2E11EF2355137393698F7
SHA1:	24DFD18C44C058435B407518409A64621E3C9F4B
SHA-256:	E48661B90B4325AE26E4D4F71F41F6230E8A0BA6EE90519AE1B5E2B88A46F3E9
SHA-512:	61D6389EC3C2810E9DEFABB0259DFDB4D0D507FC83FAC25D7B6B9BA2A4BC1E4524EC509EC7E18132162CEBC5C26865D0FBC45E425DF80ECAC11452E7BEE7F9BF
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/ua,v 1.7 2005-07-19 23:03:51 svu Exp $..// based on.// ukrainian standard keyboard .// AEN <aen@logic.ru> & Leon Kanter <leon@geon.donetsk.ua>.// Last Changes 2003/09/03 by Andriy Rysin <arysin@yahoo.com>.//.// $XFree86: xc/programs/xkbcomp/symbols/ua,v 1.4 2003/05/15 11:29:47 pascal Exp $..partial default alphanumeric_keys .xkb_symbols "basic" {.. name[Group1]= "Ukraine";.. key.<TLDE> {.[ apostrophe,.asciitilde.].};. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numbersign.].};. key.<AE04> {.[..4, asterisk.].};. key.<AE05> {.[..5,. colon.].};. key.<AE06> {.[..6,. comma.].};. key.<AE07> {.[..7,. period.].};. key.<AE08> {.[..8,. semicolon.].};. key.<AE09> {.[..9,. parenleft.].};. key.<AE10> {.[..0,.parenright.].};. key.<AE11> {.[. minus,.underscore.].};. key.<AE12> {.[. equal,. plus.].};.. key.<AD01>

C:\Program Files (x86)\Xming\xkb\symbols\us (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	19088
Entropy (8bit):	4.865303104955355
Encrypted:	false
SSDEEP:	384:JCME/ocpYX5zbsQTTI08Zey9AOSRipYodbM86npmwkFqZo3j1PoTk9aToGFZnpgN:JSoc6hF8ZNLDv6kh74G
MD5:	B09A84D644625BEEE14D37410B0416A9
SHA1:	5C275D9544446869D5944049F5A78B268810B1A9
SHA-256:	5A8EC1A90494F29297ED517C89FB7F1C0E6556960E6055076C9F0123E341DF6C
SHA-512:	F98BC8C9129C42DF8BAF6DF7F88CCDFD29AE8102651A6F611A08685FF45E685AF3AB0CD2DE701805C3C8C37A32CD1A9FAF11515D34E9E61B3FE08DA4A9CA4DFE
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/us,v 1.29 2007-04-29 17:01:02 svu Exp $..//.// $XdotOrg: xc/programs/xkbcomp/symbols/us,v 1.1.4.3 2004/03/05 13:41:33 eich Exp $.// $XFree86: xc/programs/xkbcomp/symbols/us,v 1.6 2003/10/31 14:32:05 pascal Exp $..default.partial alphanumeric_keys modifier_keys .xkb_symbols "basic" {.. name[Group1]= "U.S. English";.. // Alphanumeric section. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {

C:\Program Files (x86)\Xming\xkb\symbols\uz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.126863065142419
Encrypted:	false
SSDEEP:	48:MLxLW7d6IfweoYHJJ+/4qm0H5KZ0rh6yJYbfPP8wRH2jlFEYX2f1XCT7:6y51JY/XH4WAocP8Q2jl5qBM7
MD5:	814CA9B435BFFD4BDB281A281B3327FE
SHA1:	AAC37A7DB38D6283BA1F1CBF06C0B9D4B74B1127
SHA-256:	CFD765A5EF0018E7461AEEBA47C1D4411985830AA2CA5DEB4B6246525FA4C277
SHA-512:	E8B5E30E85570853C71571E27724B6855343CB22023D928CB6D26BEE223E502BB5BD6DDAC974E13DFBE4AFCFC8A7F2F54BC486E9F858754AC66558194DEC73BF
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/uz,v 1.6 2007-02-25 21:38:32 svu Exp $.// Uzbek standard keyboard.//.// Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// History:.//.// Jun 2, 2003. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Created based on Russian standard keyboard. AEN <aen@logic.ru> .// The following symbols of Russian standard keyboard were replaced:.// minus (key <AE11>) with Byelorussian_shortu (U045e),.// equal (key <AE12>) with Cyrillic_ka_descender (U049b).// Cyrillic_ha (key <AD11>) with Cyrillic_ghe_bar (U0493).// Cyrillic_hardsign (key <AD12>) with Cyrillic_ha_descender (U04b3).// The following symbols of Russian standard keyboard were moved:.// Cyrillic_ze to key <AC02> (english 's'), .// Cyrillic_sha to key <AD08> (english 'i'),.// Cyrillic_ha to key <AD09> (english 'o'),.// Cyrillic_hardsign to key <AD10> (english 'p'). .//.// Feb 25, 2007. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Made cyrillic and latin variants. Default is

C:\Program Files (x86)\Xming\xkb\symbols\vn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	5.123378930254987
Encrypted:	false
SSDEEP:	24:Yaeh8htDm6+qtqmfc7NgOFxXj2yMNofsgCC25KZhTAkHENyEE7sqmPblvHIF5Y:EEDgqQwcKwj6MvCC2Q3k+hEEfqZl
MD5:	8A4E700CB7E447F2105BCAD0DB6574F3
SHA1:	D3B34E00117CE88EC0A63FB1E0E5704F9A3C808A
SHA-256:	BC0945C9F8EFE1D56BFBC2EBFFB3F41D1E7694C731CF3317045D618B7D00D629
SHA-512:	F65E439EBBF48AD6A21236D9F79BD92139FC6EE6C7D45EA5150E8D9B6E09CE14762F645A0AF062DED545180AFD69BC0B7A29B69A2000E1B2E68DE0CBB907BD8F
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/vn,v 1.6 2006-09-03 22:25:14 svu Exp $..// based on:.// vn, TCVN 5712:1993.// Le Hong Boi <le.hong.boi@bigfoot.com>.// August 1999.// Further modified by Ashley Clark <aclark@debian.org>.// July 2000 for X 4.0...partial default alphanumeric_keys .xkb_symbols "basic" {.. include "us".. name[Group1]= "Vietnam";.. // Alphanumeric section. key <TLDE> { [ quoteleft, asciitilde ].};. key <AE01> { [. abreve,.Abreve..] };. key <AE02> { [. acircumflex, Acircumflex.] };. key <AE03> { [. ecircumflex,.Ecircumflex.] };. key <AE04> { [. ocircumflex,.Ocircumflex.] };. key <AE05> { [. dead_grave,.percent..] };. key <AE06> { [. dead_hook,.asciicircum.] };. key <AE07> { [. dead_tilde,.ampersand.] };. key <AE08> { [. dead_acute,.asterisk.] };. key <AE09> { [. dead_belowdot,parenleft.] };. key <AE10> { [. dstroke,.Dstroke..] };. key <AE11> { [ minus, underscore ].};. key <AE12

C:\Program Files (x86)\Xming\xkb\symbols\xfree68_vndr\amiga (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4081
Entropy (8bit):	4.937537798254512
Encrypted:	false
SSDEEP:	48:LeTQWbRgdB/3bCEfuLC35bq4MIh2T7wsCjHusUUuYkgW2VCue12CVAAr:GR4CQ5bhMIEhwOP6Vfvqr
MD5:	7DA60FF99BDF1BF992FF140BF11746A8
SHA1:	A1E003437F57601B1C5FD60ED245529EA0F49F4F
SHA-256:	9FE63259AA5BCAACD516734AF03259B247CFA9C790E3AA07CC7BFC4A572CB270
SHA-512:	E5A17A73458AFE8CF6DB2B0426C8A0A34B78EE19C35B8B79938A5AA091E049F7664E20D61543996551A3353A110EC9E4C47A1230E5AA942F977781CFA4B34B56
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:46 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/symbols/xfree68/amiga,v 1.2 2000/06/23 00:44:37 dawes Exp $..default xkb_symbols "usa1" {.. name[Group1]= "usa1";. key <ESC> {.[. Escape...].};.. // Begin "Function" section. key <FK01> {.[. F1...].};. key <FK02> {.[. F2...].};. key <FK03> {.[. F3...].};. key <FK04> {.[. F4...].};. key <FK05> {.[. F5...].};. key <FK06> {.[. F6...].};. key <FK07> {.[. F7...].};. key <FK08> {.[. F8...].};. key <FK09> {.[. F9...].};. key <FK10> {.[. F10...].};. // End "Function" section.. // Alphanumeric section. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09>

C:\Program Files (x86)\Xming\xkb\symbols\xfree68_vndr\ataritt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4893
Entropy (8bit):	4.931720117832898
Encrypted:	false
SSDEEP:	96:MLCF5bhMJwENwa0hNe7RDKHv7gR7sK7sJ:M0M7aedDQ7gR7sK7sJ
MD5:	C088044F8BE290613013642353FD0EB4
SHA1:	D01A4A9DAB6180D85CC430D4E2A07C0BA67FE5E0
SHA-256:	9AB41939B091DDF50A486FE7FF4309565066DA6E02BE1033CB3BFAC33DA0EF56
SHA-512:	1479FC6A3F21EA392F748927047910255511D32FB6161BD0EC03715FCBA98F0F9DCBEBE08241C3D5594735D6CF7ED2B7631CDE5BECD534321F8424F2A7958621
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:46 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/symbols/xfree68/ataritt,v 1.2 2000/06/23 00:44:37 dawes Exp $..default xkb_symbols "us" {.. name[Group1]= "US/ASCII";. key <ESC> {.[.Escape...].};.. // Alphanumeric section. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <BKSP> {.[.BackSpace..].};.. key <TAB> {.[.Tab,.ISO_Left_Tab.].};. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <

C:\Program Files (x86)\Xming\xkb\symbols\xfree68_vndr\is-1TLTT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4893
Entropy (8bit):	4.931720117832898
Encrypted:	false
SSDEEP:	96:MLCF5bhMJwENwa0hNe7RDKHv7gR7sK7sJ:M0M7aedDQ7gR7sK7sJ
MD5:	C088044F8BE290613013642353FD0EB4
SHA1:	D01A4A9DAB6180D85CC430D4E2A07C0BA67FE5E0
SHA-256:	9AB41939B091DDF50A486FE7FF4309565066DA6E02BE1033CB3BFAC33DA0EF56
SHA-512:	1479FC6A3F21EA392F748927047910255511D32FB6161BD0EC03715FCBA98F0F9DCBEBE08241C3D5594735D6CF7ED2B7631CDE5BECD534321F8424F2A7958621
Malicious:	false
Preview:	// $Xorg: ataritt,v 1.3 2000/08/17 19:54:46 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/symbols/xfree68/ataritt,v 1.2 2000/06/23 00:44:37 dawes Exp $..default xkb_symbols "us" {.. name[Group1]= "US/ASCII";. key <ESC> {.[.Escape...].};.. // Alphanumeric section. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <BKSP> {.[.BackSpace..].};.. key <TAB> {.[.Tab,.ISO_Left_Tab.].};. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <

C:\Program Files (x86)\Xming\xkb\symbols\xfree68_vndr\is-AUO1G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4081
Entropy (8bit):	4.937537798254512
Encrypted:	false
SSDEEP:	48:LeTQWbRgdB/3bCEfuLC35bq4MIh2T7wsCjHusUUuYkgW2VCue12CVAAr:GR4CQ5bhMIEhwOP6Vfvqr
MD5:	7DA60FF99BDF1BF992FF140BF11746A8
SHA1:	A1E003437F57601B1C5FD60ED245529EA0F49F4F
SHA-256:	9FE63259AA5BCAACD516734AF03259B247CFA9C790E3AA07CC7BFC4A572CB270
SHA-512:	E5A17A73458AFE8CF6DB2B0426C8A0A34B78EE19C35B8B79938A5AA091E049F7664E20D61543996551A3353A110EC9E4C47A1230E5AA942F977781CFA4B34B56
Malicious:	false
Preview:	// $Xorg: amiga,v 1.3 2000/08/17 19:54:46 cpqbld Exp $....// $XFree86: xc/programs/xkbcomp/symbols/xfree68/amiga,v 1.2 2000/06/23 00:44:37 dawes Exp $..default xkb_symbols "usa1" {.. name[Group1]= "usa1";. key <ESC> {.[. Escape...].};.. // Begin "Function" section. key <FK01> {.[. F1...].};. key <FK02> {.[. F2...].};. key <FK03> {.[. F3...].};. key <FK04> {.[. F4...].};. key <FK05> {.[. F5...].};. key <FK06> {.[. F6...].};. key <FK07> {.[. F7...].};. key <FK08> {.[. F8...].};. key <FK09> {.[. F9...].};. key <FK10> {.[. F10...].};. // End "Function" section.. // Alphanumeric section. key <TLDE> {.[ quoteleft,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09>

C:\Program Files (x86)\Xming\xkb\symbols\za (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.4581030440073635
Encrypted:	false
SSDEEP:	24:Yai/6CMPtdANEamSO+J+BYDjs7EtYedSyUu7M7b7BGN7x5RyC1t+a2KAQVgqLG0Y:05MFdU1yBYMtyfQPQMC0
MD5:	DCBDF2278AE5641143662A9B0492ECBB
SHA1:	BB63315055B8C07EE2BAE661194F6DD045FD7F44
SHA-256:	4D073AF6E175BE383C49781B60350CA31658559265F556FAA0E34B2390539D93
SHA-512:	4672E03B31C0A3AB109116388A2E416537EF88260B56AD61ABC900EEEB429F135297BE19815307AFA174A403899C4544F83C499CCB4AC413884B84BA3525E858
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/symbols/za,v 1.2 2006-10-11 19:32:35 svu Exp $.//.// based on the Latvian and GB keyboard maps..partial default alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. // Describes the differences between an en_US . // keyboard and a South African layout with . // dead keys. By Dwayne Bailey (dwayne@translate.org.za) .. include "latin".. name[Group1]="South Africa";.. key <TLDE> { [ grave, asciitilde, dead_grave ] };. key <AE02>.{ [ 2, at, yen ].};. key <AE03>.{ [ 3, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dollar ].};. key <AE05>.{ [ 5, percent, EuroSign ].};. key <AE06> { [ 6, asciicircum, dead_circumflex ] };.. key <AD03>.{ [ e, E, ediaeresis, Ediaeresis ].};. key <AD04>.{ [ r, R, ecircumflex, Ecircumflex ].};. key <AD05>.{ [ t, T, U1e71, U1e70

C:\Program Files (x86)\Xming\xkb\types.dir (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	624
Entropy (8bit):	3.547599649282927
Encrypted:	false
SSDEEP:	12:8CuZdqYdtggYI6IDu/q9lbCy3AvETzBtmU:81ZQYLgEqS9dzw8PBtr
MD5:	BEF9BC0CD11B23C275FFF948AA72D662
SHA1:	E4F0AF78F56D11BE4611D050FD85C025BEC5A00B
SHA-256:	18FC7C7FE8502FF45738DD2811EBFA217B97C4D0F2D2055984F130EC614DEBD1
SHA-512:	04DDFC563A7B041CD6B8647063D85B79C89C5489440DE97B29F71970EAF37ECC9777FB9A66BAD5CC6961EB86F6A30BA6D2DC5B7AC02DC14E06A5B61057D64ECE
Malicious:	false
Preview:	-dp----- -------- pc(default).--p----- -------- caps(internal).--p----- -------- caps(internal_nocancel).--p----- -------- caps(shift).--p----- -------- caps(shift_nocancel).-d------ -------- default(default).-dp----- -------- mousekeys(default).-d------ -------- basic(basic).-dp----- -------- extra(default).--p----- -------- extra(keypad).--p----- -------- extra(mac_keypad).-dp----- -------- cancel(Shift_Cancels_Caps).-d------ -------- complete(complete).-dp----- -------- level5(default).-dp----- -------- numpad(pc).--p----- -------- numpad(mac).--p----- -------- numpad(microsoft).-dp----- -------- iso9995(default).

C:\Program Files (x86)\Xming\xkb\types\README (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.256051887778693
Encrypted:	false
SSDEEP:	6:vFRh5fgFdomepnrAs6HL/xFRx1cvvPJau6czd/n:dbJpUhLDdWku6Ud/n
MD5:	12FAD9640F00F0D22DD12B27AE2E27E4
SHA1:	0462098E52903925847BD4370126C6AE386C81F5
SHA-256:	CBE1F25696664C3BAFE32808474C0D1BF2F3A20E06B8703F5931186EBB41C24D
SHA-512:	F2752C9A417F08905604D6025D753AA542D89B1DA335C877DA6590EBB3D1FE85770310927FF5DFEA071CCDB3371308A10A4A0D1A83DAE79DAA286FB47777C82F
Malicious:	false
Preview:	The types component of a keyboard mapping specifies the key types that can be.associated with the various keyboard keys. The types component can also.optionally contain real modifiers binding and symbolic names for one.or more virtual modifiers..

C:\Program Files (x86)\Xming\xkb\types\basic (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	623
Entropy (8bit):	4.9702724388135655
Encrypted:	false
SSDEEP:	12:jLqEQvn/V2EUCNcjpAQt8wMDpqv+N3wblvwDFvKJkgYIqI+NkTMLwb+LwDFyv:Cx/V2pCNGt8wMqS3wxwVakg9SkTMLwCT
MD5:	64ABBDBC27B846D8912CA58F5612F4A2
SHA1:	A5675E39A5B01431956EB35C37A1E64E55CB1D11
SHA-256:	0DFB5EC72532E4E3CB1B28FDEC396DB3D6813F280A58EEF185F688F4C7CC0EEB
SHA-512:	769535C018D50712AFE4BB738723C1B69C494E706C5C11767462270EC8B9D3DE7A0D19ACB7673DD53BC05FE68B3D5C5239432CDCCAE4A411D1B3255744E686CA
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:48 cpqbld Exp $..default xkb_types "basic" {.. // Fairly standard definitions for. // the four required key types.. virtual_modifiers NumLock;.. type "ONE_LEVEL" {..modifiers = None;..map[None] = Level1;..level_name[Level1]= "Any";. };.. type "TWO_LEVEL" {..modifiers = Shift;..map[Shift] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";. };.. type "ALPHABETIC" {. modifiers = Shift+Lock;. map[Shift] = Level2;. map[Lock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Caps";. };..};.

C:\Program Files (x86)\Xming\xkb\types\cancel (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.146160137250687
Encrypted:	false
SSDEEP:	6:jLD0JuC2vo6/CQbmnF7PG62NMTP+NMP4kGOJLEtTWYJNiLEtTfF9NAez:jL4jWn/DCnFC6qY+NM7ZJLwbOLwDFvAc
MD5:	01718A24C5F984F5EEB3B3D052B793B0
SHA1:	01667046777DFE19E90785A5EEA0896AE69489F0
SHA-256:	4FEBB6742C0380198FD90DE0406813043D44A2577A76E0BE9D9023ACBE6D93ED
SHA-512:	17182CE6B2296C9EE85754C2399B12843450B78DB6163B2EA55FC42263A13F75BB14CE1A732223ABA1EEEAC50172B0D482E4E05E6BF66CB69532D360BC935E1C
Malicious:	false
Preview:	// $Xorg: cancel,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.partial default xkb_types "Shift_Cancels_Caps" {..override type "TWO_LEVEL" {. modifiers = Shift+Lock;. map[Shift] = Level2;. preserve[Lock]= Lock;. level_name[Level1] = "Base";. level_name[Level2] = "Shift";.};..};.

C:\Program Files (x86)\Xming\xkb\types\caps (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4618
Entropy (8bit):	5.006822308535047
Encrypted:	false
SSDEEP:	96:yRmSutYS1zar5E/btYS1zar5E3hBSFtYSqaryZtYSqaryWmSDTDtYSUarkfbtYSP:fS8YS1arypYS1aryjSXYSqarmYSqarS/
MD5:	7C613DCAB1EC4A003F762254BCD04FFA
SHA1:	2D9FFF88AFA4783865FF34B96A6ADA3FD9CB0B89
SHA-256:	B5E048D2D659298DF1F0E69F6FA15B5C9E61F56F3581E3A8620A7F49784EE239
SHA-512:	F50702A55DA74C6127A46FC204D8363381F43D576C9CE583F182FDEDD3F4D9378882E06DFEE6C7130C3D40CC28D1F1EBD28D1D7EB49685C949741318A9ADDD29
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/types/caps,v 1.3 2002/11/26 02:14:02 dawes Exp $..// CapsLock uses internal capitalization rules.// Shift cancels CapsLock.partial xkb_types "internal" {. type "ALPHABETIC" {..modifiers = Shift+Lock;..map[Shift] = Level2;..preserve[Lock] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Caps";. };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level3;..preserve[Lock+LevelThree] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt";. };.. type "FOUR_LEVEL_SEMIALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;

C:\Program Files (x86)\Xming\xkb\types\complete (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	433
Entropy (8bit):	5.024046778580582
Encrypted:	false
SSDEEP:	12:jLsZaQnuwcjXzvar02bEQvn/0HJkaqbkaXau1EaUGaiT5a6v:YamuwcvL2bx/0pKz12uv
MD5:	09FC69FA6B8D63262758239F10AAF0DB
SHA1:	C85A7F5AAB60BE66E675B09DDE42E95E0767D7AC
SHA-256:	87E2154FAC4403AE7C127308E95EDCC83BEF3E19556A93FBFFE989BF7487596B
SHA-512:	54F4C13DD017555CA7DF46BCED99C231D9C45FA2090AC6DD2AF85EBB1406811813F8F100BA6482F84D1D3C58FDE3F27B154D063FAB4DA4162204F88CBC0F796D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/complete,v 1.5 2006-10-07 21:52:44 svu Exp $.// $Xorg: complete,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.//.//.//.//.// $XFree86: xc/programs/xkbcomp/types/complete,v 1.2 2001/05/18 23:35:35 dawes Exp $..default xkb_types "complete" {. include "basic". include "mousekeys". include "pc". include "iso9995". include "level5". include "extra". include "numpad".};.

C:\Program Files (x86)\Xming\xkb\types\default (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.948527228113323
Encrypted:	false
SSDEEP:	6:jLmtdTZa3puYnZnnS/cumEQvo6/Ch8dwwAJklA2ElAu1ElAiT5lA3VFlAU32lAqn:jLsZaHncGEQvn/o8eJkaXau1EaiT5avG
MD5:	58E08BE192351FFB527B65C508E46250
SHA1:	3993291CACDBEC4C4961B2EBDA6C216D62D5FEDA
SHA-256:	2A3516ABC70DD715F03560CC90E8789A5F2DB090702AC55CD1FFC2C91D3EA93E
SHA-512:	8D279DB5FB74966FB31F562661B622C677797FB56F84805E84CFAD0DCD79EF0AACB3C5398CB1AB9FC692C6D3A6B86BD7BD0AF1F8DC2F30EED998CEB2E81A39C3
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/default,v 1.6 2006-10-07 21:52:44 svu Exp $.// $Xorg: default,v 1.3 2000/08/17 19:54:48 cpqbld Exp $..default xkb_types "default" {. include "basic". include "pc". include "iso9995". include "extra". include "numpad". include "level5". include "mousekeys".};.

C:\Program Files (x86)\Xming\xkb\types\extra (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	4.919020197547123
Encrypted:	false
SSDEEP:	96:al14RtYSqarqxtYSUarubtYSUar5E3J04tHI1TdTyS3bg0r9IWtKturrwKftHSkr:an4jYSqariYSUargYSUaryZrHITdTySZ
MD5:	E64FBBDF566AAA5642C66B5B99C224AF
SHA1:	30590C07F14F2FC35C3005FD9CB90847255A2001
SHA-256:	C12D9F93A455C4039B1B52C9BC3453A814F277DD4F606D22B80B16E49D16C2EE
SHA-512:	79231E5F4DA2E7E8F616FB4FDEA228D6D521BAEEE9275DCAE0A422C97D67318B668F3006E1951A6ABF4910BAD2AEEC413A7D34BA14D986F5031E4D635388F04A
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/types/extra,v 1.3 2002/11/26 02:14:02 dawes Exp $..partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree;.. type "FOUR_LEVEL" {. modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; . };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[Lock] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level4;..map[Lock+Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Le

C:\Program Files (x86)\Xming\xkb\types\is-589CS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	505
Entropy (8bit):	5.055581258265879
Encrypted:	false
SSDEEP:	12:jLJWn/o8wMrxMNUom6fpquQtY+N9caWcywblvwDFvZvwyMF:M/o8wCMR4tYSqarywxwVJw3
MD5:	61180E4DEE8A87216CB379E13CF86F26
SHA1:	4C51D41AA311FB5EA541A539CB6E479DAEC2D2FA
SHA-256:	7B908FA07D2CD24E43A7CA3592B42E681FC1AD5E7FE236B37F0D6A030D723B66
SHA-512:	D530E84DEF6F9F14E6C05095D86A5CECAF392135CD64CAB52A248EDDAB4DE82074F52D972307BDA5541D8532C1B69939C166511298CD9E34A17DD41DAFD63769
Malicious:	false
Preview:	// $Xorg: iso9995,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.partial default xkb_types "default" {.. // Definition for a key type which . // can be used to implement ISO9995. // style level three shift. virtual_modifiers LevelThree;.. type "THREE_LEVEL" {..modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Level3";. };.};..

C:\Program Files (x86)\Xming\xkb\types\is-5VGMS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.133658469969046
Encrypted:	false
SSDEEP:	6:jLD6LWowuj7vo6/Ch8dwodivst4k2NMqNsEyaoEtTWYBTAyEtTfF9NjYwz3:jLGjn/o8td74kqDyHwblvwDFvL
MD5:	723AE020CDC746C423F9D100FF52FB53
SHA1:	BD2E378FCF8765EB8248FD39A1CA4A1C251AD712
SHA-256:	AC958EBB3217E5C6A29FD12CB81059EE4D5CBCC7AEA7CDB36ADAB8B081ABB91D
SHA-512:	9D200053A8774B7D492A63263B8A553E8484952FFF3F3C25253B2FADB559B9B174BDA3FC264EBBFA99F4A6C249E1CC2E92D5CB533D939F76CA70BDC8A9CADBC9
Malicious:	false
Preview:	// $Xorg: mousekeys,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.// .partial default xkb_types "default" {. virtual_modifiers Alt;.. type "SHIFT+ALT" {. .modifiers = Shift+Alt;. .map[Shift+Alt] = Level2;. .level_name[Level1] = "Base";..level_name[Level2] = "Shift+Alt";. };.};..

C:\Program Files (x86)\Xming\xkb\types\is-8U6HG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4618
Entropy (8bit):	5.006822308535047
Encrypted:	false
SSDEEP:	96:yRmSutYS1zar5E/btYS1zar5E3hBSFtYSqaryZtYSqaryWmSDTDtYSUarkfbtYSP:fS8YS1arypYS1aryjSXYSqarmYSqarS/
MD5:	7C613DCAB1EC4A003F762254BCD04FFA
SHA1:	2D9FFF88AFA4783865FF34B96A6ADA3FD9CB0B89
SHA-256:	B5E048D2D659298DF1F0E69F6FA15B5C9E61F56F3581E3A8620A7F49784EE239
SHA-512:	F50702A55DA74C6127A46FC204D8363381F43D576C9CE583F182FDEDD3F4D9378882E06DFEE6C7130C3D40CC28D1F1EBD28D1D7EB49685C949741318A9ADDD29
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/types/caps,v 1.3 2002/11/26 02:14:02 dawes Exp $..// CapsLock uses internal capitalization rules.// Shift cancels CapsLock.partial xkb_types "internal" {. type "ALPHABETIC" {..modifiers = Shift+Lock;..map[Shift] = Level2;..preserve[Lock] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Caps";. };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level3;..preserve[Lock+LevelThree] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt";. };.. type "FOUR_LEVEL_SEMIALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;

C:\Program Files (x86)\Xming\xkb\types\is-ETOAL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.146160137250687
Encrypted:	false
SSDEEP:	6:jLD0JuC2vo6/CQbmnF7PG62NMTP+NMP4kGOJLEtTWYJNiLEtTfF9NAez:jL4jWn/DCnFC6qY+NM7ZJLwbOLwDFvAc
MD5:	01718A24C5F984F5EEB3B3D052B793B0
SHA1:	01667046777DFE19E90785A5EEA0896AE69489F0
SHA-256:	4FEBB6742C0380198FD90DE0406813043D44A2577A76E0BE9D9023ACBE6D93ED
SHA-512:	17182CE6B2296C9EE85754C2399B12843450B78DB6163B2EA55FC42263A13F75BB14CE1A732223ABA1EEEAC50172B0D482E4E05E6BF66CB69532D360BC935E1C
Malicious:	false
Preview:	// $Xorg: cancel,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.partial default xkb_types "Shift_Cancels_Caps" {..override type "TWO_LEVEL" {. modifiers = Shift+Lock;. map[Shift] = Level2;. preserve[Lock]= Lock;. level_name[Level1] = "Base";. level_name[Level2] = "Shift";.};..};.

C:\Program Files (x86)\Xming\xkb\types\is-GC74R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2993
Entropy (8bit):	4.943540747905254
Encrypted:	false
SSDEEP:	48:n3W/PXGulDXB48OtYSqar6RmzNheuheOMQi7JV3IRqLOtYSUar1pRmzMheuhlVhX:ql14JtYSqar68zHee+nKtYSUar1p8zsh
MD5:	BD467C5C4FE063B90B987F7A13BA1D06
SHA1:	DF46C58964808A798F28E9FF73F834C3378AB3E0
SHA-256:	F85558A82DF427AA6A67872308E385E5B261AA9520817E46900D72CF43FE599E
SHA-512:	033920434C857B57DFE11FA67E53D8FC95B9733ADD225AB9E0872FFF5E1177DB205B0E33EDB2B3D93C3B568A923D9F2887587779446CDD7AD5AEEF75DB7B51BD
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/level5,v 1.3 2006-01-22 17:49:45 svu Exp $.// $XFree86: xc/programs/xkbcomp/types/extra,v 1.3 2002/11/26 02:14:02 dawes Exp $..partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree,ScrollLock,LevelFive;.. type "EIGHT_LEVEL" {. modifiers = Shift+LevelThree+LevelFive;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[LevelFive] = Level5;..map[Shift+LevelFive] = Level6;..map[LevelThree+LevelFive] = Level7;..map[Shift+LevelThree+LevelFive] = Level8;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; ..level_name[Level5] = "X";..level_name[Level6] = "X Shi

C:\Program Files (x86)\Xming\xkb\types\is-IADCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	433
Entropy (8bit):	5.024046778580582
Encrypted:	false
SSDEEP:	12:jLsZaQnuwcjXzvar02bEQvn/0HJkaqbkaXau1EaUGaiT5a6v:YamuwcvL2bx/0pKz12uv
MD5:	09FC69FA6B8D63262758239F10AAF0DB
SHA1:	C85A7F5AAB60BE66E675B09DDE42E95E0767D7AC
SHA-256:	87E2154FAC4403AE7C127308E95EDCC83BEF3E19556A93FBFFE989BF7487596B
SHA-512:	54F4C13DD017555CA7DF46BCED99C231D9C45FA2090AC6DD2AF85EBB1406811813F8F100BA6482F84D1D3C58FDE3F27B154D063FAB4DA4162204F88CBC0F796D
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/complete,v 1.5 2006-10-07 21:52:44 svu Exp $.// $Xorg: complete,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.//.//.//.//.// $XFree86: xc/programs/xkbcomp/types/complete,v 1.2 2001/05/18 23:35:35 dawes Exp $..default xkb_types "complete" {. include "basic". include "mousekeys". include "pc". include "iso9995". include "level5". include "extra". include "numpad".};.

C:\Program Files (x86)\Xming\xkb\types\is-IQMK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.948527228113323
Encrypted:	false
SSDEEP:	6:jLmtdTZa3puYnZnnS/cumEQvo6/Ch8dwwAJklA2ElAu1ElAiT5lA3VFlAU32lAqn:jLsZaHncGEQvn/o8eJkaXau1EaiT5avG
MD5:	58E08BE192351FFB527B65C508E46250
SHA1:	3993291CACDBEC4C4961B2EBDA6C216D62D5FEDA
SHA-256:	2A3516ABC70DD715F03560CC90E8789A5F2DB090702AC55CD1FFC2C91D3EA93E
SHA-512:	8D279DB5FB74966FB31F562661B622C677797FB56F84805E84CFAD0DCD79EF0AACB3C5398CB1AB9FC692C6D3A6B86BD7BD0AF1F8DC2F30EED998CEB2E81A39C3
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/default,v 1.6 2006-10-07 21:52:44 svu Exp $.// $Xorg: default,v 1.3 2000/08/17 19:54:48 cpqbld Exp $..default xkb_types "default" {. include "basic". include "pc". include "iso9995". include "extra". include "numpad". include "level5". include "mousekeys".};.

C:\Program Files (x86)\Xming\xkb\types\is-MIFFH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	4.919020197547123
Encrypted:	false
SSDEEP:	96:al14RtYSqarqxtYSUarubtYSUar5E3J04tHI1TdTyS3bg0r9IWtKturrwKftHSkr:an4jYSqariYSUargYSUaryZrHITdTySZ
MD5:	E64FBBDF566AAA5642C66B5B99C224AF
SHA1:	30590C07F14F2FC35C3005FD9CB90847255A2001
SHA-256:	C12D9F93A455C4039B1B52C9BC3453A814F277DD4F606D22B80B16E49D16C2EE
SHA-512:	79231E5F4DA2E7E8F616FB4FDEA228D6D521BAEEE9275DCAE0A422C97D67318B668F3006E1951A6ABF4910BAD2AEEC413A7D34BA14D986F5031E4D635388F04A
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/types/extra,v 1.3 2002/11/26 02:14:02 dawes Exp $..partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree;.. type "FOUR_LEVEL" {. modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; . };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[Lock] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level4;..map[Lock+Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Le

C:\Program Files (x86)\Xming\xkb\types\is-OJ8ND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.971895888114852
Encrypted:	false
SSDEEP:	24:c/o8w5s6d606Zx6tS3wxwWt43wxwF+Hkxnt4qywxwF+Jwp3wxw0:c/M3I06ZctSgOWt4gOF+Hsnt4qdOF+W8
MD5:	7CBA46C323FE30FB55AE8BCD7093A0D8
SHA1:	D9603ED5ECDF3B18048D2038C6AB171D031CC241
SHA-256:	D91C8B596A31EBACC4D8BC2AC36A5623302BD73DC631D2AA21EABC584AA5B932
SHA-512:	C7D653357DD45C55BCD0884A7BF98D37213F92A9752D07753D1E5A082C0C27AAB268DF90FB22C5079B2876F1B966BD5A333868BACEE464FFB2F52AFFC07F9FAF
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.// ..partial default xkb_types "default" {.. // Some types that are necessary. // for a full implementation of. // a PC compatible keyboard.. virtual_modifiers Alt;. virtual_modifiers LevelThree;.. type "PC_BREAK" {..modifiers = Control;..map[None] = Level1;..map[Control] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Control";. };.. type "PC_ALT_LEVEL2" {..modifiers = Alt;..map[None] = Level1;..map[Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";. };.. type "PC_SYSRQ" {..modifiers = Alt+LevelThree;..map[None] = Level1;..map[Alt] = Level2;..map[LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";..level_name[Level3] = "Level3";. };.. type "CTRL+ALT" {..modifiers = Control+Alt;..map[Control+Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Ctrl+Alt";. };.};.

C:\Program Files (x86)\Xming\xkb\types\is-R0GK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	895
Entropy (8bit):	4.894419860850381
Encrypted:	false
SSDEEP:	24:J/GrK1tYS5TrI1T8wxwUPV3WXwrK1trSWTYI1T3wewnVkT1DthTMLwCLwUa:J/GrK1tYS5TrI1T7OsVmXwrK1trSWTYm
MD5:	07BAFA886097B871B0EB5A3BB8BA83DF
SHA1:	961F3B9C26DE5C19992825C421CE5C931FFD14E9
SHA-256:	4F789CE5EB8ED0BA4DF9BA360608F5B09DD4717EDF823A1FF4F08B8FF2DE6990
SHA-512:	13032F4362BA7960A0136D22F0C30D776027685101C1ADB31A3E480AC749F561508AFD9ADD498BA251BBACDFF4D8C2731E6826265E54E02AF9827E265C5DB798
Malicious:	false
Preview:	.partial default xkb_types "pc" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level1;..map[Shift] = Level2;..map[NumLock] = Level2;..map[Shift+NumLock] = Level1;..level_name[Level1] = "Base";..level_name[Level2] = "Number";. };. include "extra(keypad)".};..// On Mac keypads, level 1 and 2 are swapped.partial xkb_types "mac" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level2;..map[Shift] = Level1;..map[NumLock] = Level1;..map[Shift+NumLock] = Level2;..level_name[Level2] = "Base";..level_name[Level1] = "Number";. };. include "extra(mac_keypad)".};..partial xkb_types "microsoft" {. type "KEYPAD" {. modifiers = Shift+NumLock;. map[None] = Level1;. preserve[Shift] = Shift;. map[NumLock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Number";. };. include "extra(keypad)".};..

C:\Program Files (x86)\Xming\xkb\types\is-UEME5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	623
Entropy (8bit):	4.9702724388135655
Encrypted:	false
SSDEEP:	12:jLqEQvn/V2EUCNcjpAQt8wMDpqv+N3wblvwDFvKJkgYIqI+NkTMLwb+LwDFyv:Cx/V2pCNGt8wMqS3wxwVakg9SkTMLwCT
MD5:	64ABBDBC27B846D8912CA58F5612F4A2
SHA1:	A5675E39A5B01431956EB35C37A1E64E55CB1D11
SHA-256:	0DFB5EC72532E4E3CB1B28FDEC396DB3D6813F280A58EEF185F688F4C7CC0EEB
SHA-512:	769535C018D50712AFE4BB738723C1B69C494E706C5C11767462270EC8B9D3DE7A0D19ACB7673DD53BC05FE68B3D5C5239432CDCCAE4A411D1B3255744E686CA
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:48 cpqbld Exp $..default xkb_types "basic" {.. // Fairly standard definitions for. // the four required key types.. virtual_modifiers NumLock;.. type "ONE_LEVEL" {..modifiers = None;..map[None] = Level1;..level_name[Level1]= "Any";. };.. type "TWO_LEVEL" {..modifiers = Shift;..map[Shift] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";. };.. type "ALPHABETIC" {. modifiers = Shift+Lock;. map[Shift] = Level2;. map[Lock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Caps";. };..};.

C:\Program Files (x86)\Xming\xkb\types\is-VE3OG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.256051887778693
Encrypted:	false
SSDEEP:	6:vFRh5fgFdomepnrAs6HL/xFRx1cvvPJau6czd/n:dbJpUhLDdWku6Ud/n
MD5:	12FAD9640F00F0D22DD12B27AE2E27E4
SHA1:	0462098E52903925847BD4370126C6AE386C81F5
SHA-256:	CBE1F25696664C3BAFE32808474C0D1BF2F3A20E06B8703F5931186EBB41C24D
SHA-512:	F2752C9A417F08905604D6025D753AA542D89B1DA335C877DA6590EBB3D1FE85770310927FF5DFEA071CCDB3371308A10A4A0D1A83DAE79DAA286FB47777C82F
Malicious:	false
Preview:	The types component of a keyboard mapping specifies the key types that can be.associated with the various keyboard keys. The types component can also.optionally contain real modifiers binding and symbolic names for one.or more virtual modifiers..

C:\Program Files (x86)\Xming\xkb\types\iso9995 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	505
Entropy (8bit):	5.055581258265879
Encrypted:	false
SSDEEP:	12:jLJWn/o8wMrxMNUom6fpquQtY+N9caWcywblvwDFvZvwyMF:M/o8wCMR4tYSqarywxwVJw3
MD5:	61180E4DEE8A87216CB379E13CF86F26
SHA1:	4C51D41AA311FB5EA541A539CB6E479DAEC2D2FA
SHA-256:	7B908FA07D2CD24E43A7CA3592B42E681FC1AD5E7FE236B37F0D6A030D723B66
SHA-512:	D530E84DEF6F9F14E6C05095D86A5CECAF392135CD64CAB52A248EDDAB4DE82074F52D972307BDA5541D8532C1B69939C166511298CD9E34A17DD41DAFD63769
Malicious:	false
Preview:	// $Xorg: iso9995,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.partial default xkb_types "default" {.. // Definition for a key type which . // can be used to implement ISO9995. // style level three shift. virtual_modifiers LevelThree;.. type "THREE_LEVEL" {..modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Level3";. };.};..

C:\Program Files (x86)\Xming\xkb\types\level5 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2993
Entropy (8bit):	4.943540747905254
Encrypted:	false
SSDEEP:	48:n3W/PXGulDXB48OtYSqar6RmzNheuheOMQi7JV3IRqLOtYSUar1pRmzMheuhlVhX:ql14JtYSqar68zHee+nKtYSUar1p8zsh
MD5:	BD467C5C4FE063B90B987F7A13BA1D06
SHA1:	DF46C58964808A798F28E9FF73F834C3378AB3E0
SHA-256:	F85558A82DF427AA6A67872308E385E5B261AA9520817E46900D72CF43FE599E
SHA-512:	033920434C857B57DFE11FA67E53D8FC95B9733ADD225AB9E0872FFF5E1177DB205B0E33EDB2B3D93C3B568A923D9F2887587779446CDD7AD5AEEF75DB7B51BD
Malicious:	false
Preview:	// $XKeyboardConfig: xkbdesc/xkeyboard-config/types/level5,v 1.3 2006-01-22 17:49:45 svu Exp $.// $XFree86: xc/programs/xkbcomp/types/extra,v 1.3 2002/11/26 02:14:02 dawes Exp $..partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree,ScrollLock,LevelFive;.. type "EIGHT_LEVEL" {. modifiers = Shift+LevelThree+LevelFive;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[LevelFive] = Level5;..map[Shift+LevelFive] = Level6;..map[LevelThree+LevelFive] = Level7;..map[Shift+LevelThree+LevelFive] = Level8;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; ..level_name[Level5] = "X";..level_name[Level6] = "X Shi

C:\Program Files (x86)\Xming\xkb\types\mousekeys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.133658469969046
Encrypted:	false
SSDEEP:	6:jLD6LWowuj7vo6/Ch8dwodivst4k2NMqNsEyaoEtTWYBTAyEtTfF9NjYwz3:jLGjn/o8td74kqDyHwblvwDFvL
MD5:	723AE020CDC746C423F9D100FF52FB53
SHA1:	BD2E378FCF8765EB8248FD39A1CA4A1C251AD712
SHA-256:	AC958EBB3217E5C6A29FD12CB81059EE4D5CBCC7AEA7CDB36ADAB8B081ABB91D
SHA-512:	9D200053A8774B7D492A63263B8A553E8484952FFF3F3C25253B2FADB559B9B174BDA3FC264EBBFA99F4A6C249E1CC2E92D5CB533D939F76CA70BDC8A9CADBC9
Malicious:	false
Preview:	// $Xorg: mousekeys,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.// .partial default xkb_types "default" {. virtual_modifiers Alt;.. type "SHIFT+ALT" {. .modifiers = Shift+Alt;. .map[Shift+Alt] = Level2;. .level_name[Level1] = "Base";..level_name[Level2] = "Shift+Alt";. };.};..

C:\Program Files (x86)\Xming\xkb\types\numpad (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	895
Entropy (8bit):	4.894419860850381
Encrypted:	false
SSDEEP:	24:J/GrK1tYS5TrI1T8wxwUPV3WXwrK1trSWTYI1T3wewnVkT1DthTMLwCLwUa:J/GrK1tYS5TrI1T7OsVmXwrK1trSWTYm
MD5:	07BAFA886097B871B0EB5A3BB8BA83DF
SHA1:	961F3B9C26DE5C19992825C421CE5C931FFD14E9
SHA-256:	4F789CE5EB8ED0BA4DF9BA360608F5B09DD4717EDF823A1FF4F08B8FF2DE6990
SHA-512:	13032F4362BA7960A0136D22F0C30D776027685101C1ADB31A3E480AC749F561508AFD9ADD498BA251BBACDFF4D8C2731E6826265E54E02AF9827E265C5DB798
Malicious:	false
Preview:	.partial default xkb_types "pc" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level1;..map[Shift] = Level2;..map[NumLock] = Level2;..map[Shift+NumLock] = Level1;..level_name[Level1] = "Base";..level_name[Level2] = "Number";. };. include "extra(keypad)".};..// On Mac keypads, level 1 and 2 are swapped.partial xkb_types "mac" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level2;..map[Shift] = Level1;..map[NumLock] = Level1;..map[Shift+NumLock] = Level2;..level_name[Level2] = "Base";..level_name[Level1] = "Number";. };. include "extra(mac_keypad)".};..partial xkb_types "microsoft" {. type "KEYPAD" {. modifiers = Shift+NumLock;. map[None] = Level1;. preserve[Shift] = Shift;. map[NumLock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Number";. };. include "extra(keypad)".};..

C:\Program Files (x86)\Xming\xkb\types\pc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.971895888114852
Encrypted:	false
SSDEEP:	24:c/o8w5s6d606Zx6tS3wxwWt43wxwF+Hkxnt4qywxwF+Jwp3wxw0:c/M3I06ZctSgOWt4gOF+Hsnt4qdOF+W8
MD5:	7CBA46C323FE30FB55AE8BCD7093A0D8
SHA1:	D9603ED5ECDF3B18048D2038C6AB171D031CC241
SHA-256:	D91C8B596A31EBACC4D8BC2AC36A5623302BD73DC631D2AA21EABC584AA5B932
SHA-512:	C7D653357DD45C55BCD0884A7BF98D37213F92A9752D07753D1E5A082C0C27AAB268DF90FB22C5079B2876F1B966BD5A333868BACEE464FFB2F52AFFC07F9FAF
Malicious:	false
Preview:	// $Xorg: pc,v 1.3 2000/08/17 19:54:48 cpqbld Exp $.// ..partial default xkb_types "default" {.. // Some types that are necessary. // for a full implementation of. // a PC compatible keyboard.. virtual_modifiers Alt;. virtual_modifiers LevelThree;.. type "PC_BREAK" {..modifiers = Control;..map[None] = Level1;..map[Control] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Control";. };.. type "PC_ALT_LEVEL2" {..modifiers = Alt;..map[None] = Level1;..map[Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";. };.. type "PC_SYSRQ" {..modifiers = Alt+LevelThree;..map[None] = Level1;..map[Alt] = Level2;..map[LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";..level_name[Level3] = "Level3";. };.. type "CTRL+ALT" {..modifiers = Control+Alt;..map[Control+Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Ctrl+Alt";. };.};.

C:\Program Files (x86)\Xming\xkbcomp.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	833536
Entropy (8bit):	7.0617971573042215
Encrypted:	false
SSDEEP:	12288:ez1wEmIIlrG2AnZejdn5cf5TsgKZ1W1YflhV+wL/lvPp4hSkfm8C6vV:ez/d4rG2EejV5cf54gKiyflhVhGfxC6
MD5:	57A69BF8F353DCF8FE1B0DCE5A77D15E
SHA1:	2B84CFF4556D6CC569D5D22A826E725042684B38
SHA-256:	3BDAC020A77E800E4B1094B107CFF927F3A3BA33521341061A506D438D731D34
SHA-512:	40A3D3051A5EBCF00D6707CE91EBF9C0FBD8D79069C9DCE51C722BC1A8ACB13486909F7B5B324A75FAD69F69D54DB2ECCCD1598620CA65494F9A59A42E1663DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:F...............8............(.............@.................................A......... .................................X........h...........................................................................................................text...............................`..`.data....=.......>..................@....rdata...(...0...*..................@..@.bss.........`...........................idata..X............B..............@....rsrc....h.......j...N..............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Uninstall Xming.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 30 20:11:26 2024, mtime=Wed Oct 30 20:11:26 2024, atime=Wed Oct 30 20:11:06 2024, length=704793, window=hide
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	4.66118533937414
Encrypted:	false
SSDEEP:	24:8qB5/NE1dOEa7Sh0Avt4podpmboUU8rqygm:8qBRK1dOHODvt4podob9wyg
MD5:	8767E471ABFAABF6514EF3DCB44F6F3B
SHA1:	7663441D32CE33209C574FCFB8DA5C425974BFEB
SHA-256:	F85095933870E5D963C79DF7825E6CF9FF30F019B770F9493E3415EC283E0371
SHA-512:	1AB825DF1AF1220AE95EBE9BFCDA6BB173F61839AA45214CB44E307244C47A0FCB68616560C253C96348F227C285164A12C69230E782E4205F2D9F31EEB82554
Malicious:	false
Preview:	L..................F.... ......G.+.....G.+..?1-<.+..........................}....P.O. .:i.....+00.../C:\.....................1.....^Yn...PROGRA~2.........O.I^Yo.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....^Yo...Xming.<......^Yn.^Yo...........................<v3.X.m.i.n.g.....f.2.....^Yd. .unins000.exe..J......^Yn.^Yn...............................u.n.i.n.s.0.0.0...e.x.e.......X...............-.......W............9......C:\Program Files (x86)\Xming\unins000.exe..8.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g.\.u.n.i.n.s.0.0.0...e.x.e.........*................@Z\|...K.J.........`.......X.......138727...........hT..CrF.f4... .\|.2=.b...,...W..hT..CrF.f4... .\|.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\XLaunch.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 20:11:26 2024, mtime=Wed Oct 30 20:11:26 2024, atime=Thu May 3 20:43:12 2007, length=858112, window=hide
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.627883829166901
Encrypted:	false
SSDEEP:	24:8mfZty2NE1dOEa7VmCAGt4whwdpHFgdpgUU8bqygm:8mf22K1dOH0Gt4xdcdbQyg
MD5:	5F30B29D94232CB9482AC47A61632BAF
SHA1:	F445EA87AD8BBD35988910DDE1EBD1A3703E0F1B
SHA-256:	D512CF6CACC106352C5BD9678EB255EB36B13DCA459527C0E2C91870E70C69A4
SHA-512:	92F74C6182CF8F539B4BBAFAA788779BE64E0F618FC3B9B5FE2ECADF4FC83D1D6774D11BD2BFE531D040E7BC864E55B4E219B931AE8F8D97B8045A4FB8755BCD
Malicious:	false
Preview:	L..................F.... ....U.H.+.....H.+....%............................y....P.O. .:i.....+00.../C:\.....................1.....^Yn...PROGRA~2.........O.I^Yo.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....^Yo...Xming.<......^Yn.^Yo...........................<v3.X.m.i.n.g.....b.2......6f. .XLaunch.exe.H......^Yn.^Yn...............................X.L.a.u.n.c.h...e.x.e.......W...............-.......V............9......C:\Program Files (x86)\Xming\XLaunch.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g.\.X.L.a.u.n.c.h...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g.........*................@Z\|...K.J.........`.......X.......138727...........hT..CrF.f4... .s.2=.b...,...W..hT..CrF.f4... .s.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3........

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Xming on the Web.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	728
Entropy (8bit):	3.2770031055894804
Encrypted:	false
SSDEEP:	12:8gl0tRa/ledp8CiGFcfRYbdpY48phQ/CNUvH4t2YZ/elFlSJm:8rdOt/ZMdp8piOUFqy
MD5:	E7BF7C6B9679394AEAE79BD56025D171
SHA1:	F4824414B556D674464DB4914321061A780C522E
SHA-256:	4A96CC5C6AB0DD2BBB9F7FFF163101E07CC9F1EF3557A31E200598F534B2DF3F
SHA-512:	D13A160E560179E20F87D0443DCDAEC4E309A676B842896E31A0FDEFC4E370484A4932BB34BE34D3E132982A2AD324502C98429A9C79789FFE030DDD8B1C7BA8
Malicious:	false
Preview:	L..................F........................................................U....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".P.1...........Xming.<............................................X.m.i.n.g.....\.2...........Xming.url.D............................................X.m.i.n.g...u.r.l.......5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g.\.X.m.i.n.g...u.r.l.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xming\Xming.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Wed Oct 30 20:11:26 2024, mtime=Wed Oct 30 20:11:26 2024, atime=Thu May 3 20:43:16 2007, length=2106368, window=hide
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.5913195052872915
Encrypted:	false
SSDEEP:	24:8zGEh0dOEa781k0TAAt4K/Mdp8pigdpZaiFUU8J+iqygm:8z5h0dOHQ1V0At4KkdM1dn2H+fyg
MD5:	1065F45D112248A878D2EB1318B48139
SHA1:	AE0D219BE7EE7509C1FA17BF40747F379CE9BD47
SHA-256:	DB91588647332C281F0A0771EED9FDC43EE832D840446C9DC9E9A1C4D9227FB4
SHA-512:	CD1F459AE208B566410EEB2F36266FBCADB2A547E8669F032D3B0E5233DED6098E87A1703B396B9ED20B1E8F0089CE85465B6901DC5E48DFA64BDCB171963718
Malicious:	false
Preview:	L..................F.... ......G.+...B.H.+...2......$ .....................s....P.O. .:i.....+00.../C:\.....................1.....^Yb...PROGRA~2.........O.I^Yb.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....^Yo...Xming.<......^Yn.^Yo...........................<v3.X.m.i.n.g.....\.2..$ ..6h. .Xming.exe.D......^Yn.^Yn...............................X.m.i.n.g...e.x.e.......U...............-.......T............9......C:\Program Files (x86)\Xming\Xming.exe..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g.\.X.m.i.n.g...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.X.m.i.n.g...:.0. .-.c.l.i.p.b.o.a.r.d. .-.m.u.l.t.i.w.i.n.d.o.w.........*................@Z\|...K.J.........`.......X.......138727...........hT..CrF.f4... .j.2=.b...,...W..hT..CrF.f4... .j.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1

C:\Users\user\AppData\Local\Temp\Xming.0.log

Download File

Process:	C:\Program Files (x86)\Xming\Xming.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2948
Entropy (8bit):	5.261878919452234
Encrypted:	false
SSDEEP:	48:LT6KcAgbwMOwQia2acN43MrvrcrX4tZbdaIb2AzjRyh4B30J57iJ57zpe35J57e:LTTcAgEMO3ia2avJoRe4+4ZsE
MD5:	B7C339E4FC7D7DC2047A0E8738C701B9
SHA1:	584E2B52561B82952F6BD03A2FE9B7417FC0613F
SHA-256:	79206D366245A5C8996BA8A322615EC0CD1E71269B4B18027851CAE48E5BA0F1
SHA-512:	82C205B4A428ADF2398E0665AB7EA44FD2C5C9A5F254C1A5ECB548E22B530F06ACA6B72429D6A5D04788B5372185BABF243202FD2787F293F090522D0D64B1AF
Malicious:	false
Preview:	Welcome to the Xming X Server..Vendor: Colin Harrison..Release: 6.9.0.31..FreeType2: 2.3.4..Contact: http://sourceforge.net/forum/?group_id=156984....C:\Program Files (x86)\Xming\Xming.exe :0 -clipboard .. -multiwindow....XdmcpRegisterConnection: newAddress 192.168.2.5..winAdjustVideoModeShadowGDI - Using Windows display depth of 32 bits per pixel..winAllocateFBShadowGDI - Creating DIB with width: 1280 height: 1024 depth: 32..winInitVisualsShadowGDI - Masks 00ff0000 0000ff00 000000ff BPRGB 8 d 24 bpp 32..glWinInitVisuals:1596: glWinInitVisuals..glWinInitVisualConfigs:1503: glWinInitVisualConfigs glWinSetVisualConfigs:1581: glWinSetVisualConfigs..init_visuals:1055: init_visuals..null screen fn ReparentWindow..null screen fn RestackWindow..InitQueue - Calling pthread_mutex_init..InitQueue - pthread_mutex_init returned..InitQueue - Calling pthread_cond_init..InitQueue - pthread_cond_init returned..winInitMultiWindowWM - Hello..winInitMultiWindowWM - Calling pthread_mutex_lock ()..winMulti

C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	4.012434743866195
Encrypted:	false
SSDEEP:	48:iAnz1hEU3FR/pmqBl8/QMCBaquEMx5BCwSS4k+bkguj0K:pz1eEFNcqBC/Qrex5MSKD
MD5:	C594B792B9C556EA62A30DE541D2FB03
SHA1:	69E0207515E913243B94C2D3A116D232FF79AF5F
SHA-256:	5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
SHA-512:	387BD07857B0DE67C04E0ABF89B754691683F30515726045FF382DA9B6B7F36570E38FAE9ECA5C4F0110CE9BB421D8045A5EC273C4C47B5831948564763ED144
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L.....%E..................................... ....@..........................@..............................................l ..P....0..8............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...8....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.203889009972449
Encrypted:	false
SSDEEP:	48:SvTmfWvPcXegCWUo1vlZwrAxoONfHFZONfH3d1xCWMBgW2p3SS4k+bkg6j0K:nfkcXegjJ/ZgYNzcld1xamW2pCSKv
MD5:	B4604F8CD050D7933012AE4AA98E1796
SHA1:	36B7D966C7F87860CD6C46096B397AA23933DF8E
SHA-256:	B50B7AC03EC6DA865BF4504C7AC1E52D9F5B67C7BCB3EC0DB59FAB24F1B471C5
SHA-512:	3057AA4810245DA0B340E1C70201E5CE528CFDC5A164915E7B11855E3A5B9BA0ED77FBC542F5E4EB296EA65AF88F263647B577151068636BA188D8C4FD44E431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d......E..........#............................@.............................`..............................................................<!.......P..8....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...8....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6HCKB.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp

Download File

Process:	C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	694272
Entropy (8bit):	6.429802333668127
Encrypted:	false
SSDEEP:	12288:pkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWoVphKvV2xg4:GFRCUn4rP/37YzHXA6QJsoPtdpQ0xg4
MD5:	A52A2BC95FC835F16506C0041211B8B7
SHA1:	E38C541BE3B445D20371308F9F55E81A707DD1B8
SHA-256:	089B2E05E71570CE2990AE45D9F540EC086394FA1F44B900BF32BCC219F3F12C
SHA-512:	3D4F09D735C18D64512079883A75A302F318D195461577EBAB1D74921286AFBB40082D5BAFA3F84E70A57060F32D11B91E3358C0BE0145E45F530F5853212F86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@..............................<%......p....................`...............................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc...p...........................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\server-0.xkm

Download File

Process:	C:\Program Files (x86)\Xming\xkbcomp.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.024935431941062
Encrypted:	false
SSDEEP:	192:qdsY96MLbryTgByXawFBZSLu5iJTjQVPJd0YxvG8T:qa6yTgByqwF7S6mIT
MD5:	6FB8BE19A4D9B386CC8E7B7DA483BEDA
SHA1:	19FF68D8AF3CD07F169EDF1A25F9C2F60461B630
SHA-256:	7035D9221DA1DFB9D0D82E77AD5503BBA6362384ECF9BA77BF7460EE08CF5D7A
SHA-512:	5A77DE16CA45C165773E0601B7D9F723F64372EC448A45A16C645C8A26CE484827D011E1E05961CEA91ADF8E5AD618AA84E17443A858458E79F271B2801299F7
Malicious:	false
Preview:	.mkx....{.......d.<...............p.....................\.t.....d.<.......NumLock.....Alt.....LevelThree..ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....9.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQMDSWLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.I44.I45.K67.K68.K69.K6A.I4A.K6B.K6C.K6D.K6E.K6F.

C:\Users\user\AppData\Local\Temp\xkb_a01396

Download File

Process:	C:\Program Files (x86)\Xming\Xming.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.217741085754921
Encrypted:	false
SSDEEP:	6:j8gdfFNGlY8A84HH2NU7nlEuaCXAkTkut6nAkTku90iA2OdM9xpQLF9A2pv:5R2lYR7n28HaBTut6ATu9+IxpQxiK
MD5:	1EFAC07434570D3EBD46766DC4B4F0CC
SHA1:	B8394210FE7831AA0A08989B413F95B39B8B47CC
SHA-256:	F3F5488113336E3CFAD46A0E67F5A4F409468F0B28CD3EF4873404AD8754AC94
SHA-512:	77BB2FBD2BA244C169B874047EBD06DF3CD70C0C50311512008A609E67E7E80845859BCDECDDC6163EA7C4AC778C9931B5B8F3CF2E13A294AD01E4BAE21AC436
Malicious:	false
Preview:	xkb_keymap "default" {.. xkb_keycodes { include "xfree86+aliases(qwerty)" };.. xkb_types { include "complete" };.. xkb_compatibility { include "complete" };.. xkb_symbols { include "pc+de_CH" };.. xkb_geometry { include "pc(pc105)" };..};..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988147307937862
TrID:	Win32 Executable (generic) a (10002005/4) 97.43% Win32 Executable PowerBASIC/Win 9.x (148305/79) 1.44% Inno Setup installer (109748/4) 1.07% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Xming-6-9-0-31-setup.exe
File size:	2'204'914 bytes
MD5:	4cd12b9bec0ae19b95584650bbaf534a
SHA1:	8e232d39e7c319ef299364c04b89bd4af1baca0a
SHA256:	9fe52242d63d90c5bf4859b9de46f516c54b80bf8e94939a4986667acf6c5024
SHA512:	cdb645dc0ea16d0de0dfaafc4678e13a4eaabffe585d53f7b9d7de96ed4df7719c61397adefc763c0cf9374af1ded593f146542866904d624c994e64a9433eb9
SSDEEP:	49152:C2FWJxdex2A96TU2PNDjDh3TQUBRbM8hMt7IJ4dZz+3txS9C2Dw050ov:TFWPdG2A9JeNDj93MUBNM9Lce9C2DT0M
TLSH:	E5A53346BAD0187AE1A496B92E23C242BD5F3D246DF0C15F78DCAA6F6F734C484143E9
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6123174c8e9a316c

Static PE Info

General

Entrypoint:	0x40991c
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFCCh
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F1D5CB786EFh
call 00007F1D5CB798F6h
call 00007F1D5CB7BB21h
call 00007F1D5CB7BBA8h
call 00007F1D5CB7E24Fh
call 00007F1D5CB7E3B6h
xor eax, eax
push ebp
push 00409FC6h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00409F7Ch
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F1D5CB7EDE0h
call 00007F1D5CB7E96Bh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F1D5CB7C025h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDD4h
call 00007F1D5CB787A0h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDD4h]
mov dl, 01h
mov eax, 0040719Ch
call 00007F1D5CB7C890h
mov dword ptr [0040CDD8h], eax
xor edx, edx
push ebp
push 00409F5Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F1D5CB7EE50h
mov dword ptr [0040CDE0h], eax
mov eax, dword ptr [0040CDE0h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F1D5CB7EF8Ah
mov eax, dword ptr [0040CDE0h]
mov edx, 00000028h
call 00007F1D5CB7CC91h
mov edx, dword ptr [0040CDE0h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x78c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9040	0x9200	3fc23a57f6f12a4277db04cb09d7c497	False	0.6109267979452054	data	6.538420413933938	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x248	0x400	9981120c17987c8a6e66ed14ebd1c6dd	False	0.3046875	data	2.711035285634283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8a4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x78c8	0x7a00	2d276dfb743eaba86d666e34b1016779	False	0.49775870901639346	data	4.932685048293178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11444	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.400609756097561
RT_ICON	0x11aac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.532258064516129
RT_ICON	0x11d94	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.6756756756756757
RT_ICON	0x11ebc	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.47974413646055436
RT_ICON	0x12d64	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.6917870036101083
RT_ICON	0x1360c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.619942196531792
RT_ICON	0x13b74	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5504149377593361
RT_ICON	0x1611c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6721388367729831
RT_ICON	0x171c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6914893617021277
RT_STRING	0x1762c	0x2f2	data			0.35543766578249336
RT_STRING	0x17920	0x30c	data			0.3871794871794872
RT_STRING	0x17c2c	0x2ce	data			0.42618384401114207
RT_STRING	0x17efc	0x68	data			0.75
RT_STRING	0x17f64	0xb4	data			0.6277777777777778
RT_STRING	0x18018	0xae	data			0.5344827586206896
RT_RCDATA	0x180c8	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x180f4	0x84	data	English	United States	0.6363636363636364
RT_VERSION	0x18178	0x3cc	data	English	United States	0.35288065843621397
RT_MANIFEST	0x18544	0x383	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4638487208008899

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	17:11:06
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe"
Imagebase:	0x400000
File size:	2'204'914 bytes
MD5 hash:	4CD12B9BEC0AE19B95584650BBAF534A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:11:06
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-70FSE.tmp\is-L00DR.tmp" /SL4 $2043A "C:\Users\user\Desktop\Xming-6-9-0-31-setup.exe" 1923415 73728
Imagebase:	0x400000
File size:	694'272 bytes
MD5 hash:	A52A2BC95FC835F16506C0041211B8B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:11:30
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Xming\Xming.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Xming\Xming.exe" :0 -clipboard -multiwindow
Imagebase:	0x400000
File size:	2'106'368 bytes
MD5 hash:	2118E06C1667CDEF92CB5977D9CC8534
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:11:31
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Xming\xkbcomp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Xming\xkbcomp" -w 1 "-RC:\Program Files (x86)\Xming\xkb" -xkm "C:\Users\user\AppData\Local\Temp\xkb_a01396" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\server-0.xkm"
Imagebase:	0x400000
File size:	833'536 bytes
MD5 hash:	57A69BF8F353DCF8FE1B0DCE5A77D15E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	1514
Total number of Limit Nodes:	27

Executed Functions

Function 0040980C Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 0040981E
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409829
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 0040986A
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 0040989C
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 004098AC

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 394947688dee8e93bacf74dedd22c2a8d1d5dd8f735b4c9dfe0a991e12bafe3f
Instruction ID: 94f5da7d78a14a24f83fc3459e547f2b55f5b17be2d71599b00960b009e03402
Opcode Fuzzy Hash: 394947688dee8e93bacf74dedd22c2a8d1d5dd8f735b4c9dfe0a991e12bafe3f
Instruction Fuzzy Hash: 2C2181B2210304ABD630AE6A8C85E57B7D89F46350F04883AFA85E63C3D679ED44C669

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Function 00409664 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000,00409754), ref: 004096D8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000), ref: 004096EC
TranslateMessage.USER32(?), ref: 004096F4
DispatchMessageA.USER32(?), ref: 004096FA
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409720
GetExitCodeProcess.KERNEL32(?,?), ref: 00409730
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044), ref: 00409739

Part of subcall function 0040927C: GetLastError.KERNEL32(00000000,0040931F,?,?,021074B0,?), ref: 004092A0

Strings

D, xrefs: 004096B2

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Message$CloseHandleProcess$CodeCreateDispatchErrorExitLastMultipleObjectsPeekTranslateWait
String ID: D
API String ID: 884379925-2746444292
Opcode ID: 8af437ce9a0ef28a3fd7f9cf6d634f98b766fb828dac67037ac986d7442df17d
Instruction ID: b5afb7c7dcba662fd328991b68db6fda78b5aaf02a74c63f92c37c95fca848c0
Opcode Fuzzy Hash: 8af437ce9a0ef28a3fd7f9cf6d634f98b766fb828dac67037ac986d7442df17d
Instruction Fuzzy Hash: BE2177B1A402047ADB10EFE6CC92F9E77AC9B48714F50053AB714F72C3DA789901862D

Function 00408DBC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408E55,?,?,?,?,00000000,?,0040994B), ref: 00408DDC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408DE2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408E55,?,?,?,?,00000000,?,0040994B), ref: 00408DF6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408DFC

Strings

shell32.dll, xrefs: 00408E28
Wow64DisableWow64FsRedirection, xrefs: 00408DD2
kernel32.dll, xrefs: 00408DD7, 00408DF1
Wow64RevertWow64FsRedirection, xrefs: 00408DEC

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0f9d61604bc9d9982718e3017efe5b9e7ff015158a0c1e52cc2775fa4df73348
Instruction ID: 8ab6fbbcb4b7f08204b51e865fdbc175ac4c782ddcdde418887d2bb644b97990
Opcode Fuzzy Hash: 0f9d61604bc9d9982718e3017efe5b9e7ff015158a0c1e52cc2775fa4df73348
Instruction Fuzzy Hash: 68017C70208304EEEB50ABA2DE57B563A68E785B18F61443FF544F61C2DEBD4800CAAD

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00409DB2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E0E
SetWindowLongA.USER32(0002043A,000000FC,004095D0), ref: 00409E25

Part of subcall function 004068D0: GetCommandLineA.KERNEL32(?,?,00406A14,00000000,00406A50,?,?,?,?,00000000,00000000,?,004093B9,00000000,00409445), ref: 004068D4

Part of subcall function 00409664: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000,00409754), ref: 004096D8
Part of subcall function 00409664: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000), ref: 004096EC
Part of subcall function 00409664: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
Part of subcall function 00409664: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409720
Part of subcall function 00409664: GetExitCodeProcess.KERNEL32(?,?), ref: 00409730
Part of subcall function 00409664: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044), ref: 00409739

RemoveDirectoryA.KERNEL32(00000000,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F11
73A15CF0.USER32(0002043A,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409264

Strings

Inno, xrefs: 00409E02

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcessWindow$CodeCommandDirectoryExitLineLongMessageMultipleObjectsPeekRemoveSleepWait
String ID: Inno
API String ID: 4113000731-2741113953
Opcode ID: 0c628eccdb5d68a9a545aaf1db1e3e5f60eee6e16505dab8839527403e1d1cdf
Instruction ID: 2adf325163ae9d4eab7e2e19cbcb2e7beeeb4b30098e95a307ad94bcbced26f9
Opcode Fuzzy Hash: 0c628eccdb5d68a9a545aaf1db1e3e5f60eee6e16505dab8839527403e1d1cdf
Instruction Fuzzy Hash: 3541D871A00205DBD701EBA9EE85B9A7BA4EB88304F10467BE100F72E2D778A944DB5D

Function 00409DD6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040927C: GetLastError.KERNEL32(00000000,0040931F,?,?,021074B0,?), ref: 004092A0

CreateWindowExA.USER32(00000000,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E0E
SetWindowLongA.USER32(0002043A,000000FC,004095D0), ref: 00409E25

Part of subcall function 004068D0: GetCommandLineA.KERNEL32(?,?,00406A14,00000000,00406A50,?,?,?,?,00000000,00000000,?,004093B9,00000000,00409445), ref: 004068D4

Part of subcall function 00409664: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000,00409754), ref: 004096D8
Part of subcall function 00409664: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021074B0,0040976C,00000000), ref: 004096EC
Part of subcall function 00409664: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
Part of subcall function 00409664: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409720
Part of subcall function 00409664: GetExitCodeProcess.KERNEL32(?,?), ref: 00409730
Part of subcall function 00409664: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044), ref: 00409739

RemoveDirectoryA.KERNEL32(00000000,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F11
73A15CF0.USER32(0002043A,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409264

Strings

Inno, xrefs: 00409E02

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMessageMultipleObjectsPeekRemoveSleepWait
String ID: Inno
API String ID: 3409222764-2741113953
Opcode ID: 436805583868c80a46dbf4807e71db515abf5c22c5a642f8ed8b105a496882fe
Instruction ID: e9def7ee7bfb5be58953016ed740f774e342afb576aa229ee19c0ea7cc18460d
Opcode Fuzzy Hash: 436805583868c80a46dbf4807e71db515abf5c22c5a642f8ed8b105a496882fe
Instruction Fuzzy Hash: 0E41BB71A00205DBDB11EBA9EE85B9A7BA4EF88304F10467BF100F72E2D7789944DB5D

Function 00409B15 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000010), ref: 00409B6F
MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409BB3

Strings

.tmp, xrefs: 00409BEA
Win32s, xrefs: 00409B58

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Message
String ID: .tmp$Win32s
API String ID: 2030045667-641751118
Opcode ID: 0650350d84dcea6d9e552b86e78e3b0d8c3ed8bc8870ba77c14be3c76cac0398
Instruction ID: e4a7c91c2f675888e1446e57887e6e31653f9486227d9385985d84613c65bf03
Opcode Fuzzy Hash: 0650350d84dcea6d9e552b86e78e3b0d8c3ed8bc8870ba77c14be3c76cac0398
Instruction Fuzzy Hash: 17417B70614241DFD701EF6ADD92A6A7BA5FB49708F10453BF800B73E2CA79AC00DA6D

Function 00409B30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000010), ref: 00409B6F
MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409BB3

Strings

.tmp, xrefs: 00409BEA
Win32s, xrefs: 00409B58

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Message
String ID: .tmp$Win32s
API String ID: 2030045667-641751118
Opcode ID: 5c85183f2e52b7f23c3bde491e99ca859335533792a2fa7a5562025a6a4f4d5d
Instruction ID: 53a170e13010cfdcd37ed059bf19451eb2c32b7c9f8c3aa4677cdf2145782a4a
Opcode Fuzzy Hash: 5c85183f2e52b7f23c3bde491e99ca859335533792a2fa7a5562025a6a4f4d5d
Instruction Fuzzy Hash: 33413B74610241DFD711EF6ADD92A5A7BA5FB49708B10453BF800B73E3CA79AC00DAAD

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 00409DC4 Relevance: 6.1, APIs: 4, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E0E
SetWindowLongA.USER32(0002043A,000000FC,004095D0), ref: 00409E25
RemoveDirectoryA.KERNEL32(00000000,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F11
73A15CF0.USER32(0002043A,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F25

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Window$CreateDirectoryLongRemove
String ID:
API String ID: 3138356250-0
Opcode ID: be88a706e7f8ddec41fb9b67e958548a21fd378de1080aa250a0a6b2343fa3ce
Instruction ID: 2d3a2dd4f708cc909457fd39b59b8c9db31cd247ded7b54bdca8c0819a44ed83
Opcode Fuzzy Hash: be88a706e7f8ddec41fb9b67e958548a21fd378de1080aa250a0a6b2343fa3ce
Instruction Fuzzy Hash: B541D971900205DBCB01EBA9EE85B9E7BA5EB88304F10467BE100F72E2D7789945CB9D

Function 00409048 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409137,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040908E
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409137,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409097

Strings

.tmp, xrefs: 00409077

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: e1937734a1853430c9afa1f0e39ce394bf5c98f1fb10b03800257182eaacca41
Instruction ID: e6f02e5a3ef63fb2035549e22e3eab84e80dcd005fd0224d32e6fa49878b353e
Opcode Fuzzy Hash: e1937734a1853430c9afa1f0e39ce394bf5c98f1fb10b03800257182eaacca41
Instruction Fuzzy Hash: 10213774A002099BDB01EFA1C9569DFB7B9EB88304F10457BE501B73C2DA7C9E058A69

Function 00409218 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409237
Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409247
GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 0040925A
GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409264

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 023cc54a606994318740f679cb8c53a5fd536adaa32b6584bbad262c3bed690b
Instruction ID: c8511b3f4ba19aadfd76f6bff8fe05ca1586462999e74820caf1f79c6a797df9
Opcode Fuzzy Hash: 023cc54a606994318740f679cb8c53a5fd536adaa32b6584bbad262c3bed690b
Instruction Fuzzy Hash: B2F02472A05114B7CF34A59F9985A6FB28CDAD136871048BFF945F3387C438CC0182AD

Function 00408CD4 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(00000000,00000000,00408D31,?,0000000D,00000000), ref: 00408D0B
GetLastError.KERNEL32(00000000,00000000,00408D31,?,0000000D,00000000), ref: 00408D13

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 2501f15afbd59f2497c49c24aacc8a9750285929f352d7693ff018c20d99fc9d
Instruction ID: 48f93351e33ec4f9f257e6af690d6c0a59e0c5f39cf555c397a326a6c8c68ee5
Opcode Fuzzy Hash: 2501f15afbd59f2497c49c24aacc8a9750285929f352d7693ff018c20d99fc9d
Instruction Fuzzy Hash: 1CF0AF71A08208ABDB01DBB99D4149EB7A8EB483147504ABBF804F36C2EA385E0095A8

Function 00406DBC Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406DC6
LoadLibraryA.KERNEL32(00000000,00000000,00406E10,?,00000000,00406E2E,?,00008000), ref: 00406DF5

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 251b2fd3ba6bec6170c8d711a8cb694cee8c8fa7366fa3f44702449984966789
Instruction ID: 5d8b6b77538e68a4f612800dda8e4c610540b92f0493cf70fb698f1bd0f3a8db
Opcode Fuzzy Hash: 251b2fd3ba6bec6170c8d711a8cb694cee8c8fa7366fa3f44702449984966789
Instruction Fuzzy Hash: ACF082B4614704BEDB029FB6CC5282BBBADE78DB0475348B6F900A66D2E53D5C30D968

Function 00409F5F Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNEL32(00000000,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F11
73A15CF0.USER32(0002043A,00409F64,?,?,?,?,?,?,?,?,?), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,?,?,?), ref: 00409264

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLast$DirectoryRemoveSleep
String ID:
API String ID: 936953547-0
Opcode ID: 5c37145d8cca6390eb17606d0469c12658fe9e292651615ea0a11198a0d1e05f
Instruction ID: 86b72a77181fdba84c8a41ff1e1c0a43dcc80b05120077e5a427e6cd6708a71a
Opcode Fuzzy Hash: 5c37145d8cca6390eb17606d0469c12658fe9e292651615ea0a11198a0d1e05f
Instruction Fuzzy Hash: 23F0C970610202DBD765EB69EED9B563AA4AF84305F00463BE100B62E2D77C9C81DA5D

Function 0040747C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040749B
GetLastError.KERNEL32(?,?,?,00000000), ref: 004074A3

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,020F03AC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 169b24ef2640c08601778b11a94e40ab324459ac5f51830493df14d65a1fbebf
Instruction ID: 9552bdc86cc108ae822706c51893dfc58bbb640de61c685b0d46ca26990e5d97
Opcode Fuzzy Hash: 169b24ef2640c08601778b11a94e40ab324459ac5f51830493df14d65a1fbebf
Instruction Fuzzy Hash: 42E092766082016BD600D95EDC81B9B37DCDFC5364F04413AB654EB2D2D675AC0087B6

Function 0040743C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407453
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407462

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 4c84914786814d375c7df0582e3333c69cc2b33e99adcffc1faed2f40f51f088
Instruction ID: 83f05ecfdf24a87f1b41e041b05bd9c7202fe80c0c1fd51eaa8a9206b621e634
Opcode Fuzzy Hash: 4c84914786814d375c7df0582e3333c69cc2b33e99adcffc1faed2f40f51f088
Instruction Fuzzy Hash: 02E092A1A081506AEB20966A9CC4F676BDCCBC5314F04407BF544DB282C678EC00837B

Function 004073D4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004073EB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004073F7

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,020F03AC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 17c6e6c40cc1673df71f6dbac71a09044ea5d2e60f34a749391102d1cab5a509
Instruction ID: 217decc83f4b597703ef417570f6aef3a04ee7e4d9e7e8ded3cc012445826751
Opcode Fuzzy Hash: 17c6e6c40cc1673df71f6dbac71a09044ea5d2e60f34a749391102d1cab5a509
Instruction Fuzzy Hash: 75E04FB16002109FDB11EEB5C881B5277D89F44368F0485B6F614DF2C7D274EC00C7A6

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c2c164bf1270d4a813d1c1f6386065a20bb20e5e17a0c6be31043b1a06862ade
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: c2c164bf1270d4a813d1c1f6386065a20bb20e5e17a0c6be31043b1a06862ade
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Function 004067A0 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00000000,00000000,?,?,?,00000000,00406826,00000000,0040684C,?,?,?,?,00000000,?,00406861), ref: 004067C8

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 897554f63ccbae32a680720dcc4028b54f9e609aa27ba82630df255f424f2303
Instruction ID: 9224fea829c25d098124f14b163f0f5d3056d9918534aaed3a7a3655efd609db
Opcode Fuzzy Hash: 897554f63ccbae32a680720dcc4028b54f9e609aa27ba82630df255f424f2303
Instruction Fuzzy Hash: 5DF0BE613009241BC6217A7F1CC15AFA78C8B8674D741007FF506EB382E93EAE27529E

Function 00407386 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004073C8

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b1fa68947a2ab1d94def65676e902ee4623d61b5855483676ee50ccbd8843e09
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: b1fa68947a2ab1d94def65676e902ee4623d61b5855483676ee50ccbd8843e09
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00406804 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 004067A0: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,00406826,00000000,0040684C,?,?,?,?,00000000,?,00406861), ref: 004067C8

GetFileAttributesA.KERNEL32(00000000,00000000,0040684C,?,?,?,?,00000000,?,00406861,00406B9B,00000000,00406BE0,?,?,?), ref: 0040682F

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AttributesCharFilePrev
String ID:
API String ID: 4082512850-0
Opcode ID: aa0dee3dfde9680b88e5d4a989f8a66a3aefd72398a6e714407ea11cf135785b
Instruction ID: e0806baaddb1c6ea98f9e88c012e13428ab5c20fb67af434123f63dcbe9dc2f9
Opcode Fuzzy Hash: aa0dee3dfde9680b88e5d4a989f8a66a3aefd72398a6e714407ea11cf135785b
Instruction Fuzzy Hash: 49E09B353043047FD701FEB2DC52D5ABBEDD789708B924476B501E7683D57D5E108568

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004074EF

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,020F03AC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: dfca1452c1d41856bc80b2aac7cf9c6a05d70dec67c5ac75a103ec90c85ecbc7
Instruction ID: a0310d4f07ecae3604ffa6e7199893bba826b12aca9885f9ae454d661ecc5e6b
Opcode Fuzzy Hash: dfca1452c1d41856bc80b2aac7cf9c6a05d70dec67c5ac75a103ec90c85ecbc7
Instruction Fuzzy Hash: 54E012727081106BD710E65EDC80EAB67DCDFC6764F04447BF608DB291D574EC449676

Function 00407388 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004073C8

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 92118dbd51eda2e30ad84dab06f37ec61f43d863242aed47289f39a4a63da246
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 92118dbd51eda2e30ad84dab06f37ec61f43d863242aed47289f39a4a63da246
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004070A0 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00408E3F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004070BF

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: d94db3dd466735f6b304bdc00126ac5bccc7ece6b58c4244780fee86a74765d6
Instruction ID: ccfea062e36be1e46cc563bda00536de7e5d43dcb430be3138f69a6af1e017ed
Opcode Fuzzy Hash: d94db3dd466735f6b304bdc00126ac5bccc7ece6b58c4244780fee86a74765d6
Instruction Fuzzy Hash: 08E0D8A1BA830226F22501654C8BF765A098780700F24423A3710EB3D2D9BFB906015F

Function 004074BC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02107504,00409D69), ref: 004074C3

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,020F03AC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3ac5f10b1bb37e7f01e908e0322c5dfc960db799671fe64ae18852e136c8f636
Instruction ID: 0982b56df3f7ad1b6cebde134965e9459a5e29f8511e6229bb4ede4161842e3a
Opcode Fuzzy Hash: 3ac5f10b1bb37e7f01e908e0322c5dfc960db799671fe64ae18852e136c8f636
Instruction Fuzzy Hash: 48C04CA1A0420097CB40AABA99C1A0767D85A4820430441B6B508DB297D678EC404666

Function 00406E17 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406E35), ref: 00406E28

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2ae47081c3e89d378e094ae235ad69d162218d9e731e50ed49666677dea9dfc4
Instruction ID: baba3f3f4808b43413c2619d6a1128f167b6937905617119bfe5d2d6fabbca22
Opcode Fuzzy Hash: 2ae47081c3e89d378e094ae235ad69d162218d9e731e50ed49666677dea9dfc4
Instruction Fuzzy Hash: BEB09B7A61C3005DE715DAD5E45553863E4D7C47103E14577F108D25C0D93C94154518

Function 00406E33 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406E35), ref: 00406E28

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6af24e5c173adb073989661b5fe6cac0a9f23c24014cb5474ad8c779b702b3b4
Instruction ID: 4535da48a03781cc4a0311619a7fab48f6a5bdc6e00ddcfdf41a89ac556e9596
Opcode Fuzzy Hash: 6af24e5c173adb073989661b5fe6cac0a9f23c24014cb5474ad8c779b702b3b4
Instruction Fuzzy Hash: 8EA022BCC00202F2CE00E3E0C080A3C23E82A883003C00AA2320EB20C0C03CC800020A

Function 00407C74 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407D04

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98d26d223b2d23dbcc171cd853fe8fe681bde8a6f93817f9055e5c50a4f0bc3a
Instruction ID: 106be43a816b8cf891e44dae459459ad6d24fd1d885678dbe863b8a515b76e6b
Opcode Fuzzy Hash: 98d26d223b2d23dbcc171cd853fe8fe681bde8a6f93817f9055e5c50a4f0bc3a
Instruction Fuzzy Hash: 261175716082049BDB00EE19C881B5B37A4AF84358F14847AF958AB2C7DA38EC05CB6A

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407358 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407368

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dc235c176c566fd7e5ff871da56091193a88c150de874b1d3d85bbfd96156598
Instruction ID: 5b809d91324b01165f3d7abffa4f1606225d7c7902e21457073849c4ce9a0a8f
Opcode Fuzzy Hash: dc235c176c566fd7e5ff871da56091193a88c150de874b1d3d85bbfd96156598
Instruction Fuzzy Hash: 77D05E81B00A6007E715E2BF498864A92C85F88645F08843AFE84E73D2D67CAC01D389

Function 00407C1C Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407CFA), ref: 00407C33

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 6581b9859b1206c1d916db2ac2ac46b2cc57049a2813a0b15916f2e6b5958528
Instruction ID: 104fdf5ac94e7fd02e0f24df8e885f7d3afef79a12a9fcd307b9ebd36a4d6817
Opcode Fuzzy Hash: 6581b9859b1206c1d916db2ac2ac46b2cc57049a2813a0b15916f2e6b5958528
Instruction Fuzzy Hash: 48D002B17553045FEBA0EEB94DC1B0237D87B48700F5044B66D04EB2D6E774E8009714

Non-executed Functions

Function 00409180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040918F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409195
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004091B1
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004091D8
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 004091DD

Part of subcall function 00409160: MessageBoxA.USER32(00000000,00000000,00000000,00000030), ref: 0040917A

ExitWindowsEx.USER32(00000002,00000000), ref: 004091F1

Strings

SeShutdownPrivilege, xrefs: 004091AA

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupMessageOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 93195177-3733053543
Opcode ID: 141232cc53b1a597fcdf5ca8d2130493ae7acfbdbc209659ba55deea20ae6dd7
Instruction ID: a22a05c0334c91e373ded132950a1cfbc2e4fd7d56acfff406f0eba1ecee2c19
Opcode Fuzzy Hash: 141232cc53b1a597fcdf5ca8d2130493ae7acfbdbc209659ba55deea20ae6dd7
Instruction Fuzzy Hash: 96F03CB4744306A6F610BAA28C4BF1B228C5B8074CF10443FBA14BD2C3DABC8C04966F

Function 004098C8 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 004098D2
SizeofResource.KERNEL32(00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 004098E5
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C,?,00000000), ref: 004098F7
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C), ref: 00409908

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 1f7f47d479afba1e25edb3dfdf66946c5a931e362b0a99e011b933594bd15731
Instruction ID: 396531010142fa93779bfa19a91fc9bb3864174ce6eca4eb40243b1b96f01e89
Opcode Fuzzy Hash: 1f7f47d479afba1e25edb3dfdf66946c5a931e362b0a99e011b933594bd15731
Instruction Fuzzy Hash: 35E05A8236430665EA623AFB08D6B2B500C4BA975EF04103FB7417A3C3DEAC8C04112E

Function 0040914C Relevance: 4.5, APIs: 3, Instructions: 33COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004091D8
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 004091DD

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AdjustErrorLastPrivilegesToken
String ID:
API String ID: 3328184475-0
Opcode ID: 467a01db60ae199ad802c26dacd045919751267d5a63fed329477ecb78e59307
Instruction ID: 9c58d4b06f9d60f0b319737994d7632eedae56a3026bc45fa00511cc05e329ac
Opcode Fuzzy Hash: 467a01db60ae199ad802c26dacd045919751267d5a63fed329477ecb78e59307
Instruction Fuzzy Hash: F5F08CB1B483825AF30166B61C5BB6627984B81708F0904BBB640FE2D3E56C9C05922E

Function 004081A8 Relevance: 3.0, Strings: 2, Instructions: 545COMMON

Download Yara Rule

Strings

}@, xrefs: 00408354, 004083C7, 004083D0, 004087D2, 00408832, 004083DC, 0040842A, 00408395
}@, xrefs: 004087A8, 004087A0

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID:
String ID: }@$}@
API String ID: 0-950108737
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: c8203a9fa98a986d8779286789c6104c8ca5558bbffbe985887727c33bce2231
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 3A32E674E04219DFCB14CF99CA80ADDBBB2BF88314F24816AD855B7385DB34AE42CB55

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405C44 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00406540,00000000,0040654E,?,?,?,?,?,0040993C), ref: 00405C52

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction ID: 6a84e84a5bdb2c7c5b206d002f2a3fc227ad50a79849cf1aa773f1ea3c1cbc6a
Opcode Fuzzy Hash: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction Fuzzy Hash: 5AC0126040470186E7109B319C42B1672D4A744310F4805396DA4953C2E73C81018A5A

Function 00406E40 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00406F45), ref: 00406E69
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406E6F
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00406F45), ref: 00406EBD

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00406ECC
GetUserDefaultUILanguage, xrefs: 00406E5F
.DEFAULT\Control Panel\International, xrefs: 00406E94
Locale, xrefs: 00406EAC
kernel32.dll, xrefs: 00406E64

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 36a3d51a04bf850c18b4ad2eba5c44474686bcc119d91182359df5913d328945
Instruction ID: 28d635b88271944ce017b23ebdd5d9b92fa5db15c94327f4e3560df006acd214
Opcode Fuzzy Hash: 36a3d51a04bf850c18b4ad2eba5c44474686bcc119d91182359df5913d328945
Instruction Fuzzy Hash: AC216170B0020AAFDB00EBA5DC55A9EB7F8AB44304F51447BA506F72C1E77C9A158B5D

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

:mm:ss, xrefs: 0040552A
:mm, xrefs: 00405510
mmmm d, yyyy, xrefs: 0040541F
m/d/yy, xrefs: 004053FD
AMPM, xrefs: 004054F9

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: aabfef4ac1302ec13b1649181b121c6b5a8ef12cbf1b40b6bb9ca22f2a6bf78e
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: aabfef4ac1302ec13b1649181b121c6b5a8ef12cbf1b40b6bb9ca22f2a6bf78e
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00406564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,SetProcessDPIAware,?,004065A9,00409941), ref: 0040656F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00406575

Strings

user32.dll, xrefs: 0040656A
SetProcessDPIAware, xrefs: 00406565

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetProcessDPIAware$user32.dll
API String ID: 1646373207-1137607222
Opcode ID: f4bf2cde95aaa1bdf38f3d59cb66c53f21b839fa02cb402c816b7bedf7b2570a
Instruction ID: 1bf9cc8084a254fdd570c786287d572880d476598588f9a2a9aa1fa269c7f067
Opcode Fuzzy Hash: f4bf2cde95aaa1bdf38f3d59cb66c53f21b839fa02cb402c816b7bedf7b2570a
Instruction Fuzzy Hash: 43B048D12413423AED1036F62CD2A1A058C4984A08722493B3A06B15CBC9BC8A24002E

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,02101650,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,02101650,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,02101650,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,02101650,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409932), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409932), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2272496656.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2272444929.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272534804.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272651701.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xming-6-9-0-31-setup.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Analysis Process: is-L00DR.tmpPID: 6728, Parent PID: 6464COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	88

Executed Functions

Function 00469F50 Relevance: 76.1, APIs: 4, Strings: 39, Instructions: 878timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

LocalFileTimeToFileTime.KERNEL32(-00000034,?,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000,?,0046BA1E), ref: 0046A1B6

Part of subcall function 00452E24: FindClose.KERNEL32(00000000,000000FF,0046A1CD,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000), ref: 00452E3A

Part of subcall function 00468558: FileTimeToLocalFileTime.KERNEL32(?), ref: 00468560
Part of subcall function 00468558: FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046856F

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 00452754: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 0045287B

Strings

Dest filename: %s, xrefs: 0046A0F5
Will register the file (a DLL/OCX) later., xrefs: 0046AD49
Non-default bitness: 64-bit, xrefs: 0046A110
Time stamp of our file: %s, xrefs: 0046A1FC
Existing file is a newer version. Skipping., xrefs: 0046A463
, xrefs: 0046A430, 0046A5F8, 0046A676
Incrementing shared file count (64-bit)., xrefs: 0046ADB6
Version of our file: %u.%u.%u.%u, xrefs: 0046A351
Uninstaller requires administrator: %s, xrefs: 0046A9CD
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046A22F
Incrementing shared file count (32-bit)., xrefs: 0046ADCF
Will register the file (a type library) later., xrefs: 0046AD3D
Time stamp of existing file: (failed to read), xrefs: 0046A298
User opted not to overwrite the existing file. Skipping., xrefs: 0046A6A5
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046A528
Non-default bitness: 32-bit, xrefs: 0046A11C
InUn, xrefs: 0046A99D
Failed to strip read-only attribute., xrefs: 0046A72B
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046A644
Version of existing file: %u.%u.%u.%u, xrefs: 0046A3DD
Version of our file: (none), xrefs: 0046A35D
Same version. Skipping., xrefs: 0046A53D
Stripped read-only attribute., xrefs: 0046A71F
Couldn't read time stamp. Skipping., xrefs: 0046A58D
Installing the file., xrefs: 0046A761
Existing file has a later time stamp. Skipping., xrefs: 0046A627
Dest file exists., xrefs: 0046A21C
.tmp, xrefs: 0046A80F
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046A50D
Dest file is protected by Windows File Protection., xrefs: 0046A14E
-- File entry --, xrefs: 00469FA3
Time stamp of our file: (failed to read), xrefs: 0046A208
Time stamp of existing file: %s, xrefs: 0046A28C
Same time stamp. Skipping., xrefs: 0046A5AD
@, xrefs: 0046A050
Version of existing file: (none), xrefs: 0046A552
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046A6EE
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046A752
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046A51C

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Time$File$Local$CloseFindFullNamePathQuerySystemValue
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 2131814033-2943590984
Opcode ID: 09d640a1e8f6e8aecf50e546a5a7bfeefbe362c8fcbd9c98bb910615cdf8ff41
Instruction ID: 2b26d2ebce0ab1b87680f01f5e8d4d1d174d7b8e5be2f55d2ae971b5cf141356
Opcode Fuzzy Hash: 09d640a1e8f6e8aecf50e546a5a7bfeefbe362c8fcbd9c98bb910615cdf8ff41
Instruction Fuzzy Hash: 61824D30A046489BDB11DFA5C885BDDBBB1AF05304F1440ABE844BB392E7789E45CF5B

Function 00423BF0 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579361aa49fb99445a4020a1528baf310ca38299916f6efa49daa7c91f23c842
Instruction ID: 234239396bac7d780282d62e0365a5eaf84f36146feb1829a52011552ebd301b
Opcode Fuzzy Hash: 579361aa49fb99445a4020a1528baf310ca38299916f6efa49daa7c91f23c842
Instruction Fuzzy Hash: B9E18130700124EFDB20DF69E989A6DBBF4EB54704FA440AAE4459B352D73CEE91DB09

Function 00422840 Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229D8
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BA2), ref: 004229E8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: ac3e009a595c1ed558da653c8b93013830882913b7a9518aba50c1e338b9f682
Instruction ID: f39cc3631680ecdf1ac9d07a6c8dace06ed48de268b54e5ae2a32077da343f05
Opcode Fuzzy Hash: ac3e009a595c1ed558da653c8b93013830882913b7a9518aba50c1e338b9f682
Instruction Fuzzy Hash: 3F917171B04214FFDB10EFA9DA86F9D77F4AB05314F5100BAF504AB2A2C778AE419B58

Function 00461C80 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1609windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0048AB80: GetWindowRect.USER32(00000000), ref: 0048AB96

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 0046204F

Part of subcall function 0041D694: GetObjectA.GDI32(?,00000018,00462069), ref: 0041D6BF

Part of subcall function 00461ADC: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00461B79
Part of subcall function 00461ADC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461B9F
Part of subcall function 00461ADC: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00461BFB
Part of subcall function 00461ADC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461C21

Part of subcall function 0046148C: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00462104,00000000,00000000,00000000,0000000C,00000000), ref: 004614A4

Part of subcall function 0048AD90: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 0048AD9A

Part of subcall function 0048AAE0: 73A0A570.USER32(00000000,?,?,?), ref: 0048AB00
Part of subcall function 0048AAE0: SelectObject.GDI32(?,00000000), ref: 0048AB23
Part of subcall function 0048AAE0: 73A0A480.USER32(00000000,?,0048AB73,0048AB6C,?,00000000,?,?,?), ref: 0048AB66

Part of subcall function 0048AD80: MulDiv.KERNEL32(0000004B,?,00000006), ref: 0048AD8A

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00462CD5
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00462CE6
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00462CFE

Part of subcall function 0042A040: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A056

Strings

, xrefs: 00462111
(Default), xrefs: 00463262
STOPIMAGE, xrefs: 00462044

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$A480A570BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 1965080796-770201673
Opcode ID: f267a776eba335c9dcaa3a2854800986158c07170a82d765df1872123448e94e
Instruction ID: f6611480b1059339d6da4444377da1e74988b953d2cb15c44e1f5011ed83dcbb
Opcode Fuzzy Hash: f267a776eba335c9dcaa3a2854800986158c07170a82d765df1872123448e94e
Instruction Fuzzy Hash: BBF2C5386005508FCB00EF69D4D9F9973F1BF49304F1581B6E9049B36ADB78AC4ACB9A

Function 004777A8 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 502COMMON

Download Yara Rule

Strings

InitializeSetup returned False; aborting., xrefs: 004779C3
CheckSerial, xrefs: 0047792B
CheckPassword, xrefs: 004778FF
InitializeSetup, xrefs: 0047798B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A159ClassInfoMessageSend
String ID: CheckPassword$CheckSerial$InitializeSetup$InitializeSetup returned False; aborting.
API String ID: 3375322265-4126056991
Opcode ID: ebbdf60ebd81009c6b69d4eb54fdb11b545bddd43fedaf0ccbdb65939b9dcddc
Instruction ID: 2b3497599f3d82cf12ff1455341614eb347a79affe37edd13f538060068cf537
Opcode Fuzzy Hash: ebbdf60ebd81009c6b69d4eb54fdb11b545bddd43fedaf0ccbdb65939b9dcddc
Instruction Fuzzy Hash: 0F223F74A042448FDB01EF69E886A9E77B1FB14308F54C0BBE4089B366D739AC45CB9D

Function 00454308 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 178comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0048EA38,00000000,00000001,0048E774,?,00000000,004544FE), ref: 00454344

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

CoCreateInstance.OLE32(0048E764,00000000,00000001,0048E774,?,00000000,004544FE), ref: 00454368
SysFreeString.OLEAUT32(00000000), ref: 004544C3

Strings

IShellLink::QueryInterface, xrefs: 0045443B
CoCreateInstance, xrefs: 00454373
IPersistFile::Save, xrefs: 00454495

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateInstanceString$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IShellLink::QueryInterface
API String ID: 2125489766-615220198
Opcode ID: e0703d10b8990764f2cc69b6d74185b8cb38d62dada355ae23bcda9d78490e6c
Instruction ID: 9617e2a97f1554c60f689d49f787e3e71de89ce4c47c5519b461097e66715909
Opcode Fuzzy Hash: e0703d10b8990764f2cc69b6d74185b8cb38d62dada355ae23bcda9d78490e6c
Instruction Fuzzy Hash: AF514071B40104AFDB50EFA9C885F9E77F8AF4930AF014466B904EB262DB78DD84CB19

Function 00453F20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00454054), ref: 00453F50
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453F56
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00454032,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00454054), ref: 00453FA1

Strings

kernel32.dll, xrefs: 00453F4B
GetDiskFreeSpaceExA, xrefs: 00453F46

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: def2a47910c73ec5475e7e39db03b949431105e427d401d86ceb168d872aa073
Instruction ID: 64add953981a0e8d9436cf63639eb88b70f6d749e6531aaf4eaba657c134a378
Opcode Fuzzy Hash: def2a47910c73ec5475e7e39db03b949431105e427d401d86ceb168d872aa073
Instruction Fuzzy Hash: EA315171A04249ABCF01EFA5C8829EFBBB8EF49704F504566F900F7292D6785D09CB69

Function 00413202 Relevance: 9.6, APIs: 6, Instructions: 615COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413648
GetWindowLongA.USER32(?,000000F0), ref: 00413653
GetWindowLongA.USER32(?,000000F4), ref: 00413665
SetWindowLongA.USER32(?,000000F4,?), ref: 00413678
SetPropA.USER32(?,00000000,00000000), ref: 0041368F
SetPropA.USER32(?,00000000,00000000), ref: 004136A6

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 0cf106467882055dbe94c3ead860931a5fd78163f14e972efc4ea3a04b9dec89
Instruction ID: cf3563636e1cedff00025660dc9b27ba04c2c96206d5fe0cb5bafc3f3c823d63
Opcode Fuzzy Hash: 0cf106467882055dbe94c3ead860931a5fd78163f14e972efc4ea3a04b9dec89
Instruction Fuzzy Hash: E5120F6108E3C05FE7278B34896A5D17F60EE2332572945DFC8C28F1A3D61D8A87C35A

Function 0047694C Relevance: 9.1, APIs: 6, Instructions: 149fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?,?,00000000), ref: 004769AC
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?), ref: 004769F5
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD), ref: 00476A02
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?), ref: 00476A4E
FindNextFileA.KERNEL32(000000FF,?,00000000,00476B1B,?,00000000,?,00000000,?,?,00000000,?,00000000,00476B48), ref: 00476AF7
FindClose.KERNEL32(000000FF,00476B22,00476B1B,?,00000000,?,00000000,?,?,00000000,?,00000000,00476B48), ref: 00476B15

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 6c5c766ea72b2cc661e3755fc7da31273cce891eaaeea2139c8707dd0defd1cd
Instruction ID: 164123f14448f320d6c42e0560521e1476ff170c523e9342d175dc641b4a39d9
Opcode Fuzzy Hash: 6c5c766ea72b2cc661e3755fc7da31273cce891eaaeea2139c8707dd0defd1cd
Instruction Fuzzy Hash: 6C5150B1900A58AFCB10EF65CC45ADEBBBDEB49319F1084AAA408F7351D6389F45CF54

Function 0046E2D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E32D
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E3F2
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E400

Strings

unins???.*, xrefs: 0046E317
unins, xrefs: 0046E380

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 66e20d13ca1787de8af3319885f7f8b9ffeca1a4d62be4ee66b3db2856e2c7f7
Instruction ID: 1f636d784df305df79a4925b18bdd965b5089876ccef66dcc0799403659eae72
Opcode Fuzzy Hash: 66e20d13ca1787de8af3319885f7f8b9ffeca1a4d62be4ee66b3db2856e2c7f7
Instruction Fuzzy Hash: DD3121755001089FDB10EB66C995ADEB7F8EF45318F5044B6F808E72A2EB389F818F59

Function 00450EA4 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00450F07,?,?,-00000001,00000000), ref: 00450EE1
GetLastError.KERNEL32(00000000,?,00000000,00450F07,?,?,-00000001,00000000), ref: 00450EE9

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 2dbbd09285c12fc2f127c1c877effb4fe86dcd41e287fab4122a701882f1e088
Instruction ID: e402c95933c7caa4badd4c344c5a78a7c0ffede8d16c763a03a8c81ae3a4f9d0
Opcode Fuzzy Hash: 2dbbd09285c12fc2f127c1c877effb4fe86dcd41e287fab4122a701882f1e088
Instruction Fuzzy Hash: 39F04936A04308AB8B10DFAA9C4149EF7ACEB4532576046BBFC14E3282DA785D04855C

Function 00408500 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 512d9064ee7cf322adfd682984fa7e4f2e5ff3eb3efe725be3721c9ea86e1f6e
Instruction ID: a2d33f1e2a7a8dadfdf8ab0f09016da465081aca7bb49ec91b321b6046be9dfe
Opcode Fuzzy Hash: 512d9064ee7cf322adfd682984fa7e4f2e5ff3eb3efe725be3721c9ea86e1f6e
Instruction Fuzzy Hash: 3CE0D87270022467D711A9595C82EF7725CA758320F40427FB949EB3C2EDB8DE8046ED

Function 00423B68 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424135,?,00000000,00424140), ref: 00423B92

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: a2844048a94398b3d9d9c5a93e66d0881ba802d30ef4c48294b03406735b2595
Instruction ID: de139bda67f101720f6c8dae38c7f91a43546766bf252fe0be859a4b80536119
Opcode Fuzzy Hash: a2844048a94398b3d9d9c5a93e66d0881ba802d30ef4c48294b03406735b2595
Instruction Fuzzy Hash: F1F0C579205608AFCB40DF9DD588D4AFBE8FB4C260B158295B988CB325C234FE80CF94

Function 00453688 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 0045369E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8f1efdc156ee4c16804148f4c428dcd924adfc09f3cade3e288c3f572785d406
Instruction ID: 8f348fcdb7fe5afc399bc0ff47d47662dfe62242c71b43ebe81c9e9d6bc10923
Opcode Fuzzy Hash: 8f1efdc156ee4c16804148f4c428dcd924adfc09f3cade3e288c3f572785d406
Instruction Fuzzy Hash: 12D0C2B160420067C301AEA9DC817AA71CC8B84352F14093F7C85CB3D3E67CCF4856AA

Function 00468D1C Relevance: 63.4, APIs: 1, Strings: 35, Instructions: 382
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00468C14: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00490044,?,00468E0B,?,00000000,00469235,?,_is1), ref: 00468C37

RegCloseKey.ADVAPI32(?,0046923C,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00469284,?,?,00000001,00490044), ref: 0046922F

Strings

NoModify, xrefs: 0046917C
Inno Setup: User Info: Organization, xrefs: 00468F6B
InstallLocation, xrefs: 00468E4E
ModifyPath, xrefs: 00469168
5.1.11, xrefs: 00468DFE
Contact, xrefs: 0046912B
Inno Setup: User, xrefs: 00468E9A
URLUpdateInfo, xrefs: 004690F1
Inno Setup: App Path, xrefs: 00468E2E
Publisher, xrefs: 0046909A
Inno Setup: User Info: Serial, xrefs: 00468F80
RegisterPreviousData, xrefs: 004691E5
DisplayIcon, xrefs: 00468FEC
DisplayVersion, xrefs: 0046907D
QuietUninstallString, xrefs: 00469060
NoRepair, xrefs: 00469190
DisplayName, xrefs: 00468FCF
HelpLink, xrefs: 004690D4
Comments, xrefs: 00469148
UninstallString, xrefs: 00469026
" /SILENT, xrefs: 00469053
Readme, xrefs: 0046910E
Inno Setup: Deselected Tasks, xrefs: 00468F3E
Inno Setup: Selected Tasks, xrefs: 00468F1F
Inno Setup: Selected Components, xrefs: 00468ED8
Inno Setup: No Icons, xrefs: 00468E7B
URLInfoAbout, xrefs: 004690B7
Inno Setup: Icon Group, xrefs: 00468E5D
Inno Setup: User Info: Name, xrefs: 00468F56
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00468D5E
InstallDate, xrefs: 004691AF
Inno Setup: Setup Version, xrefs: 00468DF9
Inno Setup: Setup Type, xrefs: 00468EB9
Inno Setup: Deselected Components, xrefs: 00468EF7
_is1, xrefs: 00468D64

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.1.11$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-595065584
Opcode ID: b16f499d4c0edc1726189a5d483357a1f89c64d7f65b599f45d231fc3551bd3f
Instruction ID: 652d5baa63bd031376f2e9dc01ecc43bb7dcd25158a9b1a79304fa3b3e803fab
Opcode Fuzzy Hash: b16f499d4c0edc1726189a5d483357a1f89c64d7f65b599f45d231fc3551bd3f
Instruction Fuzzy Hash: 3EE18774A001099FCB04EB55D991AAF73B9EB44304F20857FE8046B395EF78AE41CB7A

Function 0047A1DC Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047A1ED
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047A1FA
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047A208
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047A210
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047A21C
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047A23D
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047A250
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047A256
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047A26D

Strings

GetNativeSystemInfo, xrefs: 0047A1F4
IsWow64Process, xrefs: 0047A20A
advapi32.dll, xrefs: 0047A24B
RegDeleteKeyExA, xrefs: 0047A246
GetSystemWow64DirectoryA, xrefs: 0047A237
kernel32.dll, xrefs: 0047A1E8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 0318c22cd53163ef7490a5c12fce8536b03f41a07dd842bd68e1deeca5760385
Instruction ID: 44ff08cb5a218a7f45b72609dfebf17a8c81accd7f739df94a349df9fc97c582
Opcode Fuzzy Hash: 0318c22cd53163ef7490a5c12fce8536b03f41a07dd842bd68e1deeca5760385
Instruction Fuzzy Hash: E911D050004341A5DA21A3764C49BEF264CCBC1B18F08C9BBBD8D653C3DA6E8D608B6F

Function 004635E4 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,004637FE,?,?,00000001,00000000,00000000,00463819,?,00000000,00000000,?), ref: 004637E7

Strings

%s\%s_is1, xrefs: 00463661
Inno Setup: Selected Components, xrefs: 00463706
Inno Setup: Setup Type, xrefs: 004636F6
Inno Setup: User Info: Serial, xrefs: 004637C9
Inno Setup: User Info: Name, xrefs: 004637A3
Inno Setup: Deselected Components, xrefs: 00463728
Inno Setup: Selected Tasks, xrefs: 00463753
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00463643
Inno Setup: Icon Group, xrefs: 004636C2
Inno Setup: App Path, xrefs: 004636A6
Inno Setup: User Info: Organization, xrefs: 004637B6
Inno Setup: Deselected Tasks, xrefs: 00463775
Inno Setup: No Icons, xrefs: 004636CF

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: d80a88ac64b710b881228c4da7bab361710a00e16dad37f32d8ec60a0cac6d75
Instruction ID: ef7d7eae4a6b32f2ba9ccfdbee4e684a4261d5327a9044f3479cce72f1d49f95
Opcode Fuzzy Hash: d80a88ac64b710b881228c4da7bab361710a00e16dad37f32d8ec60a0cac6d75
Instruction Fuzzy Hash: 7F51D4B4A002889BCB15EF55D852BDEFBF4EF44305F50846AE844A7392E738AF04CB59

Function 0046CCA8 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 554
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,0046D21F,?,?,?,?,00000000,0046D379,?,?,00000001), ref: 0046CE30
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,0046D21F,?,?,?,?,00000000,0046D379,?,?), ref: 0046CE39

Part of subcall function 0046CAFC: GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB89

RegDeleteValueA.ADVAPI32(?,00000000,00000000,0046D20E,?,?,00000000,0046D21F,?,?,?,?,00000000,0046D379,?,?), ref: 0046CF57

Part of subcall function 0042DBE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC10

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,0046D20E,?,?,00000000,0046D21F,?,?,?,?), ref: 0046D02C
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000002,00000000,00000001,?,00000000,0046D20E,?,?,00000000,0046D21F,?,?,?), ref: 0046D120
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000004,?,00000004,00000000,0046D20E,?,?,00000000,0046D21F,?,?,?,?), ref: 0046D182

Part of subcall function 0046CAFC: GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB9F

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000,00000000,0046D20E,?,?,00000000,0046D21F,?,?,?,?), ref: 0046D1D2
RegCloseKey.ADVAPI32(?,0046D215,?,00000000,0046D21F,?,?,?,?,00000000,0046D379,?,?,00000001,00490044), ref: 0046D208

Strings

olddata, xrefs: 0046D048, 0046D0A7
Cannot access 64-bit registry keys on this version of Windows, xrefs: 0046CD86
break, xrefs: 0046D0B5
{olddata}, xrefs: 0046CFDD, 0046D074

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Value$CloseDeleteErrorLast$CreateQuery
String ID: Cannot access 64-bit registry keys on this version of Windows$break$olddata${olddata}
API String ID: 2797102135-4268515878
Opcode ID: 75c3f137f079926bb834c3e667d3ccdfadc6d944b4f4a8451e08ddfabdd7c9c1
Instruction ID: ea8247cb0c1e139c102cf332dfa36f5efef9d881b1d24e5ff8d7ad8b1bb1c969
Opcode Fuzzy Hash: 75c3f137f079926bb834c3e667d3ccdfadc6d944b4f4a8451e08ddfabdd7c9c1
Instruction Fuzzy Hash: 9F220B74E01248AFDB10DF99D985BEEBBF9AF08304F104066F944AB392D778AD41CB59

Function 0046C0C8 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046C25B
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046C34E
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 0046C364
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046C389

Strings

Filename: %s, xrefs: 0046C1FD
target.lnk, xrefs: 0046C3D3
.lnk, xrefs: 0046C151
Desktop.ini, xrefs: 0046C40A
{group}\, xrefs: 0046C11F
.pif, xrefs: 0046C174, 0046C2D2
.url, xrefs: 0046C197

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 27835455e15af8d1f71e6a02b96e5160de3045d2f254116b2b819d0ee3d43fc7
Instruction ID: ed409d1b68ce0096140bd8461c3c9ccc532d3a99ec7b6d3cebc44973f5dc1d6f
Opcode Fuzzy Hash: 27835455e15af8d1f71e6a02b96e5160de3045d2f254116b2b819d0ee3d43fc7
Instruction Fuzzy Hash: 89D14074A002499BDB00EF95D881BEEBBF4AF48314F54402BF840B7392D778AE45CB69

Function 004530D8 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338,00453338,?,00453338,00000000), ref: 0045328C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338,00453338,?,00453338), ref: 00453299
WaitForInputIdle.USER32(?,000000FF), ref: 004532AA
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004532CA
GetExitCodeProcess.KERNEL32(?,?), ref: 004532D7
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338), ref: 004532E0

Strings

D, xrefs: 00453229
.bat, xrefs: 00453171
COMMAND.COM" /C , xrefs: 004531F5
cmd.exe" /C ", xrefs: 004531BE
.cmd, xrefs: 0045318C

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 5f777bc87d68a2a1c87ce65a3d96daa045d05ee917bbac956c84cd11efbcbd99
Instruction ID: a6046ff60642a017085587ab877fa75dc5fc04834886d603548fbc532c1bf6e6
Opcode Fuzzy Hash: 5f777bc87d68a2a1c87ce65a3d96daa045d05ee917bbac956c84cd11efbcbd99
Instruction Fuzzy Hash: A9517870A00359AADF11EF95CC41BDEBBB9AF04746F50446BBC14BB282D77C9A09CB58

Function 00423858 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3A8: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED88,?,00423873,00423BF0,0041ED88), ref: 0041F3C6

GetClassInfoA.USER32(00400000,00423660), ref: 00423883
RegisterClassA.USER32(0048E630), ref: 0042389B
GetSystemMetrics.USER32(00000000), ref: 004238BD
GetSystemMetrics.USER32(00000001), ref: 004238CC
SetWindowLongA.USER32(00410634,000000FC,00423670), ref: 00423928
SendMessageA.USER32(00410634,00000080,00000001,00000000), ref: 00423949
GetSystemMenu.USER32(00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0,0041ED88), ref: 00423954
DeleteMenu.USER32(00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0,0041ED88), ref: 00423963
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423970
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423986

Strings

`6B, xrefs: 00423877, 004238F8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: `6B
API String ID: 183575631-2790827003
Opcode ID: 8f81d08a5fa5827f17b2bbb4aeae5863995f0e724e54aceae9d0da548a22e724
Instruction ID: dca9ab8911853f76dffcf6cae1d2b5893a5cb5f7f917fbd6c23b280ca817aa26
Opcode Fuzzy Hash: 8f81d08a5fa5827f17b2bbb4aeae5863995f0e724e54aceae9d0da548a22e724
Instruction Fuzzy Hash: 1631D3B07002006AEB10BF65DC86F6A32A89B15708F60057AFA40FE2D3D6BCED44476C

Function 00474290 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 00474392

Strings

Failed to get version numbers of _shfoldr.dll, xrefs: 004742E8
shfolder.dll, xrefs: 004742F5, 0047432E
_isetup\_shfoldr.dll, xrefs: 004742C2
Failed to load DLL "%s", xrefs: 00474375
SHFOLDERDLL, xrefs: 004742CF
shell32.dll, xrefs: 0047433D
Failed to get address of SHGetFolderPathA function, xrefs: 004743A3
SHGetFolderPathA, xrefs: 00474387

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPathA function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1072092678
Opcode ID: d87cb2d3e392e355e94c80d29309abb160cb41e2f9daf99df89ffe7e577714a2
Instruction ID: 187b3da3b30b9edf6afbf4b8feeb49d0e071275e5d931af165dcd1fc62301799
Opcode Fuzzy Hash: d87cb2d3e392e355e94c80d29309abb160cb41e2f9daf99df89ffe7e577714a2
Instruction Fuzzy Hash: A8312F30A00109DFDB00EF95D981AFEB7B5EB84344F51847BE908E7251D7389E059B6D

Function 00478408 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 167
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

FreeLibrary.KERNEL32(00000000), ref: 004785B0
FreeLibrary.KERNEL32(00000000), ref: 004785C4
SendMessageA.USER32(0002043A,00000496,00002710,00000000), ref: 00478629

Strings

DeinitializeSetup, xrefs: 004784C1
Restarting Windows., xrefs: 00478604
Not restarting Windows because Setup is being run from the debugger., xrefs: 004785E5
GetCustomSetupExitCode, xrefs: 00478465
Deinitializing Setup., xrefs: 00478426

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FreeLibrary$LocalMessageSendTime
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 2162613394-1884538726
Opcode ID: 299678665c2b602c1c7a80fbf5ed1caf9542eba1c9cf8b2a96f982edd58b5d2f
Instruction ID: 8cebeb1119a389dc60407af3f5e9ea1d97c548952aabf0385f15478dbf14d114
Opcode Fuzzy Hash: 299678665c2b602c1c7a80fbf5ed1caf9542eba1c9cf8b2a96f982edd58b5d2f
Instruction Fuzzy Hash: 7451AD30640201AFD711DB69D88DB9A7BA4EB59314F20C5BFE809D73A2DB789C48CB5D

Function 0042EC0C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042EC3B
GetFocus.USER32 ref: 0042EC43
RegisterClassA.USER32(0048E7A8), ref: 0042EC64
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042ED38,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042ECA2
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042ECE8
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042ECF9
SetFocus.USER32(00000000,00000000,0042ED1B,?,?,?,00000001,00000000,?,00455E42,00000000,0048F628), ref: 0042ED00

Strings

TWindowDisabler-Window, xrefs: 0042EC9B, 0042ECE1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 42dcc720b376cf90e72d0dc7fd4ba48b19ce87f42435d15aaaa48a902d1ac2aa
Instruction ID: e773591ee7bc48db890b071a7cc259702f38e3955da87e7047ef3545b3e081be
Opcode Fuzzy Hash: 42dcc720b376cf90e72d0dc7fd4ba48b19ce87f42435d15aaaa48a902d1ac2aa
Instruction Fuzzy Hash: E221A671740B11BAE210EB67DD03F1A7664EB44B14F50493AB504BB2D2DBB96C5187AC

Function 004515BC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515DC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515E2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515F6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515FC

Strings

Wow64RevertWow64FsRedirection, xrefs: 004515EC
shell32.dll, xrefs: 00451628
Wow64DisableWow64FsRedirection, xrefs: 004515D2
kernel32.dll, xrefs: 004515D7, 004515F1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0606df6bfe006159059d630d6b9c8d6a0745cd584e61856f819da8b163c211b5
Instruction ID: a14ab9b11594faa8221d7a32e6bcd4085858dc09a311689c1fbc26ed636eb49d
Opcode Fuzzy Hash: 0606df6bfe006159059d630d6b9c8d6a0745cd584e61856f819da8b163c211b5
Instruction Fuzzy Hash: CF01A270240744BFD711BB669C12B6A3A98D711759FA9083FF800965B3D6BC4D0CCB6D

Function 00473F64 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 108COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004740D7,?,?,00000000,0048F628,00000000,00000000,?,0048D6E6,00000000,0048D88F,?,00000000), ref: 00473FF7
GetLastError.KERNEL32(00000000,00000000,00000000,004740D7,?,?,00000000,0048F628,00000000,00000000,?,0048D6E6,00000000,0048D88F,?,00000000), ref: 00474000

Strings

REGDLL_EXE, xrefs: 00474074
Created temporary directory: , xrefs: 00473F99
_isetup, xrefs: 00473FE2
\_setup64.tmp, xrefs: 0047408F
\_RegDLL.tmp, xrefs: 00474064

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-1421604804
Opcode ID: f4f1baa41bf8016d3af3729c2ba1f8f70e19414a6c9db2e73c1fb37334a32112
Instruction ID: e189acb47d7761cccc4aae5cd70386535472efc6c5bf6feefd728c4fc98ce432
Opcode Fuzzy Hash: f4f1baa41bf8016d3af3729c2ba1f8f70e19414a6c9db2e73c1fb37334a32112
Instruction Fuzzy Hash: AE413374A001499BCB00FF95C881AEEB7B5EF84305F50847BE910B7392DB38AE49CB59

Function 0042FFDC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 0042FFE4
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0042FFF3
GetCurrentThreadId.KERNEL32 ref: 0043000D
GlobalAddAtomA.KERNEL32(00000000), ref: 0043002E

Strings

commdlg_FindReplace, xrefs: 0042FFEE
commdlg_help, xrefs: 0042FFDF
WndProcPtr%.8X%.8X, xrefs: 0043001F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: e7eacd8e0cfd777acf866629c3e6d7bebe0749c578319a26befa6026fa7b7a9d
Instruction ID: 3d581f31e7faea89bbe3ef6541795b4c6a448cbff3c72f456bb60799a018f4d5
Opcode Fuzzy Hash: e7eacd8e0cfd777acf866629c3e6d7bebe0749c578319a26befa6026fa7b7a9d
Instruction Fuzzy Hash: 6CF05E744483809AD700EB35990271E77E09B48708F104A3FB848A62A2E7788514DB1F

Function 00423670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423700
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,?,00000001), ref: 0042372D
OemToCharA.USER32(?,?), ref: 00423740
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,?,00000001), ref: 00423780

Strings

2, xrefs: 004236CE
MAINICON, xrefs: 004236F5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: d3d727af98377c70457c2042d0d517341fe3b648e56e64100d48c2ba13840636
Instruction ID: 7fa377c5858703c9b86f8d9647c5be010cde8b535fd454def1f59ee6837335bc
Opcode Fuzzy Hash: d3d727af98377c70457c2042d0d517341fe3b648e56e64100d48c2ba13840636
Instruction Fuzzy Hash: C531C4B0A042449EDB10EF29D8C57C97BE89F15308F4041BAE844DF397D7BED9888B69

Function 00418F1C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F21
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F42
GetCurrentThreadId.KERNEL32 ref: 00418F5D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F7E

Part of subcall function 004230AC: 73A0A570.USER32(00000000,?,?,00000000,?,00418FB7,00000000,?,?,?,00000001), ref: 00423102
Part of subcall function 004230AC: EnumFontsA.GDI32(00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,?,00000001), ref: 00423115
Part of subcall function 004230AC: 73A14620.GDI32(00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 0042311D
Part of subcall function 004230AC: 73A0A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 00423128

Part of subcall function 00423670: LoadIconA.USER32(00400000,MAINICON), ref: 00423700
Part of subcall function 00423670: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,?,00000001), ref: 0042372D
Part of subcall function 00423670: OemToCharA.USER32(?,?), ref: 00423740
Part of subcall function 00423670: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,?,00000001), ref: 00423780

Part of subcall function 0041F0FC: GetVersion.KERNEL32(?,00418FD4,00000000,?,?,?,00000001), ref: 0041F10A
Part of subcall function 0041F0FC: SetErrorMode.KERNEL32(00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F0FC: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F132
Part of subcall function 0041F0FC: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F140
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F170
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F199
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1AE
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C3
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1D8
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1ED
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F202
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F217
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F22C
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F241

Strings

Delphi%.8X, xrefs: 00418F33
ControlOfs%.8X%.8X, xrefs: 00418F6F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A14620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3476490787-2767913252
Opcode ID: aa67d3daeb8707f3c8e9bba54f3ad579ea3bb7aec1a807591bda911964a6ee50
Instruction ID: 1b4a44e4abfb6ea8360da9e3ea6a857f9789cdc943c5ea6839331ea518f9c664
Opcode Fuzzy Hash: aa67d3daeb8707f3c8e9bba54f3ad579ea3bb7aec1a807591bda911964a6ee50
Instruction Fuzzy Hash: 3A11F1746182809AC700FF79984664E77D0EB9830CF50853FF548EB2A1EB399949DB1E

Function 00413620 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413648
GetWindowLongA.USER32(?,000000F0), ref: 00413653
GetWindowLongA.USER32(?,000000F4), ref: 00413665
SetWindowLongA.USER32(?,000000F4,?), ref: 00413678
SetPropA.USER32(?,00000000,00000000), ref: 0041368F
SetPropA.USER32(?,00000000,00000000), ref: 004136A6

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: bca78c0abd1e769fefdd307b0e304f432521cb58dbc5c3437f5fb0cbde78b182
Instruction ID: ddf9fe5e7ba4dcb1517a1eee0c6063af63038cac47ec81f8da91bd6392d66bb8
Opcode Fuzzy Hash: bca78c0abd1e769fefdd307b0e304f432521cb58dbc5c3437f5fb0cbde78b182
Instruction Fuzzy Hash: 5A11DA76600248BFDF00DF99DC84E9A37ECEB08364F104665FA18DB2A2D738D990CB64

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0048F420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0048F420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0048F420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 087646bccf734afe8a4f13846a90f5dc5aaf49b81b64397dc3aa56e171fbbab5
Instruction ID: 861cf6afa8173077facbf206f1cb7448a694e5b835b4eeb9b82801bed0fc4338
Opcode Fuzzy Hash: 087646bccf734afe8a4f13846a90f5dc5aaf49b81b64397dc3aa56e171fbbab5
Instruction Fuzzy Hash: AD116D30A007405AE711ABA9AC82F1F37A59765B08F64487FF400A7AF2D77CA858876D

Function 00461ADC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00461B79
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461B9F

Part of subcall function 00461A1C: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00461AB4
Part of subcall function 00461A1C: DestroyCursor.USER32(00000000), ref: 00461ACA

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00461BFB
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461C21

Strings

c:\directory, xrefs: 00461B74

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 4efb9b85c9dda884be98c7544709cc12aea5fe9e1cc8288af3e2c3809c1c7e1f
Instruction ID: 63b0402a6207f92fc6075a64d4787570c5c31164492b01507c40da35ff337d98
Opcode Fuzzy Hash: 4efb9b85c9dda884be98c7544709cc12aea5fe9e1cc8288af3e2c3809c1c7e1f
Instruction Fuzzy Hash: F3416D74640248AFD711DF55DD8AFDFB7E8EB49304F1480A6F804DB391E678AE808B69

Function 00423A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A00), ref: 00423A8C
GetWindow.USER32(?,00000003), ref: 00423AA1
GetWindowLongA.USER32(?,000000EC), ref: 00423AB0
SetWindowPos.USER32(00000000,@AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042418F,?,?,00423D57), ref: 00423AE6

Strings

@AB, xrefs: 00423AD6, 00423ADA

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: @AB
API String ID: 4191631535-4268427818
Opcode ID: fad5b0840d9b80b932d59a0f0d1da196681ef992e80faad8d842702c61fe3379
Instruction ID: a5dc8fa9b8a2f99578583ec2e81c8c31737274e5edfccecfa54f69911a77f800
Opcode Fuzzy Hash: fad5b0840d9b80b932d59a0f0d1da196681ef992e80faad8d842702c61fe3379
Instruction Fuzzy Hash: 72117C70744610ABDB10DF28DC86F5A73E4EB08725F10067AF994AB2E2C3B8DD41CB58

Function 00479988 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00479C9D,?,?,00000001,?), ref: 00479A99
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00479B0E

Strings

Need to restart Windows? %s, xrefs: 00479B4B
, xrefs: 00479BCB

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: fa07ec73c735ee57fdf27462f814a032c1324f03da4810029683ee977aabdce0
Instruction ID: 2750664cd831820fccee58c95da551eb70f542662e9de577cb7051c68e096772
Opcode Fuzzy Hash: fa07ec73c735ee57fdf27462f814a032c1324f03da4810029683ee977aabdce0
Instruction Fuzzy Hash: E99190706002449FCB05EF69D886B9E77F4AF49308F5085BBE4049B362D778AD49CB5E

Function 004695BC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

GetLastError.KERNEL32(00000000,004697B9,?,?,00000001,00490044), ref: 00469696
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00469710
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00469735

Strings

Creating directory: %s, xrefs: 0046967E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ChangeNotify$CharErrorFullLastNamePathPrev
String ID: Creating directory: %s
API String ID: 2168629741-483064649
Opcode ID: 7e9d84d05626543febae1fe7d6c652187f906c6aefdd7564175c6d3f4235afd3
Instruction ID: e2f5c7cae23e52c3f241dfe830c38e7f3c7cd42f9b6b4cdedd6c4220c886e7b7
Opcode Fuzzy Hash: 7e9d84d05626543febae1fe7d6c652187f906c6aefdd7564175c6d3f4235afd3
Instruction Fuzzy Hash: 3B511174A00248EBDB01DFA5D582BDEB7F9AF49305F50856AE800B7382D7B85E04CB99

Function 00452F30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00452FDE
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004530A4), ref: 00453048

Strings

sfc.dll, xrefs: 00452FA0
SfcIsFileProtected, xrefs: 00452FD8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 05638a4956b986f5632e9eed21cdff15dd5aaeb50f664b06faddbf1b0ed16131
Instruction ID: 1d662093e745af288151e08cced0d788a5a09dfa86744915bc645a1a72a504f0
Opcode Fuzzy Hash: 05638a4956b986f5632e9eed21cdff15dd5aaeb50f664b06faddbf1b0ed16131
Instruction Fuzzy Hash: 214196709003189BEB20EF55DC85B9DB7B8EB04746F5041BBA908A3293D7789F48CB59

Function 00450954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D31520.VERSION(00000000,?,?,?,0048CB6C), ref: 00450974
74D31500.VERSION(00000000,?,00000000,?,00000000,004509EF,?,00000000,?,?,?,0048CB6C), ref: 004509A1
74D31540.VERSION(?,00450A18,?,?,00000000,?,00000000,?,00000000,004509EF,?,00000000,?,?,?,0048CB6C), ref: 004509BB

Strings

)E, xrefs: 004509FF, 004509C7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: D31500D31520D31540
String ID: )E
API String ID: 1003763464-881129960
Opcode ID: 611ef1a2111dd0497dba7112dfe665be22e6762ef5518e9d8e929094d159e1b6
Instruction ID: 4438155049cc76cb68282396f03aeb3914f24db3a958afc31e42cd10e3c1fe93
Opcode Fuzzy Hash: 611ef1a2111dd0497dba7112dfe665be22e6762ef5518e9d8e929094d159e1b6
Instruction Fuzzy Hash: C221A175A00248AFDB01DAA98C41DBFB7FCEB49341F55447AFD04E3382D679AE048B69

Function 00404D42 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DDD
ExitProcess.KERNEL32 ref: 00404E25

Strings

Runtime error at 00000000, xrefs: 00404DD6, 00404DE9
Error, xrefs: 00404DD1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4e641df12af74fe0cdfde839356ca567a0a89692a9370234c808c2925f3fb0b8
Instruction ID: 05d3b53b00026b524fcfca4b0ebed08561a1326b29ff50b9f28d258046fed248
Opcode Fuzzy Hash: 4e641df12af74fe0cdfde839356ca567a0a89692a9370234c808c2925f3fb0b8
Instruction Fuzzy Hash: 0E2183B46002918AD711B7B9A84171E26C19BD7348F148D7FE600EB2E3C67C4859876E

Function 00450C2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,`XE,00000000,HXE,?,?,?,00000000,00450CA6,?,?,?,00000001), ref: 00450C80
GetLastError.KERNEL32(00000000,00000000,?,?,`XE,00000000,HXE,?,?,?,00000000,00450CA6,?,?,?,00000001), ref: 00450C88

Strings

HXE, xrefs: 00450C6A, 00450C6D
`XE, xrefs: 00450C72, 00450C75

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: HXE$`XE
API String ID: 2919029540-2299865289
Opcode ID: 8c0db05432607deaec95097ec64cff31bbc1b6fde74a845974af3254455018ce
Instruction ID: dfbb5462f4e58795a4f341a3f9e85056f562f708a0d94e90ba33abc4bdaadeb2
Opcode Fuzzy Hash: 8c0db05432607deaec95097ec64cff31bbc1b6fde74a845974af3254455018ce
Instruction Fuzzy Hash: 6E1139B6A04208AF8B41DFADDC81DDFB7ECEB4D314B51466ABD08D3241D638ED148B68

Function 00453B24 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,00453B8F,?,00000001,00000000), ref: 00453B82

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00453B30
PendingFileRenameOperations, xrefs: 00453B54
PendingFileRenameOperations2, xrefs: 00453B63

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 1192a58cf2ba05a74e8cd39b2b221491dea6f905a5b87030c13acd5c9c7302df
Instruction ID: bce1a9e823e3a6f00c65457e0056d75a9340da40565ac55ac442632498a450a6
Opcode Fuzzy Hash: 1192a58cf2ba05a74e8cd39b2b221491dea6f905a5b87030c13acd5c9c7302df
Instruction Fuzzy Hash: 4EF0C2317442087BDB05DA66EC06A2AB3DCD744752FA0446BF800C6583DA79BE04922C

Function 0046B888 Relevance: 6.3, APIs: 4, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046BA59,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2), ref: 0046BA35
FindClose.KERNEL32(000000FF,0046BA60,0046BA59,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2,?), ref: 0046BA53
FindNextFileA.KERNEL32(000000FF,?,00000000,0046BB7B,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2), ref: 0046BB57
FindClose.KERNEL32(000000FF,0046BB82,0046BB7B,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2,?), ref: 0046BB75

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 5a4a149df628af4c850d3993175f64991961d8133159410ec82db531a67c5671
Instruction ID: d0fcd6aaacf2c77063bdc4ae7e5d3f048473d7fda7acabfe5391ba971e118263
Opcode Fuzzy Hash: 5a4a149df628af4c850d3993175f64991961d8133159410ec82db531a67c5671
Instruction Fuzzy Hash: 01B12D7490424D9FCF11DFA5C881ADEBBB9FF48304F5081AAE808A3251E738AE46CF55

Function 00421258 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421345
SetMenu.USER32(00000000,00000000), ref: 00421362
SetMenu.USER32(00000000,00000000), ref: 00421397
SetMenu.USER32(00000000,00000000), ref: 004213B3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 3ad1be53728b58936f085d074cd65e1d8723a7dcb2e5c6fed8892d9603565c38
Instruction ID: 36b1be801ec9eb7d4fdbe3c02f2f63d01ab37a0b401d8d3754119f9f7163b302
Opcode Fuzzy Hash: 3ad1be53728b58936f085d074cd65e1d8723a7dcb2e5c6fed8892d9603565c38
Instruction Fuzzy Hash: 3941937070425456E720AA3A998579A26D54F65308F4806BFFC40DF3A7CA7DCC45839C

Function 0044A638 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,00000000,00000000,00000000,0044A77B,?,?,?,?), ref: 0044A6CF
SelectObject.GDI32(?,00000000), ref: 0044A6F5
DrawTextA.USER32(?,00000000,00000000,00000000,00000000), ref: 0044A722
73A0A480.USER32(00000000,?,0044A747,0044A740,?,00000000,00000000,00000000,00000000,0044A77B,?,?,?,?), ref: 0044A73A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A480A570DrawObjectSelectText
String ID:
API String ID: 1593990899-0
Opcode ID: be3cd1260347904c130877d66720c049173b0b52d51fb9e1a17d3c376dd8c1c1
Instruction ID: 3894435ba948b31cd5e399413915a635a74ec1d9715de1c669c4c197628414c6
Opcode Fuzzy Hash: be3cd1260347904c130877d66720c049173b0b52d51fb9e1a17d3c376dd8c1c1
Instruction Fuzzy Hash: 10316F70A44208BFEB11EFA5C845F9EBBF8EB48304F5584A6F404E7291D7389E50CB29

Function 00416B26 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B68
SetTextColor.GDI32(?,00000000), ref: 00416B82
SetBkColor.GDI32(?,00000000), ref: 00416B9C
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BC4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 296af9f2060c546ec682cee1885cf8095fe0270590feed89bffcff2dfecec796
Instruction ID: bac7134ed5a65be849589c285d7f2b427d424e3f48de90f8df9f5f0117a70e24
Opcode Fuzzy Hash: 296af9f2060c546ec682cee1885cf8095fe0270590feed89bffcff2dfecec796
Instruction Fuzzy Hash: 3D115EB1200614AFD720EE6ECD84D9777ECEF48304715883AB59ACB612C638F8408B29

Function 004230AC Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,?,?,00000000,?,00418FB7,00000000,?,?,?,00000001), ref: 00423102
EnumFontsA.GDI32(00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,?,00000001), ref: 00423115
73A14620.GDI32(00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 0042311D
73A0A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 00423128

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A14620A480A570EnumFonts
String ID:
API String ID: 2780753366-0
Opcode ID: 19b3cffb79c35eecf5e51c4130a3ee25802c1987fff001932c4ce39a15a21a42
Instruction ID: 3dbf9df1a2207b610df3ad0597122edc823231e2adad812ec9c72b879bb67f73
Opcode Fuzzy Hash: 19b3cffb79c35eecf5e51c4130a3ee25802c1987fff001932c4ce39a15a21a42
Instruction Fuzzy Hash: 2D01D2616047106AE700BF6A5C86B9A77A4DF01318F00417BF904AF2C7D6BE9C04476E

Function 00474164 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00474185
GetLastError.KERNEL32 ref: 0047418F
GetTickCount.KERNEL32 ref: 00474199
Sleep.KERNEL32(00000032), ref: 004741A9

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: c643bcd7686e3e2995f1c357c9a5872f968f37f788cd1ab6df8788c1be5c5333
Instruction ID: 12ded6a52e16fbe71fc8423c8a03cbcea923c8fd41db68bb87c4b622ddffe9b0
Opcode Fuzzy Hash: c643bcd7686e3e2995f1c357c9a5872f968f37f788cd1ab6df8788c1be5c5333
Instruction Fuzzy Hash: 98E0E52130A11085C72031AE688A9BF6A88CAE1324B18853FF0CDD6242C91C4C45852E

Function 00459228 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0044F988: SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

FlushFileBuffers.KERNEL32(?), ref: 0045946C

Strings

NumRecs range exceeded, xrefs: 00459357
EndOffset range exceeded, xrefs: 0045938E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 5bbcec6483d720ed558688fb4b1317d9e27bac15226558c27210878f7f455c2f
Instruction ID: 24e980760699f03bd67425b4d674c5f46978abf03db993012867d9b330479edc
Opcode Fuzzy Hash: 5bbcec6483d720ed558688fb4b1317d9e27bac15226558c27210878f7f455c2f
Instruction Fuzzy Hash: 67617034A00258CBDB25DF25C841AD9B3B5FB49305F0085EAED48A7392D778AEC9CF54

Function 0048DCA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 0040335C: GetModuleHandleA.KERNEL32(00000000,0048DCAE), ref: 00403363
Part of subcall function 0040335C: GetCommandLineA.KERNEL32(00000000,0048DCAE), ref: 0040336E

Part of subcall function 00409B58: 6F541CD0.COMCTL32(0048DCBD), ref: 00409B5D

Part of subcall function 00410938: GetCurrentThreadId.KERNEL32 ref: 00410986

Part of subcall function 00419024: GetVersion.KERNEL32(0048DCD1), ref: 00419024

Part of subcall function 0044EB7C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048DCE5), ref: 0044EBB7
Part of subcall function 0044EB7C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EBBD

Part of subcall function 004515BC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515DC
Part of subcall function 004515BC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515E2
Part of subcall function 004515BC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515F6
Part of subcall function 004515BC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515FC

Part of subcall function 0045F050: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0048DD03), ref: 0045F05F
Part of subcall function 0045F050: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0045F065

Part of subcall function 00466AB8: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00466ACD

Part of subcall function 0048ADC8: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0048ADCD

SetErrorMode.KERNEL32(00000001,00000000,0048DD50), ref: 0048DD22

Part of subcall function 0048DAB0: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048DD2C,00000001,00000000,0048DD50), ref: 0048DABA
Part of subcall function 0048DAB0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0048DAC0

Part of subcall function 004244B8: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244D7

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

ShowWindow.USER32(?,00000005,00000000,0048DD50), ref: 0048DD93

Part of subcall function 00479114: SetActiveWindow.USER32(?), ref: 004791AE

Strings

Setup, xrefs: 0048DD79

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModeRegisterSendShowTextThreadVersion
String ID: Setup
API String ID: 3016796600-3839654196
Opcode ID: 5e260028fcea5c003e771da278fcdcf966513f59ae2712e5bbc2d6d0bf024761
Instruction ID: 99c45310959900e19b40b1da60452347f995955d81cd4fb65cbe961703ffe03f
Opcode Fuzzy Hash: 5e260028fcea5c003e771da278fcdcf966513f59ae2712e5bbc2d6d0bf024761
Instruction Fuzzy Hash: 9831D7712056009ED305BBB7EC1396D37A8DB89728B61487FF804965A3DE3C5855CB3E

Function 0042DA18 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,ProductType,00000000,?,00000000,?,00000000,0042DB39), ref: 0042DA50
RegQueryValueExA.ADVAPI32(?,ProductType,00000000,?,00000000,00000000,?,ProductType,00000000,?,00000000,?,00000000,0042DB39), ref: 0042DAA8

Strings

ProductType, xrefs: 0042DA4E, 0042DAA6

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: QueryValue
String ID: ProductType
API String ID: 3660427363-120863269
Opcode ID: 5515ace25f4e244fced323990dfe6545e7ac35029be00f6e6e157eda9b4f84d1
Instruction ID: aa1ea57d9c55ade47253787ac109cea625fab700954374de719742b7b57069bc
Opcode Fuzzy Hash: 5515ace25f4e244fced323990dfe6545e7ac35029be00f6e6e157eda9b4f84d1
Instruction Fuzzy Hash: 6F413D71E04119AFDB11DF95D885FEFBBB8EB45304F9184BAE410A7280D738AE44CB58

Function 00451D94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00451E83,?,?,00000000,0048F628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00451DDA
GetLastError.KERNEL32(00000000,00000000,?,00000000,00451E83,?,?,00000000,0048F628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00451DE3

Strings

.tmp, xrefs: 00451DC3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 0c0267f044befdc9993e9f80d192da366c6ade9c509f4af2d7f952c5d9937583
Instruction ID: 6e9789a85f1cf8d92ab4faafeaa9fc3a81a95af4c8f57c642e2c8bce0ada5150
Opcode Fuzzy Hash: 0c0267f044befdc9993e9f80d192da366c6ade9c509f4af2d7f952c5d9937583
Instruction Fuzzy Hash: 92210675A002089BDB05EFA1C852ADEB7B9EB48305F50457BEC01B7352DB7CAE058A65

Function 0041EE88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EED7
73A15940.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

Strings

B^E, xrefs: 0041EF1A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A15940CurrentThread
String ID: B^E
API String ID: 1959240892-2932950393
Opcode ID: 4b3049e1105a07ac561ea121785497a91acaa782c4bb21d2a90abad1c946949a
Instruction ID: d22defc84752bb1f375c9b34ca853fcdc4d69c025aabcd89a3851a432f640f9b
Opcode Fuzzy Hash: 4b3049e1105a07ac561ea121785497a91acaa782c4bb21d2a90abad1c946949a
Instruction Fuzzy Hash: 8F013975A04704BFE701CFA7DC2194ABBE9E789714B218C7AEC04D36A0F6345812AE19

Function 00473A74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,00473CFA,00000000,00473D10,?,?,?,?,00000000), ref: 00473AD6

Strings

RegisteredOwner, xrefs: 00473AB3
RegisteredOrganization, xrefs: 00473AC5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 06584f189311496c8cbcd52cd6f8d40f219c08a135042a9405816537cac3848e
Instruction ID: 2b56327a1c1e2526204933d5438d5e873fb9ea21772219b29d03903063c3f607
Opcode Fuzzy Hash: 06584f189311496c8cbcd52cd6f8d40f219c08a135042a9405816537cac3848e
Instruction Fuzzy Hash: BAF09020704244AFDB00DBA9ACA3B9B7799D740304F20807BF6458B252D7B9AE00E71C

Function 0046E560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046E797), ref: 0046E585
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046E797), ref: 0046E59C

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

CreateFile, xrefs: 0046E591

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 6686e6ad25de19ad566e8c1b4694bca7fe5d42e11b4e6f5260ca779268b672c6
Instruction ID: 7637e90ee4508d20334fb04ab3d6cd326067355bb1d9238a2a1584f6934d9362
Opcode Fuzzy Hash: 6686e6ad25de19ad566e8c1b4694bca7fe5d42e11b4e6f5260ca779268b672c6
Instruction Fuzzy Hash: 80E06D74240304BBE610FA6ADCC6F4977889B04728F108151FA45AF3E2D5B9EC40865D

Function 00466AB8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E1B8: SetErrorMode.KERNEL32(00008000), ref: 0042E1C2
Part of subcall function 0042E1B8: LoadLibraryA.KERNEL32(00000000,00000000,0042E20C,?,00000000,0042E22A,?,00008000), ref: 0042E1F1

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00466ACD

Strings

shell32.dll, xrefs: 00466AC2
SHPathPrepareForWriteA, xrefs: 00466AB8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: a49ab50e3c92eb79af116b047a27e43c0d5b6cdb67c912947c5a5db2deec9b3e
Instruction ID: 3b12803c986d28e39ac3ad1b4be314fd09e1afeb8d871b5ab1e3610ada41a384
Opcode Fuzzy Hash: a49ab50e3c92eb79af116b047a27e43c0d5b6cdb67c912947c5a5db2deec9b3e
Instruction Fuzzy Hash: F3B092B064061462DA00A7A65802B2A2014D793705B61C47FB140BE2D6EEBC84448B1E

Function 004243E0 Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004243F6
TranslateMessage.USER32(?), ref: 00424473
DispatchMessageA.USER32(?), ref: 0042447D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: b2329071a0421c93ee0ae4663caf12f13090b6ca3a07c5a35a5c46be63036eea
Instruction ID: fe8500af1bfcf242036ade45f780a381a823919f587051acc2528fd242358d38
Opcode Fuzzy Hash: b2329071a0421c93ee0ae4663caf12f13090b6ca3a07c5a35a5c46be63036eea
Instruction Fuzzy Hash: 0911943030431056EA20F665AD4179B73D8DFC1754F81885EF88997382D77D9D4987AA

Function 00416628 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041664E
SetPropA.USER32(00000000,00000000), ref: 00416663
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 0041668A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: f44c3f3a62ce55b1375bc8ee214f0b6504ba97b5043b7db0174100bcb2b45bbb
Instruction ID: be00217531a54bd36177c605ea93c3a6d25e3d0009ae87a2c8918f37a7e5dcde
Opcode Fuzzy Hash: f44c3f3a62ce55b1375bc8ee214f0b6504ba97b5043b7db0174100bcb2b45bbb
Instruction Fuzzy Hash: 2DF01271741210BBDB10AF598C85FA632DCAB09705F16017ABE09EF286D678DC44C7A8

Function 0041EE38 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE48
IsWindowEnabled.USER32(?), ref: 0041EE52
EnableWindow.USER32(?,00000000), ref: 0041EE78

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: e716c41a7aa4c8049a48929a68b54d310266b5fcefed060798fa6e9578af309b
Instruction ID: 45d366e35b91ce2eecdd9f05db0fdf46fffcf4c13ab4eeb186f31cda34d95c06
Opcode Fuzzy Hash: e716c41a7aa4c8049a48929a68b54d310266b5fcefed060798fa6e9578af309b
Instruction Fuzzy Hash: 4AE0EDB55003006AE310AB67DC81A5B779DAB15344F508C3AA80597292EA3AD8819B7C

Function 00406298 Relevance: 4.5, APIs: 3, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406299
GlobalUnlock.KERNEL32(00000000), ref: 004062A0
GlobalFree.KERNEL32(00000000), ref: 004062A5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Global$FreeHandleUnlock
String ID:
API String ID: 1436724280-0
Opcode ID: 0bc05864fe4ded04478dbff1515757d007f4a64d65c80ff5a9b61caa6d045342
Instruction ID: 40a4899a70fcae155b6d287ef0f72ad5de2de0cd74862d07ae0922fd7d8de528
Opcode Fuzzy Hash: 0bc05864fe4ded04478dbff1515757d007f4a64d65c80ff5a9b61caa6d045342
Instruction Fuzzy Hash: 01A001C5915A45A4D80072B2085B93F450CD8403283C05A6AB440B20838C3C8C001D3A

Function 00479114 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004791AE

Strings

InitializeWizard, xrefs: 0047915B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 9101e622fd16e43cd994ef38210536ae3c2195a43e6f0336fddb6bbd01aa9b09
Instruction ID: 3bd5c684822a03ea4ac8640b9a5413307144f1a036ebadd8ed94fa804e8e7497
Opcode Fuzzy Hash: 9101e622fd16e43cd994ef38210536ae3c2195a43e6f0336fddb6bbd01aa9b09
Instruction Fuzzy Hash: C1118E302042009FE700EB69EC49B9A77E4E79A328F60887BE504C72A1EA796C55CB5D

Function 004741B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00474200

Strings

Failed to remove temporary directory: , xrefs: 00474219

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: dde2cbb857ae34d66b0f0c1ebb0bbb63c93fe85abfa33f1abe8b028049839429
Instruction ID: f6a44f029f6d998e7ace20f431cb3f75d6e08f74c70e64d3682787806761ccc8
Opcode Fuzzy Hash: dde2cbb857ae34d66b0f0c1ebb0bbb63c93fe85abfa33f1abe8b028049839429
Instruction Fuzzy Hash: B001C430200600AADB11EBB2DC56BAE77A8D781708FB148BBB900A61A3DB7C9D49C51D

Function 00473990 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00473BD6,00000000,00473D10), ref: 004739D5

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004739A5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 96f158e785a8a79892ff0bb56e5dae33f27c1a6076e79d69693433bda0b48a2c
Instruction ID: 3803dda61ff1e03f7b4a1e3eab0a0f1fc6a18ace5ddeadb773f84aea70c157ee
Opcode Fuzzy Hash: 96f158e785a8a79892ff0bb56e5dae33f27c1a6076e79d69693433bda0b48a2c
Instruction Fuzzy Hash: 9EF082A27441286BD600A96A9C43BAFA29C8B84755F20407BF648DB242D9EDEE0157AC

Function 00468C14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00490044,?,00468E0B,?,00000000,00469235,?,_is1), ref: 00468C37

Strings

Inno Setup: Setup Version, xrefs: 00468C35

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 5a5d9c005a27806d8962722e26d93860e122acdf38a034df23c627158a68d902
Instruction ID: f4ebb4848459b4250fcbef50f6d72caf48b7ad95609634002a5a75c9b0da781c
Opcode Fuzzy Hash: 5a5d9c005a27806d8962722e26d93860e122acdf38a034df23c627158a68d902
Instruction Fuzzy Hash: 1BE06D713412043BD710EA6E9C85F6BABDCDF883A4F00443AB908EB392D978DD0146A8

Function 00468C84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00490044,00000004,00000001,?,0046918E,?,?,00000000,00469235,?,_is1,?), ref: 00468C97

Strings

NoModify, xrefs: 00468C95

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: a02c31eddcb2c2fd9a064e2b730804ac8d8a5c2dce8e839ccbf039595d16ba72
Instruction ID: cc30f3f3714627e0fcd4c7bb4f0b5fc4491066ae05f694ea084e9d213b4b617b
Opcode Fuzzy Hash: a02c31eddcb2c2fd9a064e2b730804ac8d8a5c2dce8e839ccbf039595d16ba72
Instruction Fuzzy Hash: 9DE04FB0644308BFEB04DB95CD4AF6B77ACDB48754F10415DBA049B281EA74EE008668

Function 0042DC1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC36

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: 13cad7d200b120ad5597814079c4f59ec3096416cb1acf233699b236b741948d
Instruction ID: 9b797428c6f186a72a7ba32fee826cdcf23ca6c15d4fdd534b748b65857be3de
Opcode Fuzzy Hash: 13cad7d200b120ad5597814079c4f59ec3096416cb1acf233699b236b741948d
Instruction Fuzzy Hash: F5D092B2910128BB9B109A89DC81EFB77ADDB19360F50842BF90897600C6B4AC519BF4

Function 0045234C Relevance: 3.2, APIs: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0045257F,?,00000000,004525E9,?,?,-00000001,00000000,?,00474215,00000000,00474164,00000000), ref: 0045255B
FindClose.KERNEL32(000000FF,00452586,0045257F,?,00000000,004525E9,?,?,-00000001,00000000,?,00474215,00000000,00474164,00000000,00000001), ref: 00452579

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 4cb5fe33f4f21c6a27829e3e7da9476eb7594d61072cdfc44e1cbe52ae54ac8a
Instruction ID: 4e27180880ec590effa84b7e78516a3413803233620af3d5ad2924b98cdd6442
Opcode Fuzzy Hash: 4cb5fe33f4f21c6a27829e3e7da9476eb7594d61072cdfc44e1cbe52ae54ac8a
Instruction Fuzzy Hash: 11817F70A0024DABCF11DF65C9957DFBBB4AF4A305F1044A7EC4467292E3B89E4ACB94

Function 0040AFAC Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AFC6
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B123,00000000,0040B13B,?,?,00000000,00000000), ref: 0040AFD7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 272fb5a0495e34c6311fc30b4fd83ab8ec4b4879d304c88450eec4474e8101b5
Instruction ID: 12dffaa3083004c06d189a808c14b2b9b14d906a67b209620051df5c13d0bbd6
Opcode Fuzzy Hash: 272fb5a0495e34c6311fc30b4fd83ab8ec4b4879d304c88450eec4474e8101b5
Instruction Fuzzy Hash: 5101F771300700AFD711EF65AC52D2B77ADDB4A714711847AF500BB3D1DA399C10976D

Function 0042CFB8 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042CFEE
WriteProfileStringA.KERNEL32(00000000,00000000,00000000), ref: 0042D014

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ProfileStringWrite$Private
String ID:
API String ID: 3244626871-0
Opcode ID: c1df83169b7f11daa76ce50b74a98f228edad8badb192acdd36f8538120cc8c9
Instruction ID: 62d09edab918f6ffa89fbd4701a95ac8808e46281d0a6c96c816dd041b8e40f8
Opcode Fuzzy Hash: c1df83169b7f11daa76ce50b74a98f228edad8badb192acdd36f8538120cc8c9
Instruction Fuzzy Hash: C5F01DF17441196AC604FEBE9CC2E6E6B9C8A48759310413BB209F32C2DAB8AE01136C

Function 004510C4 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00451106
GetLastError.KERNEL32(00000000,00000000,00000000,0045112C), ref: 0045110E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: a7b86cc40c20148a4e3a112fa814ef8232880cd67c8f13fe2953aff1ae5b3bf6
Instruction ID: 601d44f04c9cfe722f2e497316d95a0e2416cdaba02063a9512e5b964032ce29
Opcode Fuzzy Hash: a7b86cc40c20148a4e3a112fa814ef8232880cd67c8f13fe2953aff1ae5b3bf6
Instruction Fuzzy Hash: 09012671B00604AB8B00EBBA9C8199EB7ECDB4D31576045BBFD08E3252EA385E04855C

Function 00450BB4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00450C13), ref: 00450BED
GetLastError.KERNEL32(00000000,00000000,00000000,00450C13), ref: 00450BF5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: ac340b5e958abdb681865f7a0e130dd2ea27e6210a05c0591cebd0e4527123bc
Instruction ID: 063cd6fcc4589cb133ccd01a2e8e9e7051cfe06a6bd5c05068ad70219624bdd3
Opcode Fuzzy Hash: ac340b5e958abdb681865f7a0e130dd2ea27e6210a05c0591cebd0e4527123bc
Instruction Fuzzy Hash: B3F02875E04708AFCB11EFB59C5159EB3A8DB49315B5046B7FC04E3282E6395E04869C

Function 00450D4C Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00450DA9,?,-00000001,?), ref: 00450D83
GetLastError.KERNEL32(00000000,00000000,00450DA9,?,-00000001,?), ref: 00450D8B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 7d68d9e881eec1afca2cf1b59e20a90bd750d0fae5c0334d9c49a7cab7ad96dc
Instruction ID: 16e9cd82af67c8b8d5606378124a67fa228d7b06d730318b5b2336ca33db46ad
Opcode Fuzzy Hash: 7d68d9e881eec1afca2cf1b59e20a90bd750d0fae5c0334d9c49a7cab7ad96dc
Instruction Fuzzy Hash: DAF0C279E04708AFCB01EFF99C4149EB7F8DB4871575185BBEC14E3242E6386E18899C

Function 00451254 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,004512B1,?,-00000001,00000000), ref: 0045128B
GetLastError.KERNEL32(00000000,00000000,004512B1,?,-00000001,00000000), ref: 00451293

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 507aaad3a21d63c8601c87a5265d0cd34b218a3c5894927b33333e1c442e5d4a
Instruction ID: c912f35d2998457b2e824ecbe1a41c5136fe52c6f663370697dbd53c727baef6
Opcode Fuzzy Hash: 507aaad3a21d63c8601c87a5265d0cd34b218a3c5894927b33333e1c442e5d4a
Instruction Fuzzy Hash: 6FF0C871A04604ABCB00EFB59C4199EB7E8DB48315B514ABBFC04F3652E7385E04859C

Function 00423220 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 0042322D
LoadCursorA.USER32(00000000,00000000), ref: 00423257

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 9fec0ea2bfd00d9fceaaa73e6104b837c99125e6063ac79a0958976c72ddb8a5
Instruction ID: 0402285bfb274dd8fe4b3a25abfc235caab6f109ca1a2876507250cac3dbd624
Opcode Fuzzy Hash: 9fec0ea2bfd00d9fceaaa73e6104b837c99125e6063ac79a0958976c72ddb8a5
Instruction Fuzzy Hash: C1F0E411B4015056DA109E7E6CC0E2A71B4CBC2375761037BFF3ED72D1CA2D6E414279

Function 0042E1B8 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1C2
LoadLibraryA.KERNEL32(00000000,00000000,0042E20C,?,00000000,0042E22A,?,00008000), ref: 0042E1F1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4fb11dbb223986b0efaa74ce43b59d2dec948001b51b441eacda59d4f6d0f9e8
Instruction ID: 1297d1b4cc028e032a3df4ef759b42a31090f4e829aa6dc89ab980b0b95de88c
Opcode Fuzzy Hash: 4fb11dbb223986b0efaa74ce43b59d2dec948001b51b441eacda59d4f6d0f9e8
Instruction Fuzzy Hash: 71F082B0B14744BEDF119F779C5282BBBECE70DB0079348B6F811A2A92E53D5910C978

Function 0044F954 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,00000080,00469AF9,?,00000000), ref: 0044F96A
GetLastError.KERNEL32(?,00000000,?,00000002,?,00000080,00469AF9,?,00000000), ref: 0044F972

Part of subcall function 0044F710: GetLastError.KERNEL32(0044F52C,0044F7D2,?,00000000,?,0048D07E,00000001,00000000,00000002,00000000,0048D1E7,?,?,00000005,00000000,0048D21B), ref: 0044F713

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 51e734b65ac51a2f3c6da697b07927705d15542310c4bf27b312c7248554b184
Instruction ID: c0bc3fd2d1c16438c58ed69be3b7abd6d372baba753f02bf81082b33070d6961
Opcode Fuzzy Hash: 51e734b65ac51a2f3c6da697b07927705d15542310c4bf27b312c7248554b184
Instruction Fuzzy Hash: 4EE012A1314600ABFB00EAA599C5B3773DCDB48304F00443AB544CF282D678CC084B29

Function 0041EFD8 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EFF2
73A15940.USER32(00000000,0041EF74,00000000,004240AA,?,00000000,00424140), ref: 0041EFF8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A15940CurrentThread
String ID:
API String ID: 1959240892-0
Opcode ID: 72fe392420865928e5269dee910c8a6bfd4cbfc2ca7c70ec05203b31d982e50a
Instruction ID: 6b8f8bfd6ef27db9e6018f07578a69cdc2ada642b5fbd122d8a5cac7b1d5f54b
Opcode Fuzzy Hash: 72fe392420865928e5269dee910c8a6bfd4cbfc2ca7c70ec05203b31d982e50a
Instruction Fuzzy Hash: 08E02D71A40620AEEB10DBB6ED45B5B37A0E744308F104C3EA804D62A1F6785482BB0E

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 50c454e4b0bdda97fec49124369866c4dd2294ff55b1b02ea28c20733c315e07
Instruction ID: 8fabae77903bdf930d004f7073d368b7c939d6086f38a5e4ac05ef7a6e824755
Opcode Fuzzy Hash: 50c454e4b0bdda97fec49124369866c4dd2294ff55b1b02ea28c20733c315e07
Instruction Fuzzy Hash: C0F0E272A0023027EB20596A4C81B5355849BC5B94F154076FD08FF3E9D2B58C0142A9

Function 00475288 Relevance: 1.6, APIs: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageA.USER32(0002043A,00000496,00002711,00000000), ref: 00475435

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: 37336e12cff04accab694ac7c62c67a82c7a5eb278b6aba67f1376f69c3f0586
Instruction ID: 8e6a71a94778eff19e63319509ba446193ee9454dd77d70e1ea9677a86aea3ab
Opcode Fuzzy Hash: 37336e12cff04accab694ac7c62c67a82c7a5eb278b6aba67f1376f69c3f0586
Instruction Fuzzy Hash: CA4130713006048BCB01FF6AEC8265A7795AB44305B64C53BA9089F3B6CBBDDD46CB9D

Function 00408574 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004086AA), ref: 00408593

Part of subcall function 00406D84: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406DA1

Part of subcall function 00408500: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 8300228b4ca49032a965bb097f58aeca5fc65005efcb47fc59437154a63158b6
Instruction ID: 804587c4a4fbe97408789ceecce9f172f4438e6d4b2b8687106b1df71c731af0
Opcode Fuzzy Hash: 8300228b4ca49032a965bb097f58aeca5fc65005efcb47fc59437154a63158b6
Instruction Fuzzy Hash: FA315231E00109AFCB00EF95C8819EEB3B9EF84314F118977E815AB285E738AE058B94

Function 0041FB80 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC1D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: b1659b9cf98e61c778d26dfc389632e32ba195a6aed1158de6fb079ecdb15c0a
Instruction ID: a8b9c07c4764db74d34f4489b66f31dd02ebc5feace59a64ccf47019980fef9c
Opcode Fuzzy Hash: b1659b9cf98e61c778d26dfc389632e32ba195a6aed1158de6fb079ecdb15c0a
Instruction Fuzzy Hash: 4F213EB1608745AFC340DF29D4406A7BBE4BB48314F04893EE098C3741E778E99ACBD6

Function 004661C4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE88: GetCurrentThreadId.KERNEL32 ref: 0041EED7
Part of subcall function 0041EE88: 73A15940.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,00466222,?,00000000,?,?,00466427,?,00000000,00466466), ref: 00466206

Part of subcall function 0041EF3C: IsWindow.USER32(?), ref: 0041EF4A
Part of subcall function 0041EF3C: EnableWindow.USER32(?,00000001), ref: 0041EF59

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$A15940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 1039859321-0
Opcode ID: 63837516ed4f1aa3abd9adbd200a937e3ff40dea63f22d2836c6e8250c30d96c
Instruction ID: 117b851928a469a2dcea674701370b063ae8e939fdddb17e9f772b34c162a106
Opcode Fuzzy Hash: 63837516ed4f1aa3abd9adbd200a937e3ff40dea63f22d2836c6e8250c30d96c
Instruction Fuzzy Hash: 73F0B471604300AFE715AB62FC6AB297B9CE309714FA208BFF90492590E6795C50C61D

Function 00416534 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416569

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 60910055b19013ea9a189cf27b56cb768f80878e26af159334e614e543980376
Instruction ID: 0a570082d33188b611a1683747fe0f331d6e25d9a62a4f6c92222c92e35dbe0c
Opcode Fuzzy Hash: 60910055b19013ea9a189cf27b56cb768f80878e26af159334e614e543980376
Instruction Fuzzy Hash: 39F02BB6200510AFDB84DF9CD8C0F9373ECEB0D210B0485A5FA08CF24AD220EC108BB0

Function 00414998 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149D3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 0042CBEC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

GetFileAttributesA.KERNEL32(00000000,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86,00000000,00450E69,00000000,00450E8A,?,00000000), ref: 0042CC17

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AttributesCharFilePrev
String ID:
API String ID: 4082512850-0
Opcode ID: c3879a33e5e8faee6759289f447bdc4ad56aff4458e855c83cfc40d64ea35d92
Instruction ID: 2d68e1f4147489d5e806e421efb80b14b78c91eaaa54119f39ee65666977ef78
Opcode Fuzzy Hash: c3879a33e5e8faee6759289f447bdc4ad56aff4458e855c83cfc40d64ea35d92
Instruction Fuzzy Hash: 44E0ED70300708BBD711FA62AC92A1EBBACDB89704BA10476B400E3281D6B8AE0084AC

Function 0044F820 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044F860

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c7e8b16a9e2e46d9e90ff33e921adc2b3c3461ba36f54299435d743643695de4
Instruction ID: 22f9db402a0515e75914d2a385e5e69984b6bc08d721d2b11e33f700aeefffa9
Opcode Fuzzy Hash: c7e8b16a9e2e46d9e90ff33e921adc2b3c3461ba36f54299435d743643695de4
Instruction Fuzzy Hash: A2E0EDB53541583ED280AAAD7C52FAB679C970A754F008436F998D7241C4A19D108BA8

Function 0042E638 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 455603a8b90b884efaee48bcfa677fb8f326a641c75908919a6fff2db5e4fb31
Instruction ID: 45038a6fbdc243d8347ad9472fd33571d6fa4976b061bf25745ceed24790cfd8
Opcode Fuzzy Hash: 455603a8b90b884efaee48bcfa677fb8f326a641c75908919a6fff2db5e4fb31
Instruction Fuzzy Hash: 88E0207138431129F62510A65C87F7B130DC7A0740F9480363B10DF3D2DDAFD90601AE

Function 004062F8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423660,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0), ref: 00406321

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 864af0be76aa79f683fb891a6989ac97326493c7108e11645e767f356e92afcf
Instruction ID: 9d2fd7d54d38cc8ecaaa5d0cbba53bdf20c97294be50a81d49070602afc72c8f
Opcode Fuzzy Hash: 864af0be76aa79f683fb891a6989ac97326493c7108e11645e767f356e92afcf
Instruction Fuzzy Hash: 56E002B2214309BFDB00DE8ADCC1DABB7ACFB4C754F844105BB1C972428275AD608B75

Function 0042DBE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC10

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 09dd07eab4812bc80ae5e1924f89e0aca516d2e63a4ba20224d97dfc25453c98
Instruction ID: 89cbb2395a765718c6971404783d0f5ed735bc8b73b6938cef0302f8f2253497
Opcode Fuzzy Hash: 09dd07eab4812bc80ae5e1924f89e0aca516d2e63a4ba20224d97dfc25453c98
Instruction Fuzzy Hash: 13E07EB2600119AF9B40DE8CDC81EEB37EDAB1D350F454016FA08E7201C2B4EC519BA4

Function 00452E24 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046A1CD,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000), ref: 00452E3A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: c9bee2d8dcb77cb83a3583428c6072a6a39ab886ac1e9a3d4e58ecf381fc728c
Instruction ID: 5a3b55c4c8a322745820a5c9987438e3ac614ce5dc39266c5b0cf6c257984760
Opcode Fuzzy Hash: c9bee2d8dcb77cb83a3583428c6072a6a39ab886ac1e9a3d4e58ecf381fc728c
Instruction Fuzzy Hash: B7E09BB0A046008BCB14DF3A898171A76D15F8A320F04C56BBC5CCB3D7D77CC4465657

Function 00414660 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0048AC9A,?,0048ACBC,?,?,00000000,0048AC9A,?,?), ref: 0041467F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406AD8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CompareStringA.KERNEL32(00000400,00000000,00000000,00000000,00000000,00000000,00000000,?,0042C5C1,00000000,0042C5DE,?,?,00000000,?,00000000), ref: 00406B05

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 054469502ee2f86f0ae21832af76434713ecb1dc2a06f140a03592f29d6687d9
Instruction ID: 0b7e307bfc14650e043a785ca356d6d8cfed1aeeea1ec775d718dd049edb96a1
Opcode Fuzzy Hash: 054469502ee2f86f0ae21832af76434713ecb1dc2a06f140a03592f29d6687d9
Instruction Fuzzy Hash: 65D09ED13005103AD2547A7E0C82F5F498C4B0871AF00553EB608F72D3C5ACDF01067D

Function 00406EA8 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406EBC

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 92616a0c773315b94590898aa4a0ca2ce8d2617e301858a5bf41299c043ccb5c
Instruction ID: 32889266fe6bc7d6de414e8ccc323fa13e2116c506fd23241cccaa57e6b5ba67
Opcode Fuzzy Hash: 92616a0c773315b94590898aa4a0ca2ce8d2617e301858a5bf41299c043ccb5c
Instruction Fuzzy Hash: ADD05B763082117BD220955BAC44EAB6BDCCBC5771F11063EB558C31C1D6709C05C675

Function 00423630 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235DC: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 004235F1

ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0), ref: 0042364B

Part of subcall function 0042360C: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423628

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 8b0347f1b7f4c55d40b2d9a472991007c1ef1f775304476b0d2505f8c71f45ba
Instruction ID: 2c715c8115b6f45f2d9d75246f497caff8128bf2f9d99af5bd6ea08dbf484e7e
Opcode Fuzzy Hash: 8b0347f1b7f4c55d40b2d9a472991007c1ef1f775304476b0d2505f8c71f45ba
Instruction Fuzzy Hash: 5DD05E527415703182303BB7384698B4AEC4DC22AA348043BB548CB303E91DCA06106C

Function 004242A8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242C0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8e610f0dbba742b9926cd1bbdf10edc41fbf0fc82e2001be2856966de34d63d1
Instruction ID: 7620cff688a1dfde443edc2602f62e7a61d70f80693998c10b6ffb84950cf900
Opcode Fuzzy Hash: 8e610f0dbba742b9926cd1bbdf10edc41fbf0fc82e2001be2856966de34d63d1
Instruction Fuzzy Hash: F3D05BE270012017C701BAFD54C4ACA578C4F4925671541A7F904EB257C678DD408398

Function 0042CC8C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00451099,00000000,004510B2,?,-00000001,00000000), ref: 0042CC97

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8bde88b85f19514fa88d53882caf459a76a3b0a72daef0ca80b8eb8bf09a20d6
Instruction ID: f2bc37e410094d2d4b46bcd30065329ded81e435d317bddd9f15e79211b53fca
Opcode Fuzzy Hash: 8bde88b85f19514fa88d53882caf459a76a3b0a72daef0ca80b8eb8bf09a20d6
Instruction Fuzzy Hash: A1D012E036121049DA1869BE28CD35F03884B95335BA41A27BA6DE22E2D23D9952241C

Function 0042CC44 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450513,00000000), ref: 0042CC4F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 64b9ee0097f0801d6c5b724d659a890bd9e28945dc50801d3ed9265aa32bb838
Instruction ID: c2da3be9fc304088491ed52f96680ef007b2f0b2c8a569d1f3626438bd4e8fe4
Opcode Fuzzy Hash: 64b9ee0097f0801d6c5b724d659a890bd9e28945dc50801d3ed9265aa32bb838
Instruction Fuzzy Hash: 55C08CE03112100A9A14B5FE2DC960F0288498537A3A40E3BF42CF33E2D23D9822312C

Function 0046148C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00462104,00000000,00000000,00000000,0000000C,00000000), ref: 004614A4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 00406E58 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A8A8,0040CE54,?,00000000,?), ref: 00406E75

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 370a5b79166296d1c9eb2b781ecd89717d446db6d788d43bd9cd347de1c2462d
Instruction ID: 1716efc7a7a5fc259e55466b53f0f4780718e82ca7bae079f5c863eff473355b
Opcode Fuzzy Hash: 370a5b79166296d1c9eb2b781ecd89717d446db6d788d43bd9cd347de1c2462d
Instruction Fuzzy Hash: 89C048B138030032F52035B62C87F2A05489704B19E60943AB740FE1C2C8E9AC14025C

Function 0041F380 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F394

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Function 00406EE8 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 171f7d57e3797a719ea2f67ba25676303d1b6f3b615a850ee4ceb7b29b00a932
Instruction ID: 9a626260fa2a093a8f7ea53304216f40055a8148851859ab7cb054d00256669e
Opcode Fuzzy Hash: 171f7d57e3797a719ea2f67ba25676303d1b6f3b615a850ee4ceb7b29b00a932
Instruction Fuzzy Hash: FAB012F139130A06CA0079FE4CC1A1A01CC46093053405A3E3106F31C3D87CC8140518

Function 00407240 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0048D04A,00000000,0048D1E7,?,?,00000005,00000000,0048D21B,?,?,00000000), ref: 0040724B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 3293b503d2b4bba4523f910328dc84df787013104046f63be089ad99c5d39bd1
Instruction ID: cd60317c871f226fadd0360a9cb1dc89089301687d78bdcaa738a6012b6dfbea
Opcode Fuzzy Hash: 3293b503d2b4bba4523f910328dc84df787013104046f63be089ad99c5d39bd1
Instruction Fuzzy Hash: 92B012F039020A0BCE1079FE4CC1A1601CC4A0C3153401B3A3106F71C3DABCC4040518

Function 0044F988 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

Part of subcall function 0044F710: GetLastError.KERNEL32(0044F52C,0044F7D2,?,00000000,?,0048D07E,00000001,00000000,00000002,00000000,0048D1E7,?,?,00000005,00000000,0048D21B), ref: 0044F713

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 1bf6835b3afa51b74cb730a9de17c91ad4b569e696476521ad68ea22dcb612be
Instruction ID: b2b96b09ef525cd457ca41c8cb055b05572dc6324dc2474920b98847753819a6
Opcode Fuzzy Hash: 1bf6835b3afa51b74cb730a9de17c91ad4b569e696476521ad68ea22dcb612be
Instruction Fuzzy Hash: 1FC04CA130011057AB00AAAA95C1A0663D85A083193014476B504CB346D66CDC184A18

Function 0042E213 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E231), ref: 0042E224

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 91d9d93420304f319e9933868cd9d852c6e8dedcaa327a019e74e8a4a384f10b
Instruction ID: c6a6be4e9996dc10a82074a0352963dd07900fb0b9602375012b66d7c7e97915
Opcode Fuzzy Hash: 91d9d93420304f319e9933868cd9d852c6e8dedcaa327a019e74e8a4a384f10b
Instruction Fuzzy Hash: DEB09B7670C6105DFB0996D5B45141D63D8D7C87103E144B7F400D6581D53C54014D3C

Function 004744E4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,004785CE), ref: 004744FA

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c6d4b8a06097108d9bbe66837e1395f89f984ce991123e20e2faa630d847a78a
Instruction ID: 9f993f14f9992c846b4b0f1ee5bd501a06a9ef7a848d70bc24894987b5135329
Opcode Fuzzy Hash: c6d4b8a06097108d9bbe66837e1395f89f984ce991123e20e2faa630d847a78a
Instruction Fuzzy Hash: ADC002B1AD12029FDB44EF79AD8CB5236E4BB68385F0449BBA214C6270E7788840CB4C

Function 00478800 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00478808

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4eacb8bd649790af09cfabe7403e0dc53881079b8e15a90f2830a3b2276f51d6
Instruction ID: 5ee7a05a4b3ceff8fbfc9d56165db5a8523d8476dc0839b67a7f0c1d1a019cea
Opcode Fuzzy Hash: 4eacb8bd649790af09cfabe7403e0dc53881079b8e15a90f2830a3b2276f51d6
Instruction Fuzzy Hash: 3EA002343C431430F47462510D03F4410401744F05FE1419573053C1C304E82420211D

Function 004165D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A15CF0.USER32(?), ref: 004165D7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6972a2480f27a7129ca4b04d3909bf37eac93d34f4407162536fdf2d72391db
Instruction ID: 9856bc70106c22e97ab1ec520cce0ddbb631265c8c3a23e1343473c9e47e0204
Opcode Fuzzy Hash: f6972a2480f27a7129ca4b04d3909bf37eac93d34f4407162536fdf2d72391db
Instruction Fuzzy Hash: 19A002755015009ADE04B7A5C849F662298BB44604FC919F971449B092C53C99448A58

Function 0045AB44 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045ABD4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 289dd0e19bdd8511bf0c61ecbf7da344159e4c2bc77963dad5564a886598a76d
Instruction ID: dd6cdc6ece25f1c21b857f6fd2b6abc26455cb85e706bf00de0f0a136f71bad4
Opcode Fuzzy Hash: 289dd0e19bdd8511bf0c61ecbf7da344159e4c2bc77963dad5564a886598a76d
Instruction Fuzzy Hash: 331187716002049BDB00EF15C981B5B3795EF8435AF04856AFD589F38BDB38EC18CBAA

Function 0041F3A8 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED88,?,00423873,00423BF0,0041ED88), ref: 0041F3C6

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 526a26da29d11af119f9d7ba56fcbd399bfaf6da53e4e9bf9272eda41a53d1cb
Instruction ID: f0f8e1da57a881b7641cd442aca00d26376d6a5e22af04d95045de3f42a27b19
Opcode Fuzzy Hash: 526a26da29d11af119f9d7ba56fcbd399bfaf6da53e4e9bf9272eda41a53d1cb
Instruction Fuzzy Hash: 3F115E742403059BC710EF1AC880B86F7E4EF98350F10C63AE959DB395E374E84A8BA9

Function 00451390 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004513F9), ref: 004513DB

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 2439ab535cd57055e9d52c58c794dcca2abbf0679f036982c1bd0bb28d2da9aa
Instruction ID: b06bc9b339c214ba4a94f54531d437d24be5e552a7dfd6b2cca1f75ae5159756
Opcode Fuzzy Hash: 2439ab535cd57055e9d52c58c794dcca2abbf0679f036982c1bd0bb28d2da9aa
Instruction Fuzzy Hash: 18017035A042046F8B00DFA99C108EEFBECDB493257208277FC58C3752EB345D05D6A4

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c3bad58e3a349f8d38943356346858b5553dccce22fca691034adf89bf18d248
Instruction ID: f8cbd67f58c92ddeb19a2584d8a2306648578cd87fb0279a361d6712a58d42d8
Opcode Fuzzy Hash: c3bad58e3a349f8d38943356346858b5553dccce22fca691034adf89bf18d248
Instruction Fuzzy Hash: 5B01FC766052148FC310AE29DCC0E1B77A8D794378F15453EDA85A73A1D37A6C0587D8

Function 0045AAEC Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045ABCA), ref: 0045AB03

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ba7dfedab2d753885414fddf25a2d649a5d641a576eeeb2b297990c1ce9bafdd
Instruction ID: e16b9322e8e931031d5e1aab247efaeffe82adfb84955da7b3c9217db4cbec11
Opcode Fuzzy Hash: ba7dfedab2d753885414fddf25a2d649a5d641a576eeeb2b297990c1ce9bafdd
Instruction Fuzzy Hash: 10D0C9B07503045BDB90EE794C81B0237D8BB08600F1044766904DB286E674E8008A28

Non-executed Functions

Function 0044A890 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044A83C: GetVersionExA.KERNEL32(00000094), ref: 0044A859

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EBAD,0048DCE5), ref: 0044A8B7
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044A8CF
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044A8E1
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044A8F3
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044A905
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A917
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A929
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044A93B
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044A94D
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044A95F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044A971
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044A983
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044A995
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044A9A7
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044A9B9
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044A9CB
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044A9DD
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044A9EF
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044AA01
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044AA13
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044AA25
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044AA37
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044AA49
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044AA5B
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044AA6D
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044AA7F
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044AA91
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044AAA3
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044AAB5
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044AAC7
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044AAD9
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044AAEB
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044AAFD
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044AB0F
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044AB21
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044AB33
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044AB45
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044AB57
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044AB69
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044AB7B
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044AB8D
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044AB9F
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044ABB1
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044ABC3
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044ABD5
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044ABE7
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044ABF9
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044AC0B

Strings

GetThemePartSize, xrefs: 0044A933
DrawThemeEdge, xrefs: 0044A98D
GetThemeFilename, xrefs: 0044AABF
GetThemeIntList, xrefs: 0044AA89
GetThemeInt, xrefs: 0044AA1D
GetThemeColor, xrefs: 0044A9D5
GetThemeSysColorBrush, xrefs: 0044AAE3
IsThemeActive, xrefs: 0044AB4F
GetThemeSysColor, xrefs: 0044AAD1
GetThemeEnumValue, xrefs: 0044AA2F
HitTestThemeBackground, xrefs: 0044A97B
GetThemeSysBool, xrefs: 0044AAF5
GetThemeMetric, xrefs: 0044A9E7
GetThemeMargins, xrefs: 0044AA77
GetThemeRect, xrefs: 0044AA65
CloseThemeData, xrefs: 0044A8D9
GetThemeSysSize, xrefs: 0044AB07
IsThemePartDefined, xrefs: 0044A9B1
IsAppThemed, xrefs: 0044AB61
GetThemeTextMetrics, xrefs: 0044A957
EnableThemeDialogTexture, xrefs: 0044AB85
SetThemeAppProperties, xrefs: 0044ABBB
DrawThemeBackground, xrefs: 0044A8EB
DrawThemeParentBackground, xrefs: 0044ABF1
SetWindowTheme, xrefs: 0044AAAD
GetThemeFont, xrefs: 0044AA53
GetThemeDocumentationProperty, xrefs: 0044ABDF
GetThemePropertyOrigin, xrefs: 0044AA9B
GetThemeSysFont, xrefs: 0044AB19
GetThemeTextExtent, xrefs: 0044A945
uxtheme.dll, xrefs: 0044A8B2
GetThemeSysString, xrefs: 0044AB2B
GetThemePosition, xrefs: 0044AA41
GetCurrentThemeName, xrefs: 0044ABCD
IsThemeBackgroundPartiallyTransparent, xrefs: 0044A9C3
GetThemeBool, xrefs: 0044AA0B
EnableTheming, xrefs: 0044AC03
DrawThemeText, xrefs: 0044A8FD
GetThemeBackgroundRegion, xrefs: 0044A969
GetThemeBackgroundContentRect, xrefs: 0044A90F, 0044A921
GetWindowTheme, xrefs: 0044AB73
GetThemeSysInt, xrefs: 0044AB3D
DrawThemeIcon, xrefs: 0044A99F
GetThemeAppProperties, xrefs: 0044ABA9
OpenThemeData, xrefs: 0044A8C7
GetThemeString, xrefs: 0044A9F9
IsThemeDialogTextureEnabled, xrefs: 0044AB97

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: f99e072f65ce5fb64651f10ccd49704bf0ed7393a5e852a3ecbbe19cd1b694e8
Instruction ID: bcb542b80e1b37a6bab6985b5053b71c9442861add9d7bba732c52a67906b6e5
Opcode Fuzzy Hash: f99e072f65ce5fb64651f10ccd49704bf0ed7393a5e852a3ecbbe19cd1b694e8
Instruction Fuzzy Hash: 429152F0A80654AFEF00EFB5D886E2A37A4EB067543100A7BB444DF266D67C9915CF1E

Function 0045604C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

GetTickCount.KERNEL32 ref: 004560B3
QueryPerformanceCounter.KERNEL32(00000000,00000000,00456346,?,?,00000000,00000000,?,00456A42,?,00000000,00000000), ref: 004560BC
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 004560C6
GetCurrentProcessId.KERNEL32(?,00000000,00000000,00456346,?,?,00000000,00000000,?,00456A42,?,00000000,00000000), ref: 004560CF
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00456145
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00456153
CreateFileA.KERNEL32(00000000,C0000000,00000000,0048EA7C,00000003,00000000,00000000,00000000,00456302), ref: 0045619B
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004562F1,?,00000000,C0000000,00000000,0048EA7C,00000003,00000000,00000000,00000000,00456302), ref: 004561D4

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D793

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045627D
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004562B3
CloseHandle.KERNEL32(000000FF,004562F8,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004562EB

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

D, xrefs: 004561F6
h, xrefs: 00456230
64-bit helper EXE wasn't extracted, xrefs: 004560A7
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0045611B
Cannot utilize 64-bit features on this version of Windows, xrefs: 00456094
CreateNamedPipe, xrefs: 00456163
Starting 64-bit helper process., xrefs: 00456081
Helper process PID: %u, xrefs: 004562D0
CreateFile, xrefs: 004561A9
SetNamedPipeHandleState, xrefs: 004561DD
helper %d 0x%x, xrefs: 0045625C
CreateProcess, xrefs: 00456286

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CreateHandleTime$CloseErrorFileLastNamedPipeProcessSystem$CountCounterCurrentDirectoryLocalPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$h$helper %d 0x%x
API String ID: 2735046408-3739555822
Opcode ID: fee1e726ceefe762978d2800928dbe07b4b202d14e21e618a9dd7fe49ade5380
Instruction ID: 1a9b257d91342fef263a14e22493d9589d0be6827de17724594f8b07de3194b4
Opcode Fuzzy Hash: fee1e726ceefe762978d2800928dbe07b4b202d14e21e618a9dd7fe49ade5380
Instruction Fuzzy Hash: C7715270A003449EDB20EF69CC41B9EBBB8EB05705F5185AAF908FB283D7785944CF69

Function 00459ACC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00459AE6
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 00459B06
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoA), ref: 00459B13
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoA), ref: 00459B20
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 00459B2E
AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00459D02), ref: 00459BCD
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00459D02), ref: 00459BD6
LocalFree.KERNEL32(?,00459CB0), ref: 00459CA3

Strings

SetNamedSecurityInfoA, xrefs: 00459B1A
W, xrefs: 00459BE4
advapi32.dll, xrefs: 00459B01
GetNamedSecurityInfoA, xrefs: 00459B0D
SetEntriesInAclW, xrefs: 00459B28

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$AllocateErrorFreeHandleInitializeLastLocalModuleVersion
String ID: GetNamedSecurityInfoA$SetEntriesInAclW$SetNamedSecurityInfoA$W$advapi32.dll
API String ID: 4088882585-3389539026
Opcode ID: 87a3d02414f038d654d2b35e993e3881a61607440da0ce3e27639b1c8300002f
Instruction ID: 364729c02adb35093b02fa5f0a6a8e5783dcaa5ac0063102fef999f9ab806f4b
Opcode Fuzzy Hash: 87a3d02414f038d654d2b35e993e3881a61607440da0ce3e27639b1c8300002f
Instruction Fuzzy Hash: B65162B4900608EFDB10DF99D845BAEB7F8EB48311F20806AE914F7281D7799E45CF68

Function 00418368 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418377
GetWindowPlacement.USER32(?,0000002C), ref: 00418394
GetWindowRect.USER32(?), ref: 004183B0
GetWindowLongA.USER32(?,000000F0), ref: 004183BE
GetWindowLongA.USER32(?,000000F8), ref: 004183D3
ScreenToClient.USER32(00000000), ref: 004183DC
ScreenToClient.USER32(00000000,?), ref: 004183E7

Strings

,, xrefs: 00418380

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 13baaa4874947ce1ccf78396e4ff402cebf3e2c04b3193ada7c82926a18736d7
Instruction ID: c7ab006c70e0836cdd4d97d20ba0e9016ead7d8e1fb7c641c199fdb04dc1b3f3
Opcode Fuzzy Hash: 13baaa4874947ce1ccf78396e4ff402cebf3e2c04b3193ada7c82926a18736d7
Instruction Fuzzy Hash: 201128B1505201AFDB00DF6DC885F9B77E8AF49314F18066EBD58DB286D738D900CBAA

Function 004536F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004536FF
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453705
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00453721
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453748
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045374D

Part of subcall function 004536D0: MessageBoxA.USER32(00000000,00000000,00000000,00000030), ref: 004536EA

ExitWindowsEx.USER32(00000002,00000000), ref: 00453761

Strings

SeShutdownPrivilege, xrefs: 0045371A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupMessageOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 93195177-3733053543
Opcode ID: 06ab4e3cc3b8159c8bebd93803a4a79dc9e112bdaa4a867c66cf1b8ba3132b71
Instruction ID: 39c0802515a0aa54a97e16b41bb31fbb8fdb4c00033f9e3ec220a47d417fe51d
Opcode Fuzzy Hash: 06ab4e3cc3b8159c8bebd93803a4a79dc9e112bdaa4a867c66cf1b8ba3132b71
Instruction Fuzzy Hash: 4DF036E0A44701B6E920BE664D07B1B21885B447DBF50482FBD10A91C3DA7C960C877F

Function 0048D260 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000,0048D57C,?,?,00000000,0048F628), ref: 0048D2B7
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0048D33A
FindNextFileA.KERNEL32(000000FF,?,00000000,0048D376,?,00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000), ref: 0048D352
FindClose.KERNEL32(000000FF,0048D37D,0048D376,?,00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000,0048D57C), ref: 0048D370

Strings

isRS-???.tmp, xrefs: 0048D2A1
isRS-, xrefs: 0048D2D7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: cd29a928075d91f9230797489068766e965ee85d0cacf3ab202db9ac19de14d0
Instruction ID: 987f9ee40d090763bc429e45d3a79f7a4e713dcfad33bc3c22363f63fe7cd748
Opcode Fuzzy Hash: cd29a928075d91f9230797489068766e965ee85d0cacf3ab202db9ac19de14d0
Instruction Fuzzy Hash: 98316371D0161CABDB14EF65CC41ADEB7BCDB45314F5088BAA908B32E1DB389E418F59

Function 00474BD0 Relevance: 9.2, APIs: 6, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000,?,00474FDA,00000000,00000000), ref: 00474C31
FindNextFileA.KERNEL32(000000FF,?,00000000,00474D41,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000), ref: 00474D1D
FindClose.KERNEL32(000000FF,00474D48,00474D41,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000), ref: 00474D3B
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000,?,00474FDA,00000000), ref: 00474D94

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$First$CloseNext
String ID:
API String ID: 2001080981-0
Opcode ID: 40419843ef75bf814e07230ebfb797cb5fd68fc187aab3ecece7db1951cd391b
Instruction ID: 5a1021eec60b4e305c38063ace53cfece464fd3c4d2eb6496546c17d1e73516e
Opcode Fuzzy Hash: 40419843ef75bf814e07230ebfb797cb5fd68fc187aab3ecece7db1951cd391b
Instruction Fuzzy Hash: 3971517090061DAFCF21DF95CC41AEFBBB8FB89318F5080AAA408A7291D7399A45CF55

Function 00454CF8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00454D75
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00454D9C
SetForegroundWindow.USER32(?), ref: 00454DAD
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00455078,?,00000000,004550B4), ref: 00455063

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00454EED

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: fe3ab4845324dd3c577319e701475bca4be67e6b8b82e529866ec642797e7e93
Instruction ID: 080d525f1e7a547db07bd28221694b1843d2a8f6175d9f665494781261915881
Opcode Fuzzy Hash: fe3ab4845324dd3c577319e701475bca4be67e6b8b82e529866ec642797e7e93
Instruction Fuzzy Hash: C991D234604604EFD715CF59C951F6ABBF5E789704F2184BAF8049B7A2C778AE48CB18

Function 00417CB4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417CF3
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D11
GetWindowPlacement.USER32(?,0000002C), ref: 00417D47
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D6E

Strings

,, xrefs: 00417D35

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: b3b6ad1c7124897fa94bf6bfbd5c3f65cf90962955aabae369f45b9c3fff31a0
Instruction ID: 3d1b63ce9ace656f9b2ae4b0f4224411f6c0839012db17d2dc6e7df681baa273
Opcode Fuzzy Hash: b3b6ad1c7124897fa94bf6bfbd5c3f65cf90962955aabae369f45b9c3fff31a0
Instruction Fuzzy Hash: 67213C71A04208ABCF00DF69D8C1BDA77A8AF48354F15456AFD18EF346D778E944CBA8

Function 0045E738 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045E8F5), ref: 0045E769
FindFirstFileA.KERNEL32(00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E7F8
FindNextFileA.KERNEL32(000000FF,?,00000000,0045E8AA,?,00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E88A
FindClose.KERNEL32(000000FF,0045E8B1,0045E8AA,?,00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E8A4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: d395a21e3a35b1a59562308421452748b9eaa9dfd68947510c62e1cccd718745
Instruction ID: d8fb66e737258d5a68f6c75f5e0c2ad923488bab397bf3f4a72636b8ae97d7e5
Opcode Fuzzy Hash: d395a21e3a35b1a59562308421452748b9eaa9dfd68947510c62e1cccd718745
Instruction Fuzzy Hash: 41414774A006549FDB15EF66CC45A9DB7A8EB88306F4044BAF804A7342D63C9F49CE58

Function 0045EBB4 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045ED9B), ref: 0045EC29
FindFirstFileA.KERNEL32(00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045EC6F
FindNextFileA.KERNEL32(000000FF,?,00000000,0045ED48,?,00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045ED24
FindClose.KERNEL32(000000FF,0045ED4F,0045ED48,?,00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045ED42

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 3c0365f0ddb022bc7b3ce8b90b7bc0320d5d0972e99aa84248eb429d8baf34cd
Instruction ID: b52a73cc4bab052d864f830ebb887ebf8f68494115c020dc4efa98c4edff0ce4
Opcode Fuzzy Hash: 3c0365f0ddb022bc7b3ce8b90b7bc0320d5d0972e99aa84248eb429d8baf34cd
Instruction Fuzzy Hash: 47417435A00619DBCB14EF66CC859DEB7B9EB88305F4045AAFC04E7342D6389F48CE58

Function 0047A09C Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0047A0DA
GetWindowLongA.USER32(00000000,000000F0), ref: 0047A0F8
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0048FF3C,00479926,0047995A,00000000,0047997A,?,?,00000001,0048FF3C), ref: 0047A11A
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0048FF3C,00479926,0047995A,00000000,0047997A,?,?,00000001,0048FF3C), ref: 0047A12E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 1f4e7df7c5eb28a6925ca53f76b16e7ba9a545452942ba2dc03be8fd84032419
Instruction ID: 4e17a3d1efbb7516df40a2b8f8c6ce8488852fab1a4da3e2a6e5c0d591289125
Opcode Fuzzy Hash: 1f4e7df7c5eb28a6925ca53f76b16e7ba9a545452942ba2dc03be8fd84032419
Instruction Fuzzy Hash: 750171706082406AE700EB79DC85B9F23D49B45348F58887FB644DB2E3CB6D88569B1D

Function 0045D1B4 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045D288), ref: 0045D20C
FindNextFileA.KERNEL32(000000FF,?,00000000,0045D268,?,00000000,?,00000000,0045D288), ref: 0045D248
FindClose.KERNEL32(000000FF,0045D26F,0045D268,?,00000000,?,00000000,0045D288), ref: 0045D262

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 479a8a075d110ee97dbceed738792f7b83ccd7b8fb2ccb73eaf32badc45ff88e
Instruction ID: 1c57fcfc654a44449ebf75676d758ca9e7f6f0065839a18182e6b42ba08a7e11
Opcode Fuzzy Hash: 479a8a075d110ee97dbceed738792f7b83ccd7b8fb2ccb73eaf32badc45ff88e
Instruction Fuzzy Hash: FA21C6719047085EDB21EB658C41ADEB7ACDF49305F5084F7FC08E36A2E638DE48CA59

Function 004241C0 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241C8
SetActiveWindow.USER32(?,?,?,004669FF), ref: 004241D5

Part of subcall function 00423630: ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0), ref: 0042364B

Part of subcall function 00423AF8: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021425AC,004241EE,?,?,?,004669FF), ref: 00423B33

SetFocus.USER32(00000000,?,?,?,004669FF), ref: 00424202

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 3d96d030b52f7cbfc51dd5dfa002c3b70a1ae896cb9c7bf81eab355642eebeb8
Instruction ID: c55311e4565d0aa9d211a7a1e417d737ec1cb2c42a75af356ef873c1c87e6d71
Opcode Fuzzy Hash: 3d96d030b52f7cbfc51dd5dfa002c3b70a1ae896cb9c7bf81eab355642eebeb8
Instruction Fuzzy Hash: ECF0307170012097CB00FFEAD8C5A9622A8AB48344B5500BBBD09EF357C67CDC058764

Function 00417CB2 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417CF3
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D11
GetWindowPlacement.USER32(?,0000002C), ref: 00417D47
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D6E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: db63afb58992f9a4e1eed7bc39269436c1dd18b9b4b711010f1ae081b6a9b246
Instruction ID: 26ffe574b517fd3a71740a1ead461090191999ca45b01ba26525c739ddbbda02
Opcode Fuzzy Hash: db63afb58992f9a4e1eed7bc39269436c1dd18b9b4b711010f1ae081b6a9b246
Instruction Fuzzy Hash: 71012C31304108ABDB10EF59D8C1EEA77A8AF55364F154566FD08DF242D639EC9087A8

Function 0041757C Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175A7
GetCapture.USER32 ref: 004175B0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 89e181b32d9698778263d91ab547a7ca47992cde8936fdbe2c16ecfed2940d01
Instruction ID: 841711f9b079bfcaeba9936b10fbdc5aeed3cfad274353dbc2dc87114c0a81dd
Opcode Fuzzy Hash: 89e181b32d9698778263d91ab547a7ca47992cde8936fdbe2c16ecfed2940d01
Instruction Fuzzy Hash: FEF0A47270460167DB20972EC884AABA2FBDF84358B14443FE419CBB63EE78DCC58758

Function 00424178 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042417F

Part of subcall function 00423A68: EnumWindows.USER32(00423A00), ref: 00423A8C
Part of subcall function 00423A68: GetWindow.USER32(?,00000003), ref: 00423AA1
Part of subcall function 00423A68: GetWindowLongA.USER32(?,000000EC), ref: 00423AB0
Part of subcall function 00423A68: SetWindowPos.USER32(00000000,@AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042418F,?,?,00423D57), ref: 00423AE6

SetActiveWindow.USER32(?,?,?,00423D57,00000000,00424140), ref: 00424193

Part of subcall function 00423630: ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF0), ref: 0042364B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: ba07b28285858efed21ec7390c371de1fa8859b0b9bb1d42de52eff0d3963272
Instruction ID: af4e11ea9c9c2638f6c2bb87157055eeaefaeacf1b290160b3299b931af0d7d3
Opcode Fuzzy Hash: ba07b28285858efed21ec7390c371de1fa8859b0b9bb1d42de52eff0d3963272
Instruction Fuzzy Hash: 73E01A6170111087DF00AF69DCC8B9672E8BB48309F59017AFC49CF34BD63CC8548B24

Function 004125BC Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127B9), ref: 004127A7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: c95f97ac6ec20ed30f072c9060996fdf6f5e1fbe0af4e1ee290f8be6e927ae73
Instruction ID: f519ef056182ed18d64688683d3eee4e8b30b10f20d7e8499a38f0bf9604ea9e
Opcode Fuzzy Hash: c95f97ac6ec20ed30f072c9060996fdf6f5e1fbe0af4e1ee290f8be6e927ae73
Instruction Fuzzy Hash: BD51F831608245CFC710DF69D681A9BF3E1FF98314B20867BD414C77A5DAB8DDA29748

Function 0042EBCC Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042EBE8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 65be6a59ec8c6728d74cf36d16aa0cee7646e113b9cc458147696be4686261ff
Instruction ID: aec76960dbde7c44a52137df3fcf7df374967ee5e6a279fb202975c29c8d1344
Opcode Fuzzy Hash: 65be6a59ec8c6728d74cf36d16aa0cee7646e113b9cc458147696be4686261ff
Instruction Fuzzy Hash: 2FD05E7120010CABCB00CEA9E880C6F33AD9B88700BA08915F519CB201C234FC5187A4

Function 00487C08 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,004880FD,?,?,?,?,00000000,00000000,00000000), ref: 00487C48
FindWindowA.USER32(00000000,00000000), ref: 00487C79

Strings

CREATEMUTEX, xrefs: 00488029
POSTBROADCASTMESSAGE, xrefs: 00487E63
FINDWINDOWBYWINDOWNAME, xrefs: 00487C91
SENDMESSAGE, xrefs: 00487CCD
SLEEP, xrefs: 00487C32
SENDBROADCASTMESSAGE, xrefs: 00487E15
FINDWINDOWBYCLASSNAME, xrefs: 00487C55
FREEDLL, xrefs: 00487FF4
POSTMESSAGE, xrefs: 00487D23
REGISTERWINDOWMESSAGE, xrefs: 00487DDB
SENDNOTIFYMESSAGE, xrefs: 00487D7F
LOADDLL, xrefs: 00487F0B
OEMTOCHARBUFF, xrefs: 0048805B
CALLDLLPROC, xrefs: 00487F6D
CHARTOOEMBUFF, xrefs: 0048809E
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00487EB7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 6a5dd548a4d10776b66ca2ece86e5e7557a0fe8c4065f843ec33ee908e9f379a
Instruction ID: 306b2178578eb4663268aad54c633cc6c061a1dc434e278cb6bea8e6286ebf43
Opcode Fuzzy Hash: 6a5dd548a4d10776b66ca2ece86e5e7557a0fe8c4065f843ec33ee908e9f379a
Instruction Fuzzy Hash: A8C163A0B0421017DB14BA3E8C4651F559AAF89708B61CD3FB446EB78BCE7DDC0A835E

Function 00455930 Relevance: 45.7, APIs: 11, Strings: 15, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

CreateMutexA.KERNEL32(0048EA70,00000001,00000000,00000000,00455C65,?,?,?,00000001,?,00455E7F,00000000,00455E95,?,00000000,0048F628), ref: 0045597D
CreateFileMappingA.KERNEL32(000000FF,0048EA70,00000004,00000000,00002018,00000000), ref: 004559B5
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,00455C3B,?,0048EA70,00000001,00000000,00000000,00455C65,?,?,?), ref: 004559DC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455AE9
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,00455C3B,?,0048EA70,00000001,00000000,00000000,00455C65), ref: 00455A41

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

CloseHandle.KERNEL32(00455E7F,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455B00
WaitForSingleObject.KERNEL32(00000000,000000FF,00455E7F,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455B39
GetLastError.KERNEL32(00000000,000000FF,00455E7F,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455B4B
UnmapViewOfFile.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455C1D
CloseHandle.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455C2C
CloseHandle.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00455C35

Strings

Spawning _RegDLL.tmp, xrefs: 0045595C
REGDLL mutex wait failed (%d, %d), xrefs: 00455B5F
CreateFileMapping, xrefs: 004559C3
OleInitialize, xrefs: 00455B85
_RegDLL.tmp %u %u, xrefs: 00455A91
MapViewOfFile, xrefs: 004559EA
CreateMutex, xrefs: 0045598B
CreateProcess, xrefs: 00455AF2
ReleaseMutex, xrefs: 00455A4A
D, xrefs: 00455AAA
REGDLL returned unknown result code %d, xrefs: 00455BFC
_isetup\_RegDLL.tmp, xrefs: 00455A67
REGDLL failed with exit code 0x%x, xrefs: 00455B29
LoadLibrary, xrefs: 00455B97
GetProcAddress, xrefs: 00455BA9

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$LocalMappingObjectProcessReleaseSingleTimeUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp
API String ID: 2549506919-351310198
Opcode ID: 32bf783bec985a1d304a4025b03190207314cd54c1d582564c6d03f4c2c7a405
Instruction ID: 710ac18db1f64c4ae3f8ffc26dedb219b859fe83e417be7d18897d92390f105f
Opcode Fuzzy Hash: 32bf783bec985a1d304a4025b03190207314cd54c1d582564c6d03f4c2c7a405
Instruction Fuzzy Hash: 7F91A470A007089BDB10EBA9C855BAEB7B4FF08305F50856BE804EB393D7789948CF59

Function 0041F0FC Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FD4,00000000,?,?,?,00000001), ref: 0041F10A
SetErrorMode.KERNEL32(00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F126
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F132
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F140
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F170
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F199
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1AE
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C3
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1D8
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1ED
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F202
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F217
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F22C
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F241
FreeLibrary.KERNEL32(00000001,?,00418FD4,00000000,?,?,?,00000001), ref: 0041F253

Strings

Ctl3dUnAutoSubclass, xrefs: 0041F20C
Ctl3DColorChange, xrefs: 0041F221
BtnWndProc3d, xrefs: 0041F236
Ctl3dCtlColorEx, xrefs: 0041F1E2
Ctl3dAutoSubclass, xrefs: 0041F1F7
Ctl3dRegister, xrefs: 0041F165
CTL3D32.DLL, xrefs: 0041F12D
Ctl3dSubclassCtl, xrefs: 0041F1A3
Ctl3dUnregister, xrefs: 0041F18E
Ctl3dDlgFramePaint, xrefs: 0041F1CD
Ctl3dSubclassDlgEx, xrefs: 0041F1B8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 1757f5c62f9d192b9808821a44dbdc6ed3aaade5fd5476474320dc046a94001b
Instruction ID: d9f07ed5420252f80b44eb015e678d49fa5d4c847a3f624be6496ad68d1101f5
Opcode Fuzzy Hash: 1757f5c62f9d192b9808821a44dbdc6ed3aaade5fd5476474320dc046a94001b
Instruction Fuzzy Hash: 9B31F0B5600644AADF01FBE6AC469AA3694B70A3187100D3FB548DB5B2F77D44568B1C

Function 0041C9F0 Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,?,0041A928,?), ref: 0041CA24
73A14C40.GDI32(?,00000000,?,0041A928,?), ref: 0041CA30
73A16180.GDI32(0041A928,?,00000001,00000001,00000000,00000000,0041CC46,?,?,00000000,?,0041A928,?), ref: 0041CA54
73A14C00.GDI32(?,0041A928,?,00000000,0041CC46,?,?,00000000,?,0041A928,?), ref: 0041CA64
SelectObject.GDI32(0041CE20,00000000), ref: 0041CA7F
FillRect.USER32(0041CE20,?,?), ref: 0041CABA
SetTextColor.GDI32(0041CE20,00000000), ref: 0041CACF
SetBkColor.GDI32(0041CE20,00000000), ref: 0041CAE6
PatBlt.GDI32(0041CE20,00000000,00000000,0041A928,?,00FF0062), ref: 0041CAFC
73A14C40.GDI32(?,00000000,0041CBFF,?,0041CE20,00000000,?,0041A928,?,00000000,0041CC46,?,?,00000000,?,0041A928), ref: 0041CB0F
SelectObject.GDI32(00000000,00000000), ref: 0041CB40
73A08830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF,?,0041CE20,00000000,?,0041A928), ref: 0041CB58
73A022A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF,?,0041CE20,00000000,?), ref: 0041CB61
73A08830.GDI32(0041CE20,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF), ref: 0041CB70
73A022A0.GDI32(0041CE20,0041CE20,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF), ref: 0041CB79
SetTextColor.GDI32(00000000,00000000), ref: 0041CB92
SetBkColor.GDI32(00000000,00000000), ref: 0041CBA9
73A14D40.GDI32(0041CE20,00000000,00000000,0041A928,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CBEE,?,?,00000000), ref: 0041CBC5
SelectObject.GDI32(00000000,?), ref: 0041CBD2
DeleteDC.GDI32(00000000), ref: 0041CBE8

Part of subcall function 0041A03C: GetSysColor.USER32(?), ref: 0041A046

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Color$ObjectSelect$A022A08830Text$A16180A570DeleteFillRect
String ID:
API String ID: 2377543522-0
Opcode ID: 23ade55fb982df19fc37e4b905b5a377efb732c78859696189b05aeeb6191a28
Instruction ID: 0bc61a8ca30a981f0d59abc380613d2dd03e2c4a36898044fbf93abba256d669
Opcode Fuzzy Hash: 23ade55fb982df19fc37e4b905b5a377efb732c78859696189b05aeeb6191a28
Instruction Fuzzy Hash: 1761F171A44608AFDF10EBE9DC86FDF77B8EF48704F10446AB504E7281D67CA9408B69

Function 0042DE84 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memorylibraryloaderCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEBE
GetVersion.KERNEL32(00000000,0042E068,?,0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEDB
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E068,?,0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF4
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DEFA
FreeSid.ADVAPI32(00000000,0042E06F,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E062

Strings

CheckTokenMembership, xrefs: 0042DEEA
advapi32.dll, xrefs: 0042DEEF

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: a4b1f5f14422e3ca3f73b14fefc8629afbc83c88b960c939f0125377b2d99dd9
Instruction ID: 2f6765ec5f866ea47d282a6c21009e24887e37524e6a4a0bc91113b57b1c491d
Opcode Fuzzy Hash: a4b1f5f14422e3ca3f73b14fefc8629afbc83c88b960c939f0125377b2d99dd9
Instruction Fuzzy Hash: F551E371B44625AEDB10EAF69C42BBF77ACDB09704F500477B900F7182D9BD9901872D

Function 0048D58C Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000,?,0048DC35,00000000,0048DC3F,?,00000000), ref: 0048D60F
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000,?,0048DC35,00000000), ref: 0048D622
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000), ref: 0048D632
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0048D653
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000), ref: 0048D663

Part of subcall function 0042D308: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D393,?,?,00000000,?,?,0048D054,00000000,0048D1E7,?,?,00000005), ref: 0042D33D

Strings

/REG, xrefs: 0048D5C1
Inno-Setup-RegSvr-Mutex, xrefs: 0048D619
.msg, xrefs: 0048D686
Setup, xrefs: 0048D5FB
/REGU, xrefs: 0048D5E5
.lst, xrefs: 0048D6A0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 8929ac914d004877ad271a214da8a4c2ac8e2f263edb9159b026f0f1687d462e
Instruction ID: 37b28bd7451e977fb54c92a4b3750ca7ea8e073d6d1103c4f4b388f3075d58e0
Opcode Fuzzy Hash: 8929ac914d004877ad271a214da8a4c2ac8e2f263edb9159b026f0f1687d462e
Instruction Fuzzy Hash: 0181C370E04244AFDB01FBA5C852BAFB7B5EB49304F51487BF800AB2D2D67C9805CB29

Function 0045784C Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 199COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00457AE6,?,?,?,?), ref: 00457998

Strings

.hlp, xrefs: 00457883
Failed to strip read-only attribute., xrefs: 0045797D
.chm, xrefs: 004578E8
Stripped read-only attribute., xrefs: 00457971
.fts, xrefs: 004578C0
.gid, xrefs: 0045789C
The file appears to be in use (%d). Will delete on restart., xrefs: 004579E1
Failed to delete the file; it may be in use (%d)., xrefs: 00457A87
.chw, xrefs: 00457901
Deleting file: %s, xrefs: 00457937

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-1593206319
Opcode ID: 7362de476520fe28f9058911859b1b4b3b0344321b2eda4d2154fd1eb630a5ab
Instruction ID: f7b77abe31879538ceee7930d0a09f17d958c6af1db67e2cd919c9b6c49bc4bb
Opcode Fuzzy Hash: 7362de476520fe28f9058911859b1b4b3b0344321b2eda4d2154fd1eb630a5ab
Instruction Fuzzy Hash: A161B270B082455BDB10EB69A8817AE7BA59B48309F50847BFC01EB383DB7C9E49C759

Function 0041B390 Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A14C40.GDI32(00000000,?,00000000,?), ref: 0041B3A7
73A14C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B3B1
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3C3
73A16180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3DA
73A0A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3E6
73A14C00.GDI32(00000000,0000000B,?,00000000,0041B43F,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B413
73A0A480.USER32(00000000,00000000,0041B446,00000000,0041B43F,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B439
SelectObject.GDI32(00000000,?), ref: 0041B454
SelectObject.GDI32(?,00000000), ref: 0041B463
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B48F
SelectObject.GDI32(00000000,00000000), ref: 0041B49D
SelectObject.GDI32(?,00000000), ref: 0041B4AB
DeleteDC.GDI32(00000000), ref: 0041B4B4
DeleteDC.GDI32(?), ref: 0041B4BD

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Object$Select$Delete$A16180A480A570Stretch
String ID:
API String ID: 3135053572-0
Opcode ID: bdfd24820ffa190ffa6e5ff65337936c9d04770c1e1342dda2bcf554a444566f
Instruction ID: e33297414afcf6542cc392d9efff39766b3fffd6ca5da56ef3a599dd686c2ce6
Opcode Fuzzy Hash: bdfd24820ffa190ffa6e5ff65337936c9d04770c1e1342dda2bcf554a444566f
Instruction Fuzzy Hash: 9141C171E40619AFDB10EBE9C845FEFB7B8EB08704F104466B614FB281D77869408BA8

Function 00452AA0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,?,00000000,?,00000000,00452D39,?,00457CAE,00000003,00000000,00000000,00452D70), ref: 00452BB9

Part of subcall function 0042E638: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,00000000,?,00000004,00000000,00452C83,?,00457CAE,00000000,00000000,?,00000000,?,00000000), ref: 00452C3D
RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,00000000,?,00000004,00000000,00452C83,?,00457CAE,00000000,00000000,?,00000000,?,00000000), ref: 00452C6C

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452B10
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452AD7
RegOpenKeyEx, xrefs: 00452B3C
, xrefs: 00452B2A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 3032b77bd693c941fb84b0cde282a338af4145831cd572e8a1a18070b6d836f0
Instruction ID: 11c75cf770e070d662cfd75468ba589839849d35c86e5109ae12d43e25aff3ec
Opcode Fuzzy Hash: 3032b77bd693c941fb84b0cde282a338af4145831cd572e8a1a18070b6d836f0
Instruction Fuzzy Hash: C0912475900208ABDB05DF95D942BDEB7BCEB09305F10446BF900F7292D7B9AE098B69

Function 004564C8 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004564FF
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045651B
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00456529
GetExitCodeProcess.KERNEL32(?), ref: 0045653A
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456581
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045659D

Strings

Helper process exited with failure code: 0x%x, xrefs: 00456567
Helper process exited, but failed to get exit code., xrefs: 00456573
Helper process exited., xrefs: 00456549
Helper isn't responding; killing it., xrefs: 0045650B
Stopping 64-bit helper process. (PID: %u), xrefs: 004564F1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 1c71e367c083ba3f25508a33a98788cb8d67c21057dec2a34fbd7e3299901d51
Instruction ID: 924403a9692a20c31a41506dc372cce7d05dc03ffe61d55cfc841da12e7d3803
Opcode Fuzzy Hash: 1c71e367c083ba3f25508a33a98788cb8d67c21057dec2a34fbd7e3299901d51
Instruction Fuzzy Hash: 9F21AF70644B00AAC720EB7DD44575BB6D49F08305F81C92EB89AC7297E67CE8488B2A

Function 00452754 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 0045287B
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 004529B7

Part of subcall function 0042E638: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

Strings

, xrefs: 004527DD
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004527C3
RegCreateKeyEx, xrefs: 004527EF
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452793

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 5fa9abd6514dbdc13b437a9a936fa25f85297bb33b74e7909c5b97379e50ea20
Instruction ID: e5b2b05114a45b6ea458d1843e2fc27f939523f4e2a6c83868d4647a0cfc885a
Opcode Fuzzy Hash: 5fa9abd6514dbdc13b437a9a936fa25f85297bb33b74e7909c5b97379e50ea20
Instruction Fuzzy Hash: 1F8110B5A00209AFDB01DFD5C941BEEB7B8EB49305F50452BF900F7282D778AE058B69

Function 0048C0BC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00451C2C: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D1B
Part of subcall function 00451C2C: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D2B

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0048C139
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,0048C28D), ref: 0048C15A
CreateWindowExA.USER32(00000000,STATIC,0048C29C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0048C181
SetWindowLongA.USER32(?,000000FC,0048BB10), ref: 0048C194
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000,STATIC,0048C29C), ref: 0048C1C4
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0048C238
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000), ref: 0048C244

Part of subcall function 00451F7C: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452063

73A15CF0.USER32(?,0048C267,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000,STATIC), ref: 0048C25A

Strings

STATIC, xrefs: 0048C17A
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0048C1F3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: e0e7201ccdf1c8c884f546939fa5a283a93184af2bd95ea5c7e7943c2fbac553
Instruction ID: 7839bcae197430feb5c610349d91d1663fd62cba91bc810cc279294322e66c48
Opcode Fuzzy Hash: e0e7201ccdf1c8c884f546939fa5a283a93184af2bd95ea5c7e7943c2fbac553
Instruction Fuzzy Hash: 98414471A04208AFDB00FBA5DC92F9E77B8EB09714F514976F500F72D2D7799A048B68

Function 0042E948 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042E954
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042E968
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042E975
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042E982
GetWindowRect.USER32(?,00000000), ref: 0042E9CE
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042EA0C

Strings

MonitorFromWindow, xrefs: 0042E96F
(, xrefs: 0042E9AD
GetMonitorInfoA, xrefs: 0042E97C
user32.dll, xrefs: 0042E963

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 3f5603775b4fc10dd0556651258305c547f48fbc32dd654b42b6ca2bcfb141a2
Instruction ID: 0af0b40728300fdaf03afadc29c4b727e2047a8f6fac2f4a7bcbc8845938fe06
Opcode Fuzzy Hash: 3f5603775b4fc10dd0556651258305c547f48fbc32dd654b42b6ca2bcfb141a2
Instruction Fuzzy Hash: 6321D7717046145BD710DA65EC82F3F37D8EB84710F09062EF944AB3D2DA79EC048B59

Function 0045D454 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045D460
GetModuleHandleA.KERNEL32(user32.dll), ref: 0045D474
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0045D481
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0045D48E
GetWindowRect.USER32(?,00000000), ref: 0045D4DA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0045D518

Strings

user32.dll, xrefs: 0045D46F
MonitorFromWindow, xrefs: 0045D47B
GetMonitorInfoA, xrefs: 0045D488
(, xrefs: 0045D4B9

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: ca5f80964ff50da5a68bbe4f9b231518c354eaa71f385e3320ed60a4bd4b41d8
Instruction ID: e48a21de311d9bf3012ada18c5441f82a1ad829ba730a76b1587e0eeea20ad6e
Opcode Fuzzy Hash: ca5f80964ff50da5a68bbe4f9b231518c354eaa71f385e3320ed60a4bd4b41d8
Instruction Fuzzy Hash: 1B219576A016086BD710DAA48C45F3F3795DF88719F05062EFD84DB393E678DD088B59

Function 0044C770 Relevance: 17.0, APIs: 11, Instructions: 477windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000129,00000000,00000000), ref: 0044C7F0
LineDDA.GDI32(?,?,?,?,Function_0004C084,?), ref: 0044C941
LineDDA.GDI32(?,?,?,?,Function_0004C084,?), ref: 0044C965
DrawFrameControl.USER32(00000000,?,00000004,00000000), ref: 0044CA74

Part of subcall function 0041AC44: FillRect.USER32(?,?,00000000), ref: 0041AC6C

GetTextColor.GDI32(00000000), ref: 0044CB6F
GetSysColor.USER32(00000011), ref: 0044CB91
SetTextColor.GDI32(00000000,00000000), ref: 0044CB9F
SetTextColor.GDI32(00000000,00000000), ref: 0044CBC9
OffsetRect.USER32(00000000,00000000,?), ref: 0044CC6A
InflateRect.USER32(?,00000001,00000001), ref: 0044CD3A
SetTextColor.GDI32(00000000,?), ref: 0044CD55

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Color$Text$Rect$Line$ControlDrawFillFrameInflateMessageOffsetSend
String ID:
API String ID: 3787931423-0
Opcode ID: 162f07869473a607e5fb27f2b863ca83b1d54f080d1e276273e9dbfa414abef9
Instruction ID: 07f26109c0428e62de09795ffaf3a322f28b5910d5ecb99aa3d1d16f18510276
Opcode Fuzzy Hash: 162f07869473a607e5fb27f2b863ca83b1d54f080d1e276273e9dbfa414abef9
Instruction Fuzzy Hash: 14125E74A01148EFEB41DBA9C9C5BEEBBF5AF08304F1841A9E544E7352D738AE41CB58

Function 004566A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,0045687F,?,00000000,004568E2,?,?,00000000,00000000), ref: 004566FD
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00002034,00000014,00000000,?,00000000,00456814,?,00000000,00000001,00000000,00000000,00000000,0045687F), ref: 0045675A
GetLastError.KERNEL32(?,-00000020,0000000C,-00002034,00000014,00000000,?,00000000,00456814,?,00000000,00000001,00000000,00000000,00000000,0045687F), ref: 00456767
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004567B3
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,004567ED,?,-00000020,0000000C,-00002034,00000014,00000000,?,00000000,00456814,?,00000000), ref: 004567D9
GetLastError.KERNEL32(?,?,00000000,00000001,004567ED,?,-00000020,0000000C,-00002034,00000014,00000000,?,00000000,00456814,?,00000000), ref: 004567E0

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

CreateEvent, xrefs: 0045670B
TransactNamedPipe, xrefs: 00456773

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 511628138a9af1fffc2ca54018f242b020b50aef086158b94fbfa677a43831ca
Instruction ID: 4c7e41cf0d7ae5d30b25b1bdee82e35d5194eecc75d7c0d841924595a3a69980
Opcode Fuzzy Hash: 511628138a9af1fffc2ca54018f242b020b50aef086158b94fbfa677a43831ca
Instruction Fuzzy Hash: 9E417D74A00608EFDB15DF95C981F9EB7F8EB0C704F5180AAF904E7292D6789E44CB68

Function 00454690 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004547F5,?,?,?,?), ref: 004546B8
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 004546BE
LoadTypeLib.OLEAUT32(00000000,?), ref: 0045470B

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

OLEAUT32.DLL, xrefs: 004546B3
LoadTypeLib, xrefs: 00454716
UnRegisterTypeLib, xrefs: 00454777
GetProcAddress, xrefs: 004546CB
ITypeLib::GetLibAttr, xrefs: 00454741
UnRegisterTypeLib, xrefs: 004546AE

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 68ac724e57732a5ef26bd804bd8fec2ee262df524cce4a19ad0659e599439987
Instruction ID: 78b55bfbedc7c5482babfabb83a62abfefd12265eb729d5917211dc13d959354
Opcode Fuzzy Hash: 68ac724e57732a5ef26bd804bd8fec2ee262df524cce4a19ad0659e599439987
Instruction Fuzzy Hash: B731C374A00604AFDB10EFAACC41E5B77BDEBCE7097118466F804DB662DB38D944C728

Function 0042E23C Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E341,?,?,00000000,00000000,0047776E,?,?,00000001,00000000,00000002,00000000,00477F42), ref: 0042E265
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E26B
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E341,?,?,00000000,00000000,0047776E), ref: 0042E2B9

Strings

kernel32.dll, xrefs: 0042E260
Control Panel\Desktop\ResourceLocale, xrefs: 0042E2C8
Locale, xrefs: 0042E2A8
GetUserDefaultUILanguage, xrefs: 0042E25B
.DEFAULT\Control Panel\International, xrefs: 0042E290

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 80775962ef1de1f04fba14ff90e9629bb3050df367ac85f2afa35f0094534904
Instruction ID: 80e2083dfbe67d1c7b43627eb169adc2d480171f24ca546da77c06970b05c30e
Opcode Fuzzy Hash: 80775962ef1de1f04fba14ff90e9629bb3050df367ac85f2afa35f0094534904
Instruction Fuzzy Hash: 1D215530B00229EBDB10EAA3DC51B9F77A8EB44315F90447BB501E7281DB7CDE019B58

Function 00416D64 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416DF7
SaveDC.GDI32(?), ref: 00416E0B
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E2E
RestoreDC.GDI32(?,?), ref: 00416E49
CreateSolidBrush.GDI32(00000000), ref: 00416EC9
FrameRect.USER32(?,?,?), ref: 00416EFC
DeleteObject.GDI32(?), ref: 00416F06
CreateSolidBrush.GDI32(00000000), ref: 00416F16
FrameRect.USER32(?,?,?), ref: 00416F49
DeleteObject.GDI32(?), ref: 00416F53

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 2d530bd73c304f112faa4cd5d9512070450d880509641c7ed13b0f205e8aba23
Instruction ID: 373b4cb3aef3e1a16ecbe9e2b2013132ab0d77f14efef333e8d983e2c339df12
Opcode Fuzzy Hash: 2d530bd73c304f112faa4cd5d9512070450d880509641c7ed13b0f205e8aba23
Instruction Fuzzy Hash: 8D514C712082449FDB54EF69C8C4B9777E8AF48314F16566AFD488B287C738EC81CB99

Function 00404AD7 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B5E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B82
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B9E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BBF
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BE8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BF2
GetStdHandle.KERNEL32(000000F5), ref: 00404C12
GetFileType.KERNEL32(?,000000F5), ref: 00404C29
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C44
GetLastError.KERNEL32(000000F5), ref: 00404C5E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 19aab46d14617eeb7ff55053a6d2529793c5aca4f70347c4672e535beafe550a
Instruction ID: 243fc86442b20f36379e50c59261f474f5b259432ffcb65c19c30b2a18794a22
Opcode Fuzzy Hash: 19aab46d14617eeb7ff55053a6d2529793c5aca4f70347c4672e535beafe550a
Instruction Fuzzy Hash: 2B41B2B02093009EF7305A648905B2776E5ABC0314F208A3FE3A6F66E0D77DEC858B5D

Function 004221CC Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422217
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422235
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422242
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042224F
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225C
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422269
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422276
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00422283
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222A1
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222BD

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: dc2ea80951fe9ce63c82eec4278d9d3efa35f48831147c28f6fae4a7aea3166e
Instruction ID: 0dc555760eb23990e168f5e73d866adde3542315bfaded5258ea6dcd035754b3
Opcode Fuzzy Hash: dc2ea80951fe9ce63c82eec4278d9d3efa35f48831147c28f6fae4a7aea3166e
Instruction Fuzzy Hash: 692132703417047AE720D724CD8FF9A7AD89B14B18F0444A5B6487F2D3C6F9AA404668

Function 0045C1B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

SHGetMalloc.SHELL32(?), ref: 0045C1EB
GetActiveWindow.USER32 ref: 0045C24F
CoInitialize.OLE32(00000000), ref: 0045C263
SHBrowseForFolder.SHELL32(?), ref: 0045C27A
CoUninitialize.OLE32(0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C28F
SetActiveWindow.USER32(?,0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C2A5
SetActiveWindow.USER32(?,?,0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C2AE

Strings

A, xrefs: 0045C223

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ActiveWindow$BrowseCharFolderInitializeMallocPrevUninitialize
String ID: A
API String ID: 1128911707-3554254475
Opcode ID: 036de84f5d6a467aae8a43b6eeb0dc7aba825ebc9320c110753ae6665b078d1f
Instruction ID: 6ceb26fb85bac15bc959ba65c80639602947ac9b35543aa89682498837f70cd4
Opcode Fuzzy Hash: 036de84f5d6a467aae8a43b6eeb0dc7aba825ebc9320c110753ae6665b078d1f
Instruction Fuzzy Hash: 81312F70E003089FDB00EFA6D886A9EBBF9EB08704F51447AF814E7252D7785A04CF59

Function 0045A18C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045A195
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045A1A5
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045A1B5
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045A1C5

Strings

inflateInit_, xrefs: 0045A18F
inflateReset, xrefs: 0045A1BF
inflateEnd, xrefs: 0045A1AF
inflate, xrefs: 0045A19F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 3bf7286a66463856631d4979e79e578ff30af3c35f31498dbd1205ec2074e2c0
Instruction ID: 4d3d890dc723861f13db6395896c487a27456cfa16dca570ba405f90b3c14af2
Opcode Fuzzy Hash: 3bf7286a66463856631d4979e79e578ff30af3c35f31498dbd1205ec2074e2c0
Instruction Fuzzy Hash: 4C014FB0500640DADB04DF66AC4572E3695E78A316F108A3FEB05952B3D37C04ADCF2E

Function 0041A8C0 Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A99D
73A14D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A9D7
SetBkColor.GDI32(?,?), ref: 0041A9EC
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA36
SetTextColor.GDI32(00000000,00000000), ref: 0041AA41
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA51
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA90
SetTextColor.GDI32(00000000,00000000), ref: 0041AA9A
SetBkColor.GDI32(00000000,?), ref: 0041AAA7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 9763be554a25649a29db5595c64fb65967bde6cc01139e8cdbe8a0bd49800080
Instruction ID: a9056279ea6706653b7762b5d1918432d0ed21d641511fba6a9f580fb915d475
Opcode Fuzzy Hash: 9763be554a25649a29db5595c64fb65967bde6cc01139e8cdbe8a0bd49800080
Instruction Fuzzy Hash: 8561C6B5A00105AFCB40EFADD985E9AB7F8EF09308B14856AF518DB252C734ED40CF69

Function 004556AC Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D793

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00455860,?, /s ",?,regsvr32.exe",?,00455860), ref: 004557D2

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

CreateProcess, xrefs: 004557C4
D, xrefs: 00455788
Spawning 32-bit RegSvr32: , xrefs: 00455759
regsvr32.exe", xrefs: 004556F3
0x%x, xrefs: 004557F5
/s ", xrefs: 0045571B
Spawning 64-bit RegSvr32: , xrefs: 00455737
/u, xrefs: 0045570E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseDirectoryHandleLocalSystemTime
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 3056626195-1862435767
Opcode ID: 016fff80da410e36ac3282bdd5e6e8b1eba990e0d29eaf5279ed6e54f07cc787
Instruction ID: 668142088920a7474f5a4fc6baec131f675cf9e96f3b7cdd4543ab6606308c4e
Opcode Fuzzy Hash: 016fff80da410e36ac3282bdd5e6e8b1eba990e0d29eaf5279ed6e54f07cc787
Instruction Fuzzy Hash: 22411970A00708ABDB11EFD6CC91B9DB7B9EF44305F50447BB804BB296D778AA09CB59

Function 0044C66C Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044C69D
GetSysColor.USER32(00000014), ref: 0044C6A4
SetTextColor.GDI32(00000000,00000000), ref: 0044C6BC
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C6E5
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044C6EF
GetSysColor.USER32(00000010), ref: 0044C6F6
SetTextColor.GDI32(00000000,00000000), ref: 0044C70E
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C737
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C762

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: b3537fb242d8b7ab794fb71d0597c1b29de91112c6c0a88b9941b0d5558c02b1
Instruction ID: 871493c5d8b0256730e50f677fca3f4276f3227a00fdff1271d472b9d0e0a2a7
Opcode Fuzzy Hash: b3537fb242d8b7ab794fb71d0597c1b29de91112c6c0a88b9941b0d5558c02b1
Instruction Fuzzy Hash: AB21A0742415046FC710FB2ACD8AE9BBBDCDF19315B00457AB958FB3A3C678DE448A68

Function 0045339C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(?), ref: 0045342C
GetLastError.KERNEL32(00000000,004534AD,?,?,?,00000001), ref: 0045343D
WaitForInputIdle.USER32(?,000000FF), ref: 0045345C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0045347C
GetExitCodeProcess.KERNEL32(?,?), ref: 00453489
CloseHandle.KERNEL32(?,?,?,00000000,004534AD,?,?,?,00000001), ref: 00453492

Strings

<, xrefs: 004533E8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: cb83176401f6c4cd582b70e1be43456bf22dffdcb66fabc70813abc5eada3193
Instruction ID: c8f5c582c69a185e48b9debb62434bc0b28c6b3190209a1183e5e8841978544e
Opcode Fuzzy Hash: cb83176401f6c4cd582b70e1be43456bf22dffdcb66fabc70813abc5eada3193
Instruction Fuzzy Hash: 9E317270A00209ABDF11EFA9D845A9F7BE8AF05355F10453AB854E73C2D77C9A04CB54

Function 00469BAC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00469CA9,?,?,?,?,00000000), ref: 00469C13
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00469CA9), ref: 00469C2A

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

AddFontResourceA.GDI32(00000000), ref: 00469C47
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00469C5B

Strings

Failed to open Fonts registry key., xrefs: 00469C31
Failed to set value in Fonts registry key., xrefs: 00469C1C
AddFontResource, xrefs: 00469C65

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseFontLocalMessageNotifyOpenResourceSendTimeValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 2144475154-649663873
Opcode ID: e04f23ae531e88cdaef08651cb908a4e1a6a9fb69c251eaacbecb11b9dbbc7eb
Instruction ID: 34a06ada0e78f5f9b54380f7bc7b9d843d068f1a195b39ed9588e7f274964b56
Opcode Fuzzy Hash: e04f23ae531e88cdaef08651cb908a4e1a6a9fb69c251eaacbecb11b9dbbc7eb
Instruction Fuzzy Hash: D42192747406047BE710FBA69D42B6E779C9B44744F50447BBD00EB2C2EABC9E01966E

Function 0048BB5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Part of subcall function 0044F988: SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

GetWindowThreadProcessId.USER32(00000000,?), ref: 0048BBE4
OpenProcess.KERNEL32(001F0000,00000000,?,00000000,?), ref: 0048BBF4
SendMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 0048BC0A
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC12
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC18
Sleep.KERNEL32(000001F4,00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC22

Strings

Deleting Uninstall data files., xrefs: 0048BB63

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleLocalMessageObjectOpenSendSingleSleepThreadTimeWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 2572021473-2568741658
Opcode ID: e5c09e7293a5ff47414c0bae08d37abffaae5354862190d6ead28097e203f47d
Instruction ID: ef1d172303a259d09d19a4eb890201be45307ddd3520d78bbdc2739676507261
Opcode Fuzzy Hash: e5c09e7293a5ff47414c0bae08d37abffaae5354862190d6ead28097e203f47d
Instruction Fuzzy Hash: 76216071314304AFE761F77AEC92F2E7698E748718F50493BB904961E2DA78AC408B6C

Function 0045D894 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004163F4: GetClassInfoA.USER32(00400000,?,?), ref: 00416463
Part of subcall function 004163F4: UnregisterClassA.USER32(?,00400000), ref: 0041648F
Part of subcall function 004163F4: RegisterClassA.USER32(?), ref: 004164B2

GetVersion.KERNEL32 ref: 0045D8C4
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0045D902
SHGetFileInfo.SHELL32(0045D9A0,00000000,?,00000160,00004011), ref: 0045D91F
LoadCursorA.USER32(00000000,00007F02), ref: 0045D93D
SetCursor.USER32(00000000,00000000,00007F02,0045D9A0,00000000,?,00000160,00004011), ref: 0045D943
SetCursor.USER32(?,0045D983,00007F02,0045D9A0,00000000,?,00000160,00004011), ref: 0045D976

Strings

Explorer, xrefs: 0045D8DE

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: e91849e0618d858d9194317a1a4038b08b961e524554fbfaf58e2b90370e84dd
Instruction ID: f84993560f39c0634edb85e0f01e9d31c205d0b219b59aa2db0e2658bca57fc4
Opcode Fuzzy Hash: e91849e0618d858d9194317a1a4038b08b961e524554fbfaf58e2b90370e84dd
Instruction Fuzzy Hash: 66210DB1B443047AE720BB759C47B9B76989F08709F50447FFA05EA2C3D9BD4C09865C

Function 00456FD4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00457156,?,00000000,?,00000000), ref: 0045709A

Part of subcall function 00452620: FindClose.KERNEL32(000000FF,00452716), ref: 00452705

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045710F
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00457074
Deleting directory: %s, xrefs: 00457023
Failed to delete directory (%d). Will retry later., xrefs: 004570B3
Failed to delete directory (%d)., xrefs: 00457130
Stripped read-only attribute., xrefs: 0045705C
Failed to strip read-only attribute., xrefs: 00457068

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseErrorFindLastLocalTime
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 3419951142-1448842058
Opcode ID: e3f18493a9dc4356e0bd90b9fc6423e8710d3d0470f0641720c74ffeec107be8
Instruction ID: e7510856a5bd63b3272ba8fdda5cf88a4932d2c12bc69fe274495a2ac2fcb9de
Opcode Fuzzy Hash: e3f18493a9dc4356e0bd90b9fc6423e8710d3d0470f0641720c74ffeec107be8
Instruction Fuzzy Hash: DA41F530A086449ACB14DFAA98013AEB6E65B45306F5185BFBC05E7393D7BC8E0DC75A

Function 00422E34 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E88
GetCapture.USER32 ref: 00422E97
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E9D
ReleaseCapture.USER32 ref: 00422EA2
GetActiveWindow.USER32 ref: 00422EB1
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F30
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F94
GetActiveWindow.USER32 ref: 00422FA3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 17b80066470d9629b40eb65c1369ae5239412fa7006ec153d7f7e8c348157a78
Instruction ID: 61331741e1a9d32dfd914a534bb7b7a1458fc2215028607276cfa4a9f0666116
Opcode Fuzzy Hash: 17b80066470d9629b40eb65c1369ae5239412fa7006ec153d7f7e8c348157a78
Instruction Fuzzy Hash: 96415670B00254AFD750EB6ADA42B9E77F5EF09304F5140BAF440EB2A2D7B85E41DB58

Function 00429464 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000), ref: 0042946E
GetTextMetricsA.GDI32(00000000), ref: 00429477

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(00000000,00000000), ref: 00429486
GetTextMetricsA.GDI32(00000000,?), ref: 00429493
SelectObject.GDI32(00000000,00000000), ref: 0042949A
73A0A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004294A2
GetSystemMetrics.USER32(00000006), ref: 004294C7
GetSystemMetrics.USER32(00000006), ref: 004294E1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: 23f1bc0c727ee9f77e6f489ff04873a24ebfd5f713f10d19075d6d31f4be828a
Instruction ID: d39c3b8cedb85ddee27945d09177e972c60518b1d53f70601292aced946c6937
Opcode Fuzzy Hash: 23f1bc0c727ee9f77e6f489ff04873a24ebfd5f713f10d19075d6d31f4be828a
Instruction Fuzzy Hash: 500104513087503AE7107A7ADCC6F6B26C8DB8434CF44053BF646DA3C3D56C9C41872A

Function 0041DE08 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,?,0041903D,0048DCD1), ref: 0041DE0B
73A14620.GDI32(00000000,0000005A,00000000,?,0041903D,0048DCD1), ref: 0041DE15
73A0A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,0041903D,0048DCD1), ref: 0041DE22
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE31
GetStockObject.GDI32(00000007), ref: 0041DE3F
GetStockObject.GDI32(00000005), ref: 0041DE4B
GetStockObject.GDI32(0000000D), ref: 0041DE57
LoadIconA.USER32(00000000,00007F00), ref: 0041DE68

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ObjectStock$A14620A480A570IconLoad
String ID:
API String ID: 2920975243-0
Opcode ID: b001289e577f4548cbbd651e21da946ecebc771b89fe2a672f2df9ecb584a152
Instruction ID: 93c722843342e57aeca8888d365bffc1acb5eff67fb6fd0c7f9653bc9279ffa7
Opcode Fuzzy Hash: b001289e577f4548cbbd651e21da946ecebc771b89fe2a672f2df9ecb584a152
Instruction Fuzzy Hash: 7E112BB06442019EE340BFB56C9276E3790EB54708F10453FF604BF2E2E6791C598B6E

Function 0045DCA4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0045DDA8
SetCursor.USER32(00000000,00000000,00007F02,00000000,0045DE3D), ref: 0045DDAE
SetCursor.USER32(?,0045DE25,00007F02,00000000,0045DE3D), ref: 0045DE18

Strings

, xrefs: 0045E03E
, xrefs: 0045E023
Internal error: Item already expanding, xrefs: 0045DD45

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 39b95f3cc0a8b9166b63294a168ed62df7465f5245ad47c0cb614c53f2bc52d9
Instruction ID: 47fd772c06e249c7ddb6849c30c983d1bafec2352ed9edd8cdf6708fe5ab0d05
Opcode Fuzzy Hash: 39b95f3cc0a8b9166b63294a168ed62df7465f5245ad47c0cb614c53f2bc52d9
Instruction Fuzzy Hash: B7B1A030A00644DFDB25DF29C585B9EBBF1AF05705F1884AAE8459B793C77CAE48CB18

Function 00451F7C Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452063

Strings

.tmp, xrefs: 0045201F
WININIT.INI, xrefs: 00452011
MoveFileEx, xrefs: 00452273
[rename], xrefs: 004520C6, 00452102
NUL, xrefs: 00452125

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: b60cf4a4e6bb14c7772f8e3b7af2945edceb714bfc6c2b864953a2ed259058ec
Instruction ID: 4e2d304ab99e232e525d75e2199f44beb043213359159d3852ae2ebd11ffc70b
Opcode Fuzzy Hash: b60cf4a4e6bb14c7772f8e3b7af2945edceb714bfc6c2b864953a2ed259058ec
Instruction Fuzzy Hash: 8B91F134A001099BDB01EBA5C982BDEB7B5EF49705F508467F900B7292D77CAE49CB58

Function 004086B8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408900,?,?,?,?,00000000,00000000,00000000,?,00409907,00000000,0040991A), ref: 004086D2

Part of subcall function 00408500: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Part of subcall function 0040854C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040874E,?,?,?,00000000,00408900), ref: 0040855F

Strings

:mm:ss, xrefs: 004088CE
:mm, xrefs: 004088B4
m/d/yy, xrefs: 004087A1
AMPM, xrefs: 0040889D
mmmm d, yyyy, xrefs: 004087C3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 1e705da47985ffa4922a367eb7baaddd681388b94d020ec690b26d485f6814a1
Instruction ID: e4dac29d349118f62fd6774a3e23bf456a699e18f87bd38fc5d8080b6a40e551
Opcode Fuzzy Hash: 1e705da47985ffa4922a367eb7baaddd681388b94d020ec690b26d485f6814a1
Instruction Fuzzy Hash: 04514A34B001086BD701FAA98D41B9F7769DB94704F50D87FB181BB7C6CA3CCA098B59

Function 004116D8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118DD), ref: 00411770
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041182E

Part of subcall function 00411A90: CreatePopupMenu.USER32 ref: 00411AAA

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118BA

Part of subcall function 00411A90: CreateMenu.USER32 ref: 00411AB4

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118A1

Strings

,, xrefs: 00411783
?, xrefs: 0041178A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: e1fb53b035570fa2222cb30ffd958d27a6b36b20176d252f81fa281313642444
Instruction ID: 0334ad3b68887629b9a54eb4b7d8b43aeaa35efcad7df6a84d4f30841fb17169
Opcode Fuzzy Hash: e1fb53b035570fa2222cb30ffd958d27a6b36b20176d252f81fa281313642444
Instruction Fuzzy Hash: 5F51F674A101049BEB10EF76DC81AEE7BF9AF09344B15857AFA04E73A2D738D9418B58

Function 0041BE47 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF0C
GetObjectA.GDI32(?,00000018,?), ref: 0041BF1B
GetBitmapBits.GDI32(?,?,?), ref: 0041BF6C
GetBitmapBits.GDI32(?,?,?), ref: 0041BF7A
DeleteObject.GDI32(?), ref: 0041BF83
DeleteObject.GDI32(?), ref: 0041BF8C
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFA9

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 6ab8290f6721c08eb991d3024aa311dd4da3b1cfc13afef1c50b3c3246a1cd75
Instruction ID: 9d220f5870bbd12f3265014d348204a50707938c1f023c9dfc9dc97e0db48908
Opcode Fuzzy Hash: 6ab8290f6721c08eb991d3024aa311dd4da3b1cfc13afef1c50b3c3246a1cd75
Instruction Fuzzy Hash: 3C510575E00619AFCB14DFA9C8819EEB7F9EF48314B11842AF914E7391D738AD81CB64

Function 0041CEBC Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEE2
73A14620.GDI32(00000000,00000026), ref: 0041CF01
73A08830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CF67
73A022A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF76
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFE0
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D01E
73A08830.GDI32(?,?,00000001,0041D050,00000000,00000026), ref: 0041D043

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Stretch$A08830$A022A14620BitsMode
String ID:
API String ID: 2733548868-0
Opcode ID: 8c6f3b607d64d37a2042fe91b5d4bbbfb39ec59a86ccb9df25baee173d6c50e6
Instruction ID: dd46121b725e3b42f225da0c334f71b23089d65068998a5a38c8dd7487c11b3e
Opcode Fuzzy Hash: 8c6f3b607d64d37a2042fe91b5d4bbbfb39ec59a86ccb9df25baee173d6c50e6
Instruction Fuzzy Hash: 11513CB0644600AFDB14DFA9C985F9BBBF9AF08304F14459AB944D7392C778ED81CB58

Function 00454A40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00454A92

Part of subcall function 00424260: GetWindowTextA.USER32(?,?,00000100), ref: 00424280

Part of subcall function 0041EE88: GetCurrentThreadId.KERNEL32 ref: 0041EED7
Part of subcall function 0041EE88: 73A15940.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00454AF9
TranslateMessage.USER32(?), ref: 00454B17
DispatchMessageA.USER32(?), ref: 00454B20

Strings

[Paused] , xrefs: 00454AC8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Message$TextWindow$A15940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 1715372110-4230553315
Opcode ID: e83041b643d5c00cf529802f92d50be635d5933b916d70c92f752238d6325057
Instruction ID: c6278e554f735680dec37aab739c8584428bf0bcf03b11cd4b568db5991b3be2
Opcode Fuzzy Hash: e83041b643d5c00cf529802f92d50be635d5933b916d70c92f752238d6325057
Instruction Fuzzy Hash: 8131E830904244AEDB01DBB6DC41BDE7BB8DB49318F5144BBE800E7692D67CE949CB68

Function 004653E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046551F), ref: 0046549C
LoadCursorA.USER32(00000000,00007F02), ref: 004654AA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046551F), ref: 004654B0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046551F), ref: 004654BA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046551F), ref: 004654C0

Strings

CheckPassword, xrefs: 00465444

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: df73c6b1d4aaace0fe015eae2069d9080f1e303ef510efeb9e4f9c0003a37a70
Instruction ID: 826988ba3a19f4a7ef0b4daf9ec93b5ee07885d8aae0c5710a18fc18fb0aefb6
Opcode Fuzzy Hash: df73c6b1d4aaace0fe015eae2069d9080f1e303ef510efeb9e4f9c0003a37a70
Instruction Fuzzy Hash: 04318430640604AFD711DF79C88EB9E7BE5AF45304F5580B6F8049B3A2EB789D40CB59

Function 0041C12C Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C02C: GetObjectA.GDI32(?,00000018), ref: 0041C039

GetFocus.USER32 ref: 0041C14C
73A0A570.USER32(?), ref: 0041C158
73A08830.GDI32(?,?,00000000,00000000,0041C1D7,?,?), ref: 0041C179
73A022A0.GDI32(?,?,?,00000000,00000000,0041C1D7,?,?), ref: 0041C185
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C19C
73A08830.GDI32(?,00000000,00000000,0041C1DE,?,?), ref: 0041C1C4
73A0A480.USER32(?,?,0041C1DE,?,?), ref: 0041C1D1

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A08830$A022A480A570BitsFocusObject
String ID:
API String ID: 1424713005-0
Opcode ID: 1462acd3ed839de1fb4952b928c309763a0029310ede000dc95b9cba959b1f97
Instruction ID: 69d2c45fc0f514358a07e38578509ebc160661b28a2a6d3b67b6b30d0c7fd41f
Opcode Fuzzy Hash: 1462acd3ed839de1fb4952b928c309763a0029310ede000dc95b9cba959b1f97
Instruction Fuzzy Hash: B6113A71A84604BFDB10EBE9CC85FAFB7FCEF48700F54446AB514E7281D67899408B68

Function 00418C38 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C54
GetSystemMetrics.USER32(0000000D), ref: 00418C5C
6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C62

Part of subcall function 00409950: 6F51C400.COMCTL32(0048F628,000000FF,00000000,00418C90,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409954

6F58CB00.COMCTL32(0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CB2
6F58C740.COMCTL32(00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CBD
6F58CB00.COMCTL32(0048F628,00000001,?,?,00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000), ref: 00418CD0
6F520860.COMCTL32(0048F628,00418CF3,?,00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E), ref: 00418CE6

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MetricsSystem$C400C740F520860F522980
String ID:
API String ID: 2856677924-0
Opcode ID: 3f7400f8109769f56864c3e5e68a0cce4892016e89210e5e12579846faa68825
Instruction ID: a15bd130fbd068cc5afb6071f2cc5479729ba946ab0df199208bf8fc2813ae09
Opcode Fuzzy Hash: 3f7400f8109769f56864c3e5e68a0cce4892016e89210e5e12579846faa68825
Instruction Fuzzy Hash: 56115471B44204BBDB10EBA5DC82F5E73B8EB08704F50447EBA04FB2D2E9799E408758

Function 0047A3CC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0047A484), ref: 0047A469

Strings

LanmanNT, xrefs: 0047A433
WinNT, xrefs: 0047A419
ProductType, xrefs: 0047A408
System\CurrentControlSet\Control\ProductOptions, xrefs: 0047A3F0
ServerNT, xrefs: 0047A44D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 1fef1506e5d1a12a21068b78d04b25ddfd496f50cdf7c150aefa2c62348cd093
Instruction ID: a2e0432ed80f51b3df372a94479d53eea4c9ed601dce61c5aff662378490294f
Opcode Fuzzy Hash: 1fef1506e5d1a12a21068b78d04b25ddfd496f50cdf7c150aefa2c62348cd093
Instruction Fuzzy Hash: CA118130704204AEDB10DB65C849B9E7BE8DB85704F61C076A408E7282D7BE9D21871B

Function 0048A854 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,?,?,00000000), ref: 0048A865

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(00000000,00000000), ref: 0048A887
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0048ACF9), ref: 0048A89B
GetTextMetricsA.GDI32(00000000,?), ref: 0048A8BD
73A0A480.USER32(00000000,00000000,0048A8E7,0048A8E0,?,00000000,?,?,00000000), ref: 0048A8DA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0048A892

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 4756dc58a9fe183d04f72d5ee01b99ae46f4153cc6129f91c9988a1bf38743aa
Instruction ID: e3ebea077dd3416d839fa67d6eeb2523a561f2e9e35b0c3e0d5cf9c988656d13
Opcode Fuzzy Hash: 4756dc58a9fe183d04f72d5ee01b99ae46f4153cc6129f91c9988a1bf38743aa
Instruction Fuzzy Hash: 71016575A04604BFEB00EBA5CC41E5EB7FCDB48704F510476B500E7281D678AD118B29

Function 0041B446 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B454
SelectObject.GDI32(?,00000000), ref: 0041B463
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B48F
SelectObject.GDI32(00000000,00000000), ref: 0041B49D
SelectObject.GDI32(?,00000000), ref: 0041B4AB
DeleteDC.GDI32(00000000), ref: 0041B4B4
DeleteDC.GDI32(?), ref: 0041B4BD

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 76ed21a8a123110952df31ef417d2be93a42c5a11e27bac9dd0fe5ee96d695dd
Instruction ID: 994e7a73776f87c2a3f7ecab1024ea940e5cb60cd1c9c7467d7489c24c33dad8
Opcode Fuzzy Hash: 76ed21a8a123110952df31ef417d2be93a42c5a11e27bac9dd0fe5ee96d695dd
Instruction Fuzzy Hash: 4B114F72E00519ABDF10E6D9D885FAFB7BCEF48714F148456B614F7241C678A8418BA8

Function 00423378 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00423393
WindowFromPoint.USER32(?,?), ref: 004233A0
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233AE
GetCurrentThreadId.KERNEL32 ref: 004233B5
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233CE
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 004233E5
SetCursor.USER32(00000000), ref: 004233F7

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: a2b35a0324aed1c1a1aef43f706cca7a9ce9ecf772cb636310864d83fdb03995
Instruction ID: 8aa5c5465bd0a6766889fd83bcb534b45e50c720898f7b77a1b4925485ae0e05
Opcode Fuzzy Hash: a2b35a0324aed1c1a1aef43f706cca7a9ce9ecf772cb636310864d83fdb03995
Instruction Fuzzy Hash: BE01712230421026D621BA795C86E6F26A8DFC5B55F51413FB905AA292D93E8D10A36D

Function 0048A678 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0048A688
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0048A695
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0048A6A2

Strings

MonitorFromRect, xrefs: 0048A68F
user32.dll, xrefs: 0048A683
GetMonitorInfoA, xrefs: 0048A69C

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 6f680d3e4fe8c221cc39eca69a0bb860841f777a75b84e59e3920273577f0424
Instruction ID: 2fe08d3e4f174900d65476131225eed9468d2df8f654637943b42e84ff0c3ea0
Opcode Fuzzy Hash: 6f680d3e4fe8c221cc39eca69a0bb860841f777a75b84e59e3920273577f0424
Instruction Fuzzy Hash: 31F0C256A0161527E62035660C41A7F618CDB817E4F180937BD84B6286F9DD8D2053EE

Function 0045A060 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045A069
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045A079
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045A089

Strings

ISCryptGetVersion, xrefs: 0045A063
ArcFourCrypt, xrefs: 0045A083
ArcFourInit, xrefs: 0045A073

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: 70d587f92c1d05cb222443710637b1d912d99a584956a9cdf3b4ee4e334252bf
Instruction ID: e1d5df669823c0ab5131070bf850e98dec9033d5bf59ed0dcea5cc9d4e4819b5
Opcode Fuzzy Hash: 70d587f92c1d05cb222443710637b1d912d99a584956a9cdf3b4ee4e334252bf
Instruction Fuzzy Hash: DDF06DB0558600CBDB16DF32BD4462E3696B786702B148E3FA704851F6D7B806DCCB9E

Function 0045A560 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045A569
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045A579
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045A589

Strings

BZ2_bzDecompressEnd, xrefs: 0045A583
BZ2_bzDecompressInit, xrefs: 0045A563
BZ2_bzDecompress, xrefs: 0045A573

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 2811038c06c80202a4e2c5c8568d90add12c267d83fa08c9b71317a329bacf2d
Instruction ID: 1ed4d4c54b1ba48841aa55af7a4f99cdb235e4f9ee6f071a283307d68983f4a2
Opcode Fuzzy Hash: 2811038c06c80202a4e2c5c8568d90add12c267d83fa08c9b71317a329bacf2d
Instruction Fuzzy Hash: B1F062B0511208ABDB04DF765C40B2A32A5A74A316F009A3F9F0185273E73C045DCF1D

Function 0044BA2C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044E4C1), ref: 0044BA3B
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044BA4C
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044BA5C

Strings

LresultFromObject, xrefs: 0044BA46
CreateStdAccessibleObject, xrefs: 0044BA56
oleacc.dll, xrefs: 0044BA36

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: d17a52c6d14db7140e722f235bec08c68fff101c58966aaeb0a431b1741632cd
Instruction ID: 4eab40195bb5edf5191bdb80f64a001ad723898ce6084ed42c13c19343686ec9
Opcode Fuzzy Hash: d17a52c6d14db7140e722f235bec08c68fff101c58966aaeb0a431b1741632cd
Instruction Fuzzy Hash: DFF0ACB02407459AFB20DF65EC95B2A3694E714309F101A3FA441AA6E2E7BD958CCB5C

Function 0041B650 Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B729
73A0A570.USER32(?), ref: 0041B735
73A08830.GDI32(00000000,?,00000000,00000000,0041B800,?,?), ref: 0041B76A
73A022A0.GDI32(00000000,00000000,?,00000000,00000000,0041B800,?,?), ref: 0041B776
73A16310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B7DE,?,00000000,0041B800,?,?), ref: 0041B7A4
73A08830.GDI32(00000000,00000000,00000000,0041B7E5,?,?,00000000,00000000,0041B7DE,?,00000000,0041B800,?,?), ref: 0041B7D8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A08830$A022A16310A570Focus
String ID:
API String ID: 3731147114-0
Opcode ID: 7850deda01d5b67845034907e9d13d0af41ccb4855d62375856d062b51268ed7
Instruction ID: 96a8dcd938646780d77c4975bcb10c0d457760a3c1beb3f6860f1a63d3cb7377
Opcode Fuzzy Hash: 7850deda01d5b67845034907e9d13d0af41ccb4855d62375856d062b51268ed7
Instruction Fuzzy Hash: DB513D70A00608EFCB11DFA9C885AEEBBB8EF49704F114466F510A7390D7789D81CBA9

Function 0041B920 Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B9FB
73A0A570.USER32(?), ref: 0041BA07
73A08830.GDI32(00000000,?,00000000,00000000,0041BACD,?,?), ref: 0041BA41
73A022A0.GDI32(00000000,00000000,?,00000000,00000000,0041BACD,?,?), ref: 0041BA4D
73A16310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BAAB,?,00000000,0041BACD,?,?), ref: 0041BA71
73A08830.GDI32(00000000,00000000,00000000,0041BAB2,?,?,00000000,00000000,0041BAAB,?,00000000,0041BACD,?,?), ref: 0041BAA5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A08830$A022A16310A570Focus
String ID:
API String ID: 3731147114-0
Opcode ID: a3ce49c3f9ad935a5ee1e1cf1004842d5f36df964349e45f76b9d12872fad6c8
Instruction ID: c10e30adebc841ec4a3808293d98e29291aa3ac43dc1cc39f62f73c8df8f7935
Opcode Fuzzy Hash: a3ce49c3f9ad935a5ee1e1cf1004842d5f36df964349e45f76b9d12872fad6c8
Instruction Fuzzy Hash: 33512C71A006189FCB01DFA9C851AAEBBF5FF48700F558066F504E7755D7389D40CBA8

Function 0041B4EC Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B562
73A0A570.USER32(?,00000000,0041B63C,?,?,?,?), ref: 0041B56E
73A14620.GDI32(?,00000068,00000000,0041B610,?,?,00000000,0041B63C,?,?,?,?), ref: 0041B58A
73A3E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B610,?,?,00000000,0041B63C,?,?,?,?), ref: 0041B5A7
73A3E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B610,?,?,00000000,0041B63C), ref: 0041B5BE
73A0A480.USER32(?,?,0041B617,?,?), ref: 0041B60A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: E680$A14620A480A570Focus
String ID:
API String ID: 932946509-0
Opcode ID: 998c128d5c735b8a832e1b0da23ebfda7fc580edf4b44d5d7b13a9a2cc0cb6eb
Instruction ID: 39d1682d484abca41271a916afe7ae09def1fe3613ffd5f5840820d5a1948b9d
Opcode Fuzzy Hash: 998c128d5c735b8a832e1b0da23ebfda7fc580edf4b44d5d7b13a9a2cc0cb6eb
Instruction Fuzzy Hash: 4641E771A00658AFDF10DFA9C885A9FBBB4EF45704F1444AAF500EB352D3389D10CBA9

Function 00456B88 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000030,00000FFF,00000000,00456CB4,?,?,00000000,00000000), ref: 00456BEF

Part of subcall function 004564C8: CloseHandle.KERNEL32(?), ref: 004564FF
Part of subcall function 004564C8: WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00456529
Part of subcall function 004564C8: GetExitCodeProcess.KERNEL32(?), ref: 0045653A
Part of subcall function 004564C8: CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456581
Part of subcall function 004564C8: Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045659D

Part of subcall function 004564C8: TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045651B

Strings

UnRegisterTypeLib, xrefs: 00456C83
RegisterTypeLib, xrefs: 00456C55
HelperRegisterTypeLibrary: StatusCode invalid, xrefs: 00456C8F
ITypeLib::GetLibAttr, xrefs: 00456C67
LoadTypeLib, xrefs: 00456C38

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseHandleProcess$ByteCharCodeExitFullMultiNameObjectPathSingleSleepTerminateWaitWide
String ID: HelperRegisterTypeLibrary: StatusCode invalid$ITypeLib::GetLibAttr$LoadTypeLib$RegisterTypeLib$UnRegisterTypeLib
API String ID: 3965036325-83444288
Opcode ID: 5f5cb0a4c948379684cabe3a36274f057d4e83ff4bd67a97a3c1db2b5a4924be
Instruction ID: 3d91b91dfdb019ea9ead0d91b8b9bee1927642c3be1538803e06913f3ca9563e
Opcode Fuzzy Hash: 5f5cb0a4c948379684cabe3a36274f057d4e83ff4bd67a97a3c1db2b5a4924be
Instruction Fuzzy Hash: 2231A3703006049BD721EB6AC84265AB7A8EB44306B96893BAC84D7353DA3DAE09861D

Function 00459F24 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,00459FF0,?,?,?,?,00000000), ref: 00459F8F
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045A05C,?,00000000,00459FF0,?,?,?,?,00000000), ref: 00459FCE

Strings

CLASSES_ROOT, xrefs: 00459F54
MACHINE, xrefs: 00459F72
CURRENT_USER, xrefs: 00459F63
USERS, xrefs: 00459F81

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 949a20e0944d27fdecdd679eb0046797891f6aaf624654906bfbe349e96ad872
Instruction ID: 66965d96e5c520b71b808593f2145a5071d5b2a6a0d7e7578c2a48195cc9af2e
Opcode Fuzzy Hash: 949a20e0944d27fdecdd679eb0046797891f6aaf624654906bfbe349e96ad872
Instruction Fuzzy Hash: B811B736204608FFDB11DE91C981A9A76ACDB48716F708077AD01D62C3D67C9F09D62E

Function 0041BD70 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDB9
GetSystemMetrics.USER32(0000000C), ref: 0041BDC3
73A0A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDCD
73A14620.GDI32(00000000,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDF4
73A14620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE01
73A0A480.USER32(00000000,00000000,0041BE47,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE3A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A14620MetricsSystem$A480A570
String ID:
API String ID: 1130675633-0
Opcode ID: c1d51373f2bbde019d0ffbe74da4b0ad752ae14fba3f18c9529eb1c146801ada
Instruction ID: 11d507180d1e5a54e4cf0232c40eb60fdb0cf0375a4003166fdd62379686177d
Opcode Fuzzy Hash: c1d51373f2bbde019d0ffbe74da4b0ad752ae14fba3f18c9529eb1c146801ada
Instruction Fuzzy Hash: 2B212874E40748AFEB00EFA9C942BEEBBB4EB48714F10803AF514B7691D7795940CB69

Function 00475578 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 00475586
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004669F5), ref: 004755AC
GetWindowLongA.USER32(?,000000EC), ref: 004755BC
SetWindowLongA.USER32(?,000000EC,00000000), ref: 004755DD
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004755F1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047560D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 4cfe30cbd0b59b50aaa83c06e8e94c1e5f2b804bcd768485014b56066da9d383
Instruction ID: 12e21b805ba48ff3c42fcf32cc41c1eec5c80df977ecf80fac4cf51af71c0963
Opcode Fuzzy Hash: 4cfe30cbd0b59b50aaa83c06e8e94c1e5f2b804bcd768485014b56066da9d383
Instruction Fuzzy Hash: AD014CB2645610ABD600D7B8CD81F2A33D8AB0C320F19476AB558EF2E3C679D8458B18

Function 0041B254 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6C4: CreateBrushIndirect.GDI32 ref: 0041A72F

UnrealizeObject.GDI32(00000000), ref: 0041B260
SelectObject.GDI32(?,00000000), ref: 0041B272
SetBkColor.GDI32(?,00000000), ref: 0041B295
SetBkMode.GDI32(?,00000002), ref: 0041B2A0
SetBkColor.GDI32(?,00000000), ref: 0041B2BB
SetBkMode.GDI32(?,00000001), ref: 0041B2C6

Part of subcall function 0041A03C: GetSysColor.USER32(?), ref: 0041A046

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 122a163b2193880f71d3292b64a95471f9b780ee80d013ae274f5a014ad9ffce
Instruction ID: 0f22cd896f62185373a311de716c92a992645b0c1e29599fd5f218cfa0d167d6
Opcode Fuzzy Hash: 122a163b2193880f71d3292b64a95471f9b780ee80d013ae274f5a014ad9ffce
Instruction Fuzzy Hash: 3AF0BB71201500ABDE04FFBAE9CAD4B27ACDF183097048096B904DF1A7CA3CDC608B3A

Function 0046F9DC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 0046FA32
73A159E0.USER32(00000000,000000FC,0046F990,00000000,0046FBC2,?,00000000,0046FBE7), ref: 0046FA59
GetACP.KERNEL32(00000000,0046FBC2,?,00000000,0046FBE7), ref: 0046FA96
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0046FADC

Strings

COMBOBOX, xrefs: 0046FA2B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A159ClassInfoMessageSend
String ID: COMBOBOX
API String ID: 3375322265-1136563877
Opcode ID: 1e153654ae3344bfb8e45a4e8e245cf2872547733f63b53cc96ab755aef26ea5
Instruction ID: 138cf41232d8125400502fbd6eaef6f4dd0fa18489d1afe9aa44850546970e2d
Opcode Fuzzy Hash: 1e153654ae3344bfb8e45a4e8e245cf2872547733f63b53cc96ab755aef26ea5
Instruction Fuzzy Hash: 30518030A00204AFDB50DF65E895EAEB7F5EB08704F1541BAE844DB362EB38ED45CB59

Function 004537EC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00453983,?,00000000,004539C3), ref: 004538C9

Strings

WININIT.INI, xrefs: 004538F8
PendingFileRenameOperations2, xrefs: 00453898
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 0045384C
PendingFileRenameOperations, xrefs: 00453868

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 7a7d3f93bb0f61c9280be79a8205d29edd882a6fb67ab88c9e7bdf572148e07c
Instruction ID: c46a7a88081cef8afab9c47a691f47b0e02e7274124f98e0df333a42af0b072a
Opcode Fuzzy Hash: 7a7d3f93bb0f61c9280be79a8205d29edd882a6fb67ab88c9e7bdf572148e07c
Instruction Fuzzy Hash: 6251C6B0E002489BDB14EF61D851ADEB7B9EF44345F50857BB804A7282DB78AF49CB58

Function 00454950 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,?,00000001,00000000,0047716C,?,?,?,?,?,?,?,?), ref: 00454964
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0045496A
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004549C5

Strings

ChangeWindowMessageFilter, xrefs: 0045495A
user32.dll, xrefs: 0045495F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleMessageModuleProcSend
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 4131673079-2498399450
Opcode ID: bc021dd95022e5360540cf2639710103b0b9d0f53f436339356bbfd594e486fb
Instruction ID: 26abcbd721d1434c8b0b8f1f22e2371ea3f690708ee293562c149011b3514c34
Opcode Fuzzy Hash: bc021dd95022e5360540cf2639710103b0b9d0f53f436339356bbfd594e486fb
Instruction Fuzzy Hash: AFF081F26042406BD700A7B9AC42F7B7A9CC78172DF25047BFD80DF663C5A99888876C

Function 004555E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455610
GetExitCodeProcess.KERNEL32(?,0048D8F3), ref: 00455631
CloseHandle.KERNEL32(?,00455664,?,?,00455E7F,00000000,00000000), ref: 00455657

Strings

MsgWaitForMultipleObjects, xrefs: 0045561D
GetExitCodeProcess, xrefs: 0045563A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 58fddb5448e0289d80e822fdfbbfc1e2bb4764210f0221422b1c828392a2ba55
Instruction ID: 891a224afc9c92cb7f61e1c74de024afb74d909d8a9b5d6332e4ab834f012c0e
Opcode Fuzzy Hash: 58fddb5448e0289d80e822fdfbbfc1e2bb4764210f0221422b1c828392a2ba55
Instruction Fuzzy Hash: E201A270640644AFDB20EBA98C62F3E73A8EB49715FA04576F814DB2D2D6389D04DA1C

Function 0042DC44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(?,?), ref: 0042DC50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DDD3,00000000,0042DDEB,?,?,?,?), ref: 0042DC6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DC71

Strings

RegDeleteKeyExA, xrefs: 0042DC61
advapi32.dll, xrefs: 0042DC66

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 97db6eeaf69e6b5bce7a0a414a7f0a240410ceb0782498fa8d7d035238c1f3e0
Instruction ID: b0d6a2d15e3a0811e94f5f01b3198e97f6922e0a43d587957f6058f328b7875a
Opcode Fuzzy Hash: 97db6eeaf69e6b5bce7a0a414a7f0a240410ceb0782498fa8d7d035238c1f3e0
Instruction Fuzzy Hash: EFE039F0B41230AAD62026777C4ABAB270C9B19365FA04A3BB105F51A292FC5845DB5C

Function 0044EB7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048DCE5), ref: 0044EBB7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EBBD

Strings

NotifyWinEvent, xrefs: 0044EBAD
user32.dll, xrefs: 0044EBB2
HD, xrefs: 0044EB8F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: HD$NotifyWinEvent$user32.dll
API String ID: 1646373207-3826198660
Opcode ID: f286f674aaf7614dcf79a3fe2568934ce18c82c2af6f6931424b4a23e0e5b805
Instruction ID: eb75a9cccac2554bae57c8dba3fc34baaace4da8116a5c7eb126b48a9fc9164b
Opcode Fuzzy Hash: f286f674aaf7614dcf79a3fe2568934ce18c82c2af6f6931424b4a23e0e5b805
Instruction Fuzzy Hash: 06E0ECF09413845AFB01FBAB5806B0D2A90F785308B10087FF14566193C77C64188B2D

Function 00416C10 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C36
SaveDC.GDI32(?), ref: 00416C67
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D29), ref: 00416CC8
RestoreDC.GDI32(?,?), ref: 00416CEF
EndPaint.USER32(00000000,?,00416D30,00000000,00416D29), ref: 00416D23

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: d0d92d8ecc9623660def715b0bd80ab010e1372c2db2e59807ac5db787016297
Instruction ID: 3e3159326600a0989541e2a742afd92806c0a34c2af3a02390c8943471572ba1
Opcode Fuzzy Hash: d0d92d8ecc9623660def715b0bd80ab010e1372c2db2e59807ac5db787016297
Instruction Fuzzy Hash: 86414F70A04218AFDB14DB99C585FAAB7F9FF48308F1640AEE4449B362D778DD41CB58

Function 004147E4 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 0041481A
MulDiv.KERNEL32(?,?,?), ref: 00414834
MulDiv.KERNEL32(?,?,?), ref: 0041485D
MulDiv.KERNEL32(?,?,?), ref: 00414888
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148D0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d2e7fc5b7fb7fe24dea70fe7b2d12285f597e39a194117d0302ec218083c9d
Instruction ID: 4883fbddd944f2be6561fcacf64ddd40de7342fc3614b53169da0d1c8aa22a50
Opcode Fuzzy Hash: b6d2e7fc5b7fb7fe24dea70fe7b2d12285f597e39a194117d0302ec218083c9d
Instruction Fuzzy Hash: B73121756057809FC320EB69C584BA7BBE8AF89714F08891EF8D5C7752D638E880CB15

Function 004297B0 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297EC
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 0042981B
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429862
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429880

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f9fa41bfa0c2a70622a1e6ba29e21105fe949f91a717440d34f12e388c4d62d1
Instruction ID: a062575b4a901e12fd6f128b76fd2d06d8466d65068258292e307c4ed7c0d4dc
Opcode Fuzzy Hash: f9fa41bfa0c2a70622a1e6ba29e21105fe949f91a717440d34f12e388c4d62d1
Instruction Fuzzy Hash: E121B0707407147BE710BA66CC82F4B76ACEB82708F95447EB505FB2D2DB79AD41826C

Function 0041BB9C Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBAE
GetSystemMetrics.USER32(0000000C), ref: 0041BBB8
73A0A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBF6
73A16310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BD61,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BC3D
DeleteObject.GDI32(00000000), ref: 0041BC7E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MetricsSystem$A16310A570DeleteObject
String ID:
API String ID: 2246927583-0
Opcode ID: 7c4990574808dd91df47bf9e931a4c3972f81ae63d9c954261cd2d6ea3640d76
Instruction ID: 32119a26df4cb6bcef4669d98e6894d96ddea8bfc510c44308949a3da23dba00
Opcode Fuzzy Hash: 7c4990574808dd91df47bf9e931a4c3972f81ae63d9c954261cd2d6ea3640d76
Instruction Fuzzy Hash: A9318274E00609EFDB04DFA5C981AAEB7F4EB48700F10856AF914AB381D7789E40DB98

Function 0046CAFC Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00459F24: SetLastError.KERNEL32(00000057,00000000,00459FF0,?,?,?,?,00000000), ref: 00459F8F

GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB89
GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB9F

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

Failed to set permissions on registry key (%d)., xrefs: 0046CBB0
Setting permissions on registry key: %s\%s, xrefs: 0046CB4E
Could not set permissions on the registry key because it currently does not exist., xrefs: 0046CB93

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLast$LocalTime
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 3586426482-4018462623
Opcode ID: 33e46aaa243ce03394e0569f57d836c2483a0b84d40989d792ec939d279f98b9
Instruction ID: 151602ccadc489731ef6365da52f28a5e7e2f939e774e6eb354ce579e2e4186e
Opcode Fuzzy Hash: 33e46aaa243ce03394e0569f57d836c2483a0b84d40989d792ec939d279f98b9
Instruction Fuzzy Hash: 2F210A30A046049FCB00DBAED8826BEBBE5DB49314F50407BF444E7392E7786D058BAA

Function 00403CBC Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403D14
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D1E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D2D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: eccfed10b2dc3ba4ec014aec4ab33983c8d04f66a775d57591e3e531b44e769c
Instruction ID: 130462c07d05b28363deeaafe8667491fd09684ef10d5f25643daadcb478a337
Opcode Fuzzy Hash: eccfed10b2dc3ba4ec014aec4ab33983c8d04f66a775d57591e3e531b44e769c
Instruction Fuzzy Hash: B5F044617542043BE25065A65C43F6B198CCB81B5AF50497FB704FA1D1D8BCAD0443BD

Function 004143C4 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A08830.GDI32(00000000,00000000,00000000), ref: 004143FD
73A022A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414405
73A08830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414419
73A022A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041441F
73A0A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041442A

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A022A08830$A480
String ID:
API String ID: 3036329673-0
Opcode ID: b9d2523b3a2e97aa47ab5b42f10b24f9ea142fcf701ed100683c4f8a4ee59ce7
Instruction ID: e5d33d34636a3f5f5a8a9912c05a8f41f60f5991d540ab00ff2c74128b4d6dab
Opcode Fuzzy Hash: b9d2523b3a2e97aa47ab5b42f10b24f9ea142fcf701ed100683c4f8a4ee59ce7
Instruction Fuzzy Hash: F3017C752183806EE200B6398C85A9F6BDD9FDA714F19446AF494DB283DA79CC018765

Function 00471ABC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00473217,?,00000000,00000000,00000001,00000000,00471D59,?,00000000), ref: 00471D1D

Strings

&0G, xrefs: 00471CDD
Failed to parse "reg" constant, xrefs: 00471D24
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00471B91

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Close
String ID: &0G$Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-3943469032
Opcode ID: ad2ae07570c644154d8923a28d9286c281c1c8999e92ddb6ccca4d09835b0404
Instruction ID: d683e9762bec71dee46ea87895c2867c1f0da78df2ffc48c04af2428528d0d28
Opcode Fuzzy Hash: ad2ae07570c644154d8923a28d9286c281c1c8999e92ddb6ccca4d09835b0404
Instruction Fuzzy Hash: D0813374E001089FDB11EF99C585ADEBBF9AF48314F10C56BE814A73A1D738AE45CB98

Function 00424CC4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F058: GetActiveWindow.USER32 ref: 0041F05B
Part of subcall function 0041F058: GetCurrentThreadId.KERNEL32 ref: 0041F070
Part of subcall function 0041F058: 73A15940.USER32(00000000,Function_0001F034), ref: 0041F076

Part of subcall function 0042318C: GetSystemMetrics.USER32(00000000), ref: 0042318E

OffsetRect.USER32(?,?,?), ref: 00424DAD
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E70
OffsetRect.USER32(?,?,?), ref: 00424E81

Part of subcall function 00423548: GetCurrentThreadId.KERNEL32 ref: 0042355D
Part of subcall function 00423548: SetWindowsHookExA.USER32(00000003,00423504,00000000,00000000), ref: 0042356D
Part of subcall function 00423548: CreateThread.KERNEL32(00000000,000003E8,004234B4,00000000,00000000), ref: 00423591

Part of subcall function 00424B10: SetTimer.USER32(00000000,00000001,?,00423498), ref: 00424B2B

Strings

ZLB, xrefs: 00424CD7, 00424DB5

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A15940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: ZLB
API String ID: 4121718042-1517572801
Opcode ID: dd23933aa76bd6db6f5a5c28690e338afce2f8f9b9b71d8d371c815c0713ccaa
Instruction ID: 63cb71acd3104e73ed6fc4d364f61f1193248ff3399ee0993d53c82e8fb04522
Opcode Fuzzy Hash: dd23933aa76bd6db6f5a5c28690e338afce2f8f9b9b71d8d371c815c0713ccaa
Instruction Fuzzy Hash: A1813571A00218CFDB14DFA8C884ADEBBF4FF49314F51416AE904AB296E738AE45CF54

Function 00406F3C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F9B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00407015
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040706D

Strings

Z, xrefs: 00406FD4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 67a01e040447e774e576e8a665c798b7a07ce193432bdf0c342fe4e3fedfe949
Instruction ID: 5caf70ca5bbd669fd2e2c7b1b3e2dce8d45954f2aeddfa47fa99723591ada552
Opcode Fuzzy Hash: 67a01e040447e774e576e8a665c798b7a07ce193432bdf0c342fe4e3fedfe949
Instruction Fuzzy Hash: 70514170E04209AFDB11DF65C981A9FB7B9FB49304F1045BAE540BB3D1C778AE418B5A

Function 0042E79C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,00000000,0042E8EF,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042E7C6

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(?,00000000), ref: 0042E7E9
73A0A480.USER32(00000000,?,0042E8D4,00000000,0042E8CD,?,00000000,00000000,0042E8EF,?,?,?,?,00000000,00000000,00000000), ref: 0042E8C7

Strings

...\, xrefs: 0042E879

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 74336d573a74e3698fb3570375686f73f17764e844b15c5fb6835e350ec9c933
Instruction ID: aa7e33738bf35b786d25299c783c6e6fcf8cad152cb713b23b6674a7a4078742
Opcode Fuzzy Hash: 74336d573a74e3698fb3570375686f73f17764e844b15c5fb6835e350ec9c933
Instruction Fuzzy Hash: F6314F70B00129ABDF11EB9AD881BAEB7B8EF48304F90447BF400A7291D7789E41CA59

Function 00455120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,0045528D,?,?,00000000,00000000,0048DDCF,00000000), ref: 00455161

Strings

Log opened., xrefs: 00455260
%.4u-%.2u-%.2u, xrefs: 00455193
%s Log %s #%.3u.txt, xrefs: 004551CE

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: LocalTime
String ID: %.4u-%.2u-%.2u$%s Log %s #%.3u.txt$Log opened.
API String ID: 481472006-3806465849
Opcode ID: 3a986ec1deacf9a8af90cccb36a694523831aa442be5d47b885d18f483d23920
Instruction ID: 65e3167ce6f7fc665200a2cb316b898927ffde9a8a765fe92d3812842a2b7bb4
Opcode Fuzzy Hash: 3a986ec1deacf9a8af90cccb36a694523831aa442be5d47b885d18f483d23920
Instruction Fuzzy Hash: 3F412870D04648AFDB00DFA5D8917EEBBF5EB49305F60806AF804B7282E7785A49CF65

Function 00451C2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D1B
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D2B

Strings

_iu, xrefs: 00451CBD
.tmp, xrefs: 00451CCF

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 5db77514392e1cc04d93f1fcaad37a2866ea9c712e95f6d9182bb189e3a572e2
Instruction ID: 66189d9121b5f6debfe8db516a2db4e956e41d4f88176e9b7dd5da347c02f09b
Opcode Fuzzy Hash: 5db77514392e1cc04d93f1fcaad37a2866ea9c712e95f6d9182bb189e3a572e2
Instruction Fuzzy Hash: B6318570A00119ABDB11EFA5C982B9EB7B5AF44305F60456AF800B73D2D7786F09D7AC

Function 0048840C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,0048850A,?,?,00000001,00000000,00000000,00488525), ref: 004884F3

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00488466
Inno Setup CodeFile: , xrefs: 004884B6
%s\%s_is1, xrefs: 00488484

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup CodeFile: $Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1837835967
Opcode ID: 62435fd8610d23cf96015e51cbfdcde2eb3296c626539face596322b35ce2ef4
Instruction ID: f99006221241de176dd8a0cb1e84c1df124de6a646b4e4928a51123b4443cf72
Opcode Fuzzy Hash: 62435fd8610d23cf96015e51cbfdcde2eb3296c626539face596322b35ce2ef4
Instruction Fuzzy Hash: 25319774A00214AFDB01EFA6CC5169EBBF8EB48704F90487EE904E7381DB7CAD018B59

Function 0048CFEC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

ShowWindow.USER32(?,00000005,00000000,0048D21B,?,?,00000000), ref: 0048D022

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D793

Part of subcall function 00407240: SetCurrentDirectoryA.KERNEL32(00000000,?,0048D04A,00000000,0048D1E7,?,?,00000005,00000000,0048D21B,?,?,00000000), ref: 0040724B

Part of subcall function 0042D308: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D393,?,?,00000000,?,?,0048D054,00000000,0048D1E7,?,?,00000005), ref: 0042D33D

Strings

.msg, xrefs: 0048D0C4
Uninstall, xrefs: 0048D008
IMsg, xrefs: 0048D0B8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .msg$IMsg$Uninstall
API String ID: 3312786188-3145681768
Opcode ID: 1cfdc33d8fd86c54b66456d3de8116b0582539fdc6312dc0e5594fa963ac89a0
Instruction ID: c6641748e2ca678123da94d9d17bcca202b605359f7ea2f0cb6afc5440a23085
Opcode Fuzzy Hash: 1cfdc33d8fd86c54b66456d3de8116b0582539fdc6312dc0e5594fa963ac89a0
Instruction Fuzzy Hash: E9318234A10204AFDB00FFA5CC52D5E7BB5FB49304F51897AF800AB392DA78AD05CB58

Function 004163F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 00416463
UnregisterClassA.USER32(?,00400000), ref: 0041648F
RegisterClassA.USER32(?), ref: 004164B2

Strings

@, xrefs: 0041640D

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 34951d3f007ec4f8100455fcabade461f83daaf4babe711838291792725becaa
Instruction ID: 96fe5100f918c2d7f7d0408739941949d78fb7343742cde4a8304e61d215b847
Opcode Fuzzy Hash: 34951d3f007ec4f8100455fcabade461f83daaf4babe711838291792725becaa
Instruction Fuzzy Hash: 07316D706043409BD720EF69C98179B77E5AB45308F00487EF985CB392DB39D984CB6A

Function 0044F374 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000000E,00000000,00000000), ref: 0044F3D8
SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044F41A
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044F44B

Strings

open, xrefs: 0044F43E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessageSend$ExecuteShell
String ID: open
API String ID: 2179883421-2758837156
Opcode ID: 8d80b9c82b0a76361b38064e088d6aeaa5eb5f4118ce6336a6d1d0298eb6e2e7
Instruction ID: d594631ee7f1ae48ac709d007f4123db1ab5c6be92308301378f02d27c9fdfb2
Opcode Fuzzy Hash: 8d80b9c82b0a76361b38064e088d6aeaa5eb5f4118ce6336a6d1d0298eb6e2e7
Instruction Fuzzy Hash: 04216170E40204AFEB10EF69CC82B9EB7B8AB44714F10817BB511F72D1DB78AE458A58

Function 0048D3CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0048DC69,00000000,0048D4C2,?,?,00000000,0048F628), ref: 0048D43C
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0048DC69,00000000,0048D4C2,?,?,00000000,0048F628), ref: 0048D465
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0048D47E

Strings

isRS-%.3u.tmp, xrefs: 0048D41B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: da374f06aa09420c1cd24a0cf3d824fda0cd3be492eff802b8247247c293a327
Instruction ID: 590f0f0d50fa6108802e31e12c00657aa42c043d559cd0ea5b6598a5f09708e9
Opcode Fuzzy Hash: da374f06aa09420c1cd24a0cf3d824fda0cd3be492eff802b8247247c293a327
Instruction Fuzzy Hash: D8219870D011196BCB04FFA9CC81AAFB7B8EF44714F10453AA814F32D1D67C6E018B58

Function 0045456C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004545C0
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 004545ED

Strings

RegisterTypeLib, xrefs: 004545F8
LoadTypeLib, xrefs: 004545CB

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 66fba9a3efcefaf8abb209dd86a387d39cd04f7aeba129959e3b5c190f0f1fed
Instruction ID: 9e7d3eed9420e96e98b4ffd8ab70e8db3cf66198a8ad69df7fdc2f6129c4d7e7
Opcode Fuzzy Hash: 66fba9a3efcefaf8abb209dd86a387d39cd04f7aeba129959e3b5c190f0f1fed
Instruction Fuzzy Hash: 6511B470B00604BFD710EFA6DC51B4EBBADEB8A309F108476F904D7652DA3C9D44CA18

Function 00468558 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 00468560
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046856F

Strings

(invalid), xrefs: 004685F2
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 004685E4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: a357ac15713120fb92cd8febf7d1a530414491eb9c6a31f70f403759793ab6e5
Instruction ID: 1a03eee91b69854eff7ce2b3f4f25234da1b29834e82ffa079989c22f4912ddb
Opcode Fuzzy Hash: a357ac15713120fb92cd8febf7d1a530414491eb9c6a31f70f403759793ab6e5
Instruction Fuzzy Hash: 50110AA040C3919AD340DF2AC44032BBBE4AB89714F04896EF8D8D6391E77DC948DB7B

Function 004521C2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004521CF

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

MoveFileA.KERNEL32(00000000,00000000), ref: 004521F4

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

MoveFile, xrefs: 004521FD
DeleteFile, xrefs: 004521E0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 123f48d79d574da9d0afee727d89f8f41ee1a9216ba592c855740c09e5e2651e
Instruction ID: 73cd3731637806c9e239ea355c70be816798c2ab8ed9feda3c0043baa9865e71
Opcode Fuzzy Hash: 123f48d79d574da9d0afee727d89f8f41ee1a9216ba592c855740c09e5e2651e
Instruction Fuzzy Hash: 59F086742042444AEB04FBB6D942A6F63E8DB45306F60443BFC04B76C3DA7C9D09893C

Function 0047A324 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047A365
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047A388

Strings

CSDVersion, xrefs: 0047A35C
System\CurrentControlSet\Control\Windows, xrefs: 0047A332

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 0417c6deb749b333bfe0f37695fb775cc13902ad7745e467610162d9abc67fa6
Instruction ID: 4d0d098675958abd99c59db276b877f044ce08efc5c483be0c27f9dac492b315
Opcode Fuzzy Hash: 0417c6deb749b333bfe0f37695fb775cc13902ad7745e467610162d9abc67fa6
Instruction Fuzzy Hash: 85F04475E00209EAEF10DED18C45BDFB3BC9B44704F108567FA18E7280E67C9A548B6B

Function 0042D7AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00451ECA,00000000,00451F6D,?,?,00000000,00000000,00000000,00000000,00000000,?,00452239,00000000), ref: 0042D7C6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D7CC

Strings

kernel32.dll, xrefs: 0042D7C1
GetSystemWow64DirectoryA, xrefs: 0042D7BC

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 8a30ddc55fc689d3c3f8c4bfc58232c6cdc9ec5b771d74d1fc17cd83e1762f27
Instruction ID: 216c82e5c178693522dd7469f913417b51dece3e0b849151a4bde9421215c481
Opcode Fuzzy Hash: 8a30ddc55fc689d3c3f8c4bfc58232c6cdc9ec5b771d74d1fc17cd83e1762f27
Instruction Fuzzy Hash: ABE026A0F40B1126D720757E2C83A5B108D8BC4725FA0443F7956E52D7EDFCC94006BD

Function 00409B18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,SetProcessDPIAware,?,00409B5D,0048DCBD), ref: 00409B23
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00409B29

Strings

SetProcessDPIAware, xrefs: 00409B19
user32.dll, xrefs: 00409B1E

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetProcessDPIAware$user32.dll
API String ID: 1646373207-1137607222
Opcode ID: 4d190fb78413c4bd0883655ca5f6bd8107793786181136429c932c165ebb40cb
Instruction ID: eab02f189f05b274720f6d510884989c2924ac651145e97c4e780478f5688ef0
Opcode Fuzzy Hash: 4d190fb78413c4bd0883655ca5f6bd8107793786181136429c932c165ebb40cb
Instruction Fuzzy Hash: 58B092C1382B46A6ED10B2F22CD7E6B6B6CA920B79720413B7380751C3CDBDEC10552E

Function 0048DAB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048DD2C,00000001,00000000,0048DD50), ref: 0048DABA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0048DAC0

Strings

user32.dll, xrefs: 0048DAB5
DisableProcessWindowsGhosting, xrefs: 0048DAB0

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: ae566bde2fc7f01c2885b68a039f4b5741a3c27302e5ea3702dd7d159761417c
Instruction ID: 43d8801982fa3daa7d9ed8f0223e906238e62c9c07c1a204c8a680c842ecbdc6
Opcode Fuzzy Hash: ae566bde2fc7f01c2885b68a039f4b5741a3c27302e5ea3702dd7d159761417c
Instruction Fuzzy Hash: E5B09280E4AB02608C1832B20C02A1F0A08488072873808273400A00C3CD6C8500466D

Function 0045F050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044A890: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EBAD,0048DCE5), ref: 0044A8B7
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044A8CF
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044A8E1
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044A8F3
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044A905
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A917
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A929
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044A93B
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044A94D
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044A95F
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044A971
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044A983
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044A995
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044A9A7
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044A9B9
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044A9CB
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044A9DD
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044A9EF

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0048DD03), ref: 0045F05F
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0045F065

Strings

shell32.dll, xrefs: 0045F05A
SHPathPrepareForWriteA, xrefs: 0045F055

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 5d519e86c63e78d57e5057e0c841dd2176684f15296313c83dba8c66038960cd
Instruction ID: 7d0747962de82d9d2aac18a7f55b25c3ffa35f9cf178e03a243595302916d775
Opcode Fuzzy Hash: 5d519e86c63e78d57e5057e0c841dd2176684f15296313c83dba8c66038960cd
Instruction Fuzzy Hash: ADB092B0A91B00609E00F7BA1883B0F1098C449B1AB2406BF35047A0D3CA7C104D8A1E

Function 00413CDC Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D2A
GetDesktopWindow.USER32 ref: 00413DE2

Part of subcall function 00418EA4: 6F58C6F0.COMCTL32(?,00000000,00413FA7,00000000,004140B7,?,?,0048F628), ref: 00418EC0
Part of subcall function 00418EA4: ShowCursor.USER32(00000001,?,00000000,00413FA7,00000000,004140B7,?,?,0048F628), ref: 00418EDD

SetCursor.USER32(00000000,?,?,?,?,00413AD7,00000000,00413AEA), ref: 00413E20

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 861c570973094854ccbd8c8321d2c4d40f09d5c1caf36c3bd11ef8ba7df2e374
Instruction ID: 100525f957ecdfcd78a92647e46673428d166f253b267b63c2260cf8966f0b2b
Opcode Fuzzy Hash: 861c570973094854ccbd8c8321d2c4d40f09d5c1caf36c3bd11ef8ba7df2e374
Instruction Fuzzy Hash: 2A414175600250AFC700EF39E994B5E3BE1EB45305B24887EE404DB366DA38DD89CF58

Function 004089EC Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A0D
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408A7C
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B17
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B56

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: e6dda218e5b55bd48ff680e5991621e34b15ee6e694d87815f4aef8d55aaf21f
Instruction ID: d22533e99778954fd6890cb294b7f4ce66091e3ab3492f154047a21023ac2c2b
Opcode Fuzzy Hash: e6dda218e5b55bd48ff680e5991621e34b15ee6e694d87815f4aef8d55aaf21f
Instruction Fuzzy Hash: 173132716083819ED330EB658945B9B77D89B86704F00483EB6C8EB2D2DB789918876B

Function 0044DCE0 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044DD29

Part of subcall function 0044C49C: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C4CE

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044DDAD

Part of subcall function 0042BB98: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBAC

IsRectEmpty.USER32(?), ref: 0044DD6F
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044DD92

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 03405822ec41223206aa390bb074f4b419e4d090b363351e3cf2306338ee5558
Instruction ID: 30bc2259219ab74a13e734c277fbf9002091a886e5add9d82bb97a75e95c6f52
Opcode Fuzzy Hash: 03405822ec41223206aa390bb074f4b419e4d090b363351e3cf2306338ee5558
Instruction Fuzzy Hash: 88115EB1B4031027E710BA7E8C86B5B66899B84748F04083FB545EB387DE7DDC054399

Function 0048ABD8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 0048AC3C
OffsetRect.USER32(?,00000000,?), ref: 0048AC57
OffsetRect.USER32(?,?,00000000), ref: 0048AC71
OffsetRect.USER32(?,00000000,?), ref: 0048AC8C

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 14e81da9c9acbaf65ffa382ec7e5c04f8e81d0cf7f0d7997142d568a55a92133
Instruction ID: e02d33c2e389b425dfbe20bc442842329bb4e49dd26702c6487ee092cefc6ea8
Opcode Fuzzy Hash: 14e81da9c9acbaf65ffa382ec7e5c04f8e81d0cf7f0d7997142d568a55a92133
Instruction Fuzzy Hash: 15217CB67042019BD700EE69CD85E6BB7DAEBC4314F148E2AF684C7289D634E8548756

Function 004171FC Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417244
SetCursor.USER32(00000000), ref: 00417287
GetLastActivePopup.USER32(?), ref: 004172B1
GetForegroundWindow.USER32(?), ref: 004172B8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: f8f1459e73c1737ae874a770815550efbc0c4d2ded2b0ee8fca873e472ac491b
Instruction ID: f9e52058b1df3929264a40ec4b96364ab953ebed90a5a3d5dd1108ebb9aca0b4
Opcode Fuzzy Hash: f8f1459e73c1737ae874a770815550efbc0c4d2ded2b0ee8fca873e472ac491b
Instruction Fuzzy Hash: 0D21C1302046008ACB10EB79C980ADB33B0AB58764B1549ABF4158B3A2D73DCCC6CB4D

Function 0048A928 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000000,?), ref: 0048A945
MulDiv.KERNEL32(50142444,00000008,?), ref: 0048A958
MulDiv.KERNEL32(F7AD0FE8,00000000,?), ref: 0048A974
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0048A99B

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86be9bb8a614bca92572f6fa94aced873a8c49fd5365594b564b5dc022d3f7c
Instruction ID: 815dad5bbffd4218c2d18f62b6f2c5a3c0c9f6df475912d52f958762b40ff306
Opcode Fuzzy Hash: e86be9bb8a614bca92572f6fa94aced873a8c49fd5365594b564b5dc022d3f7c
Instruction Fuzzy Hash: 3421E7B2A00208AFCF40DFADC8C4E9EB7ECAF4C314B144596F918DB246D674EA408F65

Function 0041F464 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F454,?), ref: 0041F485
UnregisterClassA.USER32(0041F454,00400000), ref: 0041F4AE
RegisterClassA.USER32(0048E598), ref: 0041F4B8
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F4F3

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: b84ff5c321f694adbc635e84f68dfb870052098fa3c25224639b04288103a1f2
Instruction ID: f93f49962aacb077ae777ebbe7ef4c74946adada8453ae8d4e4775add4519b75
Opcode Fuzzy Hash: b84ff5c321f694adbc635e84f68dfb870052098fa3c25224639b04288103a1f2
Instruction Fuzzy Hash: 6F015671240104BFCB10EFA9EC81E9F379CA709304B10493EB905EB2E2D6399C559B6D

Function 0040D1E4 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D1FB
LoadResource.KERNEL32(00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?,?,00473F28,0000000A,REGDLL_EXE), ref: 0040D215
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?,?,00473F28), ref: 0040D22F
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?), ref: 0040D239

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 5163b48e9066bbc02aa40720a7f26dd8186bb0c7b63f2b57d2cf3de8d48ed1bf
Instruction ID: 8db5021709dd77ea604f1e723d517c79986f87b5122f3d7ad427a3c2eb2b1bf1
Opcode Fuzzy Hash: 5163b48e9066bbc02aa40720a7f26dd8186bb0c7b63f2b57d2cf3de8d48ed1bf
Instruction Fuzzy Hash: 08F0FFB36056046F9B45EE9DA881D6B76ECDE8C364310016FF908EB246DA39DD114B7C

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0048F420,0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0048F420,00401A89,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: c4298845c094fbae6b250853fcf837dad876c39d6116747930555f37ab6491e3
Instruction ID: 3764bd7d9839a2e8440ab870b903eae0a12f7a1843275c43a8f52c3cf542d08c
Opcode Fuzzy Hash: c4298845c094fbae6b250853fcf837dad876c39d6116747930555f37ab6491e3
Instruction Fuzzy Hash: 0901AD70A442405EF319BBAD9802B2F3AD4D765B48F21883FF400A6AF2C77C4848CB2D

Function 00453EB0 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,?,?,00000000,00458775), ref: 00453EEC
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,00000000,00458775), ref: 00453EF5
RemoveFontResourceA.GDI32(00000000), ref: 00453F02
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00453F16

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: db28e9a48c63d11007079e1c9041e9b1027b7f887feb080b760cdd44dd87aecd
Instruction ID: 5a19bb75b35b1d8e01697aa632786c99bd0a25d7aaca8bddf380f17a9d408612
Opcode Fuzzy Hash: db28e9a48c63d11007079e1c9041e9b1027b7f887feb080b760cdd44dd87aecd
Instruction Fuzzy Hash: DBF054B575431076EA14B6B69C87F1B128C8F88745F10483EBA01EB1C3D57CDD04572D

Function 00424224 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 00424230
IsWindowVisible.USER32(?), ref: 00424241
IsWindowEnabled.USER32(?), ref: 0042424B
SetForegroundWindow.USER32(?), ref: 00424255

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 66eaf79e65ca4ea0e7ac17de12a2cbdda6b479aec23822bf5989b5b8de2818db
Instruction ID: 5eff8a0874282e956bf62455a0d13f95e5f7646420470d1771721f59a762a120
Opcode Fuzzy Hash: 66eaf79e65ca4ea0e7ac17de12a2cbdda6b479aec23822bf5989b5b8de2818db
Instruction Fuzzy Hash: 77E08691702531969A257B27184299B128CADC93C534601A7BE26F7243DB1CCC0441BC

Function 0040627C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040627F
GlobalUnlock.KERNEL32(00000000), ref: 00406286
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040628B
GlobalLock.KERNEL32(00000000), ref: 00406291

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: 889bbec20cac368bcc6ff395ca8b0ac0bd4d5ac0b0bff3282dff31200e64140b
Instruction ID: ac93097bb4ba1240b9e32603a5e5193d1905c962d9d436e0b1c7c2bb43652313
Opcode Fuzzy Hash: 889bbec20cac368bcc6ff395ca8b0ac0bd4d5ac0b0bff3282dff31200e64140b
Instruction Fuzzy Hash: 27B009C5A24A85B8EC0873B24C9BC3F451CE88472C784AB6E7504BA0839D7C9C012E3D

Function 00464DF4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00464FE1
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00464FE7

Strings

CurPageChanged, xrefs: 0046516F

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 9e7b9b78fa86c145b3393aca8e2b4fef4f02e78fa920a13a92a8af896d41c346
Instruction ID: 73e123d7b048144e5044711a2fba28884cd8e662dddc32558297862f60887793
Opcode Fuzzy Hash: 9e7b9b78fa86c145b3393aca8e2b4fef4f02e78fa920a13a92a8af896d41c346
Instruction Fuzzy Hash: 6FA10734700204DFCB55DB69D985AAD73F5BF89304F2640BAF8049B362EB39AE41DB49

Function 00455348 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u , xrefs: 004553D9
, xrefs: 00455426

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: LocalTime
String ID: $%.4u-%.2u-%.2u %.2u:%.2u:%.2u
API String ID: 481472006-3002923774
Opcode ID: fd87415d760af0d7319028329decfea042fa4f328fee7753221da96d8acd4982
Instruction ID: 181f1faefe31f5a493d1aa1befc055b8f813f7f7130add50f950edd0bfb78ac3
Opcode Fuzzy Hash: fd87415d760af0d7319028329decfea042fa4f328fee7753221da96d8acd4982
Instruction Fuzzy Hash: FE41B070904A08AFCB11DFA9D8517BDBBF4EF49306F11007AEC00A7292D7389D49CB68

Function 004668E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; aborting., xrefs: 004669D0
Failed to proceed to next wizard page; showing wizard., xrefs: 004669E4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: f60768d55020391e8387528d05b0849c9bfb1565251ebea30e5bac66ebeee771
Instruction ID: 0d8be114483272257ae73b946d8ae1e349dfea27ea3b44e1ced370de32ae349c
Opcode Fuzzy Hash: f60768d55020391e8387528d05b0849c9bfb1565251ebea30e5bac66ebeee771
Instruction Fuzzy Hash: B031C470A04244AFD701EBA5C845E9D77F4EF49704F6684BAF804AB351E778AD44CB19

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0048F420,00000000,A), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0048F420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0048F420,0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0048F420,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0048F420,00401A89,00000000,00401A82,?,?,0040222E,0218403C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

A, xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: A
API String ID: 2227675388-3984982982
Opcode ID: c0fc7b1407729a07a9f55eaa9f875f2258e950771fafab1b3121ebc7a7cb5fe0
Instruction ID: 5df7d67c1615c52c03ce927135b27d51951973f0bdb8931f617d2c305985a5b3
Opcode Fuzzy Hash: c0fc7b1407729a07a9f55eaa9f875f2258e950771fafab1b3121ebc7a7cb5fe0
Instruction Fuzzy Hash: 7911E231B042046EE711AB7D5E1961B6AD49795758B24087FF404F32D2D9BD8C06835C

Function 00446974 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

SysFreeString.OLEAUT32(?), ref: 00446A26

Strings

Unknown Method, xrefs: 004469FF
NIL Interface Exception, xrefs: 004469C8

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: aa5954c65c79b3c9622b4833c6df89e1262215388601174cecb39748ea90a391
Instruction ID: 949aeaf05e8288bae369653f44acc0fd1cbbb43b56aa61f1cb8425134fee98eb
Opcode Fuzzy Hash: aa5954c65c79b3c9622b4833c6df89e1262215388601174cecb39748ea90a391
Instruction Fuzzy Hash: AB119A71B046489FD704DFA58D51AAEBABCEF0A704F92407EF500F7281DA7859048B6A

Function 0048BA08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0048BAD0,?,0048BAC4,00000000,0048BAAB), ref: 0048BA76
CloseHandle.KERNEL32(0048BB10,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0048BAD0,?,0048BAC4,00000000), ref: 0048BA8D

Part of subcall function 0048B960: GetLastError.KERNEL32(00000000,0048B9F8,?,?,?,?), ref: 0048B984

Strings

D, xrefs: 0048BA50

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: bea272375ce436631273bfb595c149e7d7b8f991ab183c221150d9d707f025d1
Instruction ID: 96059156585efc2ec1c61d6d141f08077575c5cc7a83de5cc0ae5e5cc79f5464
Opcode Fuzzy Hash: bea272375ce436631273bfb595c149e7d7b8f991ab183c221150d9d707f025d1
Instruction Fuzzy Hash: 320182B0604608AED704EBD1CC92B9F77ACDF48704F50043AF904E7290D7785E0087AC

Function 0042DB64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DB78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBB8

Strings

Inno Setup: No Icons, xrefs: 0042DB76

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 5554410056de8baf5c9536c3c7cce48e4cd29bb77eae3260308c3d9aed490aa8
Instruction ID: f17eae8e65927e4d6b00a5528909b55375a469b29775858eb3a4d38f160daf00
Opcode Fuzzy Hash: 5554410056de8baf5c9536c3c7cce48e4cd29bb77eae3260308c3d9aed490aa8
Instruction Fuzzy Hash: EA012B31B4537079FB3045216D51B7B5F8C9B86B60F66053BF942EA2C0D698BC04936E

Function 0046EA10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

MoveFileA.KERNEL32(00000000,00000000), ref: 0046EA6E

Part of subcall function 0046E8C0: GetLastError.KERNEL32(00000000,0046E9AC,?,?,?,00490028,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0046EA33,00000001), ref: 0046E8E1

Strings

MoveFile, xrefs: 0046EA49
DeleteFile, xrefs: 0046EA27

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: 5fab1e1bf51a151f843ffe4523c2e5d314248cd481c441d76ffd1cc86133038d
Instruction ID: 4e799b1a7958d4a8895c10ad5ba05e712b67fa6bdaaf9f7363ae9b20e7d8e13f
Opcode Fuzzy Hash: 5fab1e1bf51a151f843ffe4523c2e5d314248cd481c441d76ffd1cc86133038d
Instruction Fuzzy Hash: 48F062B910021097DE107AEBD54265A33C8AF02398B10457BF940BF383FA7D9C0547AF

Function 0040335C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0048DCAE), ref: 00403363
GetCommandLineA.KERNEL32(00000000,0048DCAE), ref: 0040336E

Strings

U1h0@, xrefs: 00403383

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1h0@
API String ID: 2123368496-562697224
Opcode ID: 9d10941dfa9e1d437e5dd8cb7fa395e763803e4e1a6a6c32adc6fe8aef801aec
Instruction ID: 98ca9cfa305ca466de0d1038b5a8d6623ff0a8a1ad94bf27ed1ec7dccf49427d
Opcode Fuzzy Hash: 9d10941dfa9e1d437e5dd8cb7fa395e763803e4e1a6a6c32adc6fe8aef801aec
Instruction Fuzzy Hash: 1FC002745012008ED7506F6678453096A949742349F9048BFB104FA1E3D67C47495BDE

Function 00453788 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 004537A7
Sleep.KERNEL32(?), ref: 004537B7
GetLastError.KERNEL32 ref: 004537CA
GetLastError.KERNEL32 ref: 004537D4

Memory Dump Source

Source File: 00000001.00000002.2270380494.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2270355357.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270476097.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2270499928.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L00DR.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 0d2e8e0af8ce227aa63bd85f97137a822896dade59bd38fc2fda2ba06bebf870
Instruction ID: fdbe6ac3cd63d7016b55b8eed32655bc7f85bdd2ebc742b670e9e992def2f257
Opcode Fuzzy Hash: 0d2e8e0af8ce227aa63bd85f97137a822896dade59bd38fc2fda2ba06bebf870
Instruction Fuzzy Hash: 6CF0F6F6E01114574B20A9AB888552FB25CDA883A7720C12BEC05D7203D439DE0856A8

Analysis Process: Xming.exePID: 1532, Parent PID: 6728COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	72

Executed Functions

Function 0043FCE0 Relevance: 143.0, APIs: 67, Strings: 14, Instructions: 1239COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,cyg_screen_prop rl), ref: 0043FD18
SetCursor.USER32(?,?,cyg_screen_prop rl), ref: 00440FBC
DefWindowProcA.USER32(?,?,?,?,?,cyg_screen_prop rl), ref: 00441054

Strings

winWindowProc - WM_SIZE - window w: %d h: %d, new client area w: %d h: %d, xrefs: 00440217
winWindowProc - WM_ACTIVATEAPP, xrefs: 00440E3E
TaskbarCreated, xrefs: 0043FFFE
winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation, xrefs: 00440DA8
winWindowProc - WM_*KEYDOWN - Closekey hit, quitting, xrefs: 00440C2B
winWindowProc - _TrackMouseEvent failed, xrefs: 00440647
cyg_screen_prop rl, xrefs: 0043FD10, 00440020
winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were intializing. This is very bad and unexpected. Exiting., xrefs: 0044005F
winWindowProc - WM_MANAGE, xrefs: 00440FCB
winWindowProc - WM_DISPLAYCHANGE - orig bpp: %d, last bpp: %d, new bpp: %d, xrefs: 0044009B
winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d, xrefs: 004400B1
winWindowProc - WM_UNMANAGE, xrefs: 00440FFC
winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting., xrefs: 00440AF6
winWindowProc - Disruptive change in depth, xrefs: 004400DD

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: CursorProcPropWindow
String ID: TaskbarCreated$cyg_screen_prop rl$winWindowProc - Disruptive change in depth$winWindowProc - WM_*KEYDOWN - Closekey hit, quitting$winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation$winWindowProc - WM_ACTIVATEAPP$winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting.$winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were intializing. This is very bad and unexpected. Exiting.$winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d$winWindowProc - WM_DISPLAYCHANGE - orig bpp: %d, last bpp: %d, new bpp: %d$winWindowProc - WM_MANAGE$winWindowProc - WM_SIZE - window w: %d h: %d, new client area w: %d h: %d$winWindowProc - WM_UNMANAGE$winWindowProc - _TrackMouseEvent failed
API String ID: 3759727132-1401679547
Opcode ID: d10a62e38a41dce56962ffa31a19988014cffbf4c84d03105933e7b5aec6f26a
Instruction ID: 5419cb48b985f3acb0410678a35220eaf4ed0e64ca6f6167777ab3a53f3512f0
Opcode Fuzzy Hash: d10a62e38a41dce56962ffa31a19988014cffbf4c84d03105933e7b5aec6f26a
Instruction Fuzzy Hash: 8CB28230900205DFFB24DF14D98AB6A37B6BB54304F044567E6049B2B2CBBDACD8EB59

Function 00445260 Relevance: 111.0, APIs: 40, Strings: 23, Instructions: 729COMMON

Download Yara Rule

Strings

winClipboardFlushXEvents - SelectionNotify - XConvertSelection () failed for UTF8String, aborting: %d, xrefs: 00445888
TARGETS, xrefs: 004452B0
winClipboardFlushXEvents - SelectionNotify - Unknown format. Cannot request conversion, aborting., xrefs: 004458DA
XConverterNotFound, xrefs: 00445A4D
winClipboardFlushXEvents - SelectionNotify malloc failed for pwszUnicodeStr, aborting., xrefs: 00445B00
winClipboardFlushXEvents - SelectionNotify - XGetWindowProperty () failed, aborting: %d, xrefs: 0044595B
XNoMemory, xrefs: 00445A46
winClipboardFlushXEvents - SelectionRequest - XChangeProperty failed: %d, xrefs: 0044542C, 004456BC
winClipboardFlushXEvents - SelectionNotify - X*TextPropertyToTextList returned: , xrefs: 00445A31, 00445ABD, 00445B52
winClipboardFlushXEvents - Could not lock global memory for clipboard transfer, xrefs: 00445B88
CYGX_CUT_BUFFER, xrefs: 0044526E
winClipboardFlushXEvents - SelectionRequest - X*TextListToTextProperty failed: %d, xrefs: 00445656
UTF8_STRING, xrefs: 0044527D
COMPOUND_TEXT, xrefs: 00445292
winClipboardFlushXEvents - SelectionRequest - XSendEvent () failed, xrefs: 004454A5, 0044575F
winClipboardFlushXEvents - SelectionNotify - X*TextPropertyToTextList list_return is NULL., xrefs: 00445A14
winClipboardFlushXEvents - SelectionRequest - OpenClipboard () failed: %08x, xrefs: 00445500
winClipboardFlushXEvents - CF_TEXT is not available from Win32 clipboard. Aborting., xrefs: 004454D5
winClipboardFlushXEvents - SelectionRequest - GetClipboardData () failed: %08x, xrefs: 00445567
winClipboardFlushXEvents - CF_UNICODETEXT is not available from Win32 clipboard. Aborting., xrefs: 004454C0
winClipboardFlushXEvents - SelectionNotify GlobalAlloc failed, aborting: %ld, xrefs: 00445B67
winClipboardFlushXEvents - SelectionNotify - XConvertSelection () failed for CompoundText, aborting: %d, xrefs: 004458BE
winClipboardFlushXEvents - SelectionRequest - XSendEvent () failed for abort event., xrefs: 00445825

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID:
String ID: COMPOUND_TEXT$CYGX_CUT_BUFFER$TARGETS$UTF8_STRING$XConverterNotFound$XNoMemory$winClipboardFlushXEvents - CF_TEXT is not available from Win32 clipboard. Aborting.$winClipboardFlushXEvents - CF_UNICODETEXT is not available from Win32 clipboard. Aborting.$winClipboardFlushXEvents - Could not lock global memory for clipboard transfer$winClipboardFlushXEvents - SelectionNotify - Unknown format. Cannot request conversion, aborting.$winClipboardFlushXEvents - SelectionNotify - X*TextPropertyToTextList list_return is NULL.$winClipboardFlushXEvents - SelectionNotify - X*TextPropertyToTextList returned: $winClipboardFlushXEvents - SelectionNotify - XConvertSelection () failed for CompoundText, aborting: %d$winClipboardFlushXEvents - SelectionNotify - XConvertSelection () failed for UTF8String, aborting: %d$winClipboardFlushXEvents - SelectionNotify - XGetWindowProperty () failed, aborting: %d$winClipboardFlushXEvents - SelectionNotify GlobalAlloc failed, aborting: %ld$winClipboardFlushXEvents - SelectionNotify malloc failed for pwszUnicodeStr, aborting.$winClipboardFlushXEvents - SelectionRequest - GetClipboardData () failed: %08x$winClipboardFlushXEvents - SelectionRequest - OpenClipboard () failed: %08x$winClipboardFlushXEvents - SelectionRequest - X*TextListToTextProperty failed: %d$winClipboardFlushXEvents - SelectionRequest - XChangeProperty failed: %d$winClipboardFlushXEvents - SelectionRequest - XSendEvent () failed$winClipboardFlushXEvents - SelectionRequest - XSendEvent () failed for abort event.
API String ID: 0-3541621428
Opcode ID: a72e8a48f1fe50029545affaf7784a5ccfdf058f9837fd3bd18be46309da54ec
Instruction ID: 70705d564ebcdf679d1416cd5bb8b827c2a1bb4a416a9329f38bb2dd2ba6ed6f
Opcode Fuzzy Hash: a72e8a48f1fe50029545affaf7784a5ccfdf058f9837fd3bd18be46309da54ec
Instruction Fuzzy Hash: E952907094071AAFEF309F54CC45BAEBBB5BF44310F1081A6F508BA292D7B55E809F69

Function 0042BEDC Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 183
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042BE85: _isctype.MSVCRT ref: 0042BEC1

strtol.MSVCRT ref: 0042BEFD
sprintf.MSVCRT ref: 0042BF0F
getservbyname.WS2_32(?,tcp), ref: 0042BF31
_errno.MSVCRT ref: 0042BF3A
htons.WS2_32(00000000), ref: 0042BFA3
htonl.WS2_32(00000000), ref: 0042BFAE
_errno.MSVCRT ref: 0042BFD0
bind.WS2_32(?,?,00000010), ref: 0042C002
setsockopt.WS2_32(?,0000FFFF,00000080,005FD170,00000008), ref: 0042C02D
listen.WS2_32(?,7FFFFFFF), ref: 0042C038
_errno.MSVCRT ref: 0042C045
_errno.MSVCRT ref: 0042C069

Part of subcall function 0042B7AD: getsockname.WS2_32(?,?,00000010), ref: 0042B7D6
Part of subcall function 0042B7AD: WSAGetLastError.WS2_32 ref: 0042B7DF
Part of subcall function 0042B7AD: _errno.MSVCRT ref: 0042B7E6
Part of subcall function 0042B7AD: _errno.MSVCRT ref: 0042B7ED
Part of subcall function 0042B7AD: WSAGetLastError.WS2_32(00000000,00000000), ref: 0042B803
Part of subcall function 0042B7AD: _errno.MSVCRT ref: 0042B844

_errno.MSVCRT ref: 0042C096
closesocket.WS2_32(?), ref: 0042C09E
_errno.MSVCRT ref: 0042C0A3
_errno.MSVCRT ref: 0042C0C5
_errno.MSVCRT ref: 0042C0EF
_errno.MSVCRT ref: 0042C111

Strings

%lu, xrefs: 0042BF09
SocketINETCreateListener: ...SocketINETGetAddr() failed, xrefs: 0042C107
SocketINETCreateListener: Unable to get service for %s, xrefs: 0042BF51
tcp, xrefs: 0042BF2B
SocketCreateListener: listen() failed, xrefs: 0042C062
SocketINETCreateListener: ...SocketCreateListener() failed, xrefs: 0042C0BB
SocketCreateListener: failed to bind listener, xrefs: 0042C086

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$ErrorLast$_isctypebindclosesocketgetservbynamegetsocknamehtonlhtonslistensetsockoptsprintfstrtol
String ID: %lu$SocketCreateListener: failed to bind listener$SocketCreateListener: listen() failed$SocketINETCreateListener: ...SocketCreateListener() failed$SocketINETCreateListener: ...SocketINETGetAddr() failed$SocketINETCreateListener: Unable to get service for %s$tcp
API String ID: 1514118853-1154815298
Opcode ID: 49625d3a11afbbed5c8f6c5ffa63158751afc97f1fe471b5f3ecbd68a386d1cb
Instruction ID: b54ca8d0cb43d09b4911e8019f8e665c3c7d46b0c6d74a558f8df519a7ea1c3d
Opcode Fuzzy Hash: 49625d3a11afbbed5c8f6c5ffa63158751afc97f1fe471b5f3ecbd68a386d1cb
Instruction Fuzzy Hash: 56512A70740311AADB106B64EC4BF6E3F54FF81710F55812AF518AB2D2DF786501ABEA

Function 0043C5CC Relevance: 44.0, APIs: 14, Strings: 11, Instructions: 257
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 0043C5EE
CreateCompatibleDC.GDI32(00000000), ref: 0043C5F7
malloc.MSVCRT ref: 0043C604
CreateDIBSection.GDI32(?,00000000,00000000,?,00000000,00000000), ref: 0043C658
EnumThreadWindows.USER32(Function_0003C4E4,00000000,?), ref: 0043C8FC

Strings

winAllocateFBShadowGDI - Requested DIB (bitmap) will be larger than %d MB. The surface may fail to be allocated on Windows 95, 98, or Me, due to a %d MB limit in DIB size. This limit does not apply to Windows NT/2000, and this message may be ignored on those, xrefs: 0043C73A
winAllocateFBShadowGDI - winQueryRGBBitsAndMasks failed, xrefs: 0043C8D8
winAllocateFBShadowGDI - CreateDIBSection failed:, xrefs: 0043C670
winAllocateFBShadowGDI - Shadow blit failure, xrefs: 0043C6DD
winAllocateFBShadowGDI - Dibsection width: %d height: %d depth: %d size image: %d, xrefs: 0043C69D
winAllocateFBShadowGDI - Creating DIB with width: %d height: %d depth: %d, xrefs: 0043C63D
winQueryRGBBitsAndMasks - malloc failed, xrefs: 0043C7E9
winQueryRGBBitsAndMasks - GetDeviceCaps (BITSPIXEL) returned 24 for the screen. Using default 24bpp masks., xrefs: 0043C7AB
winAllocateFBShadowGDI - Created shadow stride: %d, xrefs: 0043C715
winQueryRGBBitsAndMasks - winQueryScreenDIBFormat failed, xrefs: 0043C8AE
winAllocateFBShadowGDI - malloc () failed, xrefs: 0043C610

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: Create$CompatibleEnumSectionThreadWindowsmalloc
String ID: winAllocateFBShadowGDI - CreateDIBSection failed:$winAllocateFBShadowGDI - Created shadow stride: %d$winAllocateFBShadowGDI - Creating DIB with width: %d height: %d depth: %d$winAllocateFBShadowGDI - Dibsection width: %d height: %d depth: %d size image: %d$winAllocateFBShadowGDI - Requested DIB (bitmap) will be larger than %d MB. The surface may fail to be allocated on Windows 95, 98, or Me, due to a %d MB limit in DIB size. This limit does not apply to Windows NT/2000, and this message may be ignored on those$winAllocateFBShadowGDI - Shadow blit failure$winAllocateFBShadowGDI - malloc () failed$winAllocateFBShadowGDI - winQueryRGBBitsAndMasks failed$winQueryRGBBitsAndMasks - GetDeviceCaps (BITSPIXEL) returned 24 for the screen. Using default 24bpp masks.$winQueryRGBBitsAndMasks - malloc failed$winQueryRGBBitsAndMasks - winQueryScreenDIBFormat failed
API String ID: 3662448398-372008660
Opcode ID: 6958c8d260161ea363dd418ad57a9d57ec1f02e083cdf680eeb536ac319ee4fe
Instruction ID: b4f06fbf8bf31ac5d7759ec8aa16bb1b59321a2d6548d9051c94f68a8adc1154
Opcode Fuzzy Hash: 6958c8d260161ea363dd418ad57a9d57ec1f02e083cdf680eeb536ac319ee4fe
Instruction Fuzzy Hash: 04A1A170A007059FEB20AF65DC85B6EBBB5FF48304F20452EE505AB292D779E842DF58

Function 004B52E1 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 101stringsynchronizationCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 004B5306
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000044,PXK), ref: 004B53CA
GetExitCodeProcess.KERNEL32(?,00000044), ref: 004B53D6
CloseHandle.KERNEL32(?,?,000000FF,?,00000000,00000044,PXK), ref: 004B53DE
CloseHandle.KERNEL32(?,?,?,000000FF,?,00000000,00000044,PXK), ref: 004B53E6

Strings

Starting '%s' failed: %s, xrefs: 004B53A3
xkbcomp, xrefs: 004B5300
Win32System called with null pointer!, xrefs: 004B52F1
Starting '%s' failed!, xrefs: 004B5391
D, xrefs: 004B533D
Win32System command '%s' incorrect!, xrefs: 004B5312
PXK, xrefs: 004B52EA, 004B5305, 004B5311, 004B5321, 004B5390, 004B53A2

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: CloseHandle$CodeExitObjectProcessSingleWaitstrstr
String ID: D$PXK$Starting '%s' failed!$Starting '%s' failed: %s$Win32System called with null pointer!$Win32System command '%s' incorrect!$xkbcomp
API String ID: 1734309095-3849794708
Opcode ID: 4d92ca5e243dab3640c4dfa37dbf17643cfff3d6cbf067b0508de94458485e1e
Instruction ID: 94c53e256e2142d28c4560bd627e01119c235ffc2fea1d38d765949277532726
Opcode Fuzzy Hash: 4d92ca5e243dab3640c4dfa37dbf17643cfff3d6cbf067b0508de94458485e1e
Instruction Fuzzy Hash: 2A213131E443197AEF2066B1AC07FDEBFBCFF407A4F604126FA1876192D6A519019B39

Function 0042734B Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 456networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,0060E720,00000000,00000000,?), ref: 00427509
WSAGetLastError.WS2_32(00000000,0060E720,00000000,00000000,?), ref: 00427510
__WSAFDIsSet.WS2_32(0060B6E0), ref: 004276CF
__WSAFDIsSet.WS2_32(0060B6E0,0060B6E0), ref: 004276F0
__WSAFDIsSet.WS2_32(006096B0), ref: 0042779D
__WSAFDIsSet.WS2_32(000003FF,006096B0), ref: 004277C0
__WSAFDIsSet.WS2_32(0060F740), ref: 00427807
__WSAFDIsSet.WS2_32(000003FF,0060F740), ref: 0042782A
__WSAFDIsSet.WS2_32(006086A0), ref: 00427871
__WSAFDIsSet.WS2_32(?,006086A0), ref: 00427894

Strings

`_, xrefs: 0042758D, 004275FB, 004278F1
d_, xrefs: 00427586, 004275F4, 004278EA
WaitForSomething(): select: errno=%d, xrefs: 00427567, 0042757A

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLastselect
String ID: WaitForSomething(): select: errno=%d$`_$d_
API String ID: 215497628-840682427
Opcode ID: efcdfd19bdcb2b529cf6721b69867d193afa49bfb1daa35cebf479ed624daefe
Instruction ID: c730cce6e2d0fba100e2aa2e2a05e6f327adfe8929aaee3c1d0569d70e11b469
Opcode Fuzzy Hash: efcdfd19bdcb2b529cf6721b69867d193afa49bfb1daa35cebf479ed624daefe
Instruction Fuzzy Hash: EC02E370B48226CFDB20DF24F98876A77A2FB94344F91806BD60993350EB799D84DF19

Function 00431AC0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84nativeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00431AE2
GetVersionExA.KERNEL32(?,?,00000000,00000094), ref: 00431AF2
NtProtectVirtualMemory.NTDLL(00000000,0059F400,00000000), ref: 00431B97

Strings

winDetectSupportedEngines - Windows NT/2000/XP, xrefs: 00431B0A
winDetectSupportedEngines - Returning, supported engines %08x, xrefs: 00431BD8
winDetectSupportedEngines - DirectDraw4 installed, xrefs: 00431B9D
winDetectSupportedEngines - DirectDraw installed, xrefs: 00431B6D
winDetectSupportedEngines - Windows 95/98/Me, xrefs: 00431B11
winDetectSupportedEngines - DirectDraw not installed, xrefs: 00431B5F

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: MemoryProtectVersionVirtualmemset
String ID: winDetectSupportedEngines - DirectDraw installed$winDetectSupportedEngines - DirectDraw not installed$winDetectSupportedEngines - DirectDraw4 installed$winDetectSupportedEngines - Returning, supported engines %08x$winDetectSupportedEngines - Windows 95/98/Me$winDetectSupportedEngines - Windows NT/2000/XP
API String ID: 1442769214-1603301031
Opcode ID: eacd423d4d05cf5210f817691b8cd04ca8d2da0cf15ddbb864eb7ce6c8587bb1
Instruction ID: 145856ac653698e84861a3a3dbe5a753065c002eea6a1a125ebf9927bd49f9c1
Opcode Fuzzy Hash: eacd423d4d05cf5210f817691b8cd04ca8d2da0cf15ddbb864eb7ce6c8587bb1
Instruction Fuzzy Hash: 3A210631700314AFFB10AF55DD87F5AF779FB49704F10909AE148DA1A1E7786884CB66

Function 0040111C Relevance: 13.6, APIs: 9, Instructions: 66COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00401000,?,?,?,?,?,?,?,00401227), ref: 00401128
__getmainargs.MSVCRT ref: 0040115C
_setmode.MSVCRT ref: 0040118D
_setmode.MSVCRT ref: 004011AC
__p__fmode.MSVCRT ref: 004011B4
__p__environ.MSVCRT ref: 004011CC
_cexit.MSVCRT ref: 004011E9
ExitProcess.KERNEL32(00000000), ref: 004011F1
_setmode.MSVCRT ref: 004011FF

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 0980b17b310eccdea469350fd4a5041a986bb27e4e82ade74583cd791a599a34
Instruction ID: ce63b5915a203e6e1d42ce6c78066bb1b47f3e729ac71b1ea03b96931b0879a0
Opcode Fuzzy Hash: 0980b17b310eccdea469350fd4a5041a986bb27e4e82ade74583cd791a599a34
Instruction Fuzzy Hash: 6E213571D00106ABD7057B74FC8A92A3F3EFF95300B048269F928562B7F6325E24B796

Function 00428A00 Relevance: 6.4, APIs: 4, Instructions: 429COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?), ref: 00428B86
_errno.MSVCRT ref: 00428BE8
_errno.MSVCRT ref: 00428BF2
__WSAFDIsSet.WS2_32(00000004,0060D710), ref: 00428E64

Part of subcall function 00424AEB: free.MSVCRT ref: 00424B0A

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$freememmove
String ID:
API String ID: 3628973923-0
Opcode ID: bc32b7ea358a020444b4d7ea5f7a689c262fbf017d3513055dfcd1ac4521e2ed
Instruction ID: 254efe0448c695ad0c20e10d9d3a2192c1873425a15492bf1700ab210879d511
Opcode Fuzzy Hash: bc32b7ea358a020444b4d7ea5f7a689c262fbf017d3513055dfcd1ac4521e2ed
Instruction Fuzzy Hash: 4EF1DF74B022258FDB20CF19E98076EBBE2FB84304FA4853ED455C7351DB79A845CB58

Function 0042BCE4 Relevance: 4.5, APIs: 3, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 0042BCF7
WSAGetLastError.WS2_32 ref: 0042BD03
_errno.MSVCRT ref: 0042BD0A

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast_errnorecv
String ID:
API String ID: 4087403190-0
Opcode ID: febbeddced0657b653ea3d74a1b97aa8ea7326769c81694461dc5a29fe01ca80
Instruction ID: 1d5e74160a49e3a41998413c701ab6de57bf9fa2b78febc3c865a821cf43feb7
Opcode Fuzzy Hash: febbeddced0657b653ea3d74a1b97aa8ea7326769c81694461dc5a29fe01ca80
Instruction Fuzzy Hash: F9E086322102196BCF212EE8AC49DDA7F55FF44370F104561F6288B391D6319C1097D1

Function 0042FCDD Relevance: 261.9, APIs: 75, Strings: 74, Instructions: 1189stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0042FD15
strcmp.MSVCRT ref: 0042FD28
strcmp.MSVCRT ref: 0042FD3B
strcmp.MSVCRT ref: 0042FD4E
strcmp.MSVCRT ref: 0042FD61
strcmp.MSVCRT ref: 0042FD96
strcmp.MSVCRT ref: 0042FDA9
strcmp.MSVCRT ref: 0042FDBC
strcmp.MSVCRT ref: 0042FDCF
strcmp.MSVCRT ref: 0042FDE2
strcmp.MSVCRT ref: 0042FE09
atoi.MSVCRT(00FFFFFF), ref: 0042FE31
sscanf.MSVCRT ref: 0042FE68
sscanf.MSVCRT ref: 0042FF17
sscanf.MSVCRT ref: 0042FF8A
sscanf.MSVCRT ref: 0042FFCF
sscanf.MSVCRT ref: 00430018
exit.MSVCRT ref: 00430093
sscanf.MSVCRT ref: 004300B1
sscanf.MSVCRT ref: 004300CD
sscanf.MSVCRT ref: 00430145
sscanf.MSVCRT ref: 0043015D
strcmp.MSVCRT ref: 00430271
atoi.MSVCRT(004013A4,?,?,?,?,?,?,?,?,004011E7,?,004013A4,?,00424137,004011E7,004013A4), ref: 00430289
strcmp.MSVCRT ref: 004302DB

Part of subcall function 0042FC2D: FT_Init_FreeType.LIBFREETYPE-6(?,?,?,?,0042FDF2,?,?,?,?,?,?,?,?,004011E7,?,004013A4), ref: 0042FC38
Part of subcall function 0042FC2D: FT_Library_Version.LIBFREETYPE-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042FDF2), ref: 0042FC8D
Part of subcall function 0042FC2D: FT_Done_FreeType.LIBFREETYPE-6(?), ref: 0042FCAB

Part of subcall function 0042FA26: malloc.MSVCRT ref: 0042FAD7

Part of subcall function 0042F82F: memset.MSVCRT ref: 0042F851
Part of subcall function 0042F82F: GetSystemMetrics.USER32(00000000), ref: 0042F858
Part of subcall function 0042F82F: GetSystemMetrics.USER32(00000001), ref: 0042F861

strcmp.MSVCRT ref: 00430351
strcmp.MSVCRT ref: 0043039F
strcmp.MSVCRT ref: 00430415
strcmp.MSVCRT ref: 0043048B
strcmp.MSVCRT ref: 00430515
strcmp.MSVCRT ref: 0043058B
strcmp.MSVCRT ref: 00430601
strcmp.MSVCRT ref: 00430614
strcmp.MSVCRT ref: 00430678
strcmp.MSVCRT ref: 0043068B
strcmp.MSVCRT ref: 00430E43

Strings

ddxProcessArgument - screen - Querying monitors is not supported on NT4 and Win95, xrefs: 00430036
-internalwm, xrefs: 00430483
-config, xrefs: 00430BD1
-xkblayout, xrefs: 00430D37
-emulate3buttons, xrefs: 004307A5
-silent-dup-error, xrefs: 00430E17
-xf86config, xrefs: 00430BE4
-indirect, xrefs: 00430B9C
-version, xrefs: 0042FD46, 0042FDC7
-rootless, xrefs: 0043050D
-logverbose, xrefs: 00430C71
--help, xrefs: 0042FD33, 0042FDB4
-kb, xrefs: 00430CC4
@%d, xrefs: 0042FE5F
-fp, xrefs: 00430B0E
-nounixkill, xrefs: 004309D6
-nowinkill, xrefs: 0043093A
%*dx%*d+%d+%d, xrefs: 0042FF74
-notrayicon, xrefs: 00430A72
-logfile, xrefs: 00430C3B
2, xrefs: 004307EA
ddxProcessArgument - screen - Invalid monitor number %d, xrefs: 00430082
-ignoreinput, xrefs: 00430757
ddxProcessArgument - screen - Found Valid ``@Monitor'' = %d arg, xrefs: 0042FE97, 0043004F
-refresh, xrefs: 00430884
ddxProcessArgument - Initializing default screens, xrefs: 0042FD7A
%dx%d, xrefs: 0042FF0E
-broadcast, xrefs: 00430BAF
-co, xrefs: 00430B3A
-mwextwm, xrefs: 0043040D
-xkbmodel, xrefs: 00430D12
@%a, xrefs: 00430867
-scrollbars, xrefs: 004306E7
-clipupdates, xrefs: 004308DF
T%a, xrefs: 004302B6
H%a, xrefs: 004308C2
-multiplemonitors, xrefs: 004305F9
-screen, xrefs: 0042FE01
-multiwindow, xrefs: 00430583
-multimonitors, xrefs: 0043060C
ddxProcessArgument - screen - Found ``X Y'' arg, xrefs: 00430168
-depth, xrefs: 00430829
The -keyboard option is not supported in this release.Ignoring this option and continuing., xrefs: 00430C2C
-xkbvariant, xrefs: 00430D5C
ddxProcessArgument - screen - Invalid screen number %d, xrefs: 0042FE40
-fullscreen, xrefs: 004302D3
ddxProcessArgument - screen - Found ``WxD'' arg, xrefs: 0042FF28
X%a, xrefs: 0043091D
-nodecoration, xrefs: 00430397
The %s option is not supported in this release.Ignoring this option and continuing., xrefs: 00430C08
ddxProcessArgument - screen - Found ``W D'' arg, xrefs: 004300DC
-unixkill, xrefs: 00430A24
-lesspointer, xrefs: 00430349
ddxProcessArgument - screen - Found ``X+Y'' arg, xrefs: 0042FF97
-nounicodeclipboard, xrefs: 00430CA2
-swcursor, xrefs: 00430DF8
-trayicon, xrefs: 00430AC0
-keyhook, xrefs: 00430DBA
-winkill, xrefs: 00430988
-nomultimonitors, xrefs: 00430683
-noicons, xrefs: 00430E3B
%*dx%*d+%*d+%*d@%d, xrefs: 0042FFC6
-nokeyhook, xrefs: 00430DD9
--version, xrefs: 0042FD59, 0042FDDA
%*dx%*d@%d, xrefs: 0043000F
-nomultiplemonitors, xrefs: 00430670
ddxProcessArgument - screen - Did not find size arg. dwWidth: %d dwHeight: %d, xrefs: 004301AE
-xkbrules, xrefs: 00430CE6
-engine, xrefs: 00430269
-help, xrefs: 0042FCF9, 0042FD8E
-clipboard, xrefs: 00430735
-keyboard, xrefs: 00430C17
-query, xrefs: 00430B66
-xkboptions, xrefs: 00430D81

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strcmp$sscanf$FreeMetricsSystemTypeatoi$Done_Init_Library_Versionexitmallocmemset
String ID: %*dx%*d+%*d+%*d@%d$%*dx%*d+%d+%d$%*dx%*d@%d$%dx%d$--help$--version$-broadcast$-clipboard$-clipupdates$-co$-config$-depth$-emulate3buttons$-engine$-fp$-fullscreen$-help$-ignoreinput$-indirect$-internalwm$-kb$-keyboard$-keyhook$-lesspointer$-logfile$-logverbose$-multimonitors$-multiplemonitors$-multiwindow$-mwextwm$-nodecoration$-noicons$-nokeyhook$-nomultimonitors$-nomultiplemonitors$-notrayicon$-nounicodeclipboard$-nounixkill$-nowinkill$-query$-refresh$-rootless$-screen$-scrollbars$-silent-dup-error$-swcursor$-trayicon$-unixkill$-version$-winkill$-xf86config$-xkblayout$-xkbmodel$-xkboptions$-xkbrules$-xkbvariant$2$@%a$@%d$H%a$T%a$The %s option is not supported in this release.Ignoring this option and continuing.$The -keyboard option is not supported in this release.Ignoring this option and continuing.$X%a$ddxProcessArgument - Initializing default screens$ddxProcessArgument - screen - Did not find size arg. dwWidth: %d dwHeight: %d$ddxProcessArgument - screen - Found Valid ``@Monitor'' = %d arg$ddxProcessArgument - screen - Found ``W D'' arg$ddxProcessArgument - screen - Found ``WxD'' arg$ddxProcessArgument - screen - Found ``X Y'' arg$ddxProcessArgument - screen - Found ``X+Y'' arg$ddxProcessArgument - screen - Invalid monitor number %d$ddxProcessArgument - screen - Invalid screen number %d$ddxProcessArgument - screen - Querying monitors is not supported on NT4 and Win95
API String ID: 2969815749-2287662838
Opcode ID: b2a7134a97752c6b3e59161839a5615d2418d542268f74487b5bcc1f8f6f22a2
Instruction ID: 70eac175f4afd9fb89af58005b8ee836ed8e2b939ff5a8a62e912a4d581c4909
Opcode Fuzzy Hash: b2a7134a97752c6b3e59161839a5615d2418d542268f74487b5bcc1f8f6f22a2
Instruction Fuzzy Hash: A2A247706002029FDB10DF68E896BEE7FB2FB59314F505227E405CE2A1D37DA895DB89

Function 00424102 Relevance: 168.6, APIs: 59, Strings: 37, Instructions: 639stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD15
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD28
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD3B
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD4E
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD61
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FD96
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FDA9
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FDBC
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FDCF
Part of subcall function 0042FCDD: strcmp.MSVCRT ref: 0042FDE2
Part of subcall function 0042FCDD: exit.MSVCRT ref: 00430093

strchr.MSVCRT ref: 0042416A
strcmp.MSVCRT ref: 004241A4
atoi.MSVCRT(004013A4,?,?,?,004013A4,004011E7,?), ref: 004241BC
strcmp.MSVCRT ref: 004241D1

Strings

-audit, xrefs: 004241EB
-su, xrefs: 00424665
-tst, xrefs: 00424708
-noreset, xrefs: 00424535
-co, xrefs: 0042431C
nologo, xrefs: 004244D8
-help, xrefs: 00424477
-extension, xrefs: 004248DA
-reset, xrefs: 00424554
-bs, xrefs: 00424280
-auth, xrefs: 00424218
Unrecognized option: %s, xrefs: 0042491B, 0042492D
-fn, xrefs: 00424423
-logo, xrefs: 004244B6
Bad display name: %s, xrefs: 0042417F
-ac, xrefs: 004241CB
tty, xrefs: 00424831
-cc, xrefs: 004242ED
-nolisten, xrefs: 004244FA
Failed to disable listen for %s transport, xrefs: 0042452B
-nopn, xrefs: 004245CA
-dpi, xrefs: 00424368
-render, xrefs: 0042487C
+bs, xrefs: 00424260
-wr, xrefs: 00424790
-core, xrefs: 00424346
-deferglyphs, xrefs: 00424397
-maxbigreqsize, xrefs: 004247B2
-terminate, xrefs: 004246B3
-br, xrefs: 00424240
-fp, xrefs: 0042444D
-fc, xrefs: 004243F9
+extension, xrefs: 004248AD
-wm, xrefs: 0042476E
-to, xrefs: 004246D2
-pn, xrefs: 004245A8
Bad display name, exiting: %s, xrefs: 00424194

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strcmp$atoiexitstrchr
String ID: +bs$+extension$-ac$-audit$-auth$-br$-bs$-cc$-co$-core$-deferglyphs$-dpi$-extension$-fc$-fn$-fp$-help$-logo$-maxbigreqsize$-nolisten$-nopn$-noreset$-pn$-render$-reset$-su$-terminate$-to$-tst$-wm$-wr$Bad display name, exiting: %s$Bad display name: %s$Failed to disable listen for %s transport$Unrecognized option: %s$nologo$tty
API String ID: 2261857448-176228424
Opcode ID: efb19c711897947e7dd34d9e20b26c153e5b77d9fc4e48a02e8d1ec9c83174a6
Instruction ID: 729484f2fc3c9ed969d3a695d9ce149694c880c13a4fbe73ed849015f908b39d
Opcode Fuzzy Hash: efb19c711897947e7dd34d9e20b26c153e5b77d9fc4e48a02e8d1ec9c83174a6
Instruction Fuzzy Hash: B9121A74308A23BDDF12AF3CFC8AA7A3F50FBD5354FA0412BF4055A171D72964A1AA49

Function 0042E860 Relevance: 130.1, APIs: 46, Strings: 28, Instructions: 580
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00430EB0: GetCurrentThreadId.KERNEL32 ref: 00430EB3

Part of subcall function 00426EA3: malloc.MSVCRT ref: 00426EE8
Part of subcall function 00426EA3: sprintf.MSVCRT ref: 00426F03
Part of subcall function 00426EA3: _stat.MSVCRT(1035FF50,0040114B), ref: 00426F28
Part of subcall function 00426EA3: malloc.MSVCRT ref: 00426F78
Part of subcall function 00426EA3: malloc.MSVCRT ref: 00426F9E

Part of subcall function 0042E7FF: GetModuleHandleA.KERNEL32(00000000,?,0042E8A2), ref: 0042E80D
Part of subcall function 0042E7FF: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Xming,00000104,00000000,?,0042E8A2), ref: 0042E81D

fopen.MSVCRT ref: 0042E8DD
fgets.MSVCRT ref: 0042E96D
strchr.MSVCRT ref: 0042E982
strchr.MSVCRT ref: 0042E9BB
malloc.MSVCRT ref: 0042EA53
realloc.MSVCRT ref: 0042EA62
strncpy.MSVCRT ref: 0042EABB
fclose.MSVCRT ref: 0042EADE
free.MSVCRT ref: 0042EAFB
strchr.MSVCRT ref: 0042EB52
malloc.MSVCRT ref: 0042EB89
strncpy.MSVCRT ref: 0042EB95
strncmp.MSVCRT ref: 0042EBAD
malloc.MSVCRT ref: 0042EBCF
strcpy.MSVCRT(00000000,?), ref: 0042EBDE
strncat.MSVCRT ref: 0042EBFD
free.MSVCRT ref: 0042EC10
malloc.MSVCRT ref: 0042EC41
realloc.MSVCRT ref: 0042EC50
strcpy.MSVCRT(00000000,00000000), ref: 0042EC78
free.MSVCRT ref: 0042EC80
strchr.MSVCRT ref: 0042EC97

Part of subcall function 00424B8F: strcpy.MSVCRT(00000000,0042ECCF,00000000,/usr/X11R6/lib/X11,?,0042ECCF,00000000), ref: 00424BB6

free.MSVCRT ref: 0042ECDB
strncmp.MSVCRT ref: 0042ED11
malloc.MSVCRT ref: 0042ED30
strcpy.MSVCRT(00000000,?), ref: 0042ED3F
strcat.MSVCRT(00000000,\rgb.txt), ref: 0042ED4C
free.MSVCRT ref: 0042ED65
getenv.MSVCRT ref: 0042ED85
_putenv.MSVCRT ref: 0042EDD4
getenv.MSVCRT ref: 0042EDE0
_putenv.MSVCRT ref: 0042EE11
getenv.MSVCRT ref: 0042EE1C
_putenv.MSVCRT ref: 0042EE4D
getenv.MSVCRT ref: 0042EE58
_putenv.MSVCRT ref: 0042EE89
getenv.MSVCRT ref: 0042EE94
_putenv.MSVCRT ref: 0042EEC5
getenv.MSVCRT ref: 0042EED0
LoadLibraryA.KERNEL32(shfolder.dll), ref: 0042EEF4
LoadLibraryA.KERNEL32(shell32.dll,shfolder.dll), ref: 0042EF04
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0042EF15
_putenv.MSVCRT ref: 0042EF42
FreeLibrary.KERNEL32(00000000,00000000,SHGetFolderPathA,shfolder.dll), ref: 0042EF5D
GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\Xming.0.log), ref: 0042EF75
GetLongPathNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\Xming.0.log,C:\Users\user\AppData\Local\Temp\Xming.0.log,00000104), ref: 0042EFC8

Strings

XHOSTPREFIX=%s\X, xrefs: 0042EEAA
p3C, xrefs: 0042F005
HOME=, xrefs: 0042EF26, 0042EF41
XKEYSYMDB, xrefs: 0042ED80
OsVendorInit - Creating bogus screen 0, xrefs: 0042F088
Warning: Environment Variable XKEYSYMDB has been defined elsewhere and so has been overridden to avoid keyboard errors., xrefs: 0042ED98
%s\font-dirs, xrefs: 0042E8C0
SHGetFolderPathA, xrefs: 0042EF0F
XSECURITYPOLICY, xrefs: 0042EE53
XKEYSYMDB=%s\XKeysymDB, xrefs: 0042EDB9
%s\xkb, xrefs: 0042EFE7
XSECURITYPOLICY=%s\SecurityPolicy, xrefs: 0042EE6E
XLOCALEDIR=%s\locale, xrefs: 0042EE32
Xming.%s.log, xrefs: 0042EF93
XERRORDB=%s\XErrorDB, xrefs: 0042EDF6
RgbPath set to "%s", xrefs: 0042ED71
Logfile set to "%s", xrefs: 0042EFD2
XLOCALEDIR, xrefs: 0042EE17
Can not determine HOME directory, xrefs: 0042EF4A
shfolder.dll, xrefs: 0042EEDE
HOME, xrefs: 0042EECB
C:\Users\user\AppData\Local\Temp\Xming.0.log, xrefs: 0042EF6B, 0042EF9F, 0042EFB4, 0042EFB9, 0042EFBE, 0042EFCD
C:\Program Files (x86)\Xming\xkb, xrefs: 0042EFF1, 0042F012
FontPath set to "%s", xrefs: 0042ECE7
\rgb.txt, xrefs: 0042ED46
XHOSTPREFIX, xrefs: 0042EE8F
/usr/X11R6/lib/X11, xrefs: 0042EB19, 0042EBA8, 0042ECC5, 0042ED0C
shell32.dll, xrefs: 0042EEFF

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$_putenvgetenv$free$strchrstrcpy$Library$LoadModuleNamePathreallocstrncmpstrncpy$AddressCurrentFileFreeHandleLongProcTempThread_statfclosefgetsfopensprintfstrcatstrncat
String ID: %s\font-dirs$%s\xkb$/usr/X11R6/lib/X11$C:\Program Files (x86)\Xming\xkb$C:\Users\user\AppData\Local\Temp\Xming.0.log$Can not determine HOME directory$FontPath set to "%s"$HOME$HOME=$Logfile set to "%s"$OsVendorInit - Creating bogus screen 0$RgbPath set to "%s"$SHGetFolderPathA$Warning: Environment Variable XKEYSYMDB has been defined elsewhere and so has been overridden to avoid keyboard errors.$XERRORDB=%s\XErrorDB$XHOSTPREFIX$XHOSTPREFIX=%s\X$XKEYSYMDB$XKEYSYMDB=%s\XKeysymDB$XLOCALEDIR$XLOCALEDIR=%s\locale$XSECURITYPOLICY$XSECURITYPOLICY=%s\SecurityPolicy$Xming.%s.log$\rgb.txt$p3C$shell32.dll$shfolder.dll
API String ID: 286465600-3439558041
Opcode ID: 8016c189efb4cbe26f3184408d9bbf5c3faa3c14183d6b4e0a71ce26bc31d4fa
Instruction ID: b40bde121b3b91820bce62c9afba9a7ba3847b09293def41bb091b50c41b5c66
Opcode Fuzzy Hash: 8016c189efb4cbe26f3184408d9bbf5c3faa3c14183d6b4e0a71ce26bc31d4fa
Instruction Fuzzy Hash: D3221B71B002259EEF20AB25EC46B6A7FE5FF40314F4480AAE54CA6282DFB95984DF54

Function 004443F1 Relevance: 107.2, APIs: 34, Strings: 27, Instructions: 453
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00444490
GetSystemMetrics.USER32(0000000C), ref: 0044450D
GetSystemMetrics.USER32(0000000B), ref: 00444515
LoadImageA.USER32(00000065,00000001,00000000,0000000B,00000000,0000000C), ref: 00444525
GetStockObject.GDI32(00000000), ref: 00444536
GetSystemMetrics.USER32(00000032), ref: 00444550
GetSystemMetrics.USER32(00000031), ref: 00444558
LoadImageA.USER32(00000065,00000001,00000000,00000031,00000000,00000032), ref: 00444568
RegisterClassExA.USER32(00000030), ref: 00444574
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00444583
GetSystemMetrics.USER32(0000004E), ref: 004445B3
GetSystemMetrics.USER32(0000004F), ref: 004445C0
GetSystemMetrics.USER32(0000004C), ref: 004445E1
GetSystemMetrics.USER32(0000004D), ref: 004445EA
GetSystemMetrics.USER32(00000000), ref: 00444606
GetSystemMetrics.USER32(00000001), ref: 0044460F
SHAppBarMessage.SHELL32(00000004,?), ref: 004446BF
SHAppBarMessage.SHELL32(00000007,?), ref: 004446E0
SHAppBarMessage.SHELL32(00000007,?), ref: 00444704
SHAppBarMessage.SHELL32(00000007,?), ref: 00444728
SHAppBarMessage.SHELL32(00000007,?), ref: 0044474C
GetSystemMetrics.USER32(00000020), ref: 004447D1
GetSystemMetrics.USER32(00000007), ref: 004447EB
GetSystemMetrics.USER32(00000008), ref: 00444801
GetSystemMetrics.USER32(00000004), ref: 0044480B
GetSystemMetrics.USER32(0000004E), ref: 00444829
GetSystemMetrics.USER32(0000004F), ref: 00444836
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000007,?,00000007,?,00000000,0000000B,00000000,0000000C), ref: 00444901
CreateWindowExA.USER32(00000000,cygwin/x,?,800A0000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0044492D
ShowWindow.USER32(?,00000005,winCreateBoundingWindowWindowed - Setting normal windowstyle,00000000,cygwin/x,?,800A0000,?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 00444965
GetClientRect.USER32(?,?), ref: 00444977
ShowWindow.USER32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000007), ref: 00444A16
UpdateWindow.USER32(?), ref: 00444A23
BringWindowToTop.USER32(?), ref: 00444A53

Strings

winCreateBoundingWindowWindowed - WindowClient w %ld h %ld r %ld l %ld b %ld t %ld, xrefs: 004449A4
winAdjustForAutoHide - Found LEFT auto-hide taskbar, xrefs: 0044470D
winAdjustForAutoHide - Adjusted WorkArea: %d %d %d %d, xrefs: 0044476F
winCreateBoundingWindowWindowed - Current w: %d h: %d, xrefs: 00444464
winGetWorkArea - Adjusted WorkArea for multiple monitors: %d %d %d %d, xrefs: 00444673
winAdjustForAutoHide - Original WorkArea: %d %d %d %d, xrefs: 0044469B
winAdjustForAutoHide - Taskbar is auto hide, xrefs: 004446C8
winGetWorkArea - Primary screen is %d x %d, xrefs: 00444618
winAdjustForAutoHide - Found BOTTOM auto-hide taskbar, xrefs: 00444731
winCreateBoundingWindowWindowed - CreateWindowEx () failed, xrefs: 0044493E
winCreateBoundingWindowWindowed - User w: %d h: %d, xrefs: 0044444E
Xming - %s, xrefs: 004448C2
winAdjustForAutoHide - Found RIGHT auto-hide taskbar, xrefs: 00444755
<Z, xrefs: 00444549
Xming :%s.%d, xrefs: 004448E6
winGetWorkArea - Virtual screen origin is %d, %d, xrefs: 004445F1
winCreateBoundingWindowWindowed - GetClientRect () failed, xrefs: 00444980
winAdjustForAutoHide - Found TOP auto-hide taskbar, xrefs: 004446E9
$, xrefs: 004446B5
winCreateBoundingWindowWindowed - Setting normal windowstyle, xrefs: 00444951
winCreateBoundingWindowWindowed - Returning, xrefs: 00444A6A
winGetWorkArea - Original WorkArea: %d %d %d %d, xrefs: 004445A4
winGetWorkArea - Virtual screen is %d x %d, xrefs: 004445D2
winCreateBoundingWindowWindowed - UpdateWindow () failed, xrefs: 00444A2C
winCreateBoundingWindowWindowed - BringWindowToTop () failed, xrefs: 00444A5C
cygwin/x, xrefs: 00444926
0, xrefs: 004444E7

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: System$Metrics$MessageWindow$ImageInfoLoadShow$BringClassClientCreateHandleModuleObjectParametersRectRegisterStartupStockUpdate
String ID: $$0$Xming - %s$Xming :%s.%d$cygwin/x$winAdjustForAutoHide - Adjusted WorkArea: %d %d %d %d$winAdjustForAutoHide - Found BOTTOM auto-hide taskbar$winAdjustForAutoHide - Found LEFT auto-hide taskbar$winAdjustForAutoHide - Found RIGHT auto-hide taskbar$winAdjustForAutoHide - Found TOP auto-hide taskbar$winAdjustForAutoHide - Original WorkArea: %d %d %d %d$winAdjustForAutoHide - Taskbar is auto hide$winCreateBoundingWindowWindowed - Returning$winCreateBoundingWindowWindowed - BringWindowToTop () failed$winCreateBoundingWindowWindowed - CreateWindowEx () failed$winCreateBoundingWindowWindowed - Current w: %d h: %d$winCreateBoundingWindowWindowed - GetClientRect () failed$winCreateBoundingWindowWindowed - Setting normal windowstyle$winCreateBoundingWindowWindowed - UpdateWindow () failed$winCreateBoundingWindowWindowed - User w: %d h: %d$winCreateBoundingWindowWindowed - WindowClient w %ld h %ld r %ld l %ld b %ld t %ld$winGetWorkArea - Adjusted WorkArea for multiple monitors: %d %d %d %d$winGetWorkArea - Original WorkArea: %d %d %d %d$winGetWorkArea - Primary screen is %d x %d$winGetWorkArea - Virtual screen is %d x %d$winGetWorkArea - Virtual screen origin is %d, %d$<Z
API String ID: 4005750087-3318676579
Opcode ID: 9915fed1aacb70634389d431dca680335a63adb5d2c828556f1785af52c0f13a
Instruction ID: 7080c7b1e040af62fb122fa7fcb69e0e8572c07cb7b3a3e5b06ebce1a56b7d44
Opcode Fuzzy Hash: 9915fed1aacb70634389d431dca680335a63adb5d2c828556f1785af52c0f13a
Instruction Fuzzy Hash: 7E128170E40259AFEB10EF94CC49BDEBBB5BF45304F004096F5087A291C7799A85DF95

Function 00540C0C Relevance: 89.8, APIs: 31, Strings: 20, Instructions: 504
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 00540C5E
calloc.MSVCRT ref: 00540CAD
getenv.MSVCRT ref: 00540CD9
getenv.MSVCRT ref: 00540CEE
strcmp.MSVCRT ref: 00540D00
strcmp.MSVCRT ref: 00540D11
getenv.MSVCRT ref: 00540D2B
strcmp.MSVCRT ref: 00540D3D
strcmp.MSVCRT ref: 00540D4E
getenv.MSVCRT ref: 00540D68
strcmp.MSVCRT ref: 00540D7A
strcmp.MSVCRT ref: 00540D8B
getenv.MSVCRT ref: 00540DA5
strcmp.MSVCRT ref: 00540DB7
strcmp.MSVCRT ref: 00540DC8
getenv.MSVCRT ref: 00540DE2
strcmp.MSVCRT ref: 00540DF4
strcmp.MSVCRT ref: 00540E05
getenv.MSVCRT ref: 00540E1F
strcmp.MSVCRT ref: 00540E31
strcmp.MSVCRT ref: 00540E42
getenv.MSVCRT ref: 00540E76
strcmp.MSVCRT ref: 00540E88
strcmp.MSVCRT ref: 00540E99
getenv.MSVCRT ref: 00540F1A
fputs.MSVCRT ref: 00540FB7

Part of subcall function 005448F0: calloc.MSVCRT ref: 00544930
Part of subcall function 005448F0: malloc.MSVCRT ref: 0054494B
Part of subcall function 005448F0: free.MSVCRT ref: 0054495B

fprintf.MSVCRT ref: 00541052
fputs.MSVCRT ref: 0054107E
fputs.MSVCRT ref: 005410F7
fputs.MSVCRT ref: 00541117
fprintf.MSVCRT ref: 005411B5

Strings

succeeded, xrefs: 005410F2
_XKB_CONSUME_SHIFT_AND_LOCK, xrefs: 00540D63
Trying to fall back to version 0.65..., xrefs: 00541079
XKB_DISABLE, xrefs: 00540F15
_XKB_CONSUME_LOOKUP_MODS, xrefs: 00540D26
off, xrefs: 00540CFA, 00540D37, 00540D74, 00540DB1, 00540DEE, 00540E2B, 00540E82
XKEYBOARD extension not present, xrefs: 00540FB2
XKEYBOARD (version %d.%02d/%d.%02d) OK!, xrefs: 005411AF
Compose, xrefs: 00540EC2
_XKB_COMP_LED, xrefs: 00540E1A
_XKB_CONTROL_FALLBACK, xrefs: 00540DDD
XKEYBOARD version mismatch (want %d.%02d, got %d.%02d), xrefs: 0054104C
_XKB_OPTIONS_ENABLE, xrefs: 00540CD4
_XKB_COMP_FAIL_BEEP, xrefs: 00540E71
XKEYBOARD extension disabled or missing, xrefs: 00540F5E
failed, xrefs: 00541112
XKB_DEBUG, xrefs: 00540C59
XKEYBOARD, xrefs: 00540F65
_XKB_LATIN1_LOOKUP, xrefs: 00540CE9
_XKB_IGNORE_NEW_KEYBOARDS, xrefs: 00540DA0

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strcmp$getenv$fputs$callocfprintf$freemalloc
String ID: Compose$Trying to fall back to version 0.65...$XKB_DEBUG$XKB_DISABLE$XKEYBOARD$XKEYBOARD (version %d.%02d/%d.%02d) OK!$XKEYBOARD extension disabled or missing$XKEYBOARD extension not present$XKEYBOARD version mismatch (want %d.%02d, got %d.%02d)$_XKB_COMP_FAIL_BEEP$_XKB_COMP_LED$_XKB_CONSUME_LOOKUP_MODS$_XKB_CONSUME_SHIFT_AND_LOCK$_XKB_CONTROL_FALLBACK$_XKB_IGNORE_NEW_KEYBOARDS$_XKB_LATIN1_LOOKUP$_XKB_OPTIONS_ENABLE$failed$off$succeeded
API String ID: 738519595-1851473252
Opcode ID: aff446fa6f51ad4350784f32e3e31bf40230af2a852b81f64a2c5e9eccdab71c
Instruction ID: a2ddd7868564449f68776879ae4c4a9fd7ecfb6a685bcc3bdc17102b81e81f85
Opcode Fuzzy Hash: aff446fa6f51ad4350784f32e3e31bf40230af2a852b81f64a2c5e9eccdab71c
Instruction Fuzzy Hash: 2B021271600702AFE7209B74EC49BEA7FE8BF40718F24A429E919DA2D1D774E850C724

Function 00535464 Relevance: 81.3, APIs: 28, Strings: 18, Instructions: 825
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 005354BE
calloc.MSVCRT ref: 00535501
getenv.MSVCRT ref: 005357FD
strtol.MSVCRT ref: 00535811
calloc.MSVCRT ref: 0053582E
calloc.MSVCRT ref: 00535861
free.MSVCRT ref: 005358C3
free.MSVCRT ref: 005358D8
free.MSVCRT ref: 005358E9
fprintf.MSVCRT ref: 0053592A
fprintf.MSVCRT ref: 00535952
malloc.MSVCRT ref: 0053596D
fprintf.MSVCRT ref: 005359B3
fputs.MSVCRT ref: 005359D8
fwrite.MSVCRT ref: 005359EE
fwrite.MSVCRT ref: 00535A05
fprintf.MSVCRT ref: 00535A2C
malloc.MSVCRT ref: 00535B11
strncpy.MSVCRT ref: 00535B62
malloc.MSVCRT ref: 00535B7B
malloc.MSVCRT ref: 00535BFE
malloc.MSVCRT ref: 00535CCC
malloc.MSVCRT ref: 00535D3F
getenv.MSVCRT ref: 00535DE7
free.MSVCRT ref: 00535DFA
fprintf.MSVCRT ref: 00535E84
free.MSVCRT ref: 00535E94

Part of subcall function 00539B61: WSASetLastError.WS2_32(00000000), ref: 00539C79

malloc.MSVCRT ref: 00536079

Part of subcall function 00539155: WSASetLastError.WS2_32(00000000,?,?,?,?,?,00537A8E,?,00000000), ref: 005391D4

Strings

BIG-REQUESTS, xrefs: 00535FD0
Xlib: Did not parse entire setup message: parsed: %ld, message: %ld, xrefs: 00535E7E
Xlib: connection to "%s" invalid setup, xrefs: 00535ACD
, xrefs: 00535A0F
Xlib: Broken initial reply: length of reason > length of packet, xrefs: 005359D3
Xlib: Broken initial reply: Too short (%ld), xrefs: 00535A1E
XLIBBUFFERSIZE, xrefs: 005357F8
(, xrefs: 00535C31
l, xrefs: 00535880
ESTS, xrefs: 00535FC1
#, xrefs: 0053563E
Xlib: client uses different protocol version (%d) than server (%d)!, xrefs: 00535949
REQU, xrefs: 00535FBA
Xlib: connection to "%s" refused by serverXlib: , xrefs: 005359AD
XLIB_SKIP_ARGB_VISUALS, xrefs: 00535DE2
Xlib: unexpected connection setup reply from server, type %d., xrefs: 00535921
, xrefs: 00535DA6
DISPLAY, xrefs: 005354B9

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$fprintffree$callocgetenv$ErrorLastfwrite$fputsstrncpystrtol
String ID: $ $#$($BIG-REQUESTS$DISPLAY$ESTS$REQU$XLIBBUFFERSIZE$XLIB_SKIP_ARGB_VISUALS$Xlib: Broken initial reply: Too short (%ld)$Xlib: Broken initial reply: length of reason > length of packet$Xlib: Did not parse entire setup message: parsed: %ld, message: %ld$Xlib: client uses different protocol version (%d) than server (%d)!$Xlib: connection to "%s" invalid setup$Xlib: connection to "%s" refused by serverXlib: $Xlib: unexpected connection setup reply from server, type %d.$l
API String ID: 253740926-3762839477
Opcode ID: 60fd73830643728af963a89e365d222fef10a8412c2ff9a42bbc6d6107a554ea
Instruction ID: c16b340997dc5eae448f0857444bfd3e8570d4e32ae3c4a7e35061f2d88f2cff
Opcode Fuzzy Hash: 60fd73830643728af963a89e365d222fef10a8412c2ff9a42bbc6d6107a554ea
Instruction Fuzzy Hash: EB827FB0A006169FEB24CF24C885BAAFFF4FF44304F148299E5589B281E775E995DF90

Function 004B5457 Relevance: 77.5, APIs: 24, Strings: 20, Instructions: 520
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 004B5544
strrchr.MSVCRT ref: 004B5556
strrchr.MSVCRT ref: 004B5566
strrchr.MSVCRT ref: 004B5585
strncpy.MSVCRT ref: 004B5699
sprintf.MSVCRT ref: 004B56FE
strcpy.MSVCRT(?,?), ref: 004B5737
strcpy.MSVCRT(?,00000000,004356B4,?,00000103), ref: 004B576A
strcat.MSVCRT(?,\xkb_XXXXXX,004356B4,?,00000103), ref: 004B5777
_mktemp.MSVCRT ref: 004B577F
fopen.MSVCRT ref: 004B5818
fclose.MSVCRT ref: 004B5840
strncpy.MSVCRT ref: 004B5868
_unlink.MSVCRT(?), ref: 004B5880
_unlink.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004356B4), ref: 004B5896
_isctype.MSVCRT ref: 004B5920
sprintf.MSVCRT ref: 004B5992
sprintf.MSVCRT ref: 004B59DD
fopen.MSVCRT ref: 004B59FC
strncpy.MSVCRT ref: 004B5A1C
fclose.MSVCRT ref: 004B5A7B
_unlink.MSVCRT(?,00000000,00000005,Error loading keymap %s,?), ref: 004B5A81
fclose.MSVCRT ref: 004B5A8D
_unlink.MSVCRT(?,00000000), ref: 004B5A93

Strings

"%s\xkbcomp" -w %d "-R%s" -xkm "%s" -em1 %s -emp %s -eml %s "%s%s.xkm", xrefs: 004B57C5
Couldn't open compiled keymap file %s, xrefs: 004B5A3C
"The XKEYBOARD keymap compiler (xkbcomp) reports:", xrefs: 004B55E0, 004B563A, 004B57A9, 004B57E8
"> ", xrefs: 004B55DB, 004B5635, 004B57A4, 004B57E3
C:\Program Files (x86)\Xming\xkb, xrefs: 004B5601, 004B57AF, 004B598B
%s%s.xkm, xrefs: 004B59D7
-m , xrefs: 004B55EF, 004B55FB, 004B5649, 004B5655
"%s\xkbcomp" -w %d "-R%s" -xkm %s%s -em1 %s -emp %s -eml %s keymap/%s "%s%s.xkm", xrefs: 004B561A
server-%s, xrefs: 004B56F8
%s/%s%s.xkm, xrefs: 004B598C
xkbcomp -w %d -xkm "%s" -em1 %s -emp %s -eml %s "%s%s.xkm", xrefs: 004B57FD
name of keymap (%s) exceeds max length, xrefs: 004B571E
rules, xrefs: 004B5461
PA:v, xrefs: 004B5908
\xkb_XXXXXX, xrefs: 004B5771
Error loading keymap %s, xrefs: 004B5A6E
C:\Program Files (x86)\Xming, xrefs: 004B5619, 004B57C4
:, xrefs: 004B592B
xkbcomp -w %d -xkm %s%s -em1 %s -emp %s -eml %s keymap/%s "%s%s.xkm", xrefs: 004B5672
"Errors from xkbcomp are not fatal to the X server", xrefs: 004B55D6, 004B5630, 004B579F, 004B57DE

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _unlinkstrncpy$fclosesprintfstrrchr$fopenstrcpy$_isctype_mktempstrcat
String ID: "%s\xkbcomp" -w %d "-R%s" -xkm "%s" -em1 %s -emp %s -eml %s "%s%s.xkm"$"%s\xkbcomp" -w %d "-R%s" -xkm %s%s -em1 %s -emp %s -eml %s keymap/%s "%s%s.xkm"$"> "$"Errors from xkbcomp are not fatal to the X server"$"The XKEYBOARD keymap compiler (xkbcomp) reports:"$%s%s.xkm$%s/%s%s.xkm$-m $:$C:\Program Files (x86)\Xming$C:\Program Files (x86)\Xming\xkb$Couldn't open compiled keymap file %s$Error loading keymap %s$PA:v$\xkb_XXXXXX$name of keymap (%s) exceeds max length$rules$server-%s$xkbcomp -w %d -xkm "%s" -em1 %s -emp %s -eml %s "%s%s.xkm"$xkbcomp -w %d -xkm %s%s -em1 %s -emp %s -eml %s keymap/%s "%s%s.xkm"
API String ID: 952497842-3547241373
Opcode ID: 4e57e1b86be3294dade628d1d9572198650ad6b64861f5a52a8fbc1dedf8db19
Instruction ID: d6f23f7471ec40fa15d08841f584a30821332a3183c3f98ee794b5f33c096860
Opcode Fuzzy Hash: 4e57e1b86be3294dade628d1d9572198650ad6b64861f5a52a8fbc1dedf8db19
Instruction Fuzzy Hash: 7D023D756006199FEB219F14DC81FEFBBA9EB49304F14816AF808A7241DB78DD46CB78

Function 0053B195 Relevance: 65.4, APIs: 31, Strings: 6, Instructions: 610sleepstringCOMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 0053B2D6
atoi.MSVCRT(00000000), ref: 0053B31B
_isctype.MSVCRT ref: 0053B367
atoi.MSVCRT(00000002), ref: 0053B399
malloc.MSVCRT ref: 0053B42F
sprintf.MSVCRT ref: 0053B479
Sleep.KERNEL32(000003E8), ref: 0053B4DD
Sleep.KERNEL32(000003E8,?), ref: 0053B52D
free.MSVCRT ref: 0053B53E
free.MSVCRT ref: 0053B56E
malloc.MSVCRT ref: 0053B5FB
sprintf.MSVCRT ref: 0053B637
free.MSVCRT ref: 0053B664
free.MSVCRT ref: 0053B679
free.MSVCRT ref: 0053B68E
free.MSVCRT ref: 0053B6A3
sprintf.MSVCRT ref: 0053B707

Part of subcall function 0054416B: _access.MSVCRT ref: 0054419D
Part of subcall function 0054416B: fopen.MSVCRT ref: 005441B4
Part of subcall function 0054416B: strncmp.MSVCRT ref: 00544277

strncmp.MSVCRT ref: 0053B7A0
free.MSVCRT ref: 0053B801
time.MSVCRT(?), ref: 0053B813
free.MSVCRT ref: 0053B8AE
malloc.MSVCRT ref: 0053B8BE
memcpy.MSVCRT(00000000,00000000,00000000), ref: 0053B8D5
malloc.MSVCRT ref: 0053B8FD
memcpy.MSVCRT(00000000,00000000,00000000), ref: 0053B914
free.MSVCRT ref: 0053B972
free.MSVCRT ref: 0053B987
free.MSVCRT ref: 0053B99C
free.MSVCRT ref: 0053B9BF
free.MSVCRT ref: 0053B9D4
free.MSVCRT ref: 0053B9E9

Strings

XDM-AUTHORIZATION-1, xrefs: 0053B795
PA:v, xrefs: 0053B2C3, 0053B354
%s%s%d.%d, xrefs: 0053B631
%s/%s:%d, xrefs: 0053B46E
SUS, xrefs: 0053B8F3, 0053B91E
tcp, xrefs: 0053B3BC

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: free$malloc$sprintf$Sleep_isctypeatoimemcpystrncmp$_accessfopentime
String ID: %s%s%d.%d$%s/%s:%d$PA:v$SUS$XDM-AUTHORIZATION-1$tcp
API String ID: 1275017174-4061332560
Opcode ID: ab1341c80335108b423dc70de69d68c2111701394e519ba1644e9d27fc5ad9ba
Instruction ID: f0476aaecbbdbb6c7bc631026d74cd370323ea9f8a1c20437be1164b611403a2
Opcode Fuzzy Hash: ab1341c80335108b423dc70de69d68c2111701394e519ba1644e9d27fc5ad9ba
Instruction Fuzzy Hash: 4E32C171A002298BEB218F29DC85BEEBFB5BF45310F1481E5E648AB191DB749EC1DF50

Function 00441670 Relevance: 65.1, APIs: 14, Strings: 23, Instructions: 301
sleepclipboardnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00445CB0: memset.MSVCRT ref: 00445CCB
Part of subcall function 00445CB0: GetVersionExA.KERNEL32(?,?), ref: 00445CDB

pthread_exit.PTHREADGC2(00000000,winClipboardProc - XInitThreads failed.), ref: 004416D6
pthread_exit.PTHREADGC2(00000000,winClipboardProc - Locale not supported by X. Exiting.), ref: 004416F3
_setjmp.MSVCRT ref: 00441700
pthread_exit.PTHREADGC2(00000000,winClipboardProc - setjmp returned: %d exiting,00000000), ref: 00441726
pthread_exit.PTHREADGC2(00000000,winClipboardProc - setjmp returned for IO Error Handler.), ref: 00441742
Sleep.KERNEL32(00000FA0,winClipboardProc - Could not open display, try: %d, sleeping: %d,00000001,00000004), ref: 004417CE
pthread_exit.PTHREADGC2(00000000,winClipboardProc - Failed opening the display, giving up,?,?,00000004), ref: 004417E7
pthread_exit.PTHREADGC2(00000000,winClipboardProc - Could not create an X window.), ref: 004418A8
GetClipboardOwner.USER32 ref: 004418C6
pthread_exit.PTHREADGC2(00000000,winClipboardProc - Could not set PRIMARY owner), ref: 004418FD
pthread_exit.PTHREADGC2(00000000,winClipboardProc - Could not set CLIPBOARD owner), ref: 00441937
select.WS2_32(?,00000001,00000000,00000000,00000000), ref: 004419C2
WSAGetLastError.WS2_32(?,00000001,00000000,00000000,00000000), ref: 004419C9
__WSAFDIsSet.WS2_32(?,00000001), ref: 004419F4

Strings

winClipboardProc - DISPLAY=%s, xrefs: 00441798
winClipboardProc - XDestroyWindow succeeded., xrefs: 00441A60
127.0.0.1:%s.0, xrefs: 00441784
winClipboardProc - Locale not supported by X. Exiting., xrefs: 004416E7
winClipboardProc - setjmp returned: %d exiting, xrefs: 0044171A
winClipboardProc - Could not set PRIMARY owner, xrefs: 004418F1
winClipboardProc - Hello, xrefs: 00441680
winClipboardProc - XInitThreads failed., xrefs: 004416CA
winClipboardProc - setjmp returned for IO Error Handler., xrefs: 00441736
MIT-MAGIC-COOKIE-1, xrefs: 00441760
winClipboardProc - Could not open display, try: %d, sleeping: %d, xrefs: 004417BF
winClipboardProc - XOpenDisplay () returned and successfully opened the display., xrefs: 004417EF
winClipboardProc - winClipboardFlushWindowsMessageQueue trapped WM_QUIT message, exiting main loop., xrefs: 00441A30
winClipboardProc - Failed opening the display, giving up, xrefs: 004417DB
CLIPBOARD_MANAGER, xrefs: 0044184D
winClipboardProc - XSelectInput generated BadWindow on RootWindow, xrefs: 00441833
d, xrefs: 0044199A
CLIPBOARD, xrefs: 00441840
winClipboardProc - XDestroyWindow returned BadWindow., xrefs: 00441A59
winClipboardProc - Could not create an X window., xrefs: 0044189C
winClipboardProc - Could not set CLIPBOARD owner, xrefs: 0044192B
winClipboardProc - winClipboardFlushXEvents trapped shutdown event, exiting main loop., xrefs: 0044196C
winClipboardProc - Call to select () failed: %d. Bailing., xrefs: 004419DA

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: pthread_exit$ClipboardErrorLastOwnerSleepVersion_setjmpmemsetselect
String ID: 127.0.0.1:%s.0$CLIPBOARD$CLIPBOARD_MANAGER$MIT-MAGIC-COOKIE-1$d$winClipboardProc - Call to select () failed: %d. Bailing.$winClipboardProc - Could not create an X window.$winClipboardProc - Could not open display, try: %d, sleeping: %d$winClipboardProc - Could not set CLIPBOARD owner$winClipboardProc - Could not set PRIMARY owner$winClipboardProc - DISPLAY=%s$winClipboardProc - Failed opening the display, giving up$winClipboardProc - Hello$winClipboardProc - Locale not supported by X. Exiting.$winClipboardProc - XDestroyWindow returned BadWindow.$winClipboardProc - XDestroyWindow succeeded.$winClipboardProc - XInitThreads failed.$winClipboardProc - XOpenDisplay () returned and successfully opened the display.$winClipboardProc - XSelectInput generated BadWindow on RootWindow$winClipboardProc - setjmp returned for IO Error Handler.$winClipboardProc - setjmp returned: %d exiting$winClipboardProc - winClipboardFlushWindowsMessageQueue trapped WM_QUIT message, exiting main loop.$winClipboardProc - winClipboardFlushXEvents trapped shutdown event, exiting main loop.
API String ID: 1162023644-3969000611
Opcode ID: b8ca15443af3e83f14b9f61bf9f65f6f2c7a10141c80108241196dd2b62f0fdf
Instruction ID: f26fed28045c16b479d4c281b2ec9e944639f722c124f175b71f9c36d955a793
Opcode Fuzzy Hash: b8ca15443af3e83f14b9f61bf9f65f6f2c7a10141c80108241196dd2b62f0fdf
Instruction Fuzzy Hash: DAA16871A803167AFB20BB61AC86FDE3B79FF45708F108057F504E51A1DBB94A90CB29

Function 00434781 Relevance: 63.4, APIs: 15, Strings: 21, Instructions: 356
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - pProcArg is NULL. Exiting.), ref: 004347B6
pthread_mutex_lock.PTHREADGC2(?,winMultiWindowXMsgProc - Calling pthread_mutex_lock ()), ref: 004347D1
pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - pthread_mutex_lock () failed: %d. Exiting.,00000000), ref: 004347EA
pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - XInitThreads () failed. Exiting.), ref: 00434813
pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - Locale not supported by X. Exiting.), ref: 00434830
pthread_mutex_unlock.PTHREADGC2(?), ref: 00434841
_setjmp.MSVCRT ref: 00434856
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowXMsgProc - setjmp returned: %d. Exiting.,00000000), ref: 0043487E
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowXMsgProc - Caught IO Error. Exiting.), ref: 0043489A
Sleep.KERNEL32(00001388,0059CF42,00000001,00000005), ref: 00434917
pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - Failed opening the display. Exiting.,?,?,00000005), ref: 00434942
pthread_exit.PTHREADGC2(00000000,winMultiWindowXMsgProc - another window manager is running. Exiting.), ref: 004349D7
SendMessageA.USER32(?,00000464,00000000,00000000), ref: 00434B1C
Sleep.KERNEL32(000001F4), ref: 00434B26
pthread_exit.PTHREADGC2(00000000,?), ref: 00434CA9

Strings

winMultiWindowXMsgProc - WM_CHANGE_STATE - IconicState, xrefs: 00434C59
winMultiWindowXMsgProc - XOpenDisplay () returned and successfully opened the display., xrefs: 0043494A
winMultiWindowXMsgProc - pthread_mutex_lock () returned., xrefs: 004347F3
winInitMultiWindowXMsgProc - setjmp returned: %d. Exiting., xrefs: 00434872
winMultiWindowXMsgProc - Hello, xrefs: 00434790
winMultiWindowXMsgProc - Failed opening the display. Exiting., xrefs: 00434936
WM_CHANGE_STATE, xrefs: 00434A7D
!, xrefs: 00434C33
winMultiWindowXMsgProc - Calling pthread_mutex_lock (), xrefs: 004347BE
winMultiWindowXMsgProc - another window manager is running. Exiting., xrefs: 004349CB
winInitMultiWindowXMsgProc - Caught IO Error. Exiting., xrefs: 0043488E
winMultiWindowXMsgProc - pthread_mutex_unlock () returned., xrefs: 00434847
127.0.0.1:%s.%d, xrefs: 004348CB
winMultiWindowXMsgProc - pProcArg is NULL. Exiting., xrefs: 004347AA
winMultiWindowXMsgProc - XInitThreads () failed. Exiting., xrefs: 00434807
(MC, xrefs: 004348B6
winMultiWindowXMsgProc - Locale not supported by X. Exiting., xrefs: 00434824
WM_NAME, xrefs: 00434A4D
WM_HINTS, xrefs: 00434A61
winMultiWindowXMsgProc - pthread_mutex_lock () failed: %d. Exiting., xrefs: 004347DE
winMultiWindowXMsgProc - DISPLAY=%s, xrefs: 004348DE

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: pthread_exit$Sleep$MessageSend_setjmppthread_mutex_lockpthread_mutex_unlock
String ID: !$(MC$127.0.0.1:%s.%d$WM_CHANGE_STATE$WM_HINTS$WM_NAME$winInitMultiWindowXMsgProc - Caught IO Error. Exiting.$winInitMultiWindowXMsgProc - setjmp returned: %d. Exiting.$winMultiWindowXMsgProc - Calling pthread_mutex_lock ()$winMultiWindowXMsgProc - DISPLAY=%s$winMultiWindowXMsgProc - Failed opening the display. Exiting.$winMultiWindowXMsgProc - Hello$winMultiWindowXMsgProc - Locale not supported by X. Exiting.$winMultiWindowXMsgProc - WM_CHANGE_STATE - IconicState$winMultiWindowXMsgProc - XInitThreads () failed. Exiting.$winMultiWindowXMsgProc - XOpenDisplay () returned and successfully opened the display.$winMultiWindowXMsgProc - another window manager is running. Exiting.$winMultiWindowXMsgProc - pProcArg is NULL. Exiting.$winMultiWindowXMsgProc - pthread_mutex_lock () failed: %d. Exiting.$winMultiWindowXMsgProc - pthread_mutex_lock () returned.$winMultiWindowXMsgProc - pthread_mutex_unlock () returned.
API String ID: 2490243094-504996183
Opcode ID: 5ce119e85bb5caa2ba18c616e47f9c05739d7a8ceae026d6a1c215d41d419e5c
Instruction ID: 70b02bef8ffc7b77d0ef02b41ca771f997b1055ad6ecb0ef7cc424e12f196fcb
Opcode Fuzzy Hash: 5ce119e85bb5caa2ba18c616e47f9c05739d7a8ceae026d6a1c215d41d419e5c
Instruction Fuzzy Hash: F2D1B731A40216DBDF10AB60DC49BDABBB5FF88344F1490AAF108A7291D775AD81CF59

Function 00525088 Relevance: 56.5, APIs: 26, Strings: 6, Instructions: 457
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 005250CC
strncpy.MSVCRT ref: 005250E7
strcpy.MSVCRT(?,?), ref: 005250FD
strcpy.MSVCRT(?,?), ref: 00525114
strcat.MSVCRT(?,005ABCC0), ref: 00525135
strcat.MSVCRT(?,fonts.dir), ref: 00525142
fopen.MSVCRT ref: 0052514D
_stat.MSVCRT(?,?), ref: 00525167
fscanf.MSVCRT ref: 00525182
sprintf.MSVCRT ref: 005251DD
fscanf.MSVCRT ref: 0052525E
fclose.MSVCRT ref: 00525272
_errno.MSVCRT ref: 0052527A
strcpy.MSVCRT(?,?), ref: 005252D3
strcat.MSVCRT(?,005ABCC0), ref: 00525310
strcat.MSVCRT(?,fonts.alias), ref: 0052531D
fopen.MSVCRT ref: 0052532A
_errno.MSVCRT ref: 0052533B
fclose.MSVCRT ref: 0052537F
_stat.MSVCRT(?,?), ref: 0052539D
fclose.MSVCRT ref: 005253B2
fclose.MSVCRT ref: 0052562C
fclose.MSVCRT ref: 00525667

Strings

U, xrefs: 00525619
%d, xrefs: 0052517C
FILE_NAMES_ALIASES, xrefs: 00525469
%%%ds %%%d[^], xrefs: 005251D3
fonts.dir, xrefs: 0052513C
fonts.alias, xrefs: 00525317

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fclose$strcat$strcpy$_errno_statfopenfscanf$sprintfstrchrstrncpy
String ID: %%%ds %%%d[^]$%d$FILE_NAMES_ALIASES$U$fonts.alias$fonts.dir
API String ID: 3646283605-159946537
Opcode ID: e3aa1fefadcfc33e1b73de0ca0db335fd5cd9d8dc66eb141aabcc81f8802b8a5
Instruction ID: a1df4e8e143fea7bfd1cea7376956958a04e7a5e534b9fabe9d1b075abaea53a
Opcode Fuzzy Hash: e3aa1fefadcfc33e1b73de0ca0db335fd5cd9d8dc66eb141aabcc81f8802b8a5
Instruction Fuzzy Hash: 1FE15D7590063A9ADB249A34EC49A9E7F74FF46320F5082A6F509A31C3EB309E85DF50

Function 00431240 Relevance: 56.5, APIs: 2, Strings: 30, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

winFinishScreenInitFB - Could not allocate framebuffer, xrefs: 0043126A
null screen fn RealizeWindow, xrefs: 0043155F, 004316BE
+dC, xrefs: 00431435
winScreenInit - MultiWindowExtWM - RootlessInit returned, xrefs: 004314B8
null screen fn SetShape, xrefs: 004315FB, 0043181D
null screen fn ResizeWindow, xrefs: 004317A8
null screen fn CopyWindow, xrefs: 004317F6
winFinishScreenInitFB - Could not create colormap, xrefs: 0043144D
null screen fn MoveWindow, xrefs: 004317CF
null screen fn ReparentWindow, xrefs: 0043175A
null screen fn UnrealizeWindow, xrefs: 00431586, 004316E5
winFinishScreenInitFB - fbSetupScreen failed, xrefs: 00431311
winFinishScreenInitFB - fbPictureInit () failed, xrefs: 00431410
null screen fn DestroyWindow, xrefs: 00431538, 00431697
winFinishScreenInitFB - winRandRInit () failed, xrefs: 00431425
winScreenInit - MultiWindowExtWM - Calling RootlessInit, xrefs: 004314A3
winFinishScreenInitFB - returning, xrefs: 0043196E
null screen fn RestackWindow, xrefs: 00431781
winFinishScreenInitFB - pthread_mutex_init () failed: %d, xrefs: 004318CB
winFinishScreenInitFB - winInitVisuals failed, xrefs: 004312D7
null screen fn CreateWindow, xrefs: 00431511, 00431670
null screen fn PositionWindow, xrefs: 004315AD, 0043170C
winFinishScreenInitFB - Masks: %08x %08x %08x, xrefs: 004312BD
null screen fn ChangeWindowAttributes, xrefs: 004315D4, 00431733
winFinishScreenInitFB - shadowInit () failed, xrefs: 00431490
winFinishScreenInitFB - Calling winInitWM., xrefs: 0043190E
winFinishScreenInitFB - RootlessAccelInit () failed, xrefs: 004313F5
winFinishScreenInitFB - winInitWM () failed., xrefs: 00431952
winFinishScreenInitFB - pthread_mutex_lock () failed: %d, xrefs: 004318DF
winFinishScreenInitFB - fbFinishScreenInit failed, xrefs: 004313A5

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID:
String ID: +dC$null screen fn ChangeWindowAttributes$null screen fn CopyWindow$null screen fn CreateWindow$null screen fn DestroyWindow$null screen fn MoveWindow$null screen fn PositionWindow$null screen fn RealizeWindow$null screen fn ReparentWindow$null screen fn ResizeWindow$null screen fn RestackWindow$null screen fn SetShape$null screen fn UnrealizeWindow$winFinishScreenInitFB - Calling winInitWM.$winFinishScreenInitFB - Could not allocate framebuffer$winFinishScreenInitFB - Could not create colormap$winFinishScreenInitFB - Masks: %08x %08x %08x$winFinishScreenInitFB - RootlessAccelInit () failed$winFinishScreenInitFB - fbFinishScreenInit failed$winFinishScreenInitFB - fbPictureInit () failed$winFinishScreenInitFB - fbSetupScreen failed$winFinishScreenInitFB - pthread_mutex_init () failed: %d$winFinishScreenInitFB - pthread_mutex_lock () failed: %d$winFinishScreenInitFB - returning$winFinishScreenInitFB - shadowInit () failed$winFinishScreenInitFB - winInitVisuals failed$winFinishScreenInitFB - winInitWM () failed.$winFinishScreenInitFB - winRandRInit () failed$winScreenInit - MultiWindowExtWM - Calling RootlessInit$winScreenInit - MultiWindowExtWM - RootlessInit returned
API String ID: 0-1717656824
Opcode ID: 62e7e558e3157c194705f7dc2d0b8b471972fe6a5b2dad27cee35e8eb0654382
Instruction ID: 36ed8b497000876c72f626c3ae18ea7a42234e276573c4f1278f33b0702f84cc
Opcode Fuzzy Hash: 62e7e558e3157c194705f7dc2d0b8b471972fe6a5b2dad27cee35e8eb0654382
Instruction Fuzzy Hash: 99020170700702EFEB249F21D845BABBBE4BF0D708F14991FE05A96261D778A454CFA9

Function 00432D18 Relevance: 51.1, APIs: 14, Strings: 15, Instructions: 307
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000016,00000000,?,00000000), ref: 00432D6D
SystemParametersInfoA.USER32(0000000A,00000000,00000000,00000000), ref: 00432D87
GetKeyboardType.USER32(00000000), ref: 00432E03
GetKeyboardLayoutNameA.USER32(?), ref: 00432E16
strtoul.MSVCRT ref: 00432E31
LoadKeyboardLayoutA.USER32(00000409,00000001), ref: 00432E5F
memcpy.MSVCRT(?,SYSTEM\CurrentControlSet\Control\Keyboard Layouts\,00000033), ref: 00432F14
malloc.MSVCRT ref: 00432F25
strcpy.MSVCRT(00000000,?,0000003D,?,SYSTEM\CurrentControlSet\Control\Keyboard Layouts\,00000033), ref: 00432F2E
strcat.MSVCRT(00000000,?,00000000,?,0000003D,?,SYSTEM\CurrentControlSet\Control\Keyboard Layouts\,00000033), ref: 00432F35
RegOpenKeyA.ADVAPI32(80000002,00000000,00000000), ref: 00432F4A
RegQueryValueExA.ADVAPI32(00000000,Layout Text,00000000,00000000,?,00000100), ref: 00432F70
RegCloseKey.ADVAPI32(00000000), ref: 00432F95
free.MSVCRT ref: 00432F9B

Strings

XkbExtension disabled, xrefs: 0043300C
Setting autorepeat to delay=%d, rate=%d, xrefs: 00432DF0
Layout Text, xrefs: 00432F65
Loading US keyboard layout., xrefs: 00432E68
Keyboardlayout "%s" (%s) is unknown, xrefs: 00432F7B
XKB: variant: "%s", xrefs: 004330F2
XKB: model: "%s", xrefs: 0043307E
winConfigKeyboard - Layout: "%s" (%08x) , xrefs: 00432E8E
XKB: rules: "%s", xrefs: 00433044
00000409, xrefs: 00432E5A
SYSTEM\CurrentControlSet\Control\Keyboard Layouts\, xrefs: 00432F04
LoadKeyboardLaout failed., xrefs: 00432E71
Using preset keyboard for "%s" (%x), type "%d", xrefs: 00432EC0
XKB: layout: "%s", xrefs: 004330B8
XKB: options: "%s", xrefs: 0043312C

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: Keyboard$InfoLayoutParametersSystem$CloseLoadNameOpenQueryTypeValuefreemallocmemcpystrcatstrcpystrtoul
String ID: 00000409$Keyboardlayout "%s" (%s) is unknown$Layout Text$LoadKeyboardLaout failed.$Loading US keyboard layout.$SYSTEM\CurrentControlSet\Control\Keyboard Layouts\$Setting autorepeat to delay=%d, rate=%d$Using preset keyboard for "%s" (%x), type "%d"$XKB: layout: "%s"$XKB: model: "%s"$XKB: options: "%s"$XKB: rules: "%s"$XKB: variant: "%s"$XkbExtension disabled$winConfigKeyboard - Layout: "%s" (%08x)
API String ID: 527708383-1194198751
Opcode ID: 7e9eeb9a59fe3cd133f7826c1f6344ed46a4960eb44c2bd931d10182cdb53599
Instruction ID: ad853ed301fc30658b9a484c0741989d1001490b1e605acd7a5b44e5f4950a64
Opcode Fuzzy Hash: 7e9eeb9a59fe3cd133f7826c1f6344ed46a4960eb44c2bd931d10182cdb53599
Instruction Fuzzy Hash: B9A1C6B0600301AAFB20DF25FD96F6B37BCFB58754F005036E90CD6291D7B88949ABA5

Function 00434474 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 183
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - pProcArg is NULL. Exiting.), ref: 004344B4
pthread_mutex_lock.PTHREADGC2(?,winInitMultiWindowWM - Calling pthread_mutex_lock ()), ref: 004344CF
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - pthread_mutex_lock () failed: %d. Exiting.,00000000), ref: 004344EA
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - XInitThreads () failed. Exiting.), ref: 00434513
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - Locale not supported by X. Exiting.), ref: 00434530
pthread_mutex_unlock.PTHREADGC2(?), ref: 00434541
_setjmp.MSVCRT ref: 00434556
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - setjmp returned: %d. Exiting.,00000000), ref: 0043457E
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - Caught IO Error. Exiting.), ref: 0043459A
Sleep.KERNEL32(00001388,0059CBD2,?,00000005), ref: 00434620
pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - Failed opening the display. Exiting.,?,?,00000005), ref: 0043465B

Strings

winInitMultiWindowWM - Calling pthread_mutex_lock (), xrefs: 004344BC
winInitMultiWindowWM - pthread_mutex_lock () failed: %d. Exiting., xrefs: 004344DE
winInitMultiWindowWM - pProcArg is NULL. Exiting., xrefs: 004344A8
winInitMultiWindowWM - pthread_mutex_lock () returned., xrefs: 004344F3
winInitMultiWindowWM - Caught IO Error. Exiting., xrefs: 0043458E
WM_PROTOCOLS, xrefs: 00434675
127.0.0.1:%s.%d, xrefs: 004345CA
winInitMultiWindowWM - pthread_mutex_unlock () returned., xrefs: 00434547
winInitMultiWindowWM - setjmp returned: %d. Exiting., xrefs: 00434572
_WINDOWSWM_NATIVE_HWND, xrefs: 004346A3
winInitMultiWindowWM - Locale not supported by X. Exiting., xrefs: 00434524
winInitMultiWindowWM - XInitThreads () failed. Exiting., xrefs: 00434507
winInitMultiWindowWM - Failed opening the display. Exiting., xrefs: 0043464F
WM_DELETE_WINDOW, xrefs: 0043468C
winInitMultiWindowWM - XOpenDisplay () returned and successfully opened the display., xrefs: 00434663
winInitMultiWindowWM - DISPLAY=%s, xrefs: 004345DB
winInitMultiWindowWM - Hello, xrefs: 0043447E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: pthread_exit$Sleep_setjmppthread_mutex_lockpthread_mutex_unlock
String ID: 127.0.0.1:%s.%d$WM_DELETE_WINDOW$WM_PROTOCOLS$_WINDOWSWM_NATIVE_HWND$winInitMultiWindowWM - Calling pthread_mutex_lock ()$winInitMultiWindowWM - Caught IO Error. Exiting.$winInitMultiWindowWM - DISPLAY=%s$winInitMultiWindowWM - Failed opening the display. Exiting.$winInitMultiWindowWM - Hello$winInitMultiWindowWM - Locale not supported by X. Exiting.$winInitMultiWindowWM - XInitThreads () failed. Exiting.$winInitMultiWindowWM - XOpenDisplay () returned and successfully opened the display.$winInitMultiWindowWM - pProcArg is NULL. Exiting.$winInitMultiWindowWM - pthread_mutex_lock () failed: %d. Exiting.$winInitMultiWindowWM - pthread_mutex_lock () returned.$winInitMultiWindowWM - pthread_mutex_unlock () returned.$winInitMultiWindowWM - setjmp returned: %d. Exiting.
API String ID: 3211097410-714944892
Opcode ID: 3f6920c4f49752168f25bf121e7ea6e54aa302101157dbd2eeae175f6e4f45b0
Instruction ID: 842aeb463a1d19e423c57746e0c8ae4642f61e1ba5d6594695b122b0d7cb255a
Opcode Fuzzy Hash: 3f6920c4f49752168f25bf121e7ea6e54aa302101157dbd2eeae175f6e4f45b0
Instruction Fuzzy Hash: 2B51D230B40316ABEF10AB61EC4BF9A7F75BF44705F108196F108A6192DBB95E80CF69

Function 0042BA74 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 175
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 0042BA92
_errno.MSVCRT ref: 0042BAB4
accept.WS2_32(?,?,?), ref: 0042BADA
WSAGetLastError.WS2_32 ref: 0042BAE6
_errno.MSVCRT ref: 0042BAED
_errno.MSVCRT ref: 0042BAF4
_errno.MSVCRT ref: 0042BB16
memcpy.MSVCRT(00000000,?,00000010,?,00000006), ref: 0042BC93

Strings

SocketINETAccept: accept() failed, xrefs: 0042BB0C
SocketINETAccept: ...SocketINETGetPeerAddr() failed:, xrefs: 0042BC4D
SocketINETGetPeerAddr: Can't allocate space for the addr, xrefs: 0042BC21
SocketINETGetPeerAddr: getpeername() failed: %d, xrefs: 0042BBE7
SocketINETAccept: ...SocketINETGetAddr() failed:, xrefs: 0042BB70
SocketINETAccept: malloc failed, xrefs: 0042BAAA

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$ErrorLastacceptmemcpy
String ID: SocketINETAccept: ...SocketINETGetAddr() failed:$SocketINETAccept: ...SocketINETGetPeerAddr() failed:$SocketINETAccept: accept() failed$SocketINETAccept: malloc failed$SocketINETGetPeerAddr: Can't allocate space for the addr$SocketINETGetPeerAddr: getpeername() failed: %d
API String ID: 192694440-999462631
Opcode ID: e64e8ecc904c40dbc200474f9cef2c1ded587343b84386369c65f6da0f1463ec
Instruction ID: ae72517905b72de05a4ca96e1e55004a65755cb028eec4d8835440de962718b5
Opcode Fuzzy Hash: e64e8ecc904c40dbc200474f9cef2c1ded587343b84386369c65f6da0f1463ec
Instruction Fuzzy Hash: 2951A3B0740315ABDB10BFB5EC46F5A3FA4FF85304F50447AF5049B2A2DB75A900ABA5

Function 0040131B Relevance: 46.1, APIs: 7, Strings: 19, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 00401386

Strings

failed to create default stipple, xrefs: 00401634
couldn't init server resources, xrefs: 00401493
XAUTHORITY, xrefs: 00401370
couldn't create client array, xrefs: 0040141B
(, xrefs: 00401948
failed to create scratch GCs, xrefs: 0040161F
failed to create screen resources, xrefs: 0040160A
could not open default font '%s', xrefs: 004016DF
failed to initialize core devices, xrefs: 00401674
could not create connection block info, xrefs: 00401A9A
server restarted. Jumped through uninitialized pointer?, xrefs: 00401344
failed to set default font path '%s', xrefs: 004016BD
could not open default cursor font '%s', xrefs: 00401704
couldn't create server client, xrefs: 0040144E
failed to create scratch pixmaps, xrefs: 004015EB
couldn't create root window table, xrefs: 004014DE
failed to allocate serverClient devprivates, xrefs: 004015C1
no screens found, xrefs: 0040158C
failed to create root window, xrefs: 00401649

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: getenv
String ID: ($XAUTHORITY$could not create connection block info$could not open default cursor font '%s'$could not open default font '%s'$couldn't create client array$couldn't create root window table$couldn't create server client$couldn't init server resources$failed to allocate serverClient devprivates$failed to create default stipple$failed to create root window$failed to create scratch GCs$failed to create scratch pixmaps$failed to create screen resources$failed to initialize core devices$failed to set default font path '%s'$no screens found$server restarted. Jumped through uninitialized pointer?
API String ID: 498649692-3888112188
Opcode ID: ff8df88960c8e16fedc612bed5ca1352000ec52d54c52606df9118e28cc1a123
Instruction ID: ae5a12d1951d46af88558a39ec7aaf80a04e7bba2bb26cb8629823727b04f03c
Opcode Fuzzy Hash: ff8df88960c8e16fedc612bed5ca1352000ec52d54c52606df9118e28cc1a123
Instruction Fuzzy Hash: FE32F670A40655DFCB10EFA5EC42BAA7BB5FF44304F04406BF444A72A2DB389985DF9A

Function 00434D8B Relevance: 40.6, APIs: 15, Strings: 8, Instructions: 325sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00434474: pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - pProcArg is NULL. Exiting.), ref: 004344B4
Part of subcall function 00434474: pthread_mutex_lock.PTHREADGC2(?,winInitMultiWindowWM - Calling pthread_mutex_lock ()), ref: 004344CF
Part of subcall function 00434474: pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - pthread_mutex_lock () failed: %d. Exiting.,00000000), ref: 004344EA
Part of subcall function 00434474: pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - XInitThreads () failed. Exiting.), ref: 00434513
Part of subcall function 00434474: pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - Locale not supported by X. Exiting.), ref: 00434530
Part of subcall function 00434474: pthread_mutex_unlock.PTHREADGC2(?), ref: 00434541
Part of subcall function 00434474: _setjmp.MSVCRT ref: 00434556
Part of subcall function 00434474: pthread_exit.PTHREADGC2(00000000,winInitMultiWindowWM - setjmp returned: %d. Exiting.,00000000), ref: 0043457E

Sleep.KERNEL32(000003E8), ref: 00434DB2
pthread_mutex_lock.PTHREADGC2(?), ref: 00434DC0
pthread_cond_wait.PTHREADGC2(?,?), ref: 00434DD5
pthread_mutex_unlock.PTHREADGC2(?), ref: 00434E00
pthread_exit.PTHREADGC2(00000000,winMultiWindowWMProc - Queue is Empty? Exiting.), ref: 00434E17
free.MSVCRT ref: 004351EE

Strings

_MOTIF_WM_HINTS, xrefs: 00434EF2
!, xrefs: 00435171
_NET_WM_WINDOW_TYPE_DOCK, xrefs: 00434EBC
winMultiWindowWMProc - Queue is Empty? Exiting., xrefs: 00434E0B
_NET_WM_WINDOW_TYPE_DIALOG, xrefs: 00434ED7
_NET_WM_WINDOW_TYPE, xrefs: 00434EA5
winMultiWindowWMProc - Unknown Message. Exiting., xrefs: 004351D9
ra, xrefs: 0043517E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: pthread_exit$pthread_mutex_lockpthread_mutex_unlock$Sleep_setjmpfreepthread_cond_wait
String ID: !$_MOTIF_WM_HINTS$_NET_WM_WINDOW_TYPE$_NET_WM_WINDOW_TYPE_DIALOG$_NET_WM_WINDOW_TYPE_DOCK$winMultiWindowWMProc - Queue is Empty? Exiting.$winMultiWindowWMProc - Unknown Message. Exiting.$ra
API String ID: 3353992187-2715813447
Opcode ID: 4aa4c23f939899f838028761cfee6273a8366ddf440b8362ed55cea51b17254d
Instruction ID: d6711af8dbc99332f01357cff82b16520fd82841c1b65528d469b926835c1f00
Opcode Fuzzy Hash: 4aa4c23f939899f838028761cfee6273a8366ddf440b8362ed55cea51b17254d
Instruction Fuzzy Hash: EFC1E171900619EFEF319F60DC46FDABBB5BF48300F104196F608A6292DB35AA90DF65

Function 0042C691 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 286stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C666: WSAStartup.WS2_32(00000202,005FD180), ref: 0042C67D

_errno.MSVCRT ref: 0042C6D0
strcpy.MSVCRT(00000000,?), ref: 0042C716
strchr.MSVCRT ref: 0042C726
strrchr.MSVCRT ref: 0042C736
_errno.MSVCRT ref: 0042C8FD
_errno.MSVCRT ref: 0042C923
strcpy.MSVCRT(00000000,00000001), ref: 0042C934

Part of subcall function 0042BDEB: strncpy.MSVCRT ref: 0042BDFC
Part of subcall function 0042BDEB: _isctype.MSVCRT ref: 0042BE30
Part of subcall function 0042BDEB: tolower.MSVCRT ref: 0042BE41
Part of subcall function 0042BDEB: strcmp.MSVCRT ref: 0042BE67

_errno.MSVCRT ref: 0042C958
_errno.MSVCRT ref: 0042C9DC
_errno.MSVCRT ref: 0042CA02
_errno.MSVCRT ref: 0042CA1D
_errno.MSVCRT ref: 0042CA4B

Strings

Open: WSAStartup failed, xrefs: 0042C6E8
local, xrefs: 0042C772, 0042C79F
Open: transport open failed for %s/%s:%s, xrefs: 0042CA41
tcp, xrefs: 0042C77F, 0042C798
Open: Unknown Open type %d, xrefs: 0042C9F8
Open: Unable to find transport for %s, xrefs: 0042C974
Open: Unable to Parse address %s, xrefs: 0042C919
dnet, xrefs: 0042C7EF

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$strcpy$Startup_isctypestrchrstrcmpstrncpystrrchrtolower
String ID: Open: Unable to Parse address %s$Open: Unable to find transport for %s$Open: Unknown Open type %d$Open: WSAStartup failed$Open: transport open failed for %s/%s:%s$dnet$local$tcp
API String ID: 1518186865-4067984996
Opcode ID: c051a06fa243e934b9e69b008c16336ee0f0be07dbe81ebf789e7330e5aad407
Instruction ID: 41e53dec01c51696a599591a48a607a4ec0c7acc168f54f0f946f2a25f261a76
Opcode Fuzzy Hash: c051a06fa243e934b9e69b008c16336ee0f0be07dbe81ebf789e7330e5aad407
Instruction Fuzzy Hash: 44A1B771A002389BDF25AB64EC46BEE7FB4FF45314F5040EBE20866291CB795E809F95

Function 0042F34B Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 166libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0042FA26: malloc.MSVCRT ref: 0042FAD7

memset.MSVCRT ref: 0042F3AC
GetVersionExA.KERNEL32(00000094), ref: 0042F3E6
CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00000094), ref: 0042F42C
GetLastError.KERNEL32(00000400,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000094), ref: 0042F445
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000094), ref: 0042F452
LocalFree.KERNEL32(?,00001300,00000000,00000000,00000400,?,00000000,00000000,00000000,00000000,00000000), ref: 0042F46F
GetLastError.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00000094), ref: 0042F476
atoi.MSVCRT(?,?,InitOutput - Invalid command-line arguments found. Exiting.), ref: 0042F3BA

Part of subcall function 00426B96: abort.MSVCRT ref: 00426BE6
Part of subcall function 00426B96: _vsnprintf.MSVCRT ref: 00426C20
Part of subcall function 00426B96: fwrite.MSVCRT ref: 00426C56
Part of subcall function 00426B96: fwrite.MSVCRT ref: 00426C88

LoadLibraryExA.KERNEL32(comctl32.dll,00000000,00000000), ref: 0042F515
GetProcAddress.KERNEL32(00000000,_TrackMouseEvent), ref: 0042F525
FreeLibrary.KERNEL32(00000001,InitOutput - Could not get pointer to function_TrackMouseEvent in comctl32.dll. Try installingInternet Explorer 3.0 or greater if you have notalready.,00000000,_TrackMouseEvent,comctl32.dll,00000000,00000000), ref: 0042F545
GetModuleHandleA.KERNEL32(00000000,00000000,_TrackMouseEvent,comctl32.dll,00000000,00000000), ref: 0042F564

Strings

winCheckDisplayNumber - Xming is already running on display %d, xrefs: 0042F483
InitOutput - Could not get pointer to function_TrackMouseEvent in comctl32.dll. Try installingInternet Explorer 3.0 or greater if you have notalready., xrefs: 0042F533
_TrackMouseEvent, xrefs: 0042F51A
InitOutput - Couldn't add screen %d, xrefs: 0042F58D
winCheckDisplayNumber - CreateMutex failed: %s, xrefs: 0042F45D
%sCYGWINX_DISPLAY:%d, xrefs: 0042F414
comctl32.dll, xrefs: 0042F510
InitOutput - Invalid command-line arguments found. Exiting., xrefs: 0042F37D
InitOutput - Duplicate invocation on display number: %s. Exiting., xrefs: 0042F4A8
winCheckDisplayNumber - Bad display number: %d, xrefs: 0042F3CA
InitOutput - Returning., xrefs: 0042F5BF

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorFreeLastLibraryfwrite$AddressCreateFormatHandleLoadLocalMessageModuleMutexProcVersion_vsnprintfabortatoimallocmemset
String ID: %sCYGWINX_DISPLAY:%d$InitOutput - Could not get pointer to function_TrackMouseEvent in comctl32.dll. Try installingInternet Explorer 3.0 or greater if you have notalready.$InitOutput - Couldn't add screen %d$InitOutput - Duplicate invocation on display number: %s. Exiting.$InitOutput - Invalid command-line arguments found. Exiting.$InitOutput - Returning.$_TrackMouseEvent$comctl32.dll$winCheckDisplayNumber - Bad display number: %d$winCheckDisplayNumber - CreateMutex failed: %s$winCheckDisplayNumber - Xming is already running on display %d
API String ID: 1624437881-1291716205
Opcode ID: 1fe1a767e82645ff2c0d0914279d57dcae441e13fbe6a7c64f1eacc82ccec137
Instruction ID: 46a5199abdb41f4b85be9c1335ca3da5cf97f94e38f3e5f70dda698da15a4632
Opcode Fuzzy Hash: 1fe1a767e82645ff2c0d0914279d57dcae441e13fbe6a7c64f1eacc82ccec137
Instruction Fuzzy Hash: 58514B70640315AAEF20BF61FC46FAA7B74FB54308F90407AF50865192C7BD5588DBBA

Function 00429A64 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 205stringnetworkfileCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00429A84
getenv.MSVCRT ref: 00429B3B
sprintf.MSVCRT ref: 00429B49
fopen.MSVCRT ref: 00429B54
strchr.MSVCRT ref: 00429B7F
tolower.MSVCRT ref: 00429BAA
strncmp.MSVCRT ref: 00429BCE
strncmp.MSVCRT ref: 00429C00
strncmp.MSVCRT ref: 00429C14

Part of subcall function 0042982F: memchr.MSVCRT ref: 00429848
Part of subcall function 0042982F: strcmp.MSVCRT ref: 0042987B

Part of subcall function 0042939C: memcmp.MSVCRT(00429CC2,?,00000000,?,?,00000000,?,?,00429CC2,00000010,00000000,?), ref: 004293CB
Part of subcall function 0042939C: memcmp.MSVCRT(00429CC2,?,00000000,?,?,00000000,?,?,00429CC2), ref: 00429406
Part of subcall function 0042939C: memmove.MSVCRT(?,00429CC2,00000000,?,?,00000000,?,?,00429CC2), ref: 0042944F

gethostbyname.WS2_32(?), ref: 00429C5A
gethostbyname.WS2_32(?), ref: 00429C66
fgets.MSVCRT ref: 00429CD5
fclose.MSVCRT ref: 00429CEB

Strings

XHOSTPREFIX, xrefs: 00429B36
hostname, xrefs: 00429A7F, 00429AB6
local:, xrefs: 00429BC9
inet:, xrefs: 00429BFB
si:, xrefs: 00429C0F
%s%s.hosts, xrefs: 00429B43
Display name `%s' is too long, xrefs: 00429B23
#, xrefs: 00429B6F

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strncmp$gethostbynamememcmpstrcmp$fclosefgetsfopengetenvmemchrmemmovesprintfstrchrtolower
String ID: #$%s%s.hosts$Display name `%s' is too long$XHOSTPREFIX$hostname$inet:$local:$si:
API String ID: 2679989350-2185523408
Opcode ID: c8b78ac4013cb66fd0c0761f5b9f1fa5b1f3c85959cc9e602ed9c9bd280f8e7f
Instruction ID: cd4b8b2fd308be2421e8704c3bd8b135b1121ea172ef09fdcfdaf19da26cba8c
Opcode Fuzzy Hash: c8b78ac4013cb66fd0c0761f5b9f1fa5b1f3c85959cc9e602ed9c9bd280f8e7f
Instruction Fuzzy Hash: F6613B71B003269ADB209F65FD85BAA3FA4BF44310F5441BBE908DB281D7789D44DB94

Function 0043251F Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 196stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0043253B
getenv.MSVCRT ref: 00432545
strcpy.MSVCRT(?,00000000,00401580,004011E7,?,0042F4C1), ref: 0043255B
strcat.MSVCRT(?,0059BA35), ref: 0043257C
strcat.MSVCRT(?,Xmingrc), ref: 00432589
fopen.MSVCRT ref: 00432594
fopen.MSVCRT ref: 004325CB
fclose.MSVCRT ref: 004325ED
malloc.MSVCRT ref: 00432621
strcpy.MSVCRT(00000000,?,?,?,?,?,?,?,0059BA3F,?,00000104,%s\Xmingrc,00000000,00401580,004011E7), ref: 00432637
_putenv.MSVCRT ref: 0043263D
strncmp.MSVCRT ref: 004326F9
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000200,127.0.0.1:%s.0), ref: 0043272F
strcpy.MSVCRT(-00000088,?), ref: 00432799

Strings

%s\Xmingrc, xrefs: 004325AE
DISPLAY=127.0.0.1:%s.0, xrefs: 00432606
127.0.0.1:%s.0, xrefs: 00432651
winPrefsLoadPreferences: %s, xrefs: 004325DA
HOME, xrefs: 00432540
Xmingrc, xrefs: 00432583
%display%, xrefs: 004326F3

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strcpy$fopenstrcat$_putenvfclosegetenvmallocmemcpymemsetstrncmp
String ID: %display%$%s\Xmingrc$127.0.0.1:%s.0$DISPLAY=127.0.0.1:%s.0$HOME$Xmingrc$winPrefsLoadPreferences: %s
API String ID: 1896769263-3445179950
Opcode ID: 6e50fc19bf719370c26df28c353751433902100c90162624af44461453bc2526
Instruction ID: d7ba17fcd50cdbcbc1f8c976736f197a92473d3bfb120c015ae8c7c146b95d7f
Opcode Fuzzy Hash: 6e50fc19bf719370c26df28c353751433902100c90162624af44461453bc2526
Instruction Fuzzy Hash: 0E61F575A002155BEB20EB24DD56BDABF69FF44714F1081EAF809A31C3FBB85A818F54

Function 00426EA3 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 174fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00426EE8
sprintf.MSVCRT ref: 00426F03
_stat.MSVCRT(1035FF50,0040114B), ref: 00426F28
malloc.MSVCRT ref: 00426F78
malloc.MSVCRT ref: 00426F9E
sprintf.MSVCRT ref: 00426FCB
sprintf.MSVCRT ref: 00426FDA
free.MSVCRT ref: 00426FE0
rename.MSVCRT ref: 00426FEC
free.MSVCRT ref: 00427005
fopen.MSVCRT ref: 00427013
setvbuf.MSVCRT ref: 00427037
fwrite.MSVCRT ref: 00427060
fflush.MSVCRT ref: 0042706B
free.MSVCRT ref: 00427086

Strings

%s%s, xrefs: 00426FD4
Cannot allocate space for the log file name, xrefs: 00426FB7
Cannot open log file "%s", xrefs: 00427026
Cannot move old log file ("%s" to "%s", xrefs: 00426FFA

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: freemallocsprintf$_statfflushfopenfwriterenamesetvbuf
String ID: %s%s$Cannot allocate space for the log file name$Cannot move old log file ("%s" to "%s"$Cannot open log file "%s"
API String ID: 2608360780-899901001
Opcode ID: e03d785a04c7e95236cd8f40af058faac73329c01afbe79dc4240b0ca0895193
Instruction ID: 64acc2875e0c57796c6b433e6d8fb74f81b372db3edcee5ed7d35e2d4c542776
Opcode Fuzzy Hash: e03d785a04c7e95236cd8f40af058faac73329c01afbe79dc4240b0ca0895193
Instruction Fuzzy Hash: D65126716442299BEF259BA4BC45B7E3F66FB88310F10403AF404D7291DA79EC0AD794

Function 0053A8BB Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 159stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A855: _access.MSVCRT ref: 0053A867
Part of subcall function 0053A855: strcpy.MSVCRT(?,?,00000000,00000000,?,??S,?,0053A8DA,?,00000000), ref: 0053A8A5

getenv.MSVCRT ref: 0053A8EE
malloc.MSVCRT ref: 0053A935
strcpy.MSVCRT(?,00000000), ref: 0053A93F
strcat.MSVCRT(?,?,?,00000000), ref: 0053A946
getenv.MSVCRT ref: 0053A96E
malloc.MSVCRT ref: 0053A9B0
strcpy.MSVCRT(?,00000000), ref: 0053A9BA
strcat.MSVCRT(?,?,?,00000000), ref: 0053A9C1
_getdrives.MSVCRT ref: 0053A9E0
malloc.MSVCRT ref: 0053AA21
strcat.MSVCRT(?,?), ref: 0053AA39

Part of subcall function 0053A855: malloc.MSVCRT ref: 0053A895

free.MSVCRT ref: 0053AA63

Strings

HOMEDRIVE, xrefs: 0053A969
_XBASEDRIVE, xrefs: 0053A8E9
??S, xrefs: 0053A8BE

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$strcatstrcpy$getenv$_access_getdrivesfree
String ID: ??S$HOMEDRIVE$_XBASEDRIVE
API String ID: 3213560711-1647440719
Opcode ID: 628a218f5f79e465895bff18204b58e0178efe5db428fe4eeac04b2f88671c94
Instruction ID: 9240a6746c19c4fe92db2e15a66ab44253fa985a57f4a7f71c655032f9bb0e7a
Opcode Fuzzy Hash: 628a218f5f79e465895bff18204b58e0178efe5db428fe4eeac04b2f88671c94
Instruction Fuzzy Hash: F7414E3150010A5BDB11AA789C456EFBF6AFFC4360F248269F858D72C2DB31DD539791

Function 00434302 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 116COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00434313
malloc.MSVCRT ref: 0043431C
malloc.MSVCRT ref: 00434325

Strings

InitQueue - Calling pthread_mutex_init, xrefs: 004343A7
InitQueue - pQueue is NULL. Exiting., xrefs: 00434383
winInitWM - pthread_create failed for Window Manager., xrefs: 00434418
winInitWM - pthread_create failed on XMSG., xrefs: 0043444F
winInitWM - malloc failed., xrefs: 00434341
winInitWM - Returning., xrefs: 0043445D
InitQueue - pthread_mutex_init returned, xrefs: 004343CB
InitQueue - pthread_cond_init returned, xrefs: 004343F4

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc
String ID: InitQueue - Calling pthread_mutex_init$InitQueue - pQueue is NULL. Exiting.$InitQueue - pthread_cond_init returned$InitQueue - pthread_mutex_init returned$winInitWM - Returning.$winInitWM - malloc failed.$winInitWM - pthread_create failed for Window Manager.$winInitWM - pthread_create failed on XMSG.
API String ID: 2803490479-3807959349
Opcode ID: e40110b36d35fe0b80f1c0ccd1f46f3b001904c62041d72f563d5ce2069a34d8
Instruction ID: e491710cbcfd3c0292a52bb074ba9718adfff1efe6cf756b04d73062c9f0e438
Opcode Fuzzy Hash: e40110b36d35fe0b80f1c0ccd1f46f3b001904c62041d72f563d5ce2069a34d8
Instruction Fuzzy Hash: 2841E3B0A043059BDF109F55E845B9ABFE4FF48710F15C46AF954AB341C778E901CBA9

Function 0042FC2D Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 54COMMON

Download Yara Rule

APIs

FT_Init_FreeType.LIBFREETYPE-6(?,?,?,?,0042FDF2,?,?,?,?,?,?,?,?,004011E7,?,004013A4), ref: 0042FC38
FT_Library_Version.LIBFREETYPE-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042FDF2), ref: 0042FC8D
FT_Done_FreeType.LIBFREETYPE-6(?), ref: 0042FCAB

Strings

FreeType2: %d.%d.%d, xrefs: 0042FC9B
Vendor: %s, xrefs: 0042FC53
Welcome to the %s X Server, xrefs: 0042FC44
winLogVersionInfo - Can't initialize freetype library, xrefs: 0042FC73
Xming, xrefs: 0042FC3D
http://sourceforge.net/forum/?group_id=156984, xrefs: 0042FCB0
Release: %s, xrefs: 0042FC62
6.9.0.31, xrefs: 0042FC5D
%s, xrefs: 0042FCCC
Colin Harrison, xrefs: 0042FC4E
Contact: %s, xrefs: 0042FCB5

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: FreeType$Done_Init_Library_Version
String ID: %s$6.9.0.31$Colin Harrison$Contact: %s$FreeType2: %d.%d.%d$Release: %s$Vendor: %s$Welcome to the %s X Server$Xming$http://sourceforge.net/forum/?group_id=156984$winLogVersionInfo - Can't initialize freetype library
API String ID: 937616511-1967692968
Opcode ID: 7a784689d5f28e6c1504649e33834fcd4bf548998e11497866c4df47248d6a5e
Instruction ID: 317f139b5c04f5aa5814fda49303f36bc380e726ea1d8130261787270ccfec25
Opcode Fuzzy Hash: 7a784689d5f28e6c1504649e33834fcd4bf548998e11497866c4df47248d6a5e
Instruction Fuzzy Hash: 25019272F4021D7A8F00B7E1AD43DAEBF7CFA44704B804026B500B5082D96457149BBB

Function 00499A8C Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 372filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00417820: strcpy.MSVCRT(?,0048FD55,?,004011E7), ref: 0041790A

getenv.MSVCRT ref: 00499B5A
fopen.MSVCRT ref: 00499B6C
fgets.MSVCRT ref: 00499BCC
strcmp.MSVCRT ref: 00499C02
fclose.MSVCRT ref: 00499FCB

Strings

%s: invalid security policy file version, ignoring file, xrefs: 00499B99
error opening security policy file %s, xrefs: 00499B83
version-1, xrefs: 00499BFC
XSECURITYPOLICY, xrefs: 00499B55
Line %d of %s invalid, ignoring, xrefs: 00499FB3
SECURITY, xrefs: 00499B0B

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fclosefgetsfopengetenvstrcmpstrcpy
String ID: %s: invalid security policy file version, ignoring file$Line %d of %s invalid, ignoring$SECURITY$XSECURITYPOLICY$error opening security policy file %s$version-1
API String ID: 355039481-2906813990
Opcode ID: 86ef360bb3b2ca4019c06cf839221b9ebbe9439ebef34103122a9f35eeb58e3e
Instruction ID: 781a44502397e3a451432d07ab97353e0394034834a4431dc4b166cb21a81fdc
Opcode Fuzzy Hash: 86ef360bb3b2ca4019c06cf839221b9ebbe9439ebef34103122a9f35eeb58e3e
Instruction Fuzzy Hash: 9FD103709442568ADF31DF2DDC41BAA7FA4AB42300F1885BFE40996292E77CCD81DB19

Function 00426D47 Relevance: 22.6, APIs: 3, Strings: 12, Instructions: 104stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00426E1D
sprintf.MSVCRT ref: 00426E30
strcat.MSVCRT(00000000,?,00000000,%s ,(??),?,?,00000000), ref: 00426E39

Part of subcall function 00426BEB: _vsnprintf.MSVCRT ref: 00426C20
Part of subcall function 00426BEB: fwrite.MSVCRT ref: 00426C56
Part of subcall function 00426BEB: fwrite.MSVCRT ref: 00426C88

Strings

(==), xrefs: 00426DA5
(**), xrefs: 00426D9E
-help, xrefs: 00426D4B
(EE), xrefs: 00426DBC, 00426E29
(!!), xrefs: 00426DB3
(??), xrefs: 00426D50, 00426DDC
(WW), xrefs: 00426DC7
(--), xrefs: 00426D97
%s , xrefs: 00426E2A
(II), xrefs: 00426DCE
(++), xrefs: 00426DAC
(NI), xrefs: 00426DD5

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fwrite$_vsnprintfmallocsprintfstrcat
String ID: %s $(!!)$(**)$(++)$(--)$(==)$(??)$(EE)$(II)$(NI)$(WW)$-help
API String ID: 1731061059-808258525
Opcode ID: 2599e4446a6d6b96c0a631f702ce54c578a27ab2f5b1d1b49d8fcf71dd24ad9b
Instruction ID: bb646d3bbe4ba20b4f6c36cea9936c31b31b3a5938f1662ae96888aa016eeb3d
Opcode Fuzzy Hash: 2599e4446a6d6b96c0a631f702ce54c578a27ab2f5b1d1b49d8fcf71dd24ad9b
Instruction Fuzzy Hash: 7C31D935B2832D9B4F248E68B8805BE7FA5FF4C320B62413BED1997251C3745D1297D6

Function 004B8CBC Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 546COMMON

Download Yara Rule

APIs

Part of subcall function 004B757B: fread.MSVCRT ref: 004B75AC
Part of subcall function 004B757B: _filbuf.MSVCRT ref: 004B75D0
Part of subcall function 004B757B: fread.MSVCRT ref: 004B75E5

fread.MSVCRT ref: 004B8CF3

Part of subcall function 004B73F8: strcpy.MSVCRT(00000000,00000002,00435698,?,?,0049FC16,00000002,?,?,?,?,00435698,00000002,Rules = "%s" Model = "%s" Layout = "%s" Variant = "%s" Options = "%s"), ref: 004B741F

fread.MSVCRT ref: 004B8F21
fread.MSVCRT ref: 004B8F75
fread.MSVCRT ref: 004B8FD7
fread.MSVCRT ref: 004B9130

Part of subcall function 004BA6E7: strcmp.MSVCRT ref: 004BA72D
Part of subcall function 004BA6E7: strcpy.MSVCRT(00000000,00000000,?,?,?,00000000,?,004B8E27,?), ref: 004BA769

fread.MSVCRT ref: 004B9221
fread.MSVCRT ref: 004B9291
fread.MSVCRT ref: 004B93A5
fread.MSVCRT ref: 004B940E
fread.MSVCRT ref: 004B9484
fread.MSVCRT ref: 004B95AE

Strings

?, xrefs: 004B8CF8

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fread$strcpy$_filbufstrcmp
String ID: ?
API String ID: 3027553259-1684325040
Opcode ID: 8ee6fc06714d9edf37aabe1a172965f25d6080ddbdaffae224be0789df9fb758
Instruction ID: be74ae1f257d8a1fe95886492843d807678b918e9271551767b3c3779289711d
Opcode Fuzzy Hash: 8ee6fc06714d9edf37aabe1a172965f25d6080ddbdaffae224be0789df9fb758
Instruction Fuzzy Hash: 4D424C709006699EDF319F25CC40BEABBB5BF05306F0440DBE948A6292E7399ED1DF64

Function 005430A3 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0000007F,00000004), ref: 0054310C
_errno.MSVCRT ref: 00543116
fprintf.MSVCRT ref: 0054312C
fflush.MSVCRT ref: 0054313A
fprintf.MSVCRT ref: 00543153
fflush.MSVCRT ref: 00543164
_errno.MSVCRT ref: 00543169
free.MSVCRT ref: 005431AF
malloc.MSVCRT ref: 005431C4
strcpy.MSVCRT(00000100,?), ref: 005431DA
free.MSVCRT ref: 005431F8

Strings

ConvertAddress: Unknown family type %d, xrefs: 0054314D

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errnofflushfprintffree$mallocmemcpystrcpy
String ID: ConvertAddress: Unknown family type %d
API String ID: 1060909132-2792133138
Opcode ID: 4466138c1b5a8976541f49bfd02ad40bee61758cecabff28c0086dd632114bf0
Instruction ID: b135d42cd16cf7c20023fb4aa11bea8f3601bc3ce5fa17575049b25291f8b1e3
Opcode Fuzzy Hash: 4466138c1b5a8976541f49bfd02ad40bee61758cecabff28c0086dd632114bf0
Instruction Fuzzy Hash: 5641CBB5A0420A9FEB10DF54D845BDABFB5FF44318F14C45AF9049B261D770DA44DB90

Function 00424D80 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 105filestringCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00424D9F
fclose.MSVCRT ref: 00424DAD
_write.MSVCRT ref: 00424DBD
sprintf.MSVCRT ref: 00424E1A
strcpy.MSVCRT(?), ref: 00424E31
fopen.MSVCRT ref: 00424E44
fopen.MSVCRT ref: 00424E5C
_dup2.MSVCRT ref: 00424E74
fclose.MSVCRT ref: 00424E7A
setvbuf.MSVCRT ref: 00424E97

Strings

E:v, xrefs: 00424DB4, 00424DBA

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fclose$fopen$_dup2_writesetvbufsprintfstrcpy
String ID: E:v
API String ID: 1997530428-3250668589
Opcode ID: 8aad3a28952f034f912c0574c3e2760b4ca68f7520f22304176f0c83c78034db
Instruction ID: e2055677a6faa8e46eaf97de3131021e1b1c8ca74bc91fa6560e9eb43d4e6318
Opcode Fuzzy Hash: 8aad3a28952f034f912c0574c3e2760b4ca68f7520f22304176f0c83c78034db
Instruction Fuzzy Hash: 42315A71B001155BEB20A765FC0BBEE7F69FB88310F55402AF108D3192DB746944D658

Function 0042557A Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(?,006086A0), ref: 004255A6
__WSAFDIsSet.WS2_32(?,000003FF), ref: 004255C6
__WSAFDIsSet.WS2_32(00000000,005F9388), ref: 004257D1
__WSAFDIsSet.WS2_32(00000000,005FA398), ref: 004257FE
__WSAFDIsSet.WS2_32(00000000,0060F740), ref: 0042582D
__WSAFDIsSet.WS2_32(00000000,0060C700), ref: 0042585A
__WSAFDIsSet.WS2_32(00000000,00000000), ref: 004258B9
select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 004258E4

Strings

-|Y, xrefs: 004259B3
!, xrefs: 00425922

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: select
String ID: !$-|Y
API String ID: 1274211008-3028009945
Opcode ID: 452b0438d97e14b75d750c455ae486b8abc2c159e98cc8c7840bcbd01b1e0588
Instruction ID: 47b7a160a47cf218a87bd73e0c50c9e1f194045c5b5261a5e1f04ddfba57ecea
Opcode Fuzzy Hash: 452b0438d97e14b75d750c455ae486b8abc2c159e98cc8c7840bcbd01b1e0588
Instruction Fuzzy Hash: 3FC1D070A01624DFEB22DF25EC587AABBB9EB55304F4080EBD548D7241DB789E88CF15

Function 004B5AA8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 004B5AF3

Part of subcall function 004BFD42: memset.MSVCRT ref: 004BFD7C

sprintf.MSVCRT ref: 004B5B40
fopen.MSVCRT ref: 004B5B54
fclose.MSVCRT ref: 004B5B83
fclose.MSVCRT ref: 004B5BA2
fclose.MSVCRT ref: 004B5BD4

Strings

rules, xrefs: 004B5AAF
%s/rules/%s, xrefs: 004B5B3A
rules/%s, xrefs: 004B5AED
C:\Program Files (x86)\Xming\xkb, xrefs: 004B5B39

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fclose$sprintf$fopenmemset
String ID: %s/rules/%s$C:\Program Files (x86)\Xming\xkb$rules$rules/%s
API String ID: 777533785-335460288
Opcode ID: 3a01ae6e31fc06b576ea3951b3a80be90bfc137f9fe269024369b847f773a6de
Instruction ID: b06e0b3873e8eda51a3e68967b2bbf48e11e1502aef2ffb7ced058ccb17624f2
Opcode Fuzzy Hash: 3a01ae6e31fc06b576ea3951b3a80be90bfc137f9fe269024369b847f773a6de
Instruction Fuzzy Hash: 86318DB2A041185BDB209A74EC41FDEBB68FF44320F10897BF719F71C1D675AE815668

Function 0042B7AD Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,00000010), ref: 0042B7D6
WSAGetLastError.WS2_32 ref: 0042B7DF
_errno.MSVCRT ref: 0042B7E6
_errno.MSVCRT ref: 0042B7ED
WSAGetLastError.WS2_32(00000000,00000000), ref: 0042B803
_errno.MSVCRT ref: 0042B822
_errno.MSVCRT ref: 0042B844
memcpy.MSVCRT(00000000,?,00000010), ref: 0042B863

Strings

SocketINETGetAddr: Can't allocate space for the addr, xrefs: 0042B83A
SocketINETGetAddr: getsockname() failed: %d, xrefs: 0042B809

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$ErrorLast$getsocknamememcpy
String ID: SocketINETGetAddr: Can't allocate space for the addr$SocketINETGetAddr: getsockname() failed: %d
API String ID: 4105126249-479979184
Opcode ID: 73afdd19249af39ac1f955350f053a64528d902f06e8f8fe6543b3f91ba5b94e
Instruction ID: 18688eafea9575090e51f742e81d31343774faa2673c3a236168f069f7de7e75
Opcode Fuzzy Hash: 73afdd19249af39ac1f955350f053a64528d902f06e8f8fe6543b3f91ba5b94e
Instruction Fuzzy Hash: BA11C6B0600215AADF10AFB1EC46BAB7F68FF85310F508476F908E7252DA3895019BA5

Function 00441B29 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00441B55
GetStockObject.GDI32(00000000), ref: 00441B6D
RegisterClassExA.USER32(00000030), ref: 00441B8E
GetModuleHandleA.KERNEL32(00000000,00000000,00000030,00000000), ref: 00441B97
CreateWindowExA.USER32(00000000,xwinclip,xwinclip,00000000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00441BC3
ShowWindow.USER32(00000000,00000000,00000000,xwinclip,xwinclip,00000000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000,00000000,00000030), ref: 00441BCD
UpdateWindow.USER32(00000000), ref: 00441BD3

Strings

0, xrefs: 00441B32
xwinclip, xrefs: 00441BB7, 00441BBC
@:Z, xrefs: 00441B80

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: Window$HandleModule$ClassCreateObjectRegisterShowStockUpdate
String ID: 0$@:Z$xwinclip
API String ID: 4100854625-1371555091
Opcode ID: 3541f0369d41a6d90b1666621ed2b02ff0a3b36eebe49a313474152f5ca4297f
Instruction ID: 125d6145ba67049faa0d9b4b67cda89c36aa502c76bac26bc6a1d4328d2032e2
Opcode Fuzzy Hash: 3541f0369d41a6d90b1666621ed2b02ff0a3b36eebe49a313474152f5ca4297f
Instruction Fuzzy Hash: E411C4B0A40309BAFB50EFA1DC5AB9EBEB4BF44704F204008F6087A1C1C7F566049BAD

Function 00431D33 Relevance: 17.5, APIs: 4, Strings: 6, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(ddraw.dll,00000000,00000000,00000005,?,0042F507), ref: 00431D45
GetProcAddress.KERNEL32(00000000,DirectDrawCreate), ref: 00431D60
GetProcAddress.KERNEL32(DirectDrawCreateClipper,00000000), ref: 00431D86
FreeLibrary.KERNEL32(6C7D0000,DirectDrawCreateClipper,00000000,DirectDrawCreate,ddraw.dll,00000000,00000000,00000005,?,0042F507), ref: 00431DAB

Strings

ddraw.dll, xrefs: 00431D40
DirectDrawCreate, xrefs: 00431D5A
DirectDrawCreateClipper, xrefs: 00431D7B
winGetDDProcAddresses - Could not load ddraw.dll, xrefs: 00431D53
winGetDDProcAddresses - Could not get DirectDrawCreateClipper address, xrefs: 00431D94
winGetDDProcAddresses - Could not get DirectDrawCreate address, xrefs: 00431D6E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: DirectDrawCreate$DirectDrawCreateClipper$ddraw.dll$winGetDDProcAddresses - Could not get DirectDrawCreate address$winGetDDProcAddresses - Could not get DirectDrawCreateClipper address$winGetDDProcAddresses - Could not load ddraw.dll
API String ID: 2256533930-3667606226
Opcode ID: cd4e16d876ed2f436997db7c3d5fc870ce7978f3a07eda2c878164b34f5c33b2
Instruction ID: bd801ebd524294fbdc98a79f815a969ee6a08f0700594060280d0cae7561c9e7
Opcode Fuzzy Hash: cd4e16d876ed2f436997db7c3d5fc870ce7978f3a07eda2c878164b34f5c33b2
Instruction Fuzzy Hash: D7F0A47074430666FB507B76BE42B172ABDFB19748F00502AF505EA2A1E7ADD404E774

Function 004BFD42 Relevance: 16.9, APIs: 10, Strings: 1, Instructions: 396stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004BFD7C
strchr.MSVCRT ref: 004BFDD9
strchr.MSVCRT ref: 004BFDE5

Strings

C:\Program Files (x86)\Xming\xkb, xrefs: 004BFD47

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strchr$memset
String ID: C:\Program Files (x86)\Xming\xkb
API String ID: 3020236661-1196106723
Opcode ID: dc653568e4c11e441bad2a105d7faa9952b387fc5c483e45cfa04ae6c74a2196
Instruction ID: 1c9551fdac2ebae5d8a20b707ee7830b700c468b9874252a7a1b3a0214245403
Opcode Fuzzy Hash: dc653568e4c11e441bad2a105d7faa9952b387fc5c483e45cfa04ae6c74a2196
Instruction Fuzzy Hash: C0F1B43590021ADBDB718F29DC45BEABBB5EF85314F1080EBD80CAA251DB398E85DF54

Function 0042CC8E Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 151COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0042CCFE
_errno.MSVCRT ref: 0042CD3B
_errno.MSVCRT ref: 0042CD5F
_errno.MSVCRT ref: 0042CDAC
_errno.MSVCRT ref: 0042CDCE

Strings

%s/:%s, xrefs: 0042CCD4
MakeAllCOTSServerListeners: failed to open listener for %s, xrefs: 0042CD16
MakeAllCOTSServerListeners: server already running, xrefs: 0042CD55
MakeAllCOTSServerListeners: failed to create listener for %s, xrefs: 0042CDC4

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno
String ID: %s/:%s$MakeAllCOTSServerListeners: failed to create listener for %s$MakeAllCOTSServerListeners: failed to open listener for %s$MakeAllCOTSServerListeners: server already running
API String ID: 2918714741-3515685447
Opcode ID: d257b3be23eb63d2380c5eaddd8de3f3670bc48ae13d8faf5d0c431d847d3ace
Instruction ID: 5c0f27e45e3dca50f0e62d33426de2300d643e20d3335405f87cc501f2a5c17a
Opcode Fuzzy Hash: d257b3be23eb63d2380c5eaddd8de3f3670bc48ae13d8faf5d0c431d847d3ace
Instruction Fuzzy Hash: A451F0B07002159FDF20DF69ECC1B9E7BA5BF86314F508066F9189B391CB74A841CBA5

Function 0043C90C Relevance: 15.1, APIs: 10, Instructions: 138windowthreadCOMMON

Download Yara Rule

APIs

BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 0043C9C3
CreateRectRgn.GDI32(?,?,?,?), ref: 0043C9E0
CreateRectRgn.GDI32(?,?,?,?), ref: 0043CA07
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 0043CA13
DeleteObject.GDI32(00000000), ref: 0043CA19
SelectClipRgn.GDI32(?,00000000), ref: 0043CA2A
DeleteObject.GDI32(00000000), ref: 0043CA30
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 0043CA61
SelectClipRgn.GDI32(?,00000000), ref: 0043CA6B
EnumThreadWindows.USER32(Function_0003C50C,?), ref: 0043CA87

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ClipCreateDeleteObjectRectSelect$CombineEnumThreadWindows
String ID:
API String ID: 764972390-0
Opcode ID: d96202861a740b786da0df169f2a45a5adec3d21dae91e373da2dcaf32523435
Instruction ID: 0cc3ff73bcf96e81653e71b423a66214be1c04b1cef8ea26444fe81d9f36e148
Opcode Fuzzy Hash: d96202861a740b786da0df169f2a45a5adec3d21dae91e373da2dcaf32523435
Instruction Fuzzy Hash: 08514A7090061AAEDB10DF98C889B7FB7F9FF48711F148519F818A7251D338AD81DBA0

Function 00426BEB Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 107fileCOMMON

Download Yara Rule

APIs

_vsnprintf.MSVCRT ref: 00426C20
fwrite.MSVCRT ref: 00426C56
fwrite.MSVCRT ref: 00426C88
realloc.MSVCRT ref: 00426CED
malloc.MSVCRT ref: 00426CFC
memcpy.MSVCRT(-005FC288,winClipboardProc - XOpenDisplay () returned and successfully opened the display.,?), ref: 00426D32

Strings

realloc() failed while saving log messages, xrefs: 00426D10
winClipboardProc - XOpenDisplay () returned and successfully opened the display., xrefs: 00426C10, 00426C1B, 00426C51, 00426C83, 00426D2C

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fwrite$_vsnprintfmallocmemcpyrealloc
String ID: realloc() failed while saving log messages$winClipboardProc - XOpenDisplay () returned and successfully opened the display.
API String ID: 545814338-3206314588
Opcode ID: 6107e2ee86d4402a128644f15286ad563719d948f15cf4cf4299f5849d3f0376
Instruction ID: 069b6b60eeb5fcbefc398c7a758833df7ce9d3c3dee5e581c181e2704f971788
Opcode Fuzzy Hash: 6107e2ee86d4402a128644f15286ad563719d948f15cf4cf4299f5849d3f0376
Instruction Fuzzy Hash: 7931F6717402099BDB10DF29FE89B773FA9F7A0315F91403BE904C3291D678948CE6A5

Function 00445CB0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00445CCB
GetVersionExA.KERNEL32(?,?), ref: 00445CDB

Strings

DetectUnicodeSupport - Windows 2003, xrefs: 00445D19
DetectUnicodeSupport - Windows XP, xrefs: 00445D2D
DetectUnicodeSupport - Windows 2000, xrefs: 00445D41
DetectUnicodeSupport - Windows Vista, xrefs: 00445CFC
DetectUnicodeSupport - Windows 95/98/Me, xrefs: 00445D67
DetectUnicodeSupport - Windows NT, xrefs: 00445D55

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: Versionmemset
String ID: DetectUnicodeSupport - Windows 2000$DetectUnicodeSupport - Windows 2003$DetectUnicodeSupport - Windows 95/98/Me$DetectUnicodeSupport - Windows NT$DetectUnicodeSupport - Windows Vista$DetectUnicodeSupport - Windows XP
API String ID: 3136939366-3873143636
Opcode ID: 69359e85c3362865c204e940773fd02301aab78810d2b8914df74afd645a443f
Instruction ID: 1da26dfc14c629d1d6646aca59e594a9d3beac1a12b2c25d68ce18ce84404a40
Opcode Fuzzy Hash: 69359e85c3362865c204e940773fd02301aab78810d2b8914df74afd645a443f
Instruction Fuzzy Hash: 27118D71F4072C5ADF30A5646C0EB4F77687F03724F908097E14875142967809C5CA57

Function 00548B2A Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 181stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005540A0: malloc.MSVCRT ref: 005540D6
Part of subcall function 005540A0: strcpy.MSVCRT(?,?,?,?,?,0054961C,?), ref: 005540EF

strcmp.MSVCRT ref: 00548BEA

Part of subcall function 00553C07: malloc.MSVCRT ref: 00553C4D

Strings

multiByte, xrefs: 00548C77, 00548CA0, 00548CD5, 00548CE5, 00548D1A, 00548D33, 00548D5C
@%Y, xrefs: 00548BC8
compoundText, xrefs: 00548CEB, 00548D04, 00548D14, 00548D43
char, xrefs: 00548CCF
wideChar, xrefs: 00548C8D, 00548CB6, 00548CFE, 00548D2D, 00548D49, 00548D62
euc, xrefs: 00548B5A
'Y, xrefs: 00548BD6
charSet, xrefs: 00548C71, 00548C87, 00548CA6, 00548CBC

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$strcmpstrcpy
String ID: @%Y$char$charSet$compoundText$euc$multiByte$wideChar$'Y
API String ID: 1111210674-2058300363
Opcode ID: f237b78b4a2e27293e071aae5be3c4b5c2681fabd6e2c043c9c42706b4afc52b
Instruction ID: 52228af7e6bb2e7218ce881296d5e3fe155a8e0d8d053b78f0f1b3238322c282
Opcode Fuzzy Hash: f237b78b4a2e27293e071aae5be3c4b5c2681fabd6e2c043c9c42706b4afc52b
Instruction Fuzzy Hash: AA518FB0A85306AFC714DE15CC86DEEBFA8BB18755F104452F805B7292DBB5FD408BA0

Function 00533DE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00533E2D
getenv.MSVCRT ref: 00533E43
malloc.MSVCRT ref: 00533EB0

Strings

LC_CTYPE, xrefs: 00533E28
LANG, xrefs: 00533E3E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: getenv$malloc
String ID: LANG$LC_CTYPE
API String ID: 1720176507-3600100782
Opcode ID: 1a2f4bdfc1a2f085060ead6c2dcafaa401c9b8c8209878fcb155154a3ba79091
Instruction ID: 33703b68adf5cf0846f82b9d0a3b4f19c4f574be40c0f27c005e7be0be0a0b49
Opcode Fuzzy Hash: 1a2f4bdfc1a2f085060ead6c2dcafaa401c9b8c8209878fcb155154a3ba79091
Instruction Fuzzy Hash: 2231F375A042035FDB249F78AC85A6F3FEDFB84360F10412AF805D7291EB70DE01A660

Function 00426B96 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90fileCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00426BE6
_vsnprintf.MSVCRT ref: 00426C20
fwrite.MSVCRT ref: 00426C56
fwrite.MSVCRT ref: 00426C88

Strings

Fatal server error:, xrefs: 00426BA9
FatalError re-entered, aborting, xrefs: 00426BA2
winClipboardProc - XOpenDisplay () returned and successfully opened the display., xrefs: 00426C10, 00426C1B, 00426C51, 00426C83

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fwrite$_vsnprintfabort
String ID: Fatal server error:$FatalError re-entered, aborting$winClipboardProc - XOpenDisplay () returned and successfully opened the display.
API String ID: 581364476-3990760292
Opcode ID: ba36c9d7d0f9fba3931e630529cfe8b6219d738a8aed737a0a44b299d33afa8e
Instruction ID: cd3e1d6aa69c88809024416b922fcbc182687d0ac7409ebc18a9f8e22904cb36
Opcode Fuzzy Hash: ba36c9d7d0f9fba3931e630529cfe8b6219d738a8aed737a0a44b299d33afa8e
Instruction Fuzzy Hash: CC21093030031C9AEB10EF16FD86B763F99FB90714F91403FFD14A6291EA799848D69A

Function 0042B872 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0042B88B
_errno.MSVCRT ref: 0042B8AD
socket.WS2_32(?,?,?), ref: 0042B8C9
WSAGetLastError.WS2_32(?,?,?), ref: 0042B8D5
_errno.MSVCRT ref: 0042B8DC
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0042B90A

Strings

SocketOpen: malloc failed, xrefs: 0042B8A3

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$ErrorLastsetsockoptsocket
String ID: SocketOpen: malloc failed
API String ID: 4175127705-3618862846
Opcode ID: 8e3d5727375e58683cd734b49affebeed40f25a2a8eaef52bf1ff6cbc664bcb8
Instruction ID: abe944405ef4bf7658de3fc239a7a740ff34c248a456da07fa71d62072bbd81c
Opcode Fuzzy Hash: 8e3d5727375e58683cd734b49affebeed40f25a2a8eaef52bf1ff6cbc664bcb8
Instruction Fuzzy Hash: B811C6707403216ADB207FA5BC4AF6B7A68FB81744F40047AFA089A252DBB55904A7F9

Function 0054760A Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 174stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005540A0: malloc.MSVCRT ref: 005540D6
Part of subcall function 005540A0: strcpy.MSVCRT(?,?,?,?,?,0054961C,?), ref: 005540EF

strcmp.MSVCRT ref: 005476C3

Part of subcall function 00553C07: malloc.MSVCRT ref: 00553C4D

Strings

compoundText, xrefs: 005477AA, 005477C3, 005477D3, 00547802
`$Y, xrefs: 005476B2
charSet, xrefs: 00547730, 00547746, 00547765, 0054777B
char, xrefs: 0054778E
SJIS, xrefs: 00547638
wideChar, xrefs: 0054774C, 00547775, 005477BD, 005477EC, 00547808, 00547821
multiByte, xrefs: 00547736, 0054775F, 00547794, 005477A4, 005477D9, 005477F2, 0054781B

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$strcmpstrcpy
String ID: SJIS$`$Y$char$charSet$compoundText$multiByte$wideChar
API String ID: 1111210674-1724722350
Opcode ID: 2b3eb038777621614da445c236464036e473318e5cfa52acc544a4c7c1d8a8ce
Instruction ID: e656542ac46d4ca3153f7156b8c41bb60fa9437343cdf87a3ecd330a83519250
Opcode Fuzzy Hash: 2b3eb038777621614da445c236464036e473318e5cfa52acc544a4c7c1d8a8ce
Instruction Fuzzy Hash: 745163B4A4430AAFC704DB64CC8ACDEBFA9FB5C755F104466F80977252D371AD848BA0

Function 004A05B4 Relevance: 11.0, APIs: 3, Strings: 4, Instructions: 466COMMON

Download Yara Rule

APIs

Part of subcall function 004B5AA8: sprintf.MSVCRT ref: 004B5AF3
Part of subcall function 004B5AA8: fopen.MSVCRT ref: 004B5B54
Part of subcall function 004B5AA8: fclose.MSVCRT ref: 004B5B83

memcpy.MSVCRT(?,?,?,?), ref: 004A0A1C
memset.MSVCRT ref: 004A0A3F
memcpy.MSVCRT(?,?,?,?,00000000,00000100), ref: 004A0A54

Strings

rules, xrefs: 004A0637, 004A0720
;iZ, xrefs: 004A0611
@iZ, xrefs: 004A0629
Couldn't load XKB keymap, falling back to pre-XKB keymap, xrefs: 004A0A6C

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcpy$fclosefopenmemsetsprintf
String ID: ;iZ$@iZ$Couldn't load XKB keymap, falling back to pre-XKB keymap$rules
API String ID: 3261323577-1409498999
Opcode ID: 06672a49566326a21ccd187a18788f7adf1588ca57bf42aeea1c61bb6fad777a
Instruction ID: 8989c6aa2b5cc7f9743223cde2a8cf248596e94cba9af57fa10fcddd833f53b0
Opcode Fuzzy Hash: 06672a49566326a21ccd187a18788f7adf1588ca57bf42aeea1c61bb6fad777a
Instruction Fuzzy Hash: C0029471B002099FDF10DF25D884BABB7A9EF55314F5484ABE808DB251DB39E981CF68

Function 005245A7 Relevance: 10.9, APIs: 6, Strings: 1, Instructions: 359stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00527288: strcmp.MSVCRT ref: 005272C7

strchr.MSVCRT ref: 005246E7
strncmp.MSVCRT ref: 0052471D

Part of subcall function 00524243: strcpy.MSVCRT(00000000,?,?,00000000,?,?,00524AFF,?,?,?,?,?), ref: 00524269

Part of subcall function 00523DD5: memcpy.MSVCRT(?,00524B1E,00000080,?,00000000,?,?,00524B1E,?,?), ref: 00523E1F
Part of subcall function 00523DD5: memcpy.MSVCRT(00000000,00524B1E,00000001,?,00524B1E,?,?), ref: 00523E4A

memset.MSVCRT ref: 005247C8

Part of subcall function 00526787: memset.MSVCRT ref: 005267A2
Part of subcall function 00526787: memcpy.MSVCRT(?,?,00000068), ref: 005267B6
Part of subcall function 00526787: strchr.MSVCRT ref: 005267E4
Part of subcall function 00526787: strchr.MSVCRT ref: 005267F9
Part of subcall function 00526787: strchr.MSVCRT ref: 00526812
Part of subcall function 00526787: strchr.MSVCRT ref: 00526827
Part of subcall function 00526787: strchr.MSVCRT ref: 0052683C
Part of subcall function 00526787: strchr.MSVCRT ref: 00526851

memcpy.MSVCRT(?,0000000F,00000068), ref: 00524893
memset.MSVCRT ref: 00524911
memcpy.MSVCRT(00000000,0000000F,00000068), ref: 00524975

Strings

unscaled, xrefs: 00524717

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strchr$memcpy$memset$strcmpstrcpystrncmp
String ID: unscaled
API String ID: 1387389275-2570952022
Opcode ID: 6214393ad58a7c77abbb64af0c627130d93f79e51892f1c9e2bd1ef606f5fe8f
Instruction ID: 8091d6c8316f11156ee1a1a8c21f0d4ac129fbe958504a7d30ea97f088137152
Opcode Fuzzy Hash: 6214393ad58a7c77abbb64af0c627130d93f79e51892f1c9e2bd1ef606f5fe8f
Instruction Fuzzy Hash: BBD1B070A4022A9BEB30DF25DC45BEEBBB5FF46304F0481A5E848A6181EB759EC5DF50

Function 0053A2FD Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 270networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(8BFFFFFD,?), ref: 0053A484
select.WS2_32(00000000,?,00000000,00000000,00607530), ref: 0053A4B0
WSAGetLastError.WS2_32(00000000,?,00000000,00000000,00607530,8BFFFFFD,?), ref: 0053A4EB

Part of subcall function 00538E75: WSAGetLastError.WS2_32(00000000,?,?,005397A3,00000000,?,?,00539838,00537A0B,?,?,00000000,00000000), ref: 00538E84
Part of subcall function 00538E75: _errno.MSVCRT ref: 00538E8B
Part of subcall function 00538E75: exit.MSVCRT ref: 00538EAD

memcpy.MSVCRT(?,?,00000020), ref: 0053A59E
memcpy.MSVCRT(?,?,00000020), ref: 0053A5B5

Strings

, xrefs: 0053A4DD

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLastmemcpy$_errnoexitselect
String ID:
API String ID: 596492265-3916222277
Opcode ID: 6894e4d36d04c6052878cfb95180db597aa6d8f243ae48edcbecef709a9735dd
Instruction ID: f634eae05b2c1b18e25ac6c05ce608dd6cf78b92302612fa9ad7018b393c838f
Opcode Fuzzy Hash: 6894e4d36d04c6052878cfb95180db597aa6d8f243ae48edcbecef709a9735dd
Instruction Fuzzy Hash: 5291E771A002169BEF259F15C889BEABFE8FF84314F1480A9E44896142DB75EDC5CFD2

Function 0042B919 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0042B760: strcmp.MSVCRT ref: 0042B780

_errno.MSVCRT ref: 0042B956
_errno.MSVCRT ref: 0042B975
_errno.MSVCRT ref: 0042B997
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 0042B9C8

Strings

SocketOpenCOTSServer: Unable to determine socket type for %s, xrefs: 0042B98D
SocketOpenCOTSServer: Unable to open socket for %s, xrefs: 0042B96E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$setsockoptstrcmp
String ID: SocketOpenCOTSServer: Unable to determine socket type for %s$SocketOpenCOTSServer: Unable to open socket for %s
API String ID: 118407818-2027430506
Opcode ID: e84ac2e42314fe895e20e4743013df433f1fe4e3029164f01ee7b7de6a3a2715
Instruction ID: 977e54b98baa84fa5449e7673a8ac5db4a0631de60eebf9aab3d0148f66f991a
Opcode Fuzzy Hash: e84ac2e42314fe895e20e4743013df433f1fe4e3029164f01ee7b7de6a3a2715
Instruction Fuzzy Hash: 78110AB0740221ABCB11AF55FC42F6A7B58FF45710F504077FB089B292D7749940ABEA

Function 0043CBFF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0043CC1A
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0043CC36
ReleaseDC.USER32(00000000,00000000), ref: 0043CC71

Strings

winAdjustVideoModeShadowGDI - Command line bpp: %d, using bpp: %d, xrefs: 0043CC5E
winAdjustVideoModeShadowGDI - GetDC () failed, xrefs: 0043CC25
winAdjustVideoModeShadowGDI - Using Windows display depth of %d bits per pixel, xrefs: 0043CC45

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: CapsDeviceRelease
String ID: winAdjustVideoModeShadowGDI - Command line bpp: %d, using bpp: %d$winAdjustVideoModeShadowGDI - GetDC () failed$winAdjustVideoModeShadowGDI - Using Windows display depth of %d bits per pixel
API String ID: 127614599-3924548988
Opcode ID: 105d9bec10550d4eabbc2bd066efbc21648f7477604360259a1c7e43c9791ecb
Instruction ID: f36dd7d37b1d072846e86c39e0d0f1916646bf91eadb2ae05f9f2903ea12bbde
Opcode Fuzzy Hash: 105d9bec10550d4eabbc2bd066efbc21648f7477604360259a1c7e43c9791ecb
Instruction Fuzzy Hash: FF01FC717003146FEB209B65ACC5F5B7BF8FB4AB54F44002AF608E7241D626A800DB79

Function 004281A1 Relevance: 9.2, APIs: 6, Instructions: 223COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00428260
_errno.MSVCRT ref: 00428289
_errno.MSVCRT ref: 00428293
__WSAFDIsSet.WS2_32(00008D3D,0060A6C0), ref: 004282B8
memmove.MSVCRT(?,00913DF6,00913DF6), ref: 00428301
memmove.MSVCRT(?,00913DF6,00913DF6), ref: 00428359

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _errno$memmove
String ID:
API String ID: 4052706806-0
Opcode ID: d56c6e8179712bb76f8c72579ca48f70cb41eb51df18d447e7119a25e2ffe290
Instruction ID: 4e137610d62244a58462634a82af68cf97c0779b0df61a687e5b2642ce79dd37
Opcode Fuzzy Hash: d56c6e8179712bb76f8c72579ca48f70cb41eb51df18d447e7119a25e2ffe290
Instruction Fuzzy Hash: 38915C71A01215DFCF10DFA8F984A5EBBB1FF44314F58C06AE8089B255DB39D845CB65

Function 004290D7 Relevance: 9.2, APIs: 6, Instructions: 154networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000200), ref: 004290EF
gethostbyname.WS2_32(?), ref: 004290F5
memmove.MSVCRT(?,?,?,?), ref: 00429131
memcmp.MSVCRT(?,?,?,?,?,?), ref: 004291A1
memmove.MSVCRT(?,?,?,?,?,?), ref: 004291EC
htonl.WS2_32(000000FF), ref: 0042927F

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memmove$gethostbynamegethostnamehtonlmemcmp
String ID:
API String ID: 766896377-0
Opcode ID: c63cde07a01444f813c5b5b4a651d92c6e769bddd56b88c825793a2bf857d962
Instruction ID: abf60ba60f577b5765cc6272abc4c6130e172c3a36e2d7641a23e4e2ae0613cf
Opcode Fuzzy Hash: c63cde07a01444f813c5b5b4a651d92c6e769bddd56b88c825793a2bf857d962
Instruction Fuzzy Hash: D551AA70A00225EEEF20DF64E8C8B66BBF4BF15310F4485E6D8089B252D738DD84DB69

Function 0042F82F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042F851
GetSystemMetrics.USER32(00000000), ref: 0042F858
GetSystemMetrics.USER32(00000001), ref: 0042F861

Strings

winInitializeDefaultScreens - w %d h %d, xrefs: 0042F86A
winInitializeDefaultScreens - Returning, xrefs: 0042FA08

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: MetricsSystem$memset
String ID: winInitializeDefaultScreens - Returning$winInitializeDefaultScreens - w %d h %d
API String ID: 1288546170-2488553367
Opcode ID: e96a592f88635d0f69e56d61442a340cdb0ac3eec6a9e1782c6331dd647e48bf
Instruction ID: 3f9bfc9ff6c7601ca1a694eb0c79f6a66cee1e96a28bfda61251cfc43d712157
Opcode Fuzzy Hash: e96a592f88635d0f69e56d61442a340cdb0ac3eec6a9e1782c6331dd647e48bf
Instruction Fuzzy Hash: C4418EB49542049BEB009F56DC9979A7BB6FF46304F4C8099EE095E38AD7BE004CCBE4

Function 00435210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00435226

Part of subcall function 00432303: GetSystemMetrics.USER32(00000031), ref: 00432312
Part of subcall function 00432303: GetSystemMetrics.USER32(00000032), ref: 0043231D
Part of subcall function 00432303: GetSystemMetrics.USER32(00000032), ref: 00432339
Part of subcall function 00432303: GetSystemMetrics.USER32(00000031), ref: 00432341
Part of subcall function 00432303: LoadImageA.USER32(00000065,00000001,00000000,00000031,00000000,00000032), ref: 00432351

Shell_NotifyIconA.SHELL32(00000000,?), ref: 00435276

Strings

X, xrefs: 0043522B
winInitNotifyIcon - Shell_NotifyIcon Failed, xrefs: 0043527F
Xming Server:%s.%d, xrefs: 00435263

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: MetricsSystem$IconImageLoadNotifyShell_memset
String ID: X$Xming Server:%s.%d$winInitNotifyIcon - Shell_NotifyIcon Failed
API String ID: 1662634345-3418550486
Opcode ID: 396e9bfe4f577d8d9c32b5fb13fe6413b9648cf4606f2b5798b9c08a9459217e
Instruction ID: 72d221d7a6d45a2f2c03ee34162491a0946ed807f95b6b324644e60e26e3f7ef
Opcode Fuzzy Hash: 396e9bfe4f577d8d9c32b5fb13fe6413b9648cf4606f2b5798b9c08a9459217e
Instruction Fuzzy Hash: CF014075D40308AADF109FD5D846B8E7BB8FB49714F00401AEA1CBB281D779A404CF65

Function 004D4828 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(-00614180,00000030,004011E7,?,004D43CA,?,?,?,?,?,0046CEDA,?,004015AF,004011E7,?), ref: 004D4893

Strings

GLX_ARB_multisample GLX_EXT_visual_info GLX_EXT_visual_rating GLX_EXT_import_context GLX_OML_swap_method GLX_SGI_make_current_read GLX_SGIS_multisample GLX_SGIX_hyperpipe GLX_SGIX_swap_barrier GLX_SGIX_fbconfig , xrefs: 004D48E2
SGI, xrefs: 004D48BA
GL_ARB_depth_texture GL_ARB_imaging GL_ARB_multitexture GL_ARB_point_parameters GL_ARB_point_sprite GL_ARB_shadow GL_ARB_shadow_ambient GL_ARB_texture_border_clamp GL_ARB_texture_cube_map GL_ARB_texture_env_add GL_ARB_texture_env_combine GL_ARB_texture_env_cro, xrefs: 004D48A6
1.2, xrefs: 004D48CE

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcpy
String ID: 1.2$GLX_ARB_multisample GLX_EXT_visual_info GLX_EXT_visual_rating GLX_EXT_import_context GLX_OML_swap_method GLX_SGI_make_current_read GLX_SGIS_multisample GLX_SGIX_hyperpipe GLX_SGIX_swap_barrier GLX_SGIX_fbconfig $GL_ARB_depth_texture GL_ARB_imaging GL_ARB_multitexture GL_ARB_point_parameters GL_ARB_point_sprite GL_ARB_shadow GL_ARB_shadow_ambient GL_ARB_texture_border_clamp GL_ARB_texture_cube_map GL_ARB_texture_env_add GL_ARB_texture_env_combine GL_ARB_texture_env_cro$SGI
API String ID: 3510742995-4130410231
Opcode ID: 88d47ddc13833f496f31203e8df367913b90eae0b3745c3bf5242b1cae2cf95d
Instruction ID: 2f1bfc18e5399434812b31042d05966e0c039b01003169787cbdedb84917fd19
Opcode Fuzzy Hash: 88d47ddc13833f496f31203e8df367913b90eae0b3745c3bf5242b1cae2cf95d
Instruction Fuzzy Hash: D23191B0600315AFCB00DFA5E8869BB7FE9FF89318B54501BE94597311DB34E840DB94

Function 00539B61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00539C79
WSAGetLastError.WS2_32 ref: 00539C9C
WSAGetLastError.WS2_32 ref: 00539CB3

Strings

u`, xrefs: 00539CCB

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast
String ID: u`
API String ID: 1452528299-3640029977
Opcode ID: 8472d6b7de71b17bf34fdff3623751e4c054b0d2982ec780b7101d089cd3542f
Instruction ID: c5f83453ad70feb1506ed75aff040a9194142e146d6aba6c790c2f2de3a8030f
Opcode Fuzzy Hash: 8472d6b7de71b17bf34fdff3623751e4c054b0d2982ec780b7101d089cd3542f
Instruction Fuzzy Hash: 8E518271E0060AAFCF15DFA9D985AAEBFB6FF88310F148524E80997245D770AC11CB90

Function 005396BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,00000000,00000000,?,?,00539838,00537A0B,?,?,00000000,00000000), ref: 00539758
WSAGetLastError.WS2_32(?,?,00539838,00537A0B,?,?,00000000,00000000,?,?,?,00434147,?,?,?,00000000), ref: 0053977B

Strings

u`, xrefs: 005397AA

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast
String ID: u`
API String ID: 1452528299-3640029977
Opcode ID: 78ce7673a01b29a03af93420f09d27e51ad385245fb570710d006ffc243d6ab8
Instruction ID: 9579ad3aedaac96b61bc172b9da9fba144118ee7751d17cef6fb2161ed9f0b40
Opcode Fuzzy Hash: 78ce7673a01b29a03af93420f09d27e51ad385245fb570710d006ffc243d6ab8
Instruction Fuzzy Hash: 9B3194B59052019FDB10AF64CD89BAA7FB8FF86310F1404A5EC09AB297D771ED01CBA1

Function 00435BF5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002B), ref: 00435C2B
malloc.MSVCRT ref: 00435C50
free.MSVCRT ref: 00435C91

Strings

%d mouse buttons found, xrefs: 00435C40

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: MetricsSystemfreemalloc
String ID: %d mouse buttons found
API String ID: 1452243764-3257325693
Opcode ID: 3c1cd43c93845aa7a1f6502417fa5c153663b81c902ed94dac9f4bfb27055785
Instruction ID: 35a7a38a95af87106c4bd9c7b958fe926d122aa8b64dd05b48f2a534395faafc
Opcode Fuzzy Hash: 3c1cd43c93845aa7a1f6502417fa5c153663b81c902ed94dac9f4bfb27055785
Instruction Fuzzy Hash: EC212431200B45AAE7209B54DC86B6F7BA8FB4C348F146426F415CB351E778E941D7AA

Function 0053A855 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

_access.MSVCRT ref: 0053A867
malloc.MSVCRT ref: 0053A895
strcpy.MSVCRT(?,?,00000000,00000000,?,??S,?,0053A8DA,?,00000000), ref: 0053A8A5

Strings

??S, xrefs: 0053A858

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _accessmallocstrcpy
String ID: ??S
API String ID: 4129324078-2060079565
Opcode ID: d164887df756bbe80aaee14201c00869f66b4c5e74c5b8072e69b9f5d4adc0a8
Instruction ID: 13e3b725ef768a0ecd58d8b1037097821beedbbe644705ad2fa0625ac8b41e51
Opcode Fuzzy Hash: d164887df756bbe80aaee14201c00869f66b4c5e74c5b8072e69b9f5d4adc0a8
Instruction Fuzzy Hash: 6FF081756001066BEB249EAA9C8497FBF99FF84360F20893DF45AC7281EA71DC4257A0

Function 00424AEB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00424B0A
realloc.MSVCRT ref: 00424B20
malloc.MSVCRT ref: 00424B2C

Strings

Out of memory, xrefs: 00424B43

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: freemallocrealloc
String ID: Out of memory
API String ID: 197341925-696950042
Opcode ID: 5df8d0c02c599b19ae82314df95ea68117c429614e98352ab91a23d1fd9fbc40
Instruction ID: 56f60028aa0b128cde7aac1a04cea19d45577c048757fd5cb88f76435b891fa5
Opcode Fuzzy Hash: 5df8d0c02c599b19ae82314df95ea68117c429614e98352ab91a23d1fd9fbc40
Instruction Fuzzy Hash: 12F0B43130622756EB2C96367861B3B2E5AEBD4715F68C53FB806D6285EE38F8005058

Function 00441AD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

pthread_create.PTHREADGC2(00611B90,00000000,00441670,00000000,?,00435F25), ref: 00441B07

Strings

Z`C, xrefs: 00441ADE
winInitClipboard (), xrefs: 00441AD3
winInitClipboard - pthread_create failed., xrefs: 00441B19

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: pthread_create
String ID: Z`C$winInitClipboard ()$winInitClipboard - pthread_create failed.
API String ID: 175571392-624752110
Opcode ID: e0c0a458548dbbc1a6a47219234ce64154dea4b3808201a396678a9756e74cdc
Instruction ID: c25ecd67e4b3d91ffd9cf3987e9e491c3ffe4bf21b9f36c5485db2d8d9c5803b
Opcode Fuzzy Hash: e0c0a458548dbbc1a6a47219234ce64154dea4b3808201a396678a9756e74cdc
Instruction Fuzzy Hash: D3E0D83034430067FB14D76A7C0BB1936DAE742B08FA9C067B206A53A1D6E8D5C59B2D

Function 0054365B Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00543796
malloc.MSVCRT ref: 005437E1
free.MSVCRT ref: 005438A6
realloc.MSVCRT ref: 005438EB

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc$freerealloc
String ID:
API String ID: 696964274-0
Opcode ID: 672f76f8d99a6db953931bac51d562395448843027b7016c5e61814e26cfd7c2
Instruction ID: f52bce76dcf0a3b53cd798b5b724ed082df368a03d453b4864707599a1958bb6
Opcode Fuzzy Hash: 672f76f8d99a6db953931bac51d562395448843027b7016c5e61814e26cfd7c2
Instruction Fuzzy Hash: E6B19A70E04216DFDB14CF58D884AEEBBB2FB89304F154169E944AB3A4DB74AE05DB90

Function 0040E345 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

+@, xrefs: 0040E350, 0040E4B1, 0040E5BB, 0040E5F0
+@, xrefs: 0040E5F6
P, xrefs: 0040E562

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID:
String ID: +@$+@$P
API String ID: 0-3358145291
Opcode ID: 299ce7a732c748f2c3807f37cf18dbd6adda899fc8379359478a69b6830601ff
Instruction ID: 73d4cbb963f3fb044b42783fa3664cda8f550c243c4b683fc59d29920ee7532c
Opcode Fuzzy Hash: 299ce7a732c748f2c3807f37cf18dbd6adda899fc8379359478a69b6830601ff
Instruction Fuzzy Hash: 7181B131900605EFDB20DF96C845BABBBB1FF04304F108D3AE555A6291E739E9A2CF95

Function 0054416B Relevance: 6.1, APIs: 4, Instructions: 122filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0054B9A0: getenv.MSVCRT ref: 0054B9AB
Part of subcall function 0054B9A0: getenv.MSVCRT ref: 0054B9C0
Part of subcall function 0054B9A0: free.MSVCRT ref: 0054B9FD
Part of subcall function 0054B9A0: malloc.MSVCRT ref: 0054BA06
Part of subcall function 0054B9A0: strcpy.MSVCRT(00000000,00000000,?,?,?,0054418E,00000000,00000000,?,?,?), ref: 0054BA22
Part of subcall function 0054B9A0: strcat.MSVCRT(-005B2C10,00000000,00000000,?,?,?,0054418E,00000000,00000000,?,?,?), ref: 0054BA3C

_access.MSVCRT ref: 0054419D
fopen.MSVCRT ref: 005441B4

Part of subcall function 00533B6C: free.MSVCRT ref: 00533C62

strncmp.MSVCRT ref: 00544277
fclose.MSVCRT ref: 005442B7

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: freegetenv$_accessfclosefopenmallocstrcatstrcpystrncmp
String ID:
API String ID: 1070352303-0
Opcode ID: b2758ef49d44742baeff2bb48d57d4a4007fe38cbc6137997e22a20b4b6dd745
Instruction ID: 7552ad1c87b25b968fabad95cbe6a547a01ffbf785c475499416ffbd0ef724e6
Opcode Fuzzy Hash: b2758ef49d44742baeff2bb48d57d4a4007fe38cbc6137997e22a20b4b6dd745
Instruction Fuzzy Hash: AA417B79A446178BCF20EF99D8457FEBFB1BB84318F148126FC44A6145E774C892DBA0

Function 0042A3C8 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(00000000,005FCFF4,00000004,00000000,00000000,00000000,?,?,0042925A,00000000,?,00000004), ref: 0042A428
memcpy.MSVCRT(00000000,005FCFF4,00000004,XdmcpRegisterConnection: fromAddr != regAddr %d.%d.%d.%d,?,?,?,?,00000000,?,00000004), ref: 0042A459

Strings

XdmcpRegisterConnection: newAddress %d.%d.%d.%d, xrefs: 0042A4EA
XdmcpRegisterConnection: fromAddr != regAddr %d.%d.%d.%d, xrefs: 0042A447

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcmpmemcpy
String ID: XdmcpRegisterConnection: fromAddr != regAddr %d.%d.%d.%d$XdmcpRegisterConnection: newAddress %d.%d.%d.%d
API String ID: 1784268899-1119372278
Opcode ID: 1ddb0fd849e7fd136795b0097eff53d09c08800dce9d7032dd80a03a5568214c
Instruction ID: a003389b2b75ad3af296c814a87cc4f4cee82386ee32978e1fc18568b56fb5e5
Opcode Fuzzy Hash: 1ddb0fd849e7fd136795b0097eff53d09c08800dce9d7032dd80a03a5568214c
Instruction Fuzzy Hash: AE316661A042B12EC7219B6ABC05D3A3FF9FB9A311B048057FD94C6282D62CC504EB71

Function 0053924C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,00000020,?,00000020,?,?,00539621,?,?,00000020,?,000003FF,00000000,000003FF,000003FF,00000000), ref: 005392A2

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c3bedcb03dcd5e0984bd19d516257eae9c027ba32de4adf914cfbd6a1846bfeb
Instruction ID: 3a2e7a8c3117da60d23d916b10f90f7a669addc9fd564a69bb892e62b7439c79
Opcode Fuzzy Hash: c3bedcb03dcd5e0984bd19d516257eae9c027ba32de4adf914cfbd6a1846bfeb
Instruction Fuzzy Hash: CB210EF5A0060667DB20AE758C49ABBBF58BFC0360F148615F918C6191D770D80196D2

Function 00517C5F Relevance: 5.5, APIs: 4, Instructions: 472stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0052701B: strchr.MSVCRT ref: 00527036
Part of subcall function 0052701B: strchr.MSVCRT ref: 0052704A
Part of subcall function 0052701B: strchr.MSVCRT ref: 00527074

Part of subcall function 00526787: memset.MSVCRT ref: 005267A2
Part of subcall function 00526787: memcpy.MSVCRT(?,?,00000068), ref: 005267B6
Part of subcall function 00526787: strchr.MSVCRT ref: 005267E4
Part of subcall function 00526787: strchr.MSVCRT ref: 005267F9
Part of subcall function 00526787: strchr.MSVCRT ref: 00526812
Part of subcall function 00526787: strchr.MSVCRT ref: 00526827
Part of subcall function 00526787: strchr.MSVCRT ref: 0052683C
Part of subcall function 00526787: strchr.MSVCRT ref: 00526851

memset.MSVCRT ref: 0051C2FF
strcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,000003FF), ref: 0051C514
strcpy.MSVCRT(?,?), ref: 0051C704
strcat.MSVCRT(?,?,?,?), ref: 0051C713

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strchr$memsetstrcpy$memcpystrcat
String ID:
API String ID: 121717225-0
Opcode ID: cdd670382973254c7e2268791b65dbd6624a7a343495447ef16a22c5e937810f
Instruction ID: d7c926aa23366880f9c99e384a82e793a9fc2f37e56f6b65a832bcdb86ead774
Opcode Fuzzy Hash: cdd670382973254c7e2268791b65dbd6624a7a343495447ef16a22c5e937810f
Instruction Fuzzy Hash: 351235759002599BEF20DF68C881AEABFB5FF48310F148599F908A7251E7B19AD4CF90

Function 0053935E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00537EB0: fprintf.MSVCRT ref: 00537F04

fprintf.MSVCRT ref: 005393D4
memmove.MSVCRT(?,?,?,?,?,00000001,?,?,00539791,?,?,00539838,00537A0B,?,?,00000000), ref: 0053945F

Strings

Xlib: unexpected async reply (sequence 0x%lx)!, xrefs: 005393CE

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fprintf$memmove
String ID: Xlib: unexpected async reply (sequence 0x%lx)!
API String ID: 2163104495-4045455863
Opcode ID: e2e773790b2d64a4fc0eb74ea4dc843e411eb3c058f50e31e01039cd7b1f8cd0
Instruction ID: 6aefb8cbb33a38f9fecd99beb96d6cc17018f4846c27bd9786aacc1596991ee1
Opcode Fuzzy Hash: e2e773790b2d64a4fc0eb74ea4dc843e411eb3c058f50e31e01039cd7b1f8cd0
Instruction Fuzzy Hash: 714160B1600219AFDF10DF98DC88AAEBBA5FF89310F148564F818CB261D771ED51DB90

Function 005448F0 Relevance: 5.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00544930
malloc.MSVCRT ref: 0054494B
free.MSVCRT ref: 0054495B
strcpy.MSVCRT(00000000,00540F70,?,?,?,?,?,?,00540F70,00000000,XKEYBOARD,?,?,00000000), ref: 0054499F

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: callocfreemallocstrcpy
String ID:
API String ID: 1602003972-0
Opcode ID: eec8aa374c99f9dc47fae27acfb62927d7f05a0b55e38e17c704bb2df94a36bc
Instruction ID: c10eb4234389d70f9f24d17128e5ba3f0bffb6b3fb065003c4424983f41bec28
Opcode Fuzzy Hash: eec8aa374c99f9dc47fae27acfb62927d7f05a0b55e38e17c704bb2df94a36bc
Instruction Fuzzy Hash: 6E316F756006069FDB10DF79D885AEBBFE9FF44314F14C56AE919DB245EB30E9008BA0

Function 004354C2 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00435513

Strings

winKeybdProc - Error initializing keyboard AutoRepeat (No XKB), xrefs: 004356F1
Rules = "%s" Model = "%s" Layout = "%s" Variant = "%s" Options = "%s", xrefs: 00435658

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memset
String ID: Rules = "%s" Model = "%s" Layout = "%s" Variant = "%s" Options = "%s"$winKeybdProc - Error initializing keyboard AutoRepeat (No XKB)
API String ID: 2221118986-740444330
Opcode ID: b3a4fb57a3e11dfe5895713773d6e0d8e982d15cdaadd645ecda7e5856d720b8
Instruction ID: 2e0ad624dea3932360b53b0a94895cab65828e28ae82c730f8662ea7fe8aa133
Opcode Fuzzy Hash: b3a4fb57a3e11dfe5895713773d6e0d8e982d15cdaadd645ecda7e5856d720b8
Instruction Fuzzy Hash: 4861CE70504645EBDB21CF54EC90B697BA1FB2E310F205077E80DD62A5C37CA585BBAA

Function 0053645B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0053649B
malloc.MSVCRT ref: 005364D4

Strings

LANG, xrefs: 0053645E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: mallocstrcmp
String ID: LANG
API String ID: 343855240-127691222
Opcode ID: 58c4edb357dc392b65eb39de763c5498f0b22b2c87ce9c4891028fd06f44ca8e
Instruction ID: d9ed5427e1a8730becdd4fb8115e7ec3cae63c79d1a440811a03c6060b030e14
Opcode Fuzzy Hash: 58c4edb357dc392b65eb39de763c5498f0b22b2c87ce9c4891028fd06f44ca8e
Instruction Fuzzy Hash: 7B21AC32A00211EFCB119F99E8C8B567FB5FB44315F24846EEA098B225D771EC04CBA0

Function 00543550 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00543566
malloc.MSVCRT ref: 00543572

Strings

59T, xrefs: 005435A6

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: malloc
String ID: 59T
API String ID: 2803490479-3210995262
Opcode ID: dec102b15d88c1a0ce6ad63ca251516e4365687ba20c9ca0f5938cc72b54e220
Instruction ID: f609bb779ba3d5187d933687cb13a27517e1938c1be918ea44ea2dd26279860e
Opcode Fuzzy Hash: dec102b15d88c1a0ce6ad63ca251516e4365687ba20c9ca0f5938cc72b54e220
Instruction Fuzzy Hash: 60F08C30E482428BD710DF69E8409A73BE6FB883887108839E004C3272E770B901DA90

Function 0042BD1A Relevance: 4.5, APIs: 3, Instructions: 23networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 0042BD2D
WSAGetLastError.WS2_32 ref: 0042BD39
_errno.MSVCRT ref: 0042BD40

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast_errnosend
String ID:
API String ID: 218872534-0
Opcode ID: 365921878945ee2389d4e9905c8983ac42cb162f7264dcf64a59ca35ff805a04
Instruction ID: 2c096aae2a2e4f8f60ae585dc7447bde7d8beadbad7309ad578a023210a78ee0
Opcode Fuzzy Hash: 365921878945ee2389d4e9905c8983ac42cb162f7264dcf64a59ca35ff805a04
Instruction Fuzzy Hash: 8BE086326102196BCF212EE8AC499DA7F68FF443B0F004561F6288B291D6319C1097D1

Function 00542747 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,O.T), ref: 00542757

Strings

O.T, xrefs: 0054274F, 00542755

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: gethostname
String ID: O.T
API String ID: 144339138-3817246510
Opcode ID: d080aef6413de349d15f7003fe6cd15eb5619c7bc153d08a541cbf173250f59a
Instruction ID: f9fa35e44f206911dd1a6851cb0d12a96af6a5020b04e7d94225d7a8da1e653f
Opcode Fuzzy Hash: d080aef6413de349d15f7003fe6cd15eb5619c7bc153d08a541cbf173250f59a
Instruction Fuzzy Hash: EBE0CD3514414C6AD701C969DC85BADFB9CFB85234F104157F518431C1DB76A51582B1

Function 004B9A37 Relevance: 3.2, APIs: 2, Instructions: 152COMMON

Download Yara Rule

APIs

fseek.MSVCRT ref: 004B9ADD
fread.MSVCRT ref: 004B9AF0

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: freadfseek
String ID:
API String ID: 612888758-0
Opcode ID: ebaa6f48fbfcaf21643dedd68d4598438ab86e298b3d20e409477e79022fd129
Instruction ID: b126981eb965348efe9953f801d17f65b9b144d785a8343122476672c8bfcfda
Opcode Fuzzy Hash: ebaa6f48fbfcaf21643dedd68d4598438ab86e298b3d20e409477e79022fd129
Instruction Fuzzy Hash: 7851F630A04228DBDB109F65DC81BEA37F5FB44704F10809BF54997281DB788E85DBB5

Function 0042846F Relevance: 3.1, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(?,0060D710), ref: 004284FB
__WSAFDIsSet.WS2_32(?,000003FF), ref: 00428519

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d8c19c2cc017295cb9462b0392662056b2c862f1589ea25ef41ad91436be8c
Instruction ID: b957007ff107fde3087b83e11296efdb993a2492bfbe8c07c14ea57fd2267124
Opcode Fuzzy Hash: 95d8c19c2cc017295cb9462b0392662056b2c862f1589ea25ef41ad91436be8c
Instruction Fuzzy Hash: 2521F070680264EBEB20DF19FC45B9F7BA6FB40384F50806FD64886241EBBD99C58B58

Function 004B9664 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 004B7505: fread.MSVCRT ref: 004B7515

fread.MSVCRT ref: 004B96D9
fread.MSVCRT ref: 004B9700

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fread
String ID:
API String ID: 1766058891-0
Opcode ID: 83a3e67d4266636a175cb375105bffca727bcaf3f552e8e3de76382dd6996d66
Instruction ID: 67c80e635f2582531ebc0fb8642be4d6114899cb7086ee5734bc77b24b6389a0
Opcode Fuzzy Hash: 83a3e67d4266636a175cb375105bffca727bcaf3f552e8e3de76382dd6996d66
Instruction Fuzzy Hash: 1E11E371500224BBCF109F64EC84BDF3BA6F788314F148406FA198F341D7788904A7B0

Function 0042C3E2 Relevance: 3.1, APIs: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 0042C3F3
WSASetLastError.WS2_32(00000000), ref: 0042C448

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 420d3f44ee0de40beafd9c7bdcb12f9442f419cc437d04b7d6110c60e7055481
Instruction ID: c2e86207af8803207d523d95dcb6d2354e6ac0353c647b4772447ef6089f9a03
Opcode Fuzzy Hash: 420d3f44ee0de40beafd9c7bdcb12f9442f419cc437d04b7d6110c60e7055481
Instruction Fuzzy Hash: 48118231E0022A9BCF109E95EC867BFBBB4FF40364F60452AEA1467241D7749A05CBD5

Function 00534420 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(DKC,00000004,00000060,00000000,00000000,?,00434B44,?,?), ref: 0053444F

Strings

DKC, xrefs: 0053444C

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcpy
String ID: DKC
API String ID: 3510742995-1955232490
Opcode ID: 94fe9657b45f89f8026c64b6be96f9183224d276c28ce60856934a6acfbd0ebd
Instruction ID: 402087101dc6a869f8d2b8f218315830e3bd4d0d7b0796ebf41a9e5250e86d5d
Opcode Fuzzy Hash: 94fe9657b45f89f8026c64b6be96f9183224d276c28ce60856934a6acfbd0ebd
Instruction Fuzzy Hash: 91F09071200614AFDB219BA4DC45FDBBBACFF05714F008066FA08D7041EB70FA108AA5

Function 00424945 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00424958

Part of subcall function 00426B96: abort.MSVCRT ref: 00426BE6
Part of subcall function 00426B96: _vsnprintf.MSVCRT ref: 00426C20
Part of subcall function 00426B96: fwrite.MSVCRT ref: 00426C56
Part of subcall function 00426B96: fwrite.MSVCRT ref: 00426C88

Strings

Out of memory, xrefs: 0042496B

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fwrite$_vsnprintfabortmalloc
String ID: Out of memory
API String ID: 4108586212-696950042
Opcode ID: a0245c3076de57ffb662d0a2a7790732928c514738d1903870fea9863dd48144
Instruction ID: 864dc87728a6e9127212f5679d83e9507a42e5bd5b4aec6dff1d5148e61fd526
Opcode Fuzzy Hash: a0245c3076de57ffb662d0a2a7790732928c514738d1903870fea9863dd48144
Instruction Fuzzy Hash: 55D02BB030021A15DB209B39F806B173B98AB81324F5483666014D15D2FB78E884C288

Function 00401214 Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0040121C

Part of subcall function 0040111C: SetUnhandledExceptionFilter.KERNEL32(00401000,?,?,?,?,?,?,?,00401227), ref: 00401128
Part of subcall function 0040111C: __getmainargs.MSVCRT ref: 0040115C
Part of subcall function 0040111C: _setmode.MSVCRT ref: 0040118D
Part of subcall function 0040111C: _setmode.MSVCRT ref: 004011AC
Part of subcall function 0040111C: __p__fmode.MSVCRT ref: 004011B4
Part of subcall function 0040111C: __p__environ.MSVCRT ref: 004011CC
Part of subcall function 0040111C: _cexit.MSVCRT ref: 004011E9
Part of subcall function 0040111C: ExitProcess.KERNEL32(00000000), ref: 004011F1
Part of subcall function 0040111C: _setmode.MSVCRT ref: 004011FF

__set_app_type.MSVCRT ref: 00401230

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 2043081007-0
Opcode ID: 6b3d2a03bea1221b68d217452bc7348232c06c7f3d37e4cebcb8a5f7c25ea892
Instruction ID: 7d100403e6bbe5a6923a60eef4ef744de9028761e080e67dd1d46352d8d450e7
Opcode Fuzzy Hash: 6b3d2a03bea1221b68d217452bc7348232c06c7f3d37e4cebcb8a5f7c25ea892
Instruction Fuzzy Hash: E8C0123858130427C2143379DD0FB45B51E4B01704F445035BA41151E3D990540041E6

Function 004192F0 Relevance: 2.6, APIs: 2, Instructions: 133stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00419359

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strncmp
String ID:
API String ID: 1114863663-0
Opcode ID: 8ccca4605132d32b1b8d077570689207c03f02bb261abd53f797e686e444e8dd
Instruction ID: 4d4572fe39657f832e26c338f86f9b59baa7a2d59b6c4ab3e4215bece4adc46f
Opcode Fuzzy Hash: 8ccca4605132d32b1b8d077570689207c03f02bb261abd53f797e686e444e8dd
Instruction Fuzzy Hash: F641C0706002058FDF04CF68D8947AA7BA8FB48310F50852AEC25CB292DB78E995CB98

Function 00429E70 Relevance: 2.6, APIs: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00424945: malloc.MSVCRT ref: 00424958

strcmp.MSVCRT ref: 00429EF9
strcpy.MSVCRT(0000000A,00000000,?,?,?), ref: 00429F4E

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: mallocstrcmpstrcpy
String ID:
API String ID: 1455292460-0
Opcode ID: 8ae8c2b7e88724b576c3a5cb7ecf2d28e4d06a16f3e8d2ea93b29203d0cec522
Instruction ID: 810c68bf1fbca769bc10e0e917441e09a2d2a9b255710ec31111f3b4f7f46a0e
Opcode Fuzzy Hash: 8ae8c2b7e88724b576c3a5cb7ecf2d28e4d06a16f3e8d2ea93b29203d0cec522
Instruction Fuzzy Hash: 2831D5727002665BEB10DEA9E8C0BBB7BA9AFC5350F59403AE508D7341E7789D0583A9

Function 0051C18C Relevance: 2.6, APIs: 2, Instructions: 74stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(?,?), ref: 0051C20E
strcat.MSVCRT(?,?,?,?), ref: 0051C217

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: strcatstrcpy
String ID:
API String ID: 4184579235-0
Opcode ID: 978d61aceb1d08d2ecaafab4148d53255710dd73caf68a3f18b46d1bf028be65
Instruction ID: e3a90e3881f58c2b91fd16c3edfb1a73db0af794a6af67e99bc669f3b728d97d
Opcode Fuzzy Hash: 978d61aceb1d08d2ecaafab4148d53255710dd73caf68a3f18b46d1bf028be65
Instruction Fuzzy Hash: 26212C359001089FDB24DF58C880A9ABBF6FF88350F24C599F96997291DB32AE51DFD0

Function 005540A0 Relevance: 2.6, APIs: 2, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 005540D6
strcpy.MSVCRT(?,?,?,?,?,0054961C,?), ref: 005540EF

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: mallocstrcpy
String ID:
API String ID: 2462975024-0
Opcode ID: 97a9b0f9dfa7a289ac540647bb4334520951d4f37207b891cc184c0d80070d87
Instruction ID: ade047f4b83c5edb6d3fef3fe8b8eb30353e68fa44978dd0f05e3af938f724c4
Opcode Fuzzy Hash: 97a9b0f9dfa7a289ac540647bb4334520951d4f37207b891cc184c0d80070d87
Instruction Fuzzy Hash: 1A118C36200205AFDB10DF69DC84A9ABFA9FF84321F10C162F9188B251E731EC81CBA0

Function 00523DD5 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00524B1E,00000080,?,00000000,?,?,00524B1E,?,?), ref: 00523E1F
memcpy.MSVCRT(00000000,00524B1E,00000001,?,00524B1E,?,?), ref: 00523E4A

Part of subcall function 00424AEB: free.MSVCRT ref: 00424B0A

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcpy$free
String ID:
API String ID: 2888793982-0
Opcode ID: 4b7cadbae51d2f4d4edc276fac346dedff295e80a56286457a06fcd7c9798103
Instruction ID: 9cacf0ab76574123cb015a36676e8e4512d2e69350cffd3d470ca9d238781ad5
Opcode Fuzzy Hash: 4b7cadbae51d2f4d4edc276fac346dedff295e80a56286457a06fcd7c9798103
Instruction Fuzzy Hash: 6A1191B5600611AFDB20DF65D880A67BBE9FF85710B11C86AE968CB201DB35E945CB90

Function 0042C4F6 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,?), ref: 0042C506

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: gethostname
String ID:
API String ID: 144339138-0
Opcode ID: d080aef6413de349d15f7003fe6cd15eb5619c7bc153d08a541cbf173250f59a
Instruction ID: f9fa35e44f206911dd1a6851cb0d12a96af6a5020b04e7d94225d7a8da1e653f
Opcode Fuzzy Hash: d080aef6413de349d15f7003fe6cd15eb5619c7bc153d08a541cbf173250f59a
Instruction Fuzzy Hash: EBE0CD3514414C6AD701C969DC85BADFB9CFB85234F104157F518431C1DB76A51582B1

Function 004B7505 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

fread.MSVCRT ref: 004B7515

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fread
String ID:
API String ID: 1766058891-0
Opcode ID: 06893f0f07e91de4001813fb52af1b202024f8b50bfd0a10dfd01d130b013d76
Instruction ID: 71de6cbbd27fed398ce2c7d4ec8563ae9abe1d6ed514f5f6514361480d25984f
Opcode Fuzzy Hash: 06893f0f07e91de4001813fb52af1b202024f8b50bfd0a10dfd01d130b013d76
Instruction Fuzzy Hash: 9DD05BB1B0034D7BEF20D6C59CC1EDF76ACEB54358F400491F704D6241E5B1AD004665

Function 00433370 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

pthread_mutex_lock.PTHREADGC2(0057FB70), ref: 00433380

Part of subcall function 00426BEB: _vsnprintf.MSVCRT ref: 00426C20
Part of subcall function 00426BEB: fwrite.MSVCRT ref: 00426C56
Part of subcall function 00426BEB: fwrite.MSVCRT ref: 00426C88

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: fwrite$_vsnprintfpthread_mutex_lock
String ID:
API String ID: 2406814974-0
Opcode ID: 63fbdb17c6035f7e5c52ed790ede8362d9fd98d35004f69a89407f3bb0e1c817
Instruction ID: eea82effe4dbf66f0acb66762963a761a787df5e22df3a78718bffe078d5db78
Opcode Fuzzy Hash: 63fbdb17c6035f7e5c52ed790ede8362d9fd98d35004f69a89407f3bb0e1c817
Instruction Fuzzy Hash: 5AE08C36548129BBCB009B81EC959DABF68EB043A5F408047FA0C0B201C3706A00C7E1

Function 0042C128 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0042C151

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 7a1393bced630addca7d489e5f7c2a74ebc7a3f1d4da3f4a83e92ae79ab15cbc
Instruction ID: e739feb9572208409694fc8eab689fc8413ccb0f1fc86643e81635cece5f8cc2
Opcode Fuzzy Hash: 7a1393bced630addca7d489e5f7c2a74ebc7a3f1d4da3f4a83e92ae79ab15cbc
Instruction Fuzzy Hash: A9E0EC70500218EBCB04DF51D9499AA77BCAB44398F408455E41496301E675DA58DA99

Function 00542418 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00542441

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ce4c5f1b6cd06a89a432b3066c975869ca794fc515235a544c41b3c144a6d941
Instruction ID: 65d9e267d2d7903a4f4a477d25a3edd778f8a0196e4eaac359e55b2613f64bfa
Opcode Fuzzy Hash: ce4c5f1b6cd06a89a432b3066c975869ca794fc515235a544c41b3c144a6d941
Instruction Fuzzy Hash: 4FE0EC70500218EFCF00DE51C94899A77ACFB4431CF408454F40496110E671DA48DB51

Function 0042C666 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,005FD180), ref: 0042C67D

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 4b6993d6c5fcebeb6bac1787d88e0bdfb15f8defde0afbe7ccbb53bdc50f5702
Instruction ID: 6eee3d1bd6875d16ec673b04f059b62dd0b6b17b3946629e51731faf67d55036
Opcode Fuzzy Hash: 4b6993d6c5fcebeb6bac1787d88e0bdfb15f8defde0afbe7ccbb53bdc50f5702
Instruction Fuzzy Hash: 5CC0805074031921E710D1295D4FB2772DF17D0700F95C231B500912C9DBDCD849F07C

Function 0040E603 Relevance: 1.4, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00514689: memcmp.MSVCRT(?,?,00000000,0267DF58,00000000,?,00000000,?,0040E635,0267DF58,?,00000000,00000000,?,00000000), ref: 005146C7

memmove.MSVCRT(?,?,00000000,00000000,?,00000000,?,0040E763,00000000,0000001F,?,00000000,00000000,?,00000000), ref: 0040E6CC

Memory Dump Source

Source File: 00000005.00000002.3281748345.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3281719840.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281950969.000000000057E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000583000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.0000000000587000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058B000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3281982038.000000000058F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282114452.0000000000590000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282142417.0000000000593000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282171531.0000000000596000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005F6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.00000000005FC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000603000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000607000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000611000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282231167.0000000000616000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3282346415.000000000061B000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Xming.jbxd

Similarity

API ID: memcmpmemmove
String ID:
API String ID: 1261870273-0
Opcode ID: 8f6562e8989bb7b721496be40e6015a964d9afdc6c75c7a87015d0d310f13efc
Instruction ID: 9cc40ea3fd0106571cad5c0e80f73bbbb612869e5b2d51452a5d760eada1485f
Opcode Fuzzy Hash: 8f6562e8989bb7b721496be40e6015a964d9afdc6c75c7a87015d0d310f13efc
Instruction Fuzzy Hash: 5D318FB16002019BEB10DF2AE881B677BA5EF54314F14847AED08EB356D739DC61CBA5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xming-6-9-0-31-setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Xming\COPYING (copy)

C:\Program Files (x86)\Xming\SecurityPolicy (copy)

C:\Program Files (x86)\Xming\X0.hosts (copy)

C:\Program Files (x86)\Xming\XErrorDB (copy)

C:\Program Files (x86)\Xming\XKeysymDB (copy)

C:\Program Files (x86)\Xming\XLaunch.chm (copy)

C:\Program Files (x86)\Xming\XLaunch.exe (copy)

C:\Program Files (x86)\Xming\XLaunch.xsd (copy)

C:\Program Files (x86)\Xming\Xming.exe (copy)

C:\Program Files (x86)\Xming\Xming.url

C:\Program Files (x86)\Xming\example_Xmingrc (copy)

C:\Program Files (x86)\Xming\font-dirs (copy)

C:\Program Files (x86)\Xming\is-0K5LN.tmp

C:\Program Files (x86)\Xming\is-0ONS4.tmp

C:\Program Files (x86)\Xming\is-2COJJ.tmp

C:\Program Files (x86)\Xming\is-2KHC2.tmp

C:\Program Files (x86)\Xming\is-3RNSV.tmp

C:\Program Files (x86)\Xming\is-5MDNG.tmp

C:\Program Files (x86)\Xming\is-67AQV.tmp

C:\Program Files (x86)\Xming\is-7UVK4.tmp

Windows Analysis Report
Xming-6-9-0-31-setup.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre